Two-party cooperation post-quantum signature method supporting blind signature

Abstract

The invention belongs to the technical field of information security, and discloses a two-party cooperation post-quantum signature method supporting blind signature, which is applied to a client and a server, and the two-party cooperation post-quantum signature method supporting blind signature applied to the client comprises the following steps: obtaining a first public key parameter of the client, acquiring high-order part information of the public key component; after a first commitment value and a first hash value are generated based on the first random number group, a second commitment value is verified through a second hash value sent by the server; performing blinding to generate a challenge by using the blinding factor and the masking vector obtained by calculation and combining the first commitment value, the second commitment value and the high-order part information, and calculating to obtain a blinded challenge value; calculating a first signature component according to the blinded challenge value and a first private key component corresponding to the first public key parameter; generating a target blind signature value based on the first signature component and a second signature component sent by the server; through the method, the security of the collaborative signature is improved.

Description

Technical Field

[0001] This application relates to the technical field of information security, and more specifically, to a two-party collaborative post-quantum signature method that supports blind signatures. Background Technology

[0002] With the widespread adoption of mobile internet and the establishment of the legal validity of electronic signatures, collaborative signature technology plays a crucial role in ensuring that multiple parties can jointly complete a signature operation. However, the rapid development of quantum computing poses a serious threat to existing cryptographic systems, including the widely used SM series algorithms. The powerful computing capabilities of quantum computers can break traditional cryptographic algorithms based on large number factorization or discrete logarithm problems, thereby jeopardizing the security of private keys and signature values. This is a fatal challenge for critical sectors such as banking, securities, and government that heavily rely on secure electronic signatures.

[0003] To address the security challenges of the post-quantum era, the research and application of quantum-resistant cryptography (PQC) algorithms have become an urgent priority, including the evolution of collaborative signature technology towards quantum resistance. Currently, research on quantum-resistant collaborative signatures is relatively limited. Existing solutions, while achieving quantum-resistant collaborative signatures, often come with high computational and communication costs, and still require improvement in message privacy protection, failing to meet the needs of application scenarios with higher requirements for efficiency and privacy.

[0004] Therefore, in order to address the technical shortcomings of existing quantum-resistant collaborative signature methods in terms of quantum security, message privacy protection, and computational and communication overhead, there is an urgent need for a two-party collaborative post-quantum signature method that supports blind signatures. Summary of the Invention

[0005] The purpose of this application is to provide a two-party collaborative quantum signature method that supports blind signatures. By using a blind signature method, a collaborative signature is performed based on a homomorphic commitment value generated by the first commitment value and first hash value of the client and the second commitment value and second hash value of the server. The target blind signature value is then calculated. This method addresses the shortcomings of existing quantum-resistant collaborative signature methods in terms of quantum security, message privacy protection, and computational and communication overhead. It enables secure, efficient, and privacy-preserving collaborative signatures under quantum computing threats, thereby improving the security of collaborative signatures.

[0006] Firstly, this application provides a two-party collaborative quantum signature method supporting blind signatures, applied to a client to achieve blind signatures with a server, including: S1, obtain the first public key parameter of its own client, and obtain the high-order part of the public key component jointly generated with the server; S2, after generating a first commitment value and a first hash value based on a first random array, receive a second commitment value and a second hash value sent by the server, and use the second hash value to verify the second commitment value; S3, using the blinding factor and masking vector calculated based on the client's signature information, preset hash parameters and preset restart parameters, combined with the first commitment value, the second commitment value and the high-order part information, a blinding challenge is generated, and the blinded challenge value is calculated; S4. Calculate the first signature component based on the blinded challenge value and the first private key component corresponding to the first public key parameter. S5, Based on the first signature component and the second signature component sent by the server, generate a target blind signature value.

[0007] The two-party collaborative quantum signature method supporting blind signature provided in this application can realize blind signature between the server and the client. Through blind signature, based on the homomorphic commitment value generated by the first commitment value and first hash value of the server and the second commitment value and second hash value of the client, collaborative signature is performed to calculate the target blind signature value. This solves the problems of existing anti-quantum collaborative signature methods in terms of anti-quantum security, message privacy protection, and computation and communication overhead. It can provide secure, efficient, and privacy-preserving collaborative signature under the threat of quantum computing, thus improving the security of collaborative signature.

[0008] Optionally, the client obtains its own first public key parameter, and obtains the high-order part of the public key component jointly generated with the server, including: Generate a first private key component within a preset random number range; Using a lattice-based cryptographic algorithm, generate the first public key parameter corresponding to the first private key component; The system receives the second public key parameter sent by the server and extracts the high-order part information from the public key component generated by the first public key parameter and the second public key parameter.

[0009] Optionally, after generating a first commitment value and a first hash value based on a first random array, receiving a second commitment value and a second hash value sent by the server, and verifying the second commitment value through the second hash value, includes: Generate a first random array within a preset random number range; Perform high-order bit calculations on the first random array to obtain the first commitment value and the first hash value; After the server generates a second random array within a preset random number range to calculate the second commitment value and the second hash value, the server receives the second commitment value and the second hash value sent by the server. The second hash value is used to verify the second commitment value to ensure the correctness of both the second commitment value and the second hash value.

