Digital signature method based on approximate trap door under on-lattice standard model

Abstract

The invention discloses a digital signature method based on an approximate trap door under an on-lattice standard model, and the method comprises the steps: generating a public parameter, a main public key and a main private key through a system parameter generation device according to a system safety parameter; generating a signature vector of the to-be-signed message through a signature generation device according to the main public key, the main private key and the to-be-signed message; verifying the validity of the signature through a signature verification device according to the main public key, the to-be-signed message and the signature vector; wherein in the signature generation process, an approximate trap door expansion generation device and an approximate trap door sampling device are adopted, and the approximate trap door sampling device is used for carrying out geometric compensation on distribution deviation caused by using an approximate trap door, so that output distribution of signature vectors and ideal spherical discrete Gaussian distribution are indistinguishable in statistics. According to the method, significant compression of the public key and the signature size is realized, and an efficient signature solution is provided for quantum cryptography.

Description

Technical Field

[0001] This invention belongs to the field of information security, and in particular relates to a digital signature method based on an approximate trapdoor under the lattice standard model. Background Technology

[0002] With the rapid development of quantum computing technology, traditional digital signature schemes based on large integer factorization and discrete logarithm problems (such as RSA, ElGamal, and ECDSA) face a severe threat of being cracked by polynomial-time algorithms. Lattice cryptography, as a core candidate scheme for quantum-resistant cryptography, has become a research focus in the post-quantum cryptography standardization process due to its strong security guarantee based on the worst-case difficulty problem on lattices and its rich algebraic structure. Digital signature systems typically consist of three core devices: parameter generation, signature generation, and signature verification. Their security depends on the design of the trapdoor function. In cryptographic proof systems, the Standard Model relies only on the mathematical difficulty assumption itself, while the random oracle model additionally assumes the ideal behavior of the hash function. Therefore, security proofs under the Standard Model have stronger practical significance. Existing lattice signature schemes under the Standard Model mainly employ exact trapdoor techniques, constructing signatures by precisely satisfying matrix equations. This results in the number of columns in the public key matrix being proportional to the logarithmic modulus, leading to large signature size, public / private key volume, and storage and transmission overhead. Recent research has attempted to introduce approximate trapdoor techniques to compress the parameter size, but this technique has only achieved security proofs under the random oracle model and has not yet been able to achieve provably secure constructions in the Standard Model.

[0003] While approximate trapdoor techniques offer a novel approach to reducing lattice signature size, their application under the standard model faces fundamental technical obstacles. First, the security of existing approximate trapdoor schemes under the random oracle model relies on the ideal assumption of the hash function, making direct transfer to the standard model impossible, which requires rigorous mathematical reduction proofs. Second, the dimensions of the master key, expansion matrix, and signature vector in exact trapdoor schemes are all related to the full bit length of the logarithmic modulus, leading to system parameter inflation. Achieving size reduction while maintaining security through approximation techniques remains a technical challenge. More critically, the inherent bias introduced by approximate trapdoors causes the signature distribution to exhibit a non-spherical skew: the directly output signature vector is confined to a low-dimensional subspace of the linear space, and the label matrix transformation and approximation error terms generate correlated distributions in the target space. A multinomial number of signature samples will reveal the geometry of the trapdoor matrix. Existing approximate trapdoor constructions under the standard model only compensate for perturbations in the signature space, neglecting collaborative compensation for the label matrix space and error space, resulting in a skewed output distribution. Ultimately, this exposes the signature algorithm to the risk of secret information leakage, rendering the security proof ineffective.

[0004] Therefore, how to construct a signature scheme based on an approximate trapdoor under the standard model, and how to correctly compensate for distribution deviations while compressing the size, so as to prevent the leakage of secret information, is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a digital signature method based on an approximate trapdoor under the lattice standard model, comprising:

[0006] Based on the system security parameters, public parameters, master public key, and master private key are generated through the system parameter generation device.

[0007] Based on the master public key, master private key, and message to be signed, a signature vector for the message to be signed is generated by a signature generation device.

[0008] The validity of the signature is verified by a signature verification device based on the master public key, the message to be signed, and the signature vector.

[0009] In the signature generation process, an approximate trapdoor expansion generation device and an approximate trapdoor sampling device are used. The approximate trapdoor sampling device performs geometric compensation for the distribution deviation caused by the use of the approximate trapdoor, so that the output distribution of the signature vector is statistically indistinguishable from the ideal spherical discrete Gaussian distribution.

[0010] Preferably, the system parameter generation device is used to perform the following operations:

[0011] Receive system security parameters as input;

[0012] Determine the system parameter set, which includes the modulus, lattice dimension, truncation parameter, and error distribution parameter;

[0013] Generate a master public key, which includes a master common matrix, an approximate component matrix, a set of expansion factor matrices, and a target vector;

[0014] Generate a master private key, which includes a master approximate trapdoor matrix;

[0015] Output the master public key, master private key, and system parameter set.

[0016] Preferably, the generation process of the master public key and master private key includes:

[0017] Using a labeled trapdoor generation device, a main common matrix and a main approximate trapdoor matrix are generated based on system security parameters, lattice dimension parameters, truncation parameters, and a label matrix.

