Quantum digital signature method and system for multi-receiver verification arbitration

Abstract

The invention discloses a quantum digital signature method and system for multi-receiver verification arbitration, and relates to the technical field of quantum digital signatures, secret key consumption is reduced from O (k2) magnitude to O (k) magnitude through a secret key synthesis technology, and under the same security parameter and message length, the secret key consumption of the scheme of the invention is reduced by at least two orders of magnitude compared with the existing scheme; based on the information theory security of the quantum key and the unconditional security of one-time hash / encryption, the scheme of the invention can effectively resist forgery attack and denial attack, and the security is strictly proved; the multiple receivers can interact with the arbiter at the same time and complete verification independently, the whole signature verification time of the system is greatly shortened, and the method is particularly suitable for large-scale quantum network application.

Description

Technical Field

[0001] This invention relates to the field of quantum digital signature technology, specifically a quantum digital signature method and system based on an arbitrator mechanism that supports multi-party parallel verification. Background Technology

[0002] Quantum digital signatures (QDS) utilize quantum mechanical principles (such as the no-cloning theorem) to provide information-theoretically secure authentication, unforgeability, and non-repudiation for digital messages. Early QDS schemes were limited to signing single-bit messages or only applicable to three-party scenarios (one signer and two receivers).

[0003] In recent years, QDS schemes for multiple receivers have emerged. Current schemes are based on universal hashing, and while they offer optimizations in key and signature lengths compared to earlier schemes, they still fundamentally rely on the sequential transmission and verification of signatures among receivers to ensure security. This serial verification mode directly leads to a bottleneck in verification efficiency. More importantly, to guarantee a certain level of transferability, the signer needs to pre-allocate a large number of security keys (on the order of k) with each receiver. 2 ξ, where k is the number of receivers and ξ is a security parameter), makes key management extremely cumbersome and greatly limits the applicability of the scheme when there are a large number of receivers.

[0004] Another approach is to introduce an arbitrator. Some existing arbitrated QDS schemes mainly focus on how to sign quantum messages (composed of quantum states), which is still theoretically controversial and far from practical application.

[0005] In summary, existing technologies lack a multi-receiver quantum digital signature scheme that can simultaneously satisfy low key consumption, high verification efficiency, and compatibility with existing QKD networks. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a quantum digital signature method and system with multi-recipient verification and arbitration. Its core idea lies in introducing a fixed and trusted arbitrator and cleverly combining One-Time Universal Hash (OTUH) and One-Time Codebook (OTP) encryption technologies to construct a framework that allows all recipients to verify the same signature in parallel. This reduces key consumption by two orders of magnitude while ensuring information security (possessing unforgeability and non-repudiation).

[0007] This invention protects a quantum digital signature method with multi-receiver verification and arbitration, wherein the signer U S Arbitrator U a and k receivers U i (i = 0,1,2…k) participate, including at least the distribution phase and the message phase.

[0008] Distribution phase:

[0009] Signer U S With each receiver U i The QKD protocol uses a security key Ksi = (Xi, Yi), where Xi is used for subsequent encryption operations and Yi is used to generate a hash function.

[0010] Signer U S With arbitrator U a The QKD protocol uses a security key Ksa = (Xa, Ya), where Xa is used for subsequent encryption operations and Ya is used to generate a hash function.

[0011] Signer U S Calculate the synthetic encryption key used for the entire signing process locally. and synthesized signature key .

[0012] The message phase includes signer U S The first sub-stage of signature generation during execution, receiver U i With arbitrator U a The second sub-phase of collaborative execution involves recipient verification, and arbitrator U... a The arbitrator who executes the judgment verifies the third sub-phase.

[0013] As an embodiment of the present invention, the first sub-stage includes:

[0014] Signer U S Using the synthetic signature key Ys as the initial vector, a hash function H is generated, and the hash value T = H×M of message M is calculated, where the hash function satisfies the collision probability. m is the length of the message, and n is the length of the hash value;

[0015] Signer U S Generate a quantum random number Rs and concatenate it with the hash value T to form a digest D = T∥Rs;

[0016] Signer U S The digest D is encrypted once using the synthesized encryption key Xs, generating the signature S = Xs. D; Signer U S Send message M and signature S to all receivers U via a classic broadcast channel. i .