[0010] Optionally, high-order bit calculations are performed on the first random array to calculate the first commitment value and the first hash value, including: Based on the first random array and combined with a preset common matrix, the first intermediate value is calculated; Based on the first intermediate value, high-order calculation is performed to obtain the first high-order value; Using the commitment function, the first commitment value is calculated based on the first random array and the first high-order value; A hash function is used to calculate the first hash value corresponding to the first commitment value.

[0011] Optionally, using the blinding factor and masking vector calculated based on the client's signature information, preset hash parameters, and preset restart parameters, combined with the first commitment value, the second commitment value, and the high-order information, a blinding challenge is generated to calculate the blinded challenge value, including: Based on the client's pending signature information, preset hash parameters, and preset restart parameters, and combined with the anti-collision hash function, sparse binomial distribution sampling algorithm, and extended masking function, the initial digest, blinding factor, and masking vector are calculated respectively. Based on the blinding factor, the masking vector, the first commitment value, and the second commitment value, a blinding polynomial is constructed to calculate the homomorphic commitment value. The sparse binomial distribution sampling algorithm is used to calculate the original challenge value corresponding to the first commitment value, the second commitment value, and the initial summary; Using the blinding factor, the original challenge value is subjected to additive offset processing to calculate the blinded challenge value.

[0012] The two-party collaborative quantum signature method for supporting blind signatures provided in this application can realize blind signatures between the server and the client. By introducing a blinding factor, the client can generate a blinded challenge value without disclosing the information to be signed to the server, thereby achieving privacy protection of the message content.

[0013] Optionally, the first signature component is calculated based on the blinded challenge value and the first private key component corresponding to the first public key parameter, including: The initial first signature component is calculated based on the blinded challenge value and the first private key component corresponding to the first public key parameter; Determine whether the initial first signature component satisfies the preset first norm check condition; if yes, determine the initial first signature component as the first signature component; if no, regenerate another random array within the preset random number range as the first random array, and return to step S2.

[0014] Optionally, based on the first signature component and the second signature component sent by the server, a target blind signature value is generated, including: The second commitment value is verified based on the second signature component and the second random array sent by the server. After successful verification, the initial blind signature value is calculated based on the first signature component and the second signature component; The hint vector is calculated based on the initial blind signature value, the first public key parameter, and the second public key parameter sent by the server. After deblinding the initial blind signature value, a target blind signature value corresponding to the hint vector, the original challenge value, and the deblinded initial blind signature value is generated.

[0015] Secondly, a two-party collaborative quantum signature method supporting blind signatures is applied to the server side to achieve blind signatures with the client, including: Obtain the second public key parameter of its own server; After generating a second commitment value and a second hash value based on a second random array, the second commitment value and the second hash value are sent to the client, and the first commitment value and the first hash value sent by the client are received, so as to verify the first commitment value through the first hash value; The second signature component is calculated based on the blinded challenge value sent by the client and the second private key component corresponding to the second public key parameter. Based on the first signature component and the first random array sent by the client, while verifying the first commitment value, the second signature component is sent to the client, so that after the client successfully verifies the second signature component and the second random array, it generates a target blind signature value based on the second signature component.

[0016] This two-party collaborative quantum signature method that supports blind signatures generates a second signature component through a blinded challenge value, enabling the client to generate a target blind signature value based on the second signature component. This addresses the shortcomings of existing quantum-resistant collaborative signature methods in terms of quantum security, message privacy protection, and computational and communication overhead. It enables secure, efficient, and privacy-preserving collaborative signatures under quantum computing threats, thus improving the security of collaborative signatures.

[0017] Optionally, after generating a second commitment value and a second hash value based on a second random array, the second commitment value and the second hash value are sent to the client, and the client sends a first commitment value and a first hash value to verify the first commitment value using the first hash value, including: Generate a second random array within a preset random number range; Perform high-order bit calculations on the second random array to obtain the second commitment value and the second hash value; After the client generates a first random array within a preset random number range to calculate the first commitment value and the first hash value, the system sends the second commitment value and the second hash value to the client, and receives the first commitment value and the first hash value sent by the client. The first hash value is used to verify the first commitment value to ensure the correctness of the first commitment value and the first hash value.

[0018] Optionally, based on the blinded challenge value sent by the client and combined with the second private key component corresponding to the second public key parameter, a second signature component is calculated, including: The initial second signature component is calculated based on the blinded challenge value sent by the client and the second public key parameter; Determine whether the initial second signature component satisfies the preset second norm check condition; if yes, determine the initial second signature component as the second signature component; if no, regenerate another random array within the preset random number range as the second random array, and return to the step of generating the second commitment value and the second hash value based on the second random array.

[0019] The two-party collaborative quantum signature method for supporting blind signatures provided in this application can realize blind signatures between the server and the client. Through the norm checking mechanism, the validity of the signature component generated by the server is ensured, and retry is performed when the conditions are not met, thereby improving the reliability of the signature process.

