Linear homomorphic digital signature method based on identity on lattice and related equipment

Abstract

The invention discloses an on-lattice identity-based linear homomorphic digital signature method and related equipment, and belongs to the technical field of information security and passwords, and the method comprises the following steps: S1, generating a public parameter based on a preset security level; s2, calculating a main public key and a main private key based on the public parameters and an NTRU equation; s3, calculating an identity private key based on the main public key, the main private key, the public parameter and the identity id; s4, calculating a signature of the to-be-signed message based on the to-be-signed message, the identity private key and the identity id; s5, performing linear homomorphic operation on the signature of the to-be-signed message based on the public parameter to obtain a homomorphic signature; and S6, verifying whether the signature is passed based on the to-be-signed message, the homomorphic signature, the identity id, the main public key and the public parameter. According to the method, the problem of dependence on a public key certificate management system is solved while the efficient homomorphic operation capability is kept, and more times of linear homomorphic operation are supported, so that the security and practicability of a signature scheme in a quantum computing environment are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security and cryptography technology, and more particularly to an identity-based linear homomorphic digital signature method on a lattice and related equipment. Background Art

[0002] With the rapid development and gradual application of quantum computing technology, traditional public-key cryptographic algorithms based on mathematical problems such as large integer factorization, discrete logarithms, and elliptic curves are facing unprecedented threats from quantum computing attacks, posing a severe challenge to the information security field. To effectively counter the impact of quantum computing on existing cryptographic systems, developing a new generation of post-quantum cryptographic algorithms that are resistant to quantum computing attacks has become a top priority.

[0003] Against the backdrop of the growing threat of quantum computing and the growing demand for large-scale distributed applications such as the Internet of Things, existing homomorphic signature schemes are struggling to meet the demands for higher computational depth, lower dependencies, and greater flexibility. In particular, the reliance on public key certificate management systems increases system complexity and maintenance costs, limiting their widespread application in resource-constrained environments such as IoT devices.

[0004] Therefore, how to provide a linear homomorphic digital signature method that can solve the problem of dependence on the public key certificate management system while maintaining efficient homomorphic computing capabilities and support more linear homomorphic operations, thereby improving the security and practicality of the signature scheme in a quantum computing environment is an issue that technical personnel in this field urgently need to solve. Summary of the Invention

[0005] In view of this, the object of the present invention is to provide an identity-based linear homomorphic digital signature method on a lattice and related equipment.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, a method for identity-based linear homomorphic digital signature on a lattice is provided, comprising the following steps:

[0008] S1: Generate public parameters based on the preset security level;

[0009] S2: Calculate the master public key and master private key based on the public parameters and the NTRU equation;

[0010] S3: Calculate the identity private key based on the master public key, master private key, public parameters and identity ID;

[0011] S4: Calculate the signature of the message to be signed based on the message to be signed, the identity private key, and the identity ID;

[0012] S5: Perform a linear homomorphic operation on the signature of the message to be signed based on the public parameters to obtain a homomorphic signature;

[0013] S6: Verify whether the signature is passed based on the message to be signed, homomorphic signature, identity ID, master public key, and public parameters.

[0014] Preferably, the common parameters include integer modulo prime number q, polynomial degree n, cyclotomic polynomial , discrete Gaussian distribution and its standard deviation , maximum number of linear homomorphic signatures L, linear homomorphic signature depth l, linear function LF, first hash function H, second hash function hash; where, ; ; represents the set of positive integers; ; represents n-dimensional integer space; ; ; ; ; , which means mapping a binary string of arbitrary length into a binary character of length n; , which represents mapping a binary string of arbitrary length to an n-dimensional vector space modulo q.

[0015] Preferably, S2 specifically includes the following steps:

[0016] S21: Generate the discrete Gaussian distribution from the trapdoor function Sampling in the middle, obtain polynomial f and polynomial g; where polynomial f and polynomial g satisfy: Reversible and , ; represents the adjoint polynomial of the polynomial f; represents the adjoint polynomial of the polynomial g;

[0017] S22: Solve the NTRU equations using the extended Euclidean algorithm and the Babai closest plane algorithm , obtain polynomial F and polynomial G;

[0018] S23: Calculate the master public key and the master private key ; Among them, A(g) represents n g; A(-f) represents n -f; A(G) represents n G; A(-F) represents n -F; , which represents the NTRU grid A set of short vector bases; Represents the matrix space of the 2n×2n-dimensional module q; the master public key h and the master private key Constructing the master key .

