Post-quantum collaborative signature method and device based on key segmentation and medium

Abstract

The invention provides a post-quantum collaborative signature method and device based on key segmentation and a medium, and relates to the technical field of information security. The method comprises the following steps: acquiring segmentation public keys and segmentation private keys of a plurality of collaborative users; according to the user identifiers of the plurality of collaborative users, respectively calculating binding information of the plurality of collaborative users for the signature fragments of the to-be-sent message; according to the segmentation private key and the binding information of each collaborative user, calculating a signature value of each collaborative user for the signature fragment; generating a target signature of the to-be-sent message according to the signature values of the plurality of collaborative users for the signature fragments; and verifying the target signature and outputting the target signature according to the segmented public keys of the plurality of collaborative users. According to the invention, the security and reliability of the collaborative signature can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and more specifically, to a post-quantum collaborative signature method, device, and medium based on key splitting. Background Art

[0002] As the wave of digitalization sweeps across the world, information security has become the focus of audiences from all walks of life. Collaborative Signature technology, as an important means to ensure the authenticity and integrity of information, plays an irreplaceable role in many fields.

[0003] Collaborative signature technology allows multiple parties to jointly generate a signature, avoiding the exposure of the complete private key through distributed computing, greatly improving the security of the signature.

[0004] With the rapid development of quantum computing technology, how to realize multi-party collaborative signature in a quantum computing environment to improve the security of signatures is an urgent problem that needs to be solved. Summary of the Invention

[0005] The purpose of this application is to address the deficiencies in the above-mentioned prior art and provide a post-quantum collaborative signature method, device and medium based on key splitting, so as to improve the security and reliability of collaborative signature.

[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of the present application are as follows: In a first aspect, an embodiment of the present application provides a post-quantum collaborative signature method based on key splitting, the method comprising: Obtain split public keys and split private keys of multiple collaborative users; Calculating binding information of the signature fragments of the to-be-sent messages of the multiple collaborative users respectively according to the user identifiers of the multiple collaborative users; Calculate the signature value of each collaborative user for the signature fragment according to the split private key and binding information of each collaborative user; generating a target signature for the message to be sent according to the signature values ​​of the multiple collaborative users for the signature fragments; The target signature is verified according to the split public keys of the multiple collaborative users and the target signature is output.

[0007] Optionally, obtaining the split public keys and split private keys of the multiple collaborative users includes: Generate a master key and system public parameters using a preset trapdoor algorithm according to a preset modulus parameter, a preset dimension parameter, and a preset length parameter, wherein the system public parameters include: a random matrix, a first hash function, a Gaussian parameter, the preset modulus parameter, the preset dimension parameter, and the preset length parameter; Mapping the user identification of each collaborative user to a matrix space using the first hash function to obtain a split public key of each collaborative user; According to the master key, the random matrix, the Gaussian parameter and the split public keys of the multiple collaborative users, a preset sampling algorithm is adopted to respectively calculate the split private keys of the multiple collaborative users.

[0008] Optionally, the system public parameters further include: a second hash function and a third hash function, wherein the calculation of binding information of the multiple collaborative users for signature fragments of the to-be-sent messages based on the user identifiers of the multiple collaborative users includes: Using the second hash function, mapping the user identification of each collaborative user and the message to be sent to a column vector space to obtain a collaborative hash value of each collaborative user for the message to be sent; Using the third hash function, mapping the message to be sent and the collaborative hash values ​​of the multiple collaborative users into a binary string to obtain a message hash value of the message to be sent; Using the third hash function, mapping the user identifiers of the multiple collaborative users into binary character strings, and respectively calculating hash values ​​of the user identifiers of the multiple collaborative users; Binding information of the multiple collaborative users for the signature fragments is calculated respectively according to the message hash value and the user identification hash values ​​of the multiple collaborative users.

[0009] Optionally, after calculating the signature value of each collaborative user for the signature fragment based on the split private key and binding information of each collaborative user, the method includes: determining whether to output the signature value according to a discrete Gaussian distribution probability of the signature value of each collaborative user for the signature fragment; If the discrete Gaussian distribution probability is less than or equal to 1, it is determined to output the signature value.

[0010] Optionally, generating the target signature of the message to be sent according to the signature values ​​of the multiple collaborative users for the signature fragments includes: Calling an ideal function to verify the relationship between the signature value of each collaborative user for the signature shard and the split private key of each collaborative user; If the relationship between the signature value of each collaborative user for the signature fragment and the split private key of each collaborative user is valid, the target signature of the message to be sent is generated according to the signature values ​​of the multiple collaborative users for the signature fragments.

[0011] Optionally, generating the target signature of the message to be sent according to the signature values ​​of the multiple collaborative users for the signature fragments includes: Determine whether the message hash values ​​of the multiple collaborative users for the signature fragments are consistent; If the message hash values ​​of the multiple collaborative users for the signature fragments are consistent, a target signature for the message to be sent is generated according to the signature values ​​of the multiple collaborative users for the signature fragments.

[0012] Optionally, the system public parameter further includes: a positive real number, and the verifying the target signature according to the split public keys of the multiple collaborative users and outputting the target signature includes: generating an aggregated public key according to the user identifiers of the multiple collaborative users and the split public keys of the multiple collaborative users; The target signature is verified and output according to the aggregated public key, the collaborative hash values ​​of the multiple collaborative users, the message hash value of the message to be sent, the positive real number, the random matrix and the preset length parameter.

[0013] Optionally, verifying the target signature and outputting the target signature includes: If the target signature is verified, the target signature is output; If the target signature verification fails, the message to be sent is refused to be signed.