[0020] Beneficial effects: The two-party collaborative quantum signature method supporting blind signature provided in this application performs collaborative signature based on a homomorphic commitment value generated by the first commitment value and first hash value of the client and the second commitment value and second hash value of the server, and calculates the target blind signature value. This solves the problems of existing anti-quantum collaborative signature methods in terms of anti-quantum security, message privacy protection, and computation and communication overhead. It can provide secure, efficient, and privacy-preserving collaborative signatures under the threat of quantum computing, thus improving the security of collaborative signatures. Attached Figure Description

[0021] Figure 1This is a flowchart illustrating a two-party collaborative quantum signature method supporting blind signatures, provided as an embodiment of this application.

[0022] Figure 2 A flowchart of another two-party collaborative post-quantum signature method supporting blind signatures provided in an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0024] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0025] Please refer to Figure 1 , Figure 1 This application provides a two-party collaborative quantum signature method supporting blind signatures, applied to a client to achieve blind signatures with a server, comprising: Step S1: Obtain the first public key parameter of the client itself, and obtain the high-order part of the public key component jointly generated with the server; Step S2: After generating a first commitment value and a first hash value based on the first random array, receive a second commitment value and a second hash value sent by the server, and use the second hash value to verify the second commitment value; Step S3: Using the blinding factor and masking vector calculated based on the client's signature information, preset hash parameters and preset restart parameters, combined with the first commitment value, the second commitment value and the high-order part information, a blinding challenge is generated, and the blinded challenge value is calculated. Step S4: Calculate the first signature component based on the blinded challenge value and the first private key component corresponding to the first public key parameter; Step S5: Generate a target blind signature value based on the first signature component and the second signature component sent by the server.

[0026] The two-party collaborative quantum signature method supporting blind signature provided in this application performs collaborative signature based on a homomorphic commitment value generated by the first commitment value and first hash value of the client and the second commitment value and second hash value of the server, and calculates the target blind signature value. This method solves the problems of existing quantum-resistant collaborative signature methods in terms of quantum security, message privacy protection, and computation and communication overhead. It can provide secure, efficient, and privacy-preserving collaborative signatures under the threat of quantum computing, thus improving the security of collaborative signatures.

[0027] Specifically, in step S1, the client obtains its own first public key parameter and the high-order part of the public key component jointly generated with the server, including: Generate a first private key component within a preset random number range; Using a lattice-based cryptographic algorithm, generate the first public key parameter corresponding to the first private key component; Receive the second public key parameter sent by the server, and extract the high-order part information from the public key component generated by the first and second public key parameters.

[0028] It should be noted that the preset random number range can be set according to specific security requirements and cryptographic standards, such as by specifying the random number range according to lattice-based cryptographic algorithms. The purpose is to ensure that the generated private key strictly meets the specification requirements and avoids the risk of invalid or weak keys.

[0029] In step S1, the randomness and unpredictability of the private key are guaranteed by generating a first private key component (sk1_1, sk1_2) within a preset random number range. Utilizing the mathematical properties of lattice-based cryptographic algorithms, the first public key parameter t1 is securely derived from this first private key component, i.e., t1 = A·sk1_1 + sk1_2, ensuring the correspondence between the public and private keys and the cryptographic strength. The lattice-based cryptographic algorithm is existing technology and will not be described in detail here.

[0030] After generating the first public key parameter t1, it can be shared with the second public key parameter t2 generated by the server. From this, the public key component t is calculated, t = t1 + t2. The high-order part is extracted from the public key component t to obtain the high-order part information t. High In addition, information from the higher-order part t is also used. High Together with a pre-defined public matrix A, a common public key pk is generated, where pk = (A, t) High And other common parameters are generated through the first public key parameter t1 and the second public key parameter t2, such as the hash parameter tr mentioned later.

[0031] In this process, the public matrix A is a pre-defined and publicly available mathematical matrix, typically constructed jointly by the two parties involved in the signature. For example, the client randomly selects matrix A1, calculates the hash value g1 = H1(A1), and sends it to the server, where H1 is the hash function. Similarly, the server selects matrix A2, calculates the hash value g2 = H2(A2), and sends it to the client. Then, the two parties exchange the original matrices; that is, the client sends matrix A1 to the server, and the server sends matrix A2 to the client. After the client verifies H2(A2) = g2 and the server verifies H1(A1) = g1, the process continues. ， The common matrix A is calculated to be A1 + A2.

[0032] Specifically, in step S2, after generating a first commitment value and a first hash value based on a first random array, the system receives a second commitment value and a second hash value sent by the server to verify the second commitment value using the second hash value, including: Generate a first random array within a preset random number range; Perform high-order bit calculations on the first random array to obtain the first commitment value and the first hash value; After the server generates a second random array within a preset random number range to calculate the second commitment value and the second hash value, it receives the second commitment value and the second hash value sent by the server. The second hash value is used to verify the second commitment value, ensuring the correctness of both the second commitment value and the second hash value.

[0033] In step S2, a first random array (y1, r1) is generated within a preset random number range to provide a basis for randomness in the client's commitment calculation and ensure the unpredictability of the commitment value.

[0034] Specifically, in step S2, the high-order bits of the first random array are calculated to obtain the first commitment value and the first hash value, including: The first intermediate value is calculated based on the first random array and the preset common matrix. Based on the first intermediate value, perform high-order calculations to obtain the first high-order value; Using the commitment function, the first commitment value is calculated based on the first random array and the first high-order value; A hash function is used to calculate the first hash value corresponding to the first commitment value.