[0019] Preferably, S3 specifically includes the following steps:

[0020] S31: Perform hash operation on the identity ID to obtain the seed ;

[0021] The master public key h, the master private key , standard deviation The lattice delegation algorithm uses the seed as the input parameter to perform the lattice delegation operation to obtain the identity basis. ;in, represents the lattice delegation algorithm;

[0022] S32: Identity base Perform fast Fourier transform to get the matrix ;

[0023] S33: Matrix Recursively perform LDL* decomposition and split the diagonal elements of the D matrix to generate a FALCON tree ;in, express The conjugate matrix of and FALCON tree Constitute the identity private key.

[0024] Preferably, S4 specifically includes the following steps:

[0025] S41: Send the message After synthesizing the string with the identity id and performing hash operation, the message is obtained Corresponding summary ;in, Indicates that the message Combined with identity id; ; M represents the message to be signed;

[0026] S42: Calculation Summary The corresponding preimage ; Wherein, FFT stands for Fast Fourier Transform;

[0027] S43: The original image and FALCON tree As the input of the fast Fourier sampling algorithm, fast Fourier sampling is performed to obtain a short polynomial and short polynomials ;in, Represents fast Fourier sampling; short polynomial satisfy ;

[0028] S44: Short polynomials Perform inverse fast Fourier transform to obtain a short vector and short vectors ;in, ; represents the inverse fast Fourier transform; a short vector and short vectors satisfy: ;

[0029] S45: Repeat S41-S44 to obtain the message to be signed Signature .

[0030] Preferably, S5 specifically includes the following steps:

[0031] Sign the message to be signed Perform linear homomorphic operation as the input of linear function LF to obtain homomorphic signature ;in, express Two short vectors.

[0032] Preferably, S6 specifically includes the following steps:

[0033] S61: Determine whether the linear homomorphic signature depth l is greater than 1; if greater than 1, execute S62; if equal to 1, execute S63;

[0034] S62: Send the message After synthesizing the string with the identity id and performing hash operation, the message is obtained Corresponding summary ;

[0035] Message-based Corresponding summary Calculating the hash value ;

[0036] Determine whether it is satisfied and If the conditions are met, the signature verification is successful; if not, the signature verification fails.

[0037] S63: Send the message After synthesizing the string with the identity id and performing hash operation, the message is obtained Corresponding summary ;

[0038] Determine whether it is satisfied and If the conditions are met, the signature verification passes; if not, the signature verification fails.

[0039] In a second aspect, a lattice-based identity-based linear homomorphic digital signature device is provided, which is used to implement the above-mentioned linear homomorphic digital signature method, including a public parameter generation module, a master key calculation module, an identity private key calculation module, a digital signature generation module, a homomorphic operation module, and a signature verification module;

[0040] The public parameter generation module is used to generate public parameters based on a preset security level;

[0041] The master key calculation module is used to calculate a master public key and a master private key based on public parameters and the NTRU equation; wherein the master public key and the master private key constitute a master secret key;

[0042] The identity private key calculation module is used to calculate the identity private key based on the master public key, the master private key, the public parameters and the identity ID;

[0043] The digital signature generation module is used to calculate the signature of the message to be signed based on the message to be signed, the identity private key, and the identity ID;

[0044] The homomorphic operation module is used to perform a linear homomorphic operation on the signature of the message to be signed based on the public parameters to obtain a homomorphic signature;

[0045] The signature verification module verifies whether the signature is passed based on the message to be signed, the homomorphic signature, the identity ID, the master public key, and the public parameters.

[0046] In a third aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned identity-based linear homomorphic digital signature method on the lattice when executing the computer program.

[0047] In a fourth aspect, a non-transitory computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the identity-based linear homomorphic digital signature method on the lattice described above is implemented.