[0017] As an embodiment of the present invention, the second sub-stage includes:

[0018] Each receiver U iUpon receiving message M and signature S, it forwards them, along with its own security key Ksi, to arbitrator U via the authentication channel within a pre-defined timeframe. a ;

[0019] Arbitrator U a After collecting all timely forwarded requests, calculate the verification key. , and will , Send to the corresponding recipient U i ;

[0020] Receiver U i use Decrypt the signature to obtain the expected hash value T. i and random number R i ; Receiver U i use As the initial vector, a hash function is generated. Then calculate the hash value of message M. ×M, and the hash value T obtained from decryption. i Compare, if ×M T i If the value is 0, the signature is accepted; otherwise, it is rejected.

[0021] The hash function here also satisfies the collision probability. m is the length of the message, and n is the length of the hash value.

[0022] As an embodiment of the present invention, the third sub-stage includes: Arbitrator U a Perform secondary verification using the verification key. , For each receiver U i Message M sent i and signature S i Conduct with receiver U i The same decryption and hash calculation process is followed, and if the verification passes, the arbitrator confirms that the signature is valid for the recipient.

[0023] As an embodiment of the present invention, when receiver U i Recipient U who failed to participate in verification within the specified time, or who has already received the signature. i When you want to forward the signature to a third party, it will enter the timeout verification and forwarding stage.

[0024] For recipients who have exceeded the timeout period, after completing the signing for the current round, they should submit their signatures to the arbitrator U. a Submit (M) i ,S i ,Xi, Yi), arbiter Ua The key set is checked and the message M and signature S are compared to those that have been successfully verified, thus directly providing the verification result.

[0025] For the signature forwarding requirement, the recipient U who has already received the signature... i (M) i ,S i Forwarded to any third party, which then submits the information to the arbitrator U. a A verification request is sent, and the arbitrator provides a reliable verification result based on the stored global information, thereby achieving the transferability of the signature.

[0026] The present invention also protects a quantum digital signature system with multi-recipient verification and arbitration, comprising a signer node, an arbitrator node and multiple receiver nodes, wherein the nodes are connected through a quantum channel and a classical authentication channel, and are configured to perform the steps of the above-described quantum digital signature method with multi-recipient verification and arbitration.

[0027] The present invention also protects a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described quantum digital signature method for multi-receiver verification arbitration.

[0028] The beneficial effects of this invention are:

[0029] 1. Extremely low key consumption: Through key synthesis technology, the key consumption is reduced from O(k... 2 The key consumption of the present invention is reduced to the O(k) level. Under the same security parameters and message length, the key consumption of the present invention is reduced by at least two orders of magnitude compared with the existing scheme.

[0030] 2. Highly efficient parallel verification: Multiple receivers can interact with the arbitrator simultaneously and complete verification independently, which greatly shortens the overall signature verification time of the system and is particularly suitable for large-scale quantum network applications;

[0031] 3. Strong security: Based on the information-theoretic security of quantum key distribution and the unconditional security of one-time hashing / encryption, the present invention can effectively resist forgery attacks and repudiation attacks, and its security has been rigorously proven.

[0032] 4. High practicality and compatibility: The present invention is based entirely on classical computing and communication (except for the QKD stage), and can work with any type of existing QKD protocol (such as BB84, BBM92), and is easy to integrate into deployed quantum networks. Attached Figure Description

[0033] Figure 1 This is a flowchart illustrating the process from signature generation to multi-party verification.

[0034] Figure 2A fully connected eight-user quantum entangled network;

[0035] Figure 3 This is a graph showing the relationship between security key consumption and message length. Detailed Implementation

[0036] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. The embodiments of the present invention are given for illustrative and descriptive purposes only, and are not intended to be exhaustive or to limit the invention to the forms disclosed. Many modifications and variations will be apparent to those skilled in the art. The embodiments were chosen and described to better illustrate the principles and practical application of the invention, and to enable those skilled in the art to understand the invention and design various embodiments with various modifications suitable for a particular purpose.

[0037] This invention provides a quantum digital signature method and system with multi-recipient verification and arbitration. Its core idea is to introduce a fixed and trusted arbitrator and cleverly combine one-time universal hash (OTUH) and one-time password book (OTP) encryption technology to build a framework that allows all recipients to verify the same signature in parallel. This reduces key consumption by two orders of magnitude while ensuring information security (possessing non-forgeability and non-repudiation).