[0014] In a second aspect, an embodiment of the present application provides a post-quantum collaborative signature device based on key splitting, the device comprising: A key acquisition module, used to obtain split public keys and split private keys of multiple collaborative users; a signature fragment calculation module, configured to calculate binding information of signature fragments of the multiple collaborative users for the messages to be sent, respectively, based on the user identities of the multiple collaborative users; The signature shard calculation module is further configured to calculate the signature value of each collaborative user for the signature shard based on the split private key and binding information of each collaborative user; A signature generation module, configured to generate a target signature for the message to be sent based on the signature values ​​of the multiple collaborative users for the signature fragments; The signature verification module is used to verify the target signature according to the split public keys of the multiple collaborative users and output the target signature.

[0015] Optionally, the key acquisition module is specifically used to generate a master key and system public parameters based on a preset modulus parameter, a preset dimension parameter and a preset length parameter using a preset trapdoor algorithm, where the system public parameters include: a random matrix, a first hash function, a Gaussian parameter, the preset modulus parameter, the preset dimension parameter and the preset length parameter; the first hash function is used to map the user identifier of each collaborative user to the matrix space to obtain the split public key of each collaborative user; and a preset sampling algorithm is used to calculate the split private keys of the multiple collaborative users respectively based on the master key, the random matrix, the Gaussian parameter and the split public keys of the multiple collaborative users.

[0016] Optionally, the system public parameters also include: a second hash function and a third hash function, and the signature shard calculation module is specifically used to use the second hash function to map the user identifier of each collaborative user and the message to be sent to the column vector space to obtain the collaborative hash value of each collaborative user for the message to be sent; use the third hash function to map the message to be sent and the collaborative hash values ​​of the multiple collaborative users into a binary string to obtain the message hash value of the message to be sent; use the third hash function to map the user identifiers of the multiple collaborative users into a binary string, and respectively calculate the user identifier hash values ​​of the multiple collaborative users; and calculate the binding information of the multiple collaborative users for the signature shard according to the message hash value and the user identifier hash values ​​of the multiple collaborative users.

[0017] Optionally, the device further comprises: The signature fragment verification module is used to determine whether to output the signature value according to the discrete Gaussian distribution probability of the signature value of each collaborative user for the signature fragment; if the discrete Gaussian distribution probability is less than or equal to 1, determine to output the signature value.

[0018] Optionally, the signature generation module is specifically used to call an ideal function to verify the relationship between the signature value of each collaborative user for the signature fragment and the split private key of each collaborative user; if the relationship between the signature value of each collaborative user for the signature fragment and the split private key of each collaborative user is valid, the target signature of the message to be sent is generated according to the signature values ​​of the multiple collaborative users for the signature fragment.

[0019] Optionally, the signature generation module is also used to determine whether the message hash values ​​of the multiple collaborative users for the signature fragment are consistent; if the message hash values ​​of the multiple collaborative users for the signature fragment are consistent, the target signature of the message to be sent is generated according to the signature values ​​of the multiple collaborative users for the signature fragment.

[0020] Optionally, the system public parameters also include: a positive real number, the signature verification module, specifically used to generate an aggregate public key based on the user identifiers of the multiple collaborative users and the split public keys of the multiple collaborative users; verify the target signature and output the target signature based on the aggregate public key, the collaborative hash values ​​of the multiple collaborative users, the message hash value of the message to be sent, the positive real number, the random matrix and the preset length parameter.

[0021] Optionally, the signature verification module is further configured to output the target signature if the target signature verification passes; and refuse to sign the message to be sent if the target signature verification fails.

[0022] In a third aspect, an embodiment of the present application further provides an electronic device comprising: a processor, a storage medium, and a bus, wherein the storage medium stores program instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the program instructions to perform the steps of the post-quantum collaborative signature method based on key splitting as described in any one of the first aspects.

[0023] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the post-quantum collaborative signature method based on key splitting as described in any one of the first aspects are executed.

[0024] The beneficial effects of this application are: The post-quantum collaborative signature method, device, and system based on key splitting provided by the present application, in the key negotiation stage, each collaborative user generates a split public key and a split private key by himself, without relying on a key generation center and a secure channel, thus realizing decentralized key generation. In the collaborative signature stage, each collaborative user signs the message to be sent, generates binding information and signature values ​​for the signature fragments, and embeds the identity information of each collaborative user into the generated signature value, ensuring that the signature value generated by each collaborative user cannot be forged, thereby ensuring the security and reliability of the signature. In the signature verification stage, the target signature is verified based on the split public key of each collaborative user. The verification method is simple and efficient, and can quickly verify the authenticity of the signature while ensuring the security of the signature. This solution realizes efficient and secure multi-party collaborative signing in the post-quantum era, improves the security of the signature, ensures the integrity and non-repudiation of the message to be sent, and can be widely used in scenarios with high security requirements such as the Internet of Things, blockchain, and distributed finance. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 An architectural diagram of a post-quantum collaborative signature system based on key splitting provided in an embodiment of the present application; Figure 2 Schematic diagram of the process of the post-quantum collaborative signature method based on key splitting provided in the embodiment of this application Figure 1 ; Figure 3 Schematic diagram of the process of the post-quantum collaborative signature method based on key splitting provided in the embodiment of this application Figure 2 ; Figure 4 Flowchart of the key negotiation phase provided in an embodiment of the present application; Figure 5 Schematic diagram of the process of the post-quantum collaborative signature method based on key splitting provided in the embodiment of this application Figure 3 ; Figure 6 Flowchart of the collaborative signing phase provided in an embodiment of the present application; Figure 7 Flowchart of the signature verification phase provided in the embodiment of the present application; Figure 8 A schematic diagram of the structure of a post-quantum collaborative signature device based on key splitting provided in an embodiment of the present application; Figure 9 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0028] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present application. All other embodiments obtained by persons of ordinary skill in the art based on the embodiments in the present application without creative work are within the scope of protection of the present application.