[0048] It can be seen from the above technical solution that compared with the existing technology, the present invention discloses an identity-based linear homomorphic digital signature method and related equipment on a lattice. While maintaining efficient homomorphic computing capabilities, the present invention solves the problem of dependence on the public key certificate management system and supports more linear homomorphic operations, thereby improving the security and practicality of the signature scheme in a quantum computing environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0050] Figure 1 A flowchart of an identity-based linear homomorphic digital signature method on a lattice provided by the present invention;

[0051] Figure 2 A schematic diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0053] In the first aspect, the embodiment of the present invention provides an identity-based linear homomorphic digital signature method on a lattice, such as Figure 1 As shown, the following steps are included:

[0054] S1: Generate public parameters based on the preset security level;

[0055] In one embodiment, the common parameters include an integer modulo a prime number q, a polynomial degree n, a cyclotomic polynomial , discrete Gaussian distribution and its standard deviation , maximum number of linear homomorphic signatures L, linear homomorphic signature depth l, linear function LF, first hash function H, second hash function hash; where, ; ; represents the set of positive integers; ; represents n-dimensional integer space; ; ; ; ; , which means mapping a binary string of arbitrary length into a binary character of length n; , which represents mapping a binary string of arbitrary length to an n-dimensional vector space modulo q.

[0056] It can be understood that different security levels correspond to different integer modulo prime number q and polynomial degree n. Based on the desired security level, the corresponding integer modulo prime number q and polynomial degree n can be determined. After determining the integer modulo prime number q and polynomial degree n, the cyclotomic polynomial can be determined. , discrete Gaussian distribution and its standard deviation , first hash function H, second hash function hash.

[0057] S2: Calculate the master public key and master private key based on the public parameters and the NTRU equation;

[0058] In one embodiment, S2 specifically includes the following steps:

[0059] S21: Generate the discrete Gaussian distribution from the trapdoor function Sampling in the middle, obtain polynomial f and polynomial g; where polynomial f and polynomial g satisfy: Reversible and , ; represents the adjoint polynomial of the polynomial f; represents the adjoint polynomial of the polynomial g;

[0060] S22: Solve the NTRU equations using the extended Euclidean algorithm and the Babai closest plane algorithm , obtain polynomial F and polynomial G;

[0061] S23: Calculate the master public key and the master private key ; Among them, A(g) represents n g; A(-f) represents n -f; A(G) represents n G; A(-F) represents n -F; , which represents the NTRU grid A set of short vector bases; Represents the matrix space of the 2n×2n-dimensional module q; the master public key h and the master private key Constructing the master key .

[0062] S3: Calculate the identity private key based on the master public key, master private key, public parameters and identity ID;

[0063] In one embodiment, S3 specifically includes the following steps:

[0064] S31: Perform hash operation on the identity ID to obtain the seed ;

[0065] It can be understood that the identity ID is the identity ID of the holder of the message to be signed.

[0066] The master public key h, the master private key , standard deviation The lattice delegation algorithm uses the seed as the input parameter to perform the lattice delegation operation to obtain the identity basis. ;in, represents the lattice delegation algorithm;

[0067] S32: Identity base Perform fast Fourier transform to get the matrix ;

[0068] S33: Matrix Recursively perform LDL* decomposition and split the diagonal elements of the D matrix to generate a FALCON tree ;in, express The conjugate matrix of and FALCON tree Constitute the identity private key.

[0069] S4: Calculate the signature of the message to be signed based on the message to be signed, the identity private key, and the identity ID;

[0070] In one embodiment, S4 specifically includes the following steps:

[0071] S41: Send the message After synthesizing the string with the identity id and performing hash operation, the message is obtained Corresponding summary ;in, Indicates that the message Combined with identity id; ; M represents the message to be signed;

[0072] S42: Calculation Summary The corresponding preimage ; Wherein, FFT stands for Fast Fourier Transform;

[0073] S43: The original image and FALCON tree As the input of the fast Fourier sampling algorithm, fast Fourier sampling is performed to obtain a short polynomial and short polynomials ;in, Represents fast Fourier sampling; short polynomial satisfy ;

[0074] S44: Short polynomials Perform inverse fast Fourier transform to obtain a short vector and short vectors ;in, ; represents the inverse fast Fourier transform; a short vector and short vectors satisfy: ;

[0075] S45: Repeat S41-S44 to obtain the message to be signed Signature .

[0076] S5: Perform a linear homomorphic operation on the signature of the message to be signed based on the public parameters to obtain a homomorphic signature;

[0077] In one embodiment, S5 specifically includes the following steps:

[0078] Sign the message to be signed Perform linear homomorphic operation as the input of linear function LF to obtain homomorphic signature ;in, express Two short vectors of Express Two short vectors obtained after inverse fast Fourier transform).