[0038] Participants include:

[0039] Signer U S An entity that needs to sign the same message to multiple recipients.

[0040] Receiver U i (i = 0,1,2…k): k entities whose signatures need to be verified.

[0041] Arbitrator U a A fixed and trusted third party is responsible for assisting in verification and handling abnormal situations such as timeouts.

[0042] Premise:

[0043] All participants have pre-established a security key of sufficient length through a predetermined protocol.

[0044] There are classic authentication channels between the signer and the arbitrator, and between the arbitrator and each recipient.

[0045] The arbitrators are honest, but there may be dishonest individuals among the recipients.

[0046] Example 1

[0047] This embodiment discloses a quantum digital signature method with multi-receiver verification arbitration, which includes at least a distribution phase and a message phase.

[0048] I. Distribution Phase

[0049] Signer U S With each receiver U i The QKD protocol uses a 3n-bit security key Ksi = (Xi, Yi), where Xi is 2n bits used for subsequent encryption operations and Yi is n bits used to generate the hash function.

[0050] Signer U S With arbitrator U a The QKD protocol yields a 3n-bit security key Ksa = (Xa, Ya), where Xa is 2n bits used for subsequent encryption operations, and Ya is n bits used to generate the hash function.

[0051] Signer U S Calculate the synthetic encryption key used for the entire signing process locally. and synthesized signature key This step is crucial for reducing key consumption, as it condenses the association with k receivers into two master keys.

[0052] II. Message Phase (see...) Figure 1 )

[0053] The message phase includes signer U S The first sub-stage of signature generation during execution, receiver U i With arbitrator U a The second sub-phase of collaborative execution involves recipient verification, and arbitrator U... a The arbitrator who executes the judgment verifies the third sub-phase.

[0054] 1. First sub-phase

[0055] Signer U S Using the synthetic signature key Ys as the initial vector, an n×m hash function Hnm is generated, and the hash value T = Hnm×M of message M is calculated. Here, the chosen hash function should satisfy the collision probability... For example, the Toeplitz hash function of LFSR, the Universal2 hash function family, etc., where m is the length of the message and n is the length of the hash value.

[0056] Signer U S Generate an n-bit quantum random number Rs and treat it as an n-degree irreducible polynomial over a finite field GF(2). Concatenate the quantum random number Rs with the hash value T to form a digest D = T∥Rs.

[0057] Signer U SThe digest D is encrypted once using the synthesized encryption key Xs, generating the signature S = Xs. D; Signer U S Send message M and signature S to all receivers U via a classic broadcast channel. i .

[0058] 2. Second sub-stage

[0059] Each receiver U i Upon receiving message M and signature S, it forwards them, along with its own security key Ksi, to arbitrator U via the authentication channel within a pre-defined timeframe. a .

[0060] Arbitrator U a After collecting all timely forwarded requests, calculate the verification key. , and will , Send to the corresponding recipient U i .

[0061] Receiver U i use Decrypt the signature to obtain the expected hash value T. i and random number R i ; Receiver U i use As the initial vector, generate an n×m hash function. Then calculate the hash value of message M. ×M, and the hash value T obtained from decryption. i Compare, if ×M T i If the hash value is 0, the signature is accepted; otherwise, it is rejected. Here, the chosen hash function should also satisfy the collision probability. .

[0062] 3. Third sub-stage

[0063] Arbitrator U a Perform secondary verification using the verification key. , For each receiver U i Message M sent i and signature S i Conduct with receiver U i The same decryption and hash calculation process is followed, and if the verification passes, the arbitrator confirms that the signature is valid for the recipient.

[0064] III. Timeout Verification and Forwarding Phase

[0065] When the receiver U i Recipient U who failed to participate in verification within the specified time, or who has already received the signature. i When you want to forward the signature to a third party, it will enter the timeout verification and forwarding stage.

[0066] For recipients who have exceeded the timeout period, after completing the signing for the current round, they should submit their signatures to the arbitrator U. a Submission (S) i M i ,Xi, Yi), arbiter U a The key set is checked and the message M and signature S are compared to those that have been successfully verified, thus directly providing the verification result.