[0029] In addition, the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Faced with the threat of quantum computing, the cryptography community has proposed lattice cryptography. Lattice cryptography is a cryptographic system built based on mathematical problems on lattices. Its security mainly relies on problems such as learning with errors (LWE) and short integer solutions (SIS), which are considered difficult to solve in both classical and quantum computing environments. Lattice cryptography has rich cryptographic functions and asymptotically tight security proofs, becoming a core direction in the standardization process.

[0031] However, the existing collaborative signature scheme based on lattice cryptography needs to rely on a key generation center to generate keys, and then distribute the keys to collaborative users through a secure channel. As a third party, the key generation center needs to be online for a long time and is vulnerable to attacks, becoming a single point of failure in the system.

[0032] In order to better understand the post-quantum collaborative signature scheme based on key splitting provided by this application, the post-quantum collaborative signature system based on key splitting applied in this application is first introduced.

[0033] Figure 1 The architecture diagram of the post-quantum collaborative signature system based on key splitting provided in the embodiment of this application is as follows: Figure 1 As shown, the post-quantum collaborative signature system based on key splitting may include: a hardware security module 101, collaborative signature control software 102 and a signature verification accelerator 103.

[0034] Among them, the hardware security module 101 serves as the hardware security core of the entire system. It is responsible for executing key operations in the lattice cryptographic algorithm, complex calculations in the collaborative signature process, and complex calculations such as discrete Gaussian distribution sampling in the collaborative signature process. The hardware security module 101 is deployed on the electronic devices of each collaborative user participating in the collaborative signature. The hardware security module 101 provides a safe and efficient computing environment to ensure the confidentiality and integrity of key generation and signature calculation, and to resist hardware-level security threats such as physical attacks and side-channel attacks.

[0035] The collaborative signature control software 102 also runs on the electronic devices of each collaborative user participating in the collaborative signature. It is responsible for coordinating the entire collaborative signature process and managing the interaction between the hardware security module 101 and the application, including initiating key negotiation requests, organizing message transmission during the collaborative signature process, and verifying the received zero-knowledge proof.

[0036] The signature verification accelerator 103 is a hardware device or software device used to accelerate the signature verification process. It can be integrated into the electronic device of the verifier. The verifier can be one of the collaborative users. It uses parallel computing technology and optimized algorithms to accelerate operations such as polynomial calculations and matrix-vector multiplication in lattice-based signature verification, thereby improving verification efficiency.

[0037] It should be noted that the electronic devices of each collaborative user may be, for example, servers, computer devices, mobile devices, etc., and this embodiment does not impose any limitation on this.

[0038] Based on the above-mentioned post-quantum collaborative signature system based on key splitting, the specific implementation method of the post-quantum collaborative signature method based on key splitting provided in the embodiment of the present application is described below.

[0039] Figure 2 Schematic diagram of the process of the post-quantum collaborative signature method based on key splitting provided in the embodiment of this application Figure 1 ,like Figure 2 As shown, the method may include: S201: Obtain split public keys and split private keys of multiple collaborative users.

[0040] In this embodiment, during the key negotiation phase, each collaborative user generates a corresponding split public key and a split private key.

[0041] Key Splitting Technique is used to split a key into multiple parts and store them in different locations to enhance the security and confidentiality of the key.

[0042] Lattice-Based Cryptography is a cryptographic system based on lattice theory. Mathematically, a lattice is a point structure with specific rules in n-dimensional space. Lattice cryptography uses the complex properties of the lattice to construct encryption algorithms and protocols.

[0043] Each collaborative user's hardware security module executes a lattice cryptographic algorithm based on the user ID of each collaborative user. , generate split public keys for each collaborative user , and execute the sampling matrix (SampleMatrix, SampleMat) algorithm in lattice cryptography to generate the split private key for each collaborative user .

[0044] In the process of generating split public keys and split private keys, each collaborative user completes it independently without relying on a key generation center and a secure channel, thus realizing decentralized key generation.

[0045] In some embodiments, in order to facilitate subsequent verification of the signature, multiple collaborative users generate split public keys. After that, use your own split public key Broadcast to other collaborative users so that each collaborative user can determine the split public key of all collaborative users , so that any collaborative user can verify the generated signature when they become a verifier.

[0046] S202: Calculate binding information of signature fragments of the to-be-sent messages of the multiple collaborative users respectively according to the user identifiers of the multiple collaborative users.

[0047] In this embodiment, during the collaborative signing phase, each collaborative user signs the message to be sent and generates a signature fragment, which is a part of the final target signature. The signature fragments generated by multiple collaborative users are combined to form the target signature.

[0048] The signature fragment consists of two parts, namely binding information and signature value , signature value The real signature value for each collaborative user to sign the message to be sent, binding information Used to combine the identity information of each collaborative user with the message hash value of the message to be sent Bind to the binding information Generate signature value When the identity information of each collaborative user is embedded in the generated signature value , ensuring that the signature value generated by each collaborative user Cannot be forged.