[0035] In step S2, based on y1 in the first random array and the preset common matrix A, the first intermediate value w1 is calculated, where w1 = A * y1. Then, the high-order byte function HighBits is used to perform high-order byte calculations to obtain the first high-order byte value H. w1 H w1=HighBits(w1, 2γ'), where 2γ' is the number of dividing boundaries, and HighBits(w1, 2γ') represents extracting the numbers with absolute values ​​greater than 2γ' from the first intermediate value w1 as the high-order bits. This is done by combining r1 from the first random array with the first high-order bit value H. w1 Input is given to the commitment function Commit, and the first commitment value com1 is output, where com1 = Commit(H w1 The commitment function (r1) ensures the binding of the first random array to the commitment, meaning that once the commitment is generated, the original random array cannot be altered. A hash function H3 is used to calculate the first hash value h1 corresponding to the first commitment value com1, where h1 = H3(com1). The hash function provides an immutable digest of the first commitment value, further enhancing its integrity and verifiability. The commitment function and hash function are existing technologies and will not be detailed here.

[0036] Similarly, the server generates a second random array within a preset random number range to calculate the second commitment value com2 and the second hash value h2, and sends the second commitment value com2 and the second hash value h2 to the client. The client verifies the second commitment value com2 and the second hash value h2 using the hash function mentioned above. When the hash function is true (i.e., h2 = H3(com2)), the verification is successful, ensuring the correctness of the second commitment value and the second hash value.

[0037] In some optional embodiments, a multi-round commitment exchange protocol can be employed, enabling the client and server to generate multiple commitment values ​​(a first commitment value and a second commitment value) and a corresponding number of hash values ​​(a first hash value and a second hash value). These commitment values ​​are then sorted and numbered according to their generation order. After exchanging numbers and corresponding commitment values, each commitment value is verified to ensure successful verification before proceeding to the next step. Furthermore, if subsequent verification fails and the calculation of commitment values ​​is returned, the number of commitment values ​​can be reduced accordingly to simplify the process and save time.

[0038] Specifically, in step S3, using the blinding factor and masking vector calculated based on the client's signature information, preset hash parameters, and preset restart parameters, combined with the first commitment value, the second commitment value, and the high-order information, a blinding challenge is generated, and the blinded challenge value is calculated, including: Based on the client's pending signature information, preset hash parameters, and preset restart parameters, and combined with the anti-collision hash function, sparse binomial distribution sampling algorithm, and extended masking function, the initial digest, blinding factor, and masking vector are calculated respectively. Based on the blinding factor, masking vector, first commitment value and second commitment value, a blinding polynomial is constructed to calculate the homomorphic commitment value. The sparse binomial distribution sampling algorithm is used to calculate the homomorphic commitment value and the original challenge value corresponding to the initial summary; By using a blinding factor, the original challenge value is additively offset to calculate the blinded challenge value.

[0039] In step S3, using an anti-collision hash function, with the information to be signed and preset hash parameters as input, the initial digest μ is output, μ=CRH(tr||M), where CRH is the anti-collision hash function, tr is the preset hash parameter, M is the information to be signed, and || is the concatenation symbol, indicating that the data on both sides of the symbol are concatenated to form new data. Using a sparse binomial sampling algorithm, with the information to be signed and preset hash parameters as input, the blinding factor p is output, p =H0(M,tr)∈X=Bτ, where H0 is the sparse binomial sampling algorithm (in this polynomial, τ coefficients have values ​​of +1 or -1, and the remaining coefficients are set to 0), X is a preset random output domain; Bτ is a set representing a polynomial, where each polynomial satisfies the following: τ coefficients have values ​​of +1 or -1, and the remaining coefficients are set to 0; ∈ represents the symbol. Using another hash function or an expanded masking function, a random seed ρ' is constructed from the initial digest μ, where ρ'∈{0,1}384=CRH(K||μ), K is the system's common random seed with a length of 384 bits. The masking vector x is then calculated using the expanded masking function (ExpandMask function) with the random seed ρ' and the preset restart parameter i as input. , Let be a set of length vectors, where each element is a vector of length. The vectors are given, and the values ​​of the components in each vector are integers, with absolute values ​​not exceeding γ, where γ is the boundary parameter.

[0040] Based on the blinding factor, masking vector, first commitment value, and second commitment value, combined with the common matrix A, a blinding polynomial is constructed, and the homomorphic commitment value com is calculated: com = Ax + com1 + com2 + p·t High Where Ax = NTT -1 (Â⊙NTT(x)), t High The high-order part of the public key component t, t = t1 + t2, t High =t3·2 d t3 is the high-order coefficient, d is the critical scaling exponent, used to amplify the effect of the blinding factor; NTT is the number-theoretic transformation function, Â is the representation of the common matrix A after the number-theoretic transformation (NTT), and ⊙ is the efficient multiplication operation in the transformation domain.

[0041] Using the sparse binomial distribution sampling algorithm, the original challenge value c corresponding to the homomorphic commitment value and the initial summary is calculated, c=H0(μ||com)∈X=Bτ.