[0067] For the signature forwarding requirement, the recipient U who has already received the signature... i (S) i M i Forwarded to any third party, which then submits the information to the arbitrator U. a A verification request is sent, and the arbitrator provides a reliable verification result based on the stored global information, thereby achieving the transferability of the signature.

[0068] Figure 1 The three core participants (signer U) are clearly presented. S Receiver U i Arbitrator U a The interaction logic and data flow of the system embody the innovative architecture of "one-time signature, multi-party parallel verification".

[0069] The superiority of the quantum digital signature method with multi-receiver verification arbitration proposed in this embodiment is verified below.

[0070] Figure 2 It is a fully connected eight-user quantum entangled network, in which Alice is the signer (single control point), Ivan is the arbitrator (trusted third party), and Bob, Chloe, Dave, Feng, Gopi, and Heidi (6 verification nodes) are the receivers.

[0071] 1. Eight user signatures in a laboratory environment

[0072] Network settings:

[0073] (a) Physical layer topology: showing 8 users interconnected via fiber optic and wavelength channels;

[0074] (b) Communication layer topology: Showing the secure links formed between each of the eight users.

[0075] Parameters: Message length m = 1KB, security parameters .

[0076] Process and Results: After 18.45 hours of key distribution, a 6.81Mb security key was generated on the worst-case link (Alice-Ivan). Using the scheme of this invention, a total of 49,589 complete rounds of signature verification can be supported.

[0077] 2. Eight-user signature in a metropolitan area network environment

[0078] Network settings: Same as above, but based on actual urban fiber optic deployment.

[0079] Parameters: Message length m = 1KB, security parameters .

[0080] Process and Results: After 27 minutes of key distribution, a 901-bit security key was generated on the worst-case link (Alice-Ivan). Despite this, the proposed solution still successfully supported six rounds of signature verification, demonstrating its efficiency in key utilization in a real-world network environment.

[0081] 3. Comparison with existing representative multi-recipient QDS schemes

[0082] Existing representative multi-recipient QDS schemes used for comparison include:

[0083] Scheme A, a non-arbitrated multi-receiver QDS scheme based on universal hashing, Ryan Amiri, Aysajan Abidin, Petros Wallden, et al. Unconditionally Secure Signatures. Cryptology ePrintArchive, 739 (2016);

[0084] Scheme B, a demonstration of transferability-based multi-receiver QDS experiments, Yoann Pelet, Ittoop V. Puthoor, Natarajan Venkatachalam, et al. Unconditionally secure digital signatures implemented in an eight-user quantum network. New Journal of Physics 24, 093038 (2022);

[0085] Scheme C extends the three-party QDS scheme to a multi-receiver scheme with a fixed trusted party. Hua-Lei Yin, Yao Fu, Chen-Long Li, et al. Experimental quantum secure network with digital signatures and encryption. National Science Review 10(4), 228 (2023).

[0086] Parameters: Number of receivers k=7, message length m=8 bits, security parameters .

[0087] Results: As shown in Table 1, the proposed solution has an overwhelming advantage in key consumption.

[0088] Table 1

[0089] Serial Number plan Number of receivers (k) Message length (m) Total key consumption (K_total) 1 Option A 7 8 bits 21.888 kbits 2 Option B 7 8 bits 35.898 kbits 3 Option C 7 8 bits 1.596 kbits 4 The present invention solution (AQDS) 7 8 bits 0.912 kbits

[0090] Figure 3 The display shows different numbers of receivers k and security parameters. The curve below, showing the total key consumption as a function of message length, intuitively demonstrates that the solution of this invention has extremely low consumption.

[0091] Example 2

[0092] This embodiment discloses a quantum digital signature system with multi-receiver verification arbitration, comprising:

[0093] Signer node: It is equipped with a QKD transmitter, a classic communication module, a processing unit and a memory, and is used to perform key synthesis, hash calculation, encryption and signature broadcasting;

[0094] Arbitrator node: Equipped with a QKD receiver, authentication classic communication module, processing unit and memory, used to securely collect information, calculate and distribute verification keys, and perform secondary verification;

[0095] Multiple receiver nodes: Each node is configured with a QKD receiver, a classic communication module, a processing unit and a memory, used to request verification, decrypt the signature and complete the verification.

[0096] The nodes are connected via quantum channels (for QKD) and certified classical channels;

[0097] The system's processing unit is configured to run a computer program to collaboratively execute all steps of the quantum digital signature method for multi-receiver verification arbitration as described in Example 1.