[0049] The specific method of generating the binding information may be: according to the user ID of each collaborative user , treat the message sent M Perform hash calculation to obtain the hash calculation result, and generate the message hash value of the message to be sent based on the hash calculation results of multiple collaborative users , build the message hash value User ID of each collaborating user Binding relationship, generate binding information of signature shards for each collaborative user .

[0050] S203. Calculate the signature value of each collaborative user for the signature fragment based on the split private key and binding information of each collaborative user.

[0051] In this embodiment, as can be seen from S202 above, the binding information Contains the message hash values ​​signed by multiple collaborative users for the message to be sent, as well as the user ID of each collaborative user , based on the split private key of each collaborative user Binding information Encrypt and generate the signature value of each collaborative user for the signature shard , and output the signature fragment of each collaborative user .

[0052] In some embodiments, to hide the split private key of each collaborating user , get a random vector , based on the split private key of each collaborative user Binding information Encrypt and combine with random vector , generate the signature value of each collaborative user for the signature shard , .

[0053] Furthermore, from the message hash value Related Sampling to obtain random vectors ,satisfy ,in, The module generated for executing the lattice cryptographic algorithm of A matrix in the space of integer matrices.

[0054] S204: Generate a target signature for the message to be sent based on the signature values ​​of the multiple collaborative users for the signature fragments.

[0055] In this embodiment, multiple collaborative users will each use their signature value for the signature fragment Sent to the target collaborative user, the target collaborative user's signature value for multiple collaborative users for the signature shard Perform summation , generate the message to be sent M Target signature .

[0056] S205: Verify the target signature according to the split public keys of the multiple collaborative users and output the target signature.

[0057] In this embodiment, during the signature verification phase, for the verifiers among multiple collaborative users, the target collaborative user will Sent to the verifier, who then broadcasts the split public keys of multiple collaborating users received previously. Perform aggregation, generate an aggregated public key, and sign the target based on the aggregated public key Perform verification, if verification passes, determine the target signature Has not been illegally tampered with and can output the target signature of the message to be sent If the verification fails, the target signature is determined Possibly illegal, refusing to sign the message to be sent.

[0058] In some embodiments, the verifier can be the target collaborative user or other users among multiple collaborative users. The signature verification accelerator in the electronic device corresponding to the verifier verifies the target signature. Perform verification. If the verification passes, output 1; if the verification fails, output 0.

[0059] The post-quantum collaborative signature method based on key splitting provided by the above embodiment, in the key negotiation stage, each collaborative user generates a split public key and a split private key by himself, without relying on a key generation center and a secure channel, thus realizing decentralized key generation. In the collaborative signature stage, each collaborative user signs the message to be sent, generates binding information and signature values ​​for the signature fragments, and embeds the identity information of each collaborative user into the generated signature value, ensuring that the signature value generated by each collaborative user cannot be forged, thereby ensuring the security and reliability of the signature. In the signature verification stage, the target signature is verified based on the split public key of each collaborative user. The verification method is simple and efficient, and can quickly verify the authenticity of the signature while ensuring the security of the signature. This solution realizes efficient and secure multi-party collaborative signing in the post-quantum era, improves the security of the signature, ensures the integrity and non-repudiation of the message to be sent, and can be widely used in scenarios with high security requirements such as the Internet of Things, blockchain, and distributed finance.

[0060] In one possible implementation, Figure 3 Schematic diagram of the process of the post-quantum collaborative signature method based on key splitting provided in the embodiment of this application Figure 2 ,like Figure 3 As shown, the process of obtaining the split public keys and split private keys of multiple collaborative users in S201 may include: S301. Generate a master key and system public parameters using a preset trapdoor algorithm according to a preset modulus parameter, a preset dimension parameter, and a preset length parameter.

[0061] The system common parameters include: a random matrix, a first hash function, a Gaussian parameter, a preset modulus parameter, a preset dimension parameter, and a preset length parameter.

[0062] In this embodiment, the preset lattice cryptographic algorithm is the trapdoor algorithm TrapGen, and the input parameters of the trapdoor algorithm TrapGen include: preset module parameters q , preset dimension parameters n (dimensions of the grid) and preset length parameters m , execute the algorithm TrapGen( q, n,m ), generate the model q of Random matrices in integer matrix space A Passive base ,satisfy , , represents the space complexity, x represents an m-dimensional vector, The representative length is Integer vector of , Represents the modulus length symbol, is a positive integer, is a prime number.

[0063] The master key is , system common parameters ,in is a positive real number, is a Gaussian parameter and satisfies , the first hash function Used to map binary strings of arbitrary length to modules of Integer matrix space, second hash function Used to map binary strings of arbitrary length to modules Integer dimensional column vector space, third hash function Used to map a binary string of arbitrary length to a The binary string.

[0064] S302: Use a first hash function to map the user identification of each collaborative user to a matrix space to obtain a split public key of each collaborative user.

[0065] In this embodiment, the user ID of each collaborative user is Convert to binary string using the first hash function , the user ID of each collaborative user The corresponding binary string is mapped to the module of Integer matrix space, generating the split public key of each collaborative user .

[0066] For example, the split public key of each collaborating user The calculation formula can be expressed as: .

[0067] Furthermore, after the split public key is generated, the split public key is broadcast to multiple collaborative users.

[0068] S303 : Calculate the split private keys of the multiple collaborative users respectively using a preset sampling algorithm according to the master key, the random matrix, the Gaussian parameter, and the split public keys of the multiple collaborative users.

[0069] In this embodiment, according to the master key , random matrix A , Gaussian parameters and the split public key of each collaborating user , execute the sampling matrix algorithm SampleMat , generate split private keys for each collaborative user ,satisfy and .