[0079] S6: Verify whether the signature is passed based on the message to be signed, homomorphic signature, identity ID, master public key, and public parameters.

[0080] In one embodiment, S6 specifically includes the following steps:

[0081] S61: Determine whether the linear homomorphic signature depth l is greater than 1; if greater than 1, execute S62; if equal to 1, execute S63;

[0082] S62: Send the message After synthesizing the string with the identity id and performing hash operation, the message is obtained Corresponding summary ;

[0083] Message-based Corresponding summary Calculating the hash value ;

[0084] Determine whether it is satisfied and If the conditions are met, the signature verification is successful; if not, the signature verification fails.

[0085] S63: Send the message After synthesizing the string with the identity id and performing hash operation, the message is obtained Corresponding summary ;

[0086] Determine whether it is satisfied and If the conditions are met, the signature verification passes; if not, the signature verification fails.

[0087] It should be noted that:

[0088] S1-S4 are executed by the holder of the message to be signed;

[0089] S5 is performed by the second party;

[0090] S6 is performed by a third party or the holder of the message to be signed.

[0091] In a second aspect, an embodiment of the present invention provides an identity-based linear homomorphic digital signature device on a lattice, which is used to implement the linear homomorphic digital signature method described above, including a public parameter generation module, a master key calculation module, an identity private key calculation module, a digital signature generation module, a homomorphic operation module, and a signature verification module;

[0092] The public parameter generation module is used to generate public parameters based on a preset security level;

[0093] The master key calculation module is used to calculate a master public key and a master private key based on public parameters and the NTRU equation; wherein the master public key and the master private key constitute a master secret key;

[0094] The identity private key calculation module is used to calculate the identity private key based on the master public key, the master private key, the public parameters and the identity ID;

[0095] The digital signature generation module is used to calculate the signature of the message to be signed based on the message to be signed, the identity private key, and the identity ID;

[0096] The homomorphic operation module is used to perform a linear homomorphic operation on the signature of the message to be signed based on the public parameters to obtain a homomorphic signature;

[0097] The signature verification module verifies whether the signature is passed based on the message to be signed, the homomorphic signature, the identity ID, the master public key, and the public parameters.

[0098] In a third aspect, an embodiment of the present invention further provides an electronic device, such as Figure 2 As shown, the electronic device may include: a processor 201, a communications interface 202, a memory 203, and a communication bus 204. The processor 201, the communications interface 202, and the memory 203 communicate with each other via the communication bus 204. The processor 201 may call logic instructions in the memory 203 to execute the identity-based linear homomorphic digital signature method on the lattice.

[0099] Furthermore, the logic instructions in the aforementioned memory 203 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0100] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the identity-based linear homomorphic digital signature method on a lattice provided by the above-mentioned methods.

[0101] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0102] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A linear homomorphic digital signature method based on identity on a lattice, characterized in that: The following steps are involved: S1: Generate public parameters based on the preset security level; S2: Calculate the master public key and master private key based on the public parameters and the NTRU equation; S3: Calculate the identity private key based on the master public key, master private key, public parameters and identity ID; S4: Calculate the signature of the message to be signed based on the message to be signed, the identity private key, and the identity ID; S5: Perform a linear homomorphic operation on the signature of the message to be signed based on the public parameters to obtain a homomorphic signature; S6: Verify whether the signature is passed based on the message to be signed, homomorphic signature, identity ID, master public key, and public parameters.

2. The identity-based linear homomorphic digital signature method on a lattice according to claim 1, characterized in that: The common parameters include integer modulo prime number q, polynomial degree n, cyclotomic polynomial , discrete Gaussian distribution and its standard deviation , maximum number of linear homomorphic signatures L, linear homomorphic signature depth l, linear function LF, first hash function H, second hash function hash; where, ; ; represents the set of positive integers; ; represents n-dimensional integer space; ; ; ; ; , which means mapping a binary string of arbitrary length into a binary character of length n; , which represents mapping a binary string of arbitrary length to an n-dimensional vector space modulo q.