[0098] Example 3

[0099] This embodiment discloses a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the quantum digital signature method for multi-receiver verification arbitration as described in Embodiment 1.

[0100] Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art and related fields based on the embodiments of the present invention without inventive effort should fall within the scope of protection of the present invention.

Claims

1. A quantum digital signature method of multi-recipient verification arbitration, participated by a signer U S , an arbitrator U a and k recipients U i , where i = 0, 1, 2…k, characterized in that, at least comprising a distribution phase and a message phase; the distribution phase: Signer U S With each receiver U i Secure key Ksi= (Xi, Yi) through QKD protocol, where Xi is used for subsequent encryption operation, and Yi is used for generating hash function; Signer U S With the arbitrator U a Secure key Ksa= (Xa, Ya) is generated through the QKD protocol, where Xa is used for subsequent encryption operations, and Ya is used for generating a hash function; Signer U S Computing a composite encryption key locally for the entire signing process and a composite signing key ; The message phase includes a signer U S The executed signature generates a first sub-phase, a receiver U i The executed signature generates a first sub-phase, a receiver U a The executed signature generates a first sub-phase, a receiver U a The executed signature generates a first sub-phase, a receiver U 2. The multi-recipient verification arbitrated quantum digital signature method of claim 1, wherein, the first sub-phase comprises: Signer U S A hash function H is generated with the synthetic signature key Ys as the initial vector, and the hash value T = H x M of the message M is calculated. Signer U S A quantum random number Rs is generated, and concatenated with the hash value T to form a digest D = T∥Rs; Signer U S The digest D is once-ciphertext encrypted using the synthetic encryption key Xs, generating the signature S = Xs D; Signer U S The message M and the signature S are sent to all receivers U over a classical broadcast channel i .

3. The multi-recipient verification arbitrated quantum digital signature method of claim 1, wherein, the second sub-phase comprises: Each receiver U i Upon receipt of the message M and the signature S, these are forwarded to the arbitrator U within a predetermined specified time, together with the own security key Ksi over an authenticated channel a ; Arbitrator U a After collecting all timely forwarded requests, calculate the verification key. , and will , Send to the corresponding recipient U i ; Receiver U i Using Decrypt the signature to get the expected hash value T i and random number R i ; Receiver U i Using As the initial vector, generate a hash function , and then calculate the hash value of the message M ×M, and compare it with the decrypted hash value T i , if ×M T i =0, receive the signature, otherwise refuse.

4. The multi-recipient verification arbitrated quantum digital signature method of claim 1, wherein, The third sub-phase comprises: the arbitrator U a carries out a second verification using the verification key , i for each receiver U i the message M i and signature S i are subjected to the same decryption and hash calculation process as the receiver U, and if the verification is successful, the arbitrator confirms that the signature for that receiver is valid.

5. The multi-recipient verification arbitrated quantum digital signature method of claim 1, wherein, When the receiver U i The receiver U who did not participate in the verification within the specified time, or who has received the signature i When the receiver U wishes to forward the signature to a third party, the timeout verification and forwarding phase is entered.

6. The multi-recipient verification arbitrated quantum digital signature method of claim 5, wherein, For the timeout receiver, after the current round signature is completed, the arbitrator U a Submit (M i ,S i Xi, Yi), the arbitrator U a Check the key set and compare the message M and the signature S with the successfully verified one, thereby directly giving the verification result.

7. The multi-recipient verification arbitrated quantum digital signature method of claim 5, wherein, For the signature forwarding requirement, the recipient U who has already received the signature... i (M) i ,S i Forwarded to any third party, which then submits the information to the arbitrator U. a A verification request is sent, and the arbitrator provides a reliable verification result based on the stored global information, thereby achieving the transferability of the signature.

8. The multi-recipient verification arbitrated quantum digital signature method of claim 1, wherein, A hash function satisfies a collision probability where m is the length of the message and n is the length of the hash value.

9. A multi-recipient verification arbitration quantum digital signature system, characterized by, The computer program is executed by a processor to implement the multi-recipient quantum digital signature method for verification and arbitration as claimed in any one of claims 1-8.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the multi-recipient quantum digital signature method for verification and arbitration as claimed in any one of claims 1-8.

Images