[0070] Using the SampleMat algorithm to directly generate split private keys that meet mathematical constraints can avoid complex key extraction steps and improve signing efficiency.

[0071] For example, Figure 4 The flowchart of the key negotiation phase provided in the embodiment of the present application is as follows: Figure 4 As shown, the key negotiation phase may include: S11. Each collaborative user generates a master key and system public parameters; S12. Each collaborative user calculates a split public key and a split private key; S13. Each collaborative user stores the split private key and broadcasts the split public key.

[0072] The post-quantum collaborative signature method based on key splitting provided in the above embodiment uses the TrapGen algorithm and the SampleMat algorithm to generate a split public key and a split private key for each collaborative user, thereby realizing decentralized key generation and secure distribution, ensuring the efficiency and security of key agreement, and providing a reliable key foundation for subsequent collaborative signatures.

[0073] In one possible implementation, Figure 5 Schematic diagram of the process of the post-quantum collaborative signature method based on key splitting provided in the embodiment of this application Figure 3 ,like Figure 5 As shown, the process of calculating the binding information of the signature fragments of the to-be-sent messages of the multiple collaborative users respectively according to the user identifiers of the multiple collaborative users in S202 may include: S401 : Using a second hash function, map the user identification of each collaborative user and the message to be sent to a column vector space to obtain a collaborative hash value of each collaborative user for the message to be sent.

[0074] In this embodiment, as can be seen from S301 above, the system common parameters may also include a second hash function , the user ID of each collaborative user and messages to be sent M Convert to binary string using the second hash function The user ID of each collaborative user and messages to be sent M The corresponding binary string is mapped to the module Integer dimensional column vector space to identify each collaborative user and messages to be sent M Mapped to random points on the grid , with random points As the collaborative hash value of each collaborative user for the message to be sent .

[0075] Example, collaborative hash value The calculation formula can be expressed as: .

[0076] S402: Use a third hash function to map the message to be sent and the collaborative hash values ​​of multiple collaborative users into a binary string to obtain a message hash value of the message to be sent.

[0077] In this embodiment, the collaborative hash values ​​of the messages to be sent by multiple collaborative users are Aggregate and get the global hash value , global hash value The calculation formula can be expressed as: , t is the number of collaborative users.

[0078] As can be seen from S301 above, the system public parameters may also include a third hash function , the message to be sent M and the global hash value Convert to binary string using the third hash function Message to be sent M and the global hash value The corresponding binary string is mapped to a length of Binary string to get the message hash value of the message to be sent .

[0079] Example, message hash value The calculation formula can be expressed as: .

[0080] S403: Use a third hash function to map the user identifications of the multiple collaborative users into binary character strings, and calculate hash values ​​of the user identifications of the multiple collaborative users respectively.

[0081] In this embodiment, based on the user identifications of multiple collaborative users , using the third hash function to determine the user ID of each collaborative user Personalized weight factors among multiple collaborative users, to obtain the user ID hash value of each collaborative user .

[0082] Example, user ID hash value The calculation formula can be expressed as: ,in, .

[0083] S404: Calculate binding information of the multiple collaborative users for the signature fragments according to the message hash value and the user identification hash values ​​of the multiple collaborative users.

[0084] In this embodiment, according to the message hash value and the user ID hash value of each collaborating user , calculate the binding information of each collaborative user for the signature shard , to identify each collaborative user By user ID hash With messages to be sent M By message hash Binding ensures that all collaborating users share the same message hash value , thereby ensuring the consistency of the final aggregate signature.

[0085] For example, the binding information of each collaborative user's signature shard The calculation formula can be expressed as: .

[0086] The post-quantum collaborative signature method based on key splitting provided in the above embodiment, after each collaborative user calculates the collaborative hash value for the message to be sent, calculates the binding information of the signature fragment based on the collaborative hash value to embed the identity information of each collaborative user into the generated signature value, ensuring that the signature value generated by each collaborative user cannot be forged, thereby ensuring the security and reliability of the signature.

[0087] In a possible implementation, after calculating the signature value of each collaborative user for the signature fragment according to the split private key and binding information of each collaborative user in S203, the method may further include: According to the discrete Gaussian distribution probability of the signature value of each collaborative user for the signature fragment, determine whether to output the signature value; if the discrete Gaussian distribution probability is less than or equal to 1, determine to output the signature value.

[0088] In this embodiment, the split private key of each collaborative user is Binding information Encrypt and combine with random vector , generate the signature value of each collaborative user for the signature shard , for the signature value The discrete Gaussian distribution probability is used for verification. If the signature value The discrete Gaussian probability of is less than or equal to 1, then the output signature value is determined Otherwise, it is necessary to re-execute the above S203 until the calculated signature value is The discrete Gaussian probability of is less than or equal to 1.

[0089] For example, the probability of discrete Gaussian distribution Signature value Verify, if satisfied , then the output ,in, is a discrete Gaussian distribution, It means that the center is 0 and the standard deviation is of m dimensional discrete Gaussian distribution, Indicates is the center and the standard deviation is of m dimensional discrete Gaussian distribution.

[0090] The post-quantum collaborative signature method based on key splitting provided in the above embodiment uses discrete Gaussian distribution to constrain the Gaussian distribution of the signature value, thereby ensuring the security and reliability of the signature.

[0091] In one possible implementation, the step of generating a target signature for the message to be sent according to the signature values ​​of the multiple cooperating users for the signature fragments in S204 may include: The ideal function is called to verify the relationship between the signature value of each collaborative user for the signature shard and the split private key of each collaborative user; if the relationship between the signature value of each collaborative user for the signature shard and the split private key of each collaborative user is valid, the target signature of the message to be sent is generated based on the signature values ​​of multiple collaborative users for the signature shard.