[0042] The blinding factor and the original challenge value are added together to calculate the blinded challenge value c. * c * =c+p.

[0043] Among them, the anti-collision hash function, sparse binomial distribution sampling algorithm, extended mask function and number theory transformation function are existing technologies, and will not be described in detail here.

[0044] In step S3, by generating a blinding factor p, the original challenge value c constructed from the original message digest μ and the homomorphic commitment value v1 is transformed to construct a blinded challenge c*=c+p. This makes it impossible for the server to obtain or recover the original message or the real challenge value c when participating in the signature calculation. It can effectively protect the privacy of the client without the need for a trusted third party, and realize true "two-party collaborative blind signature". This provides a feasible post-quantum security solution for application scenarios that require high privacy protection, such as anonymous voting and privacy payment.

[0045] Specifically, in step S4, the first signature component is calculated based on the blinded challenge value and the first private key component corresponding to the first public key parameter, including: The initial first signature component is calculated based on the blinded challenge value and the first private key component corresponding to the first public key parameter; Determine whether the initial first signature component meets the preset first norm check condition; if yes, then determine the initial first signature component as the first signature component; if no, then regenerate another random array within the preset random number range as the first random array, and return to step S2.

[0046] In step S4, based on the blinded challenge value and the first private key component corresponding to the first public key parameter, the initial first signature component z1 is calculated, z1 = y1 + c * ·sk1_1, sk1_1 is the first private key component corresponding to the first public key parameter t1.

[0047] After calculating the initial first signature component, its validity needs to be checked. This involves determining whether the initial first signature component satisfies the preset first norm check condition, i.e., whether ||z1||∞≥γ1–β holds true or whether ||c * ·t Low Is ||∞≥γ' true or certain?||LowBits(w1-c *Whether ·sk1_2,2γ')||∞≥γ'-β holds true, where ||·||∞ is the infinity norm function, representing the maximum value among the absolute values ​​of all coefficients in ·; ||z1||∞ is the infinity norm of the initial first signature component z1, i.e., taking the maximum value among the absolute values ​​of all coefficients in z1; γ1 is the preset first boundary parameter; and β is a small parameter related to security and error range. low Let be the low-order part of the public key component t; LowBits is the low-order byte function. If any one of these conditions is true, the initial first signature component is determined not to satisfy the preset first norm check condition. If none of the three conditions are true, the initial first signature component is determined to satisfy the preset first norm check condition. The infinite norm function and the low-order byte function are existing technologies and will not be described in detail here.

[0048] When the initial first signature component meets the preset first norm check condition, the initial first signature component is determined to be the first signature component.

[0049] If the initial first signature component does not meet the preset first norm check condition, another random array is regenerated within the preset random number range as the first random array, and the process returns to step S2 to make the recalculated initial first signature component meet the preset first norm check condition.

[0050] Specifically, in step S5, a target blind signature value is generated based on the first signature component and the second signature component sent by the server, including: The second commitment value is verified based on the second signature component and the second random array sent by the server. After successful verification, the initial blind signature value is calculated based on the first signature component and the second signature component. The hint vector is calculated based on the initial blind signature value, the first public key parameter, and the second public key parameter sent by the server; After deblinding the initial blind signature value, a target blind signature value is generated that corresponds to the hint vector, the original challenge value, and the deblinded initial blind signature value.

[0051] In step S5, after receiving the second signature component and the second random array sent by the server, the client uses the second signature component and the second random array (y2, r2) used by the server when generating the second commitment value to verify the second commitment value. First, H is calculated. w2 =HighBits(Az2-ct2,2γ'), where H w2 z2 is the second most significant bit, z2 is the second signature component, t2 is the second public key parameter, and the commitment Open(com2;H) is opened. w2`r2` is a second random array. When the `Open` function successfully opens the commitment, the verification is considered successful. This verification process aims to confirm the consistency between the second signature component provided by the server and the previously negotiated second commitment value, ensuring that the server has not maliciously tampered with or improperly manipulated the signature during the signing process.

[0052] Once the above verification process is successful, the client will calculate an initial blind signature value z based on the first signature component z1 calculated by itself and the second signature component z2 received from the server, z = z1 + z2. This initial blind signature value is an intermediate form of the final target blind signature value, combining the core elements of two-party collaborative signing.

[0053] Receive the second public key parameter sent by the server, and calculate the hint vector h based on the initial blind signature value, the first public key parameter, and the second public key parameter sent by the server, where h=v H -v H’ v H =HighBits(Az-ct,4γ'), v H’ =Ax+H w1 +H w2 +p*t High mod (q-1) / 2γ'; where v H As the first cue component, v H’ For the second hint component, t = t1 + t2, where t1 is the first public key parameter and t2 is the second public key parameter; H w1 H is the first highest bit value. w2 H is the second highest value. w2 =HighBits(w2, 2γ'), where w2 is the second intermediate value, w2=A*y2, y2 is the second random array, and q is the prime modulus.