3. The identity-based linear homomorphic digital signature method on a lattice according to claim 2, characterized in that: S2 specifically includes the following steps: S21: Generate the discrete Gaussian distribution from the trapdoor function Sampling in the middle, obtain polynomial f and polynomial g; where polynomial f and polynomial g satisfy: Reversible and , ; represents the adjoint polynomial of the polynomial f; represents the adjoint polynomial of the polynomial g; S22: Solve the NTRU equations using the extended Euclidean algorithm and the Babai closest plane algorithm , obtain polynomial F and polynomial G; S23: Calculate the master public key and the master private key ; Among them, A(g) represents n g; A(-f) represents n -f; A(G) represents n G; A(-F) represents n -F; , which represents the NTRU grid A set of short vector bases; Represents the matrix space of the 2n×2n-dimensional module q; the master public key h and the master private key Constructing the master key .

4. The identity-based linear homomorphic digital signature method on a lattice according to claim 3, characterized in that: S3 specifically includes the following steps: S31: Perform hash operation on the identity ID to obtain the seed ; The master public key h, the master private key , standard deviation The lattice delegation algorithm uses the seed as the input parameter to perform the lattice delegation operation to obtain the identity basis. ;in, represents the lattice delegation algorithm; S32: Identity base Perform fast Fourier transform to get the matrix ; S33: Matrix Recursively perform LDL* decomposition and split the diagonal elements of the D matrix to generate a FALCON tree ;in, express The conjugate matrix of and FALCON tree Constitute the identity private key.

5. The identity-based linear homomorphic digital signature method on a lattice according to claim 4, characterized in that: S4 specifically includes the following steps: S41: Send the message After synthesizing the string with the identity id and performing hash operation, the message is obtained Corresponding summary ;in, Indicates that the message Combined with identity id; ; M represents the message to be signed; S42: Calculation Summary The corresponding preimage ; Wherein, FFT stands for Fast Fourier Transform; S43: The original image and FALCON tree As the input of the fast Fourier sampling algorithm, fast Fourier sampling is performed to obtain a short polynomial and short polynomials ;in, Represents fast Fourier sampling; short polynomial satisfy ; S44: Short polynomials Perform inverse fast Fourier transform to obtain a short vector and short vectors ;in, ; represents the inverse fast Fourier transform; a short vector and short vectors satisfy: ; S45: Repeat S41-S44 to obtain the message to be signed Signature .

6. The identity-based linear homomorphic digital signature method on a lattice according to claim 5, characterized in that: S5 specifically includes the following steps: Sign the message to be signed Perform linear homomorphic operation as the input of linear function LF to obtain homomorphic signature ;in, express Two short vectors.

7. The identity-based linear homomorphic digital signature method on a lattice according to claim 6, characterized in that: S6 specifically includes the following steps: S61: Determine whether the linear homomorphic signature depth l is greater than 1; if greater than 1, execute S62; if equal to 1, execute S63; S62: Send the message After synthesizing the string with the identity id and performing hash operation, the message is obtained Corresponding summary ; Message-based Corresponding summary Calculating the hash value ; Determine whether it is satisfied and If the conditions are met, the signature verification is successful; if not, the signature verification fails. S63: Send the message After synthesizing the string with the identity id and performing hash operation, the message is obtained Corresponding summary ; Determine whether it is satisfied and If the conditions are met, the signature verification passes; if not, the signature verification fails.

8. A lattice-based identity-based linear homomorphic digital signature device, used to implement the linear homomorphic digital signature method according to any one of claims 1 to 7, characterized in that: It includes public parameter generation module, master key calculation module, identity private key calculation module, digital signature generation module, homomorphic operation module, and signature verification module; The public parameter generation module is used to generate public parameters based on a preset security level; The master key calculation module is used to calculate a master public key and a master private key based on public parameters and the NTRU equation; wherein the master public key and the master private key constitute a master secret key; The identity private key calculation module is used to calculate the identity private key based on the master public key, the master private key, the public parameters and the identity ID; The digital signature generation module is used to calculate the signature of the message to be signed based on the message to be signed, the identity private key, and the identity ID; The homomorphic operation module is used to perform a linear homomorphic operation on the signature of the message to be signed based on the public parameters to obtain a homomorphic signature; The signature verification module verifies whether the signature is passed based on the message to be signed, the homomorphic signature, the identity ID, the master public key, and the public parameters.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the identity-based linear homomorphic digital signature method on a lattice is implemented according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the identity-based linear homomorphic digital signature method on a lattice is implemented according to any one of claims 1 to 7.

Images