[0092] In this embodiment, the ideal function is used to describe the behavior of Zero-Knowledge Proof (ZKP) in a perfectly secure environment, where the prover (collaborative user) provides a statement (the signature value of the signature shard) ) and evidence (split private key ), ideal function verification in evidence (split private key ) below statement (the signature value of the signature fragment ) is established.

[0093] Specifically, each collaborative user moves towards the ideal function Send the signature value of the signature fragment About splitting private keys Zero-knowledge proof of the relationship between , requesting the ideal function Verify the signature value of the signature fragment and split private key Is the relationship between valid if the ideal function Determine the signature value of the signature fragment and split private key If the relationship between them is valid, the target collaborative user is sent the i Each collaborative user determines the signature value of the signature shard. and split private key After the relationship between them is valid, send its own signature fragment to the target collaborative user .

[0094] After the target collaborative user receives the valid zero-knowledge proofs of all other collaborative users and the zero-knowledge proof returned by its own ideal function is also valid, it generates the target signature of the message to be sent based on the signature values ​​of multiple collaborative users for the signature shard. If the zero-knowledge proof of any collaborative user is invalid, the signature is terminated.

[0095] The post-quantum collaborative signature method based on key splitting provided in the above embodiment is that each collaborative user performs zero-knowledge proof through an ideal function on his own. There is no need for multiple collaborative users to send signature values ​​to the aggregator. The aggregator obtains the signature values ​​of multiple collaborative users and performs zero-knowledge proof separately. This can effectively reduce communication delays in the collaborative signature process, improve signature efficiency, and at the same time ensure the security and reliability of the signature.

[0096] Furthermore, by utilizing a local verification mechanism based on discrete Gaussian distribution and zero-knowledge proofs, the independent generation and validity verification of signature shards can be achieved, reducing reliance on multi-party communication. This also reduces the algorithmic complexity of key generation and signature shard calculations, significantly reducing the number of interactions and significantly improving system scalability. Furthermore, it supports dynamic node participation and is suitable for large-scale distributed scenarios, such as IoT edge networks and cross-chain transaction systems, achieving linear efficiency improvements while ensuring security.

[0097] In one possible implementation, the process of generating a target signature for the message to be sent in S204 based on the signature values ​​of the multiple cooperating users for the signature fragments may include: Determine whether the message hash values ​​of multiple collaborative users for the signature fragments are consistent; if the message hash values ​​of multiple collaborative users for the signature fragments are consistent, generate the target signature of the message to be sent based on the signature values ​​of multiple collaborative users for the signature fragments.

[0098] In this embodiment, the target collaborative user checks the signature fragments of multiple collaborative users. The message hash value in Whether they are consistent, that is, whether they are equal, if the signature shards of multiple collaborative users The message hash value in If they are consistent, the signature values ​​in multiple signature fragments Sum and get the target signature

[0099] If multiple collaborative users have signature shards The message hash value in If they are inconsistent, the signature is terminated.

[0100] The post-quantum collaborative signature method based on key splitting provided in the above embodiment determines whether the message hash values ​​of multiple collaborative users for signature fragments are consistent. If they are consistent, the valid signature values ​​are summed to obtain the target signature, thereby ensuring the security and reliability of the signature.

[0101] For example, Figure 6 The flowchart of the collaborative signing phase provided in the embodiment of this application is as follows: Figure 6 As shown, the collaborative signing phase may include: S21. Each collaborative user calculates a collaborative hash value for the message to be sent and sums them up to obtain a global hash value.

[0102] S22. Calculate the binding information of the signature fragment.

[0103] S23. Calculate the signature value of the signature fragment through discrete Gaussian distribution and make it satisfy the constraint relationship.

[0104] S24. Send zero-knowledge proof to the ideal function.

[0105] S25. Output the signature fragment and send it to the target collaborative user.

[0106] S26. The target collaborative user determines that the zero-knowledge proof is valid and then sums the signature values ​​of the signature fragments to obtain the target signature.

[0107] In a possible implementation, the process of verifying the target signature and outputting the target signature in S205 according to the split public keys of the multiple cooperating users may include: An aggregate public key is generated based on the user identifiers of multiple collaborative users and the split public keys of multiple collaborative users; a target signature is verified and output based on the aggregate public key, the collaborative hash values ​​of multiple collaborative users, the message hash value of the message to be sent, a positive real number, a random matrix and a preset length parameter.

[0108] In this embodiment, as can be seen from S301 above, the system common parameters may also include positive real numbers , the verifier is for multiple collaborative users , calculate based on the user IDs of multiple collaborative users , using the third hash function to determine the user ID of each collaborative user Personalized weight factors among multiple collaborative users, to obtain the user ID hash value of each collaborative user , .

[0109] User ID hash values ​​based on multiple collaborative users and split public keys for multiple collaborating users , aggregate to generate aggregate public key , aggregate public key The calculation formula can be expressed as: .

[0110] Based on the collaborative hash value of multiple collaborative users , calculate the global hash value , using the third hash function According to the message to be sent M and the global hash value Calculate the message hash value of the message to be sent .

[0111] It should be noted that if the verifier is a collaborative user, the global hash value has been calculated in the process of calculating the binding information of the signature fragment in S401-S404 above. and the message hash , it can be used directly here without having to calculate again.