[0054] After deblinding the initial blind signature value, the deblinded initial blind signature value z is obtained. * , z * =z+x, by combining the cue vector, the original challenge value calculated during the blinding challenge generation stage, and the initial blind signature value after deblinding calculated above, the final target blind signature value σ=(z) is generated. * (c,h). The target blind signature value is the signature result that the client expects to obtain, which can be verified by a third party but retains the blindness of the original message.

[0055] In an optional embodiment, before calculating the hint vector h, it is necessary to verify the initial blind signature value and determine whether ||LowBits(Az-ct,4γ')||∞≥2(γ'-β') or ||z *The statement checks if ||∞<2γ-2β+γ holds true, where γ is another boundary number and β' is another small parameter related to safety and error range. If neither of these conditions is met, the verification is considered successful.

[0056] As shown above, this two-party collaborative quantum signature method supporting blind signatures uses a blind signature approach. Based on a homomorphic commitment value generated by the first commitment value and first hash value of the client and the second commitment value and second hash value of the server, a collaborative signature is performed to calculate the target blind signature value. This solves the shortcomings of existing quantum-resistant collaborative signature methods in terms of quantum security, message privacy protection, and computational and communication overhead. It enables secure, efficient, and privacy-preserving collaborative signatures under quantum computing threats, thus improving the security of collaborative signatures.

[0057] Please refer to Figure 2 , Figure 2 Another two-party collaborative quantum signature method supporting blind signatures, provided in this application embodiment, is applied to a client to achieve blind signatures with a server, including: Step A1: Obtain the second public key parameter of your own server; Step A2: After generating the second commitment value and the second hash value based on the second random array, send the second commitment value and the second hash value to the client, and receive the first commitment value and the first hash value sent by the client, so as to verify the first commitment value through the first hash value; Step A3: Calculate the second signature component based on the blinded challenge value sent by the client and the second private key component corresponding to the second public key parameter. Step A4: Based on the first signature component and the first random array sent by the client, while verifying the first commitment value, the second signature component is sent to the client so that after the client successfully verifies the second signature component and the second random array, it generates the target blind signature value based on the second signature component.

[0058] This two-party collaborative quantum signature method, which supports blind signatures, generates a second signature component through a blinded challenge value, enabling the client to generate a target blind signature value based on the second signature component. This method provides secure, efficient, and privacy-preserving collaborative signatures even under quantum computing threats, thus improving the security of collaborative signatures.

[0059] Specifically, in step A1, similar to step S1, a second private key component (sk2_1, sk2_2) is generated within a preset random number range. Then, using the mathematical properties of lattice-based cryptographic algorithms, the second public key parameter t2 is securely derived from the second private key component, i.e., t2 = A * sk2_1 + sk2_2, thus ensuring the correspondence between the public and private keys and the cryptographic strength.

[0060] Specifically, in step A2, after generating the second commitment value and the second hash value based on the second random array, the second commitment value and the second hash value are sent to the client, and the first commitment value and the first hash value sent by the client are received to verify the first commitment value through the first hash value, including: Generate a second random array within a preset random number range; Perform high-order bit calculations on the second random array to obtain the second commitment value and the second hash value; After the client generates a first random array within a preset random number range to calculate the first commitment value and the first hash value, it sends the second commitment value and the second hash value to the client, and receives the first commitment value and the first hash value sent by the client. The first hash value is used to verify the first commitment value to ensure the correctness of both the first commitment value and the first hash value.

[0061] In step A2, a second random array (y2, r2) is generated within a preset random number range to provide a basis for randomness in the client's commitment calculation and ensure the unpredictability of the commitment value.

[0062] Similar to step S2, the second intermediate value w2 is calculated based on y2 in the second random array and the preset common matrix A, where w2 = A * y2. The high-bit value H is then calculated using the high-bit byte function HighBits. w2 H w2 =HighBits(w2, 2γ'), where 2γ' is the number of dividing boundaries, and HighBits(w2, 2γ') means extracting the numbers whose absolute value is greater than 2γ' from the first intermediate value w2 as the high-order bits. Input r2 and the second high-order bit value from the second random array into H. w2 The commit function `Commit` outputs the first commit value `com2`, where `com2 = Commit(H)`. w2 The commitment function (r2) ensures the binding of the second random array, meaning that once the commitment is generated, the original random array cannot be changed. A hash function H3 is used to calculate the second hash value h2 corresponding to the second commitment value com2, h2 = H3(com2). The hash function provides an immutable digest of the second commitment value, further enhancing its integrity and verifiability. The commitment function and hash function are existing technologies and will not be detailed here.

[0063] After the client calculates the first commitment value com1 and the first hash value h1, it sends the second commitment value com2 and the second hash value h2 to the client and receives the first commitment value com1 and the first hash value h1 from the client. It then verifies the first commitment value com1 and the first hash value h1 using the hash function mentioned above. If the hash function is true (i.e., h1 = H3(com1)), the verification is successful.

[0064] Specifically, in step A3, based on the blinded challenge value sent by the client and combined with the second private key component corresponding to the second public key parameter, the second signature component is calculated, including: The initial second signature component is calculated based on the blinded challenge value and the second public key parameter sent by the client; Determine whether the initial second signature component satisfies the preset second norm check condition; if yes, then determine the initial second signature component as the second signature component; if no, then regenerate another random array within the preset random number range as the second random array, and return to execute the step of generating the second commitment value and the second hash value based on the second random array.