[0018] An approximate component matrix and its explicit basis for the orthogonal complement lattice are generated using an approximate matrix generation device based on the lattice dimension parameter and the truncation parameter.

[0019] The main common matrix is ​​obtained by subtracting the main approximate trapdoor matrix from the product of the label matrix and the approximate component matrix, and satisfies an approximate equality relationship rather than an exact equality relationship.

[0020] Preferably, the truncation parameter is half the logarithmic modulus;

[0021] The number of columns in the main approximate trapdoor matrix is ​​half the number of columns in the exact trapdoor scheme;

[0022] The approximate component matrix is ​​obtained based on the difference between the number of columns in the master common matrix and the truncation parameter.

[0023] Preferably, the signature generation device is used to perform the following operations:

[0024] Receive the master public key, master private key, and message to be signed as input;

[0025] Calculate the expansion matrix based on the bit values ​​of the message to be signed;

[0026] The approximate trapdoor extension generation device generates an extended approximate trapdoor matrix based on the main common matrix, the main approximate trapdoor matrix, and the extension matrix.

[0027] The signature vector is generated using the approximate trapdoor sampling device based on the extended matrix, the extended approximate trapdoor matrix, and the target vector.

[0028] Preferably, the approximate trapdoor expansion generating device is used to perform the following operations:

[0029] It receives the main common matrix, the main approximation trapdoor matrix, the approximation component matrix, and the message to be signed as input;

[0030] Based on the binary form of the message to be signed, as well as the main common matrix and the expansion factor matrix, generate the extended common matrix;

[0031] For each column of the approximate component matrix, the approximate trapdoor sampling device is invoked to generate the corresponding column vector of the extended trapdoor;

[0032] The column vectors of the extended trapdoor are combined in sequence to obtain the extended trapdoor matrix corresponding to the extended matrix.

[0033] Preferably, when the approximate trapdoor sampling device is used to generate an extended approximate trapdoor, the following operations are performed:

[0034] It receives the main common matrix, the main approximation trapdoor matrix, the label matrix, the target vector, and the first Gaussian parameters as input;

[0035] In the linear space defined by the master common matrix, sampling is performed using a spherical discrete Gaussian distribution controlled by the first Gaussian parameter;

[0036] A short vector is generated as a column vector of the extended approximate trapdoor matrix, such that the product of the main common matrix and the short vector is approximately equal to the target vector, and the error does not exceed a first threshold value.

[0037] Preferably, when the approximate trapdoor sampling device is used to generate the signature vector, the following operations are performed:

[0038] It receives the extended matrix, the extended approximate trapdoor matrix, the label matrix, the target vector, and the second Gaussian parameters as input;

[0039] Sampling is performed in the linear space defined by the extended matrix using the second Gaussian parameter to control a spherical discrete Gaussian distribution.

[0040] A short vector is generated as the signature vector, such that the product of the extended matrix and the signature vector is approximately equal to the target vector, and the error does not exceed the second threshold value.

[0041] Preferably, the approximate trapdoor sampling device achieves the geometric compensation through the following three types of perturbations:

[0042] Generate the first perturbation vector to compensate for the distribution deviation of the short vector in the column space of the extended matrix;

[0043] A second perturbation vector is generated to compensate for the distribution deviation caused by the truncation of lower-order terms in the label matrix space due to the approximate component matrix.

[0044] A third perturbation vector is generated to compensate for the distribution deviation in the error space caused by the approximation deviation between the product of the master approximation trapdoor matrix and the approximation component matrix;

[0045] The first perturbation vector, the second perturbation vector, the third perturbation vector, and the linear transformation result are superimposed to obtain the final output vector.

[0046] Preferably, the approximate trapdoor sampling device merges the second perturbation vector and the third perturbation vector into a single perturbation vector, the merging operation including:

[0047] The sum of the label matrix and the approximate deviation is used as the merged perturbation matrix;

[0048] Calculate the combined covariance matrix based on the combined perturbation matrix;

[0049] Based on the merged covariance matrix, a single discrete Gaussian sampling is performed in the label matrix space to generate the single perturbation vector.

[0050] Compared with the prior art, the present invention has the following advantages and technical effects:

[0051] This invention addresses the technical problems of existing technologies, such as the inapplicability of approximate trapdoors to the standard model, excessively large signature sizes, and secret leakage due to skewed distribution, by constructing a digital signature scheme based on approximate trapdoors within the standard model. It reduces the number of columns in the master public key, expansion matrix, and signature vector to approximately half of their logarithmic modulus by employing a truncated approximation component matrix. Simultaneously, it uses an approximate trapdoor sampling device to perform cooperative geometric compensation on the signature space, tag matrix space, and error space, generating a signature output that is statistically indistinguishable from an ideal spherical discrete Gaussian distribution. Compared to exact trapdoor schemes, this invention reduces the master public key size, private key size, and signature length by approximately 50% while maintaining the provable security of the standard model. It eliminates the risk of secret information leakage caused by approximation bias, achieves efficient quantum-resistant signature deployment, and provides a compact and provably secure signature solution for post-quantum secure communication. Attached Figure Description

[0052] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0053] Figure 1 This is a schematic diagram of the method flow according to an embodiment of