[0112] Establishing an aggregate public key , global hash value , message hash value , positive real numbers and random matrices A The collaborative signature equation , and create target signatures , positive real numbers , preset length parameters m and the Gaussian constraint inequality formed by the number of collaborative users t , judge whether the equality and inequality are satisfied according to the value of each parameter. If the equality and inequality are satisfied, it is determined that the target signature verification passes. If the equality or inequality is not satisfied, it is determined that the target signature verification fails.

[0113] Furthermore, the above-mentioned verification of the target signature and output of the target signature includes: If the target signature verification passes, the target signature is output; if the target signature verification fails, the message to be sent is refused to be signed.

[0114] In this embodiment, after the signature verification accelerator 103 in the electronic device corresponding to the verifier verifies the target signature according to the above-mentioned equality and inequality, it outputs 1 if the verification is successful, and outputs 0 if the verification fails. If the verification is successful, the target signature of the message to be sent is output, and if the verification fails, the message to be sent is refused to be signed.

[0115] For example, Figure 7 The following is a flowchart of the signature verification phase provided in the embodiment of the present application, such as Figure 7 As shown, the signature verification phase may include: S31. The verifier aggregates the split public keys of multiple collaborative users into an aggregated public key.

[0116] S32. Calculate the global hash value and the message hash value.

[0117] S33. Determine whether the target signature satisfies the collaborative signature equation and the inequality of the Gaussian constraint condition.

[0118] S34. Output the signature verification result.

[0119] The post-quantum collaborative signature method based on key splitting provided in the above embodiment aggregates the split public keys and verifies the equality and constraints of the target signature based on the global hash value, the message hash value and related parameters. This verification method is simple and efficient. While ensuring security, it can quickly verify the authenticity of the target signature, ensuring the integrity and non-repudiation of the information.

[0120] Based on the above method embodiments, the embodiments of the present application also provide a post-quantum collaborative signature device based on key splitting. Figure 8 This is a schematic diagram of the structure of a post-quantum collaborative signature device based on key splitting provided in an embodiment of the present application, as shown in FIG. Figure 8 As shown, the device may include: A key acquisition module 501 is used to obtain split public keys and split private keys of multiple collaborative users; The signature fragment calculation module 502 is used to calculate the binding information of the signature fragments of the multiple collaborative users for the message to be sent according to the user identifiers of the multiple collaborative users; The signature fragment calculation module 502 is further configured to calculate the signature value of each collaborative user for the signature fragment based on the split private key and binding information of each collaborative user; The signature generation module 504 is used to generate a target signature for the message to be sent based on the signature values ​​of the multiple collaborative users for the signature fragments; The signature verification module 505 is used to verify the target signature according to the split public keys of multiple collaborative users and output the target signature.

[0121] Optionally, the key acquisition module 501 is specifically used to generate a master key and system public parameters based on a preset modulus parameter, a preset dimension parameter and a preset length parameter using a preset trapdoor algorithm, where the system public parameters include: a random matrix, a first hash function, a Gaussian parameter, a preset modulus parameter, a preset dimension parameter and a preset length parameter; the first hash function is used to map the user identifier of each collaborative user to the matrix space to obtain the split public key of each collaborative user; based on the master key, the random matrix, the Gaussian parameter and the split public keys of multiple collaborative users, a preset sampling algorithm is used to respectively calculate the split private keys of multiple collaborative users.

[0122] Optionally, the system public parameters also include: a second hash function and a third hash function, a signature shard calculation module 502, which is specifically used to use the second hash function to map the user identifier of each collaborative user and the message to be sent to a column vector space to obtain a collaborative hash value of each collaborative user for the message to be sent; use the third hash function to map the message to be sent and the collaborative hash values ​​of multiple collaborative users into a binary string to obtain a message hash value of the message to be sent; use the third hash function to map the user identifiers of multiple collaborative users into a binary string, and calculate the user identifier hash values ​​of multiple collaborative users respectively; calculate the binding information of multiple collaborative users for the signature shards respectively according to the message hash value and the user identifier hash values ​​of multiple collaborative users.

[0123] Optionally, the device further comprises: The signature fragment verification module 503 is used to determine whether to output the signature value according to the discrete Gaussian distribution probability of the signature value of each collaborative user for the signature fragment; if the discrete Gaussian distribution probability is less than or equal to 1, the signature value is output.

[0124] Optionally, the signature generation module 504 is specifically used to call an ideal function to verify the relationship between the signature value of each collaborative user for the signature fragment and the split private key of each collaborative user; if the relationship between the signature value of each collaborative user for the signature fragment and the split private key of each collaborative user is valid, the target signature of the message to be sent is generated according to the signature values ​​of multiple collaborative users for the signature fragment.

[0125] Optionally, the signature generation module 504 is also used to determine whether the message hash values ​​of multiple collaborative users for the signature fragments are consistent; if the message hash values ​​of multiple collaborative users for the signature fragments are consistent, the target signature of the message to be sent is generated according to the signature values ​​of multiple collaborative users for the signature fragments.

[0126] Optionally, the system public parameters also include: a positive real number, a signature verification module 505, which is specifically used to generate an aggregated public key based on the user identifiers of multiple collaborative users and the split public keys of multiple collaborative users; verify the target signature and output the target signature based on the aggregated public key, the collaborative hash values ​​of multiple collaborative users, the message hash value of the message to be sent, a positive real number, a random matrix and a preset length parameter.

[0127] Optionally, the signature verification module 505 is further configured to output the target signature if the target signature verification passes; and refuse to sign the message to be sent if the target signature verification fails.