[0065] In step A3, based on the blinded challenge value and the second private key component corresponding to the second public key parameter, the initial second signature component z2 is calculated, z2 = y2 + c. * ·sk2_1, where sk2_1 is the first private key component corresponding to the second public key parameter t1.

[0066] After calculating the initial second signature component, its validity needs to be checked. This involves determining whether the initial second signature component satisfies the preset first norm check condition, i.e., whether ||z2||∞≥γ1–β holds true or whether ||LowBits(w2-c * The condition is determined as follows: ·sk2_2,2γ')||∞≥γ'-β is true or false. Here, ||·||∞ is the infinite norm function, representing the maximum value among the absolute values ​​of all coefficients in ·, and ||z2||∞ is the infinite norm of the initial second signature component z2, which is the maximum value among the absolute values ​​of all coefficients in z2. If either condition is true, the initial second signature component does not satisfy the preset second norm check condition. If neither condition is true, the initial second signature component satisfies the preset second norm check condition.

[0067] When the initial second signature component meets the preset second norm check condition, the initial second signature component is determined to be the second signature component.

[0068] If the initial second signature component does not meet the preset first norm check condition, then two other random arrays are regenerated within the preset random number range as the second random array, and the process returns to step S2 to make the recalculated initial second signature component meet the preset second norm check condition.

[0069] Specifically, in step A4, after receiving the second signature component sent by the client, the legal department will use the first signature component and the first random array (y1, r1) used by the server when generating the first commitment value to verify the first commitment value, first calculating H. w1 =HighBits(Az1-ct1,2γ'), where H w1 z1 is the first high-order bit value, z1 is the first signature component, t1 is the first public key parameter, and the commitment Open(com1;H) is opened. w1 `;r1)`, where `Open` is the open function and `r1` is the first random array. Verification is considered successful when the `Open` function successfully opens the commitment. This verification process aims to confirm the consistency between the first signature component provided by the client and the previously negotiated first commitment value, ensuring that the client has not maliciously tampered with or improperly manipulated the signature during the signing process.

[0070] Simultaneously, the second signature component z2 is sent to the client, so that after successfully verifying the second signature component z2 and the second random array (y2, r2), the client generates the target blind signature value σ=(z2, r2) based on the second signature component z2. * , c, h).

[0071] In an optional embodiment, when generating the target blind signature value σ=(z) * After (c,h), any verifier uses the public key (t1 and t2), message M, and received signature σ=(z) * (c,h), execute the standard verification algorithm. The verification process will check z. * The norm of the signature is determined, and the commitment is reconstructed using the hint vector h, ultimately verifying the correctness of the challenge c. If all checks pass, the signature is valid. The verification algorithm is as follows, verifying that the signature components satisfy ||z||. * ||∞<2γ-2β+γ, to ensure numerical validity; use the common public key pk=(A,t) High ) and initial summary μ, t High =t3*2 d The commitment key c=H is calculated using a hash function. ck (μ, pk); Calculate the intermediate value v = Az - ct, and extract the high-order bits: v H =HighBits(v, 4γ'), calculates the temporary value: v H’ =v H-hmod (q-1) / 2γ'; Generate commitment: com=Commit(v H’ Commit is a cryptographic commitment, r = r1 + r2, and verifies hash consistency: c = H0(μ,com). The cryptographic commitment is existing technology and will not be detailed here.

[0072] As can be seen from the above, the two-party collaborative quantum signature method that supports blind signatures generates a second signature component through a blinded challenge value, enabling the client to generate a target blind signature value based on the second signature component. This solves the shortcomings of existing quantum-resistant collaborative signature methods in terms of quantum security, message privacy protection, and computational and communication overhead. It enables secure, efficient, and privacy-preserving collaborative signatures under quantum computing threats, thus improving the security of collaborative signatures.

[0073] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0074] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0075] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0076] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0077] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A two-party collaborative quantum signature method supporting blind signatures, characterized in that, Applied to the client side to enable blind signatures with the server, including: S1, obtain the first public key parameter of its own client, and obtain the high-order part of the public key component jointly generated with the server; S2, after generating a first commitment value and a first hash value based on a first random array, receive a second commitment value and a second hash value sent by the server, and use the second hash value to verify the second commitment value; S3, using the blinding factor and masking vector calculated based on the client's signature information, preset hash parameters and preset restart parameters, combined with the first commitment value, the second commitment value and the high-order part information, a blinding challenge is generated, and the blinded challenge value is calculated; S4. Calculate the first signature component based on the blinded challenge value and the first private key component corresponding to the first public key parameter. S5, Based on the first signature component and the second signature component sent by the server, generate a target blind signature value.

2. The two-party collaborative quantum signature method supporting blind signatures according to claim 1, characterized in that, Obtain the first public key parameter of the client itself, and obtain the high-order part of the public key component jointly generated with the server, including: Generate a first private key component within a preset random number range; Using a lattice-based cryptographic algorithm, generate the first public key parameter corresponding to the first private key component; The system receives the second public key parameter sent by the server and extracts the high-order part information from the public key component generated by the first public key parameter and the second public key parameter.