[0128] The above-mentioned device is used to execute the method provided in the above-mentioned embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0129] The above modules can be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), one or more microprocessors, or one or more field programmable gate arrays (FPGAs). For example, when a module is implemented by scheduling program code through a processing element, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules can be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0130] Figure 9 This is a schematic diagram of an electronic device provided in an embodiment of the present application. The electronic device 600 may include: a processor 601, a storage medium 602, and a bus. The storage medium 602 stores program instructions executable by the processor 601. When the electronic device 600 is running, the processor 601 and the storage medium 602 communicate via the bus, and the processor 601 executes the program instructions to perform the above method embodiment. The specific implementation methods and technical effects are similar and will not be repeated here.

[0131] Optionally, the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is run by a processor, the above method embodiment is executed.

[0132] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0133] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0134] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0135] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: USB flash drives, mobile hard drives, read-only memory (English: Read-Only Memory, abbreviated: ROM), random access memory (English: Random Access Memory, abbreviated: RAM), magnetic disks or optical disks, and other media that can store program code.

[0136] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited to them. Any changes or substitutions that can be easily conceived by any person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A post-quantum collaborative signature method based on key splitting, characterized in that: The method comprises: Obtain split public keys and split private keys of multiple collaborative users; Calculating binding information of the signature fragments of the to-be-sent messages of the multiple collaborative users respectively according to the user identifiers of the multiple collaborative users; Calculate the signature value of each collaborative user for the signature fragment according to the split private key and binding information of each collaborative user; generating a target signature for the message to be sent according to the signature values ​​of the multiple collaborative users for the signature fragments; The target signature is verified according to the split public keys of the multiple collaborative users and the target signature is output.

2. The method according to claim 1, wherein The obtaining of the split public keys and split private keys of the multiple collaborative users includes: Generate a master key and system public parameters using a preset trapdoor algorithm according to a preset modulus parameter, a preset dimension parameter, and a preset length parameter, wherein the system public parameters include: a random matrix, a first hash function, a Gaussian parameter, the preset modulus parameter, the preset dimension parameter, and the preset length parameter; Mapping the user identification of each collaborative user to a matrix space using the first hash function to obtain a split public key of each collaborative user; According to the master key, the random matrix, the Gaussian parameter and the split public keys of the multiple collaborative users, a preset sampling algorithm is adopted to respectively calculate the split private keys of the multiple collaborative users.

3. The method according to claim 2, wherein The system public parameters further include: a second hash function and a third hash function, wherein the calculation of binding information of the signature fragments of the multiple collaborative users for the to-be-sent messages based on the user identifiers of the multiple collaborative users includes: Using the second hash function, mapping the user identification of each collaborative user and the message to be sent to a column vector space to obtain a collaborative hash value of each collaborative user for the message to be sent; Using the third hash function, mapping the message to be sent and the collaborative hash values ​​of the multiple collaborative users into a binary string to obtain a message hash value of the message to be sent; Using the third hash function, mapping the user identifiers of the multiple collaborative users into binary character strings, and respectively calculating hash values ​​of the user identifiers of the multiple collaborative users; Binding information of the multiple collaborative users for the signature fragments is calculated respectively according to the message hash value and the user identification hash values ​​of the multiple collaborative users.

4. The method according to claim 1, wherein After calculating the signature value of each collaborative user for the signature fragment based on the split private key and binding information of each collaborative user, the method includes: determining whether to output the signature value according to a discrete Gaussian distribution probability of the signature value of each collaborative user for the signature fragment; If the discrete Gaussian distribution probability is less than or equal to 1, it is determined to output the signature value.

5. The method according to claim 1, wherein Generating the target signature of the message to be sent according to the signature values ​​of the multiple collaborative users for the signature fragments includes: Calling an ideal function to verify the relationship between the signature value of each collaborative user for the signature shard and the split private key of each collaborative user; If the relationship between the signature value of each collaborative user for the signature fragment and the split private key of each collaborative user is valid, the target signature of the message to be sent is generated according to the signature values ​​of the multiple collaborative users for the signature fragments.

6. The method according to claim 3, wherein Generating the target signature of the message to be sent according to the signature values ​​of the multiple collaborative users for the signature fragments includes: Determine whether the message hash values ​​of the multiple collaborative users for the signature fragments are consistent; If the message hash values ​​of the multiple collaborative users for the signature fragments are consistent, a target signature for the message to be sent is generated according to the signature values ​​of the multiple collaborative users for the signature fragments.

7. The method according to claim 3, wherein The system public parameter further includes: a positive real number, and the verifying the target signature according to the split public keys of the multiple collaborative users and outputting the target signature includes: generating an aggregated public key according to the user identifiers of the multiple collaborative users and the split public keys of the multiple collaborative users; The target signature is verified and output according to the aggregated public key, the collaborative hash values ​​of the multiple collaborative users, the message hash value of the message to be sent, the positive real number, the random matrix and the preset length parameter.

8. The method according to claim 7, wherein The verifying the target signature and outputting the target signature includes: If the target signature is verified, the target signature is output; If the target signature verification fails, the message to be sent is refused to be signed.

9. An electronic device, characterized in that: include: A processor, a storage medium, and a bus, wherein the storage medium stores program instructions executable by the processor. When the electronic device is running, the processor and the storage medium communicate via the bus, and the processor executes the program instructions to perform the steps of the post-quantum collaborative signature method based on key splitting as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that The storage medium stores a computer program, which, when executed by a processor, executes the steps of the post-quantum collaborative signature method based on key splitting according to any one of claims 1 to 8.

Images