3. The two-party collaborative quantum signature method supporting blind signatures according to claim 2, characterized in that, After generating a first commitment value and a first hash value based on a first random array, the system receives a second commitment value and a second hash value sent by the server, and verifies the second commitment value using the second hash value, including: Generate a first random array within a preset random number range; Perform high-order bit calculations on the first random array to obtain the first commitment value and the first hash value; After the server generates a second random array within a preset random number range to calculate the second commitment value and the second hash value, the server receives the second commitment value and the second hash value sent by the server. The second hash value is used to verify the second commitment value to ensure the correctness of both the second commitment value and the second hash value.

4. The two-party collaborative quantum signature method supporting blind signatures according to claim 3, characterized in that, Perform high-order bit calculations on the first random array to obtain the first commitment value and the first hash value, including: Based on the first random array and combined with a preset common matrix, the first intermediate value is calculated; Based on the first intermediate value, high-order calculation is performed to obtain the first high-order value; Using the commitment function, the first commitment value is calculated based on the first random array and the first high-order value; A hash function is used to calculate the first hash value corresponding to the first commitment value.

5. The two-party collaborative quantum signature method supporting blind signatures according to claim 4, characterized in that, Using the client-side signature information, preset hash parameters, and preset restart parameters to calculate the blinding factor and masking vector, combined with the first commitment value, the second commitment value, and the high-order information, a blinding challenge is generated, and the blinded challenge value is calculated, including: Based on the client's pending signature information, preset hash parameters, and preset restart parameters, and combined with the anti-collision hash function, sparse binomial distribution sampling algorithm, and extended masking function, the initial digest, blinding factor, and masking vector are calculated respectively. Based on the blinding factor, the masking vector, the first commitment value, and the second commitment value, a blinding polynomial is constructed to calculate the homomorphic commitment value. The sparse binomial distribution sampling algorithm is used to calculate the original challenge value corresponding to the first commitment value, the second commitment value, and the initial summary; Using the blinding factor, the original challenge value is subjected to additive offset processing to calculate the blinded challenge value.

6. The two-party collaborative quantum signature method supporting blind signatures according to claim 5, characterized in that, Based on the blinded challenge value and the first private key component corresponding to the first public key parameter, the first signature component is calculated, including: The initial first signature component is calculated based on the blinded challenge value and the first private key component corresponding to the first public key parameter; Determine whether the initial first signature component satisfies the preset first norm check condition; if yes, then determine the initial first signature component as the first signature component; if no, then regenerate another random array within the preset random number range as the first random array, and return to step S2.

7. The two-party collaborative quantum signature method supporting blind signatures according to claim 6, characterized in that, Based on the first signature component and the second signature component sent by the server, a target blind signature value is generated, including: The second commitment value is verified based on the second signature component and the second random array sent by the server. After successful verification, the initial blind signature value is calculated based on the first signature component and the second signature component; The hint vector is calculated based on the initial blind signature value, the first public key parameter, and the second public key parameter sent by the server. After deblinding the initial blind signature value, a target blind signature value corresponding to the hint vector, the original challenge value, and the deblinded initial blind signature value is generated.

8. A two-party collaborative quantum signature method supporting blind signatures, characterized in that, Applied to the server side, to achieve blind signatures with the client using the two-party collaborative post-quantum signature method supporting blind signatures as described in claim 7, comprising: Obtain the second public key parameter of its own server; After generating a second commitment value and a second hash value based on a second random array, the second commitment value and the second hash value are sent to the client, and the first commitment value and the first hash value sent by the client are received, so as to verify the first commitment value through the first hash value; The second signature component is calculated based on the blinded challenge value sent by the client and the second private key component corresponding to the second public key parameter. Based on the first signature component and the first random array sent by the client, while verifying the first commitment value, the second signature component is sent to the client, so that after the client successfully verifies the second signature component and the second random array, it generates a target blind signature value based on the second signature component.

9. The two-party collaborative quantum signature method supporting blind signatures according to claim 8, characterized in that, After generating a second commitment value and a second hash value based on a second random array, the second commitment value and the second hash value are sent to the client, and the client sends a first commitment value and a first hash value to verify the first commitment value using the first hash value, including: Generate a second random array within a preset random number range; Perform high-order bit calculations on the second random array to obtain the second commitment value and the second hash value; After the client generates a first random array within a preset random number range to calculate the first commitment value and the first hash value, the system sends the second commitment value and the second hash value to the client, and receives the first commitment value and the first hash value sent by the client. The first hash value is used to verify the first commitment value to ensure the correctness of the first commitment value and the first hash value.

10. The two-party collaborative post-quantum signature method supporting blind signatures according to claim 8, characterized in that, Based on the blinded challenge value sent by the client, and combined with the second private key component corresponding to the second public key parameter, the second signature component is calculated, including: The initial second signature component is calculated based on the blinded challenge value sent by the client and the second public key parameter; Determine whether the initial second signature component satisfies the preset second norm check condition; if yes, determine the initial second signature component as the second signature component; if no, regenerate another random array within the preset random number range as the second random array, and return to the step of generating the second commitment value and the second hash value based on the second random array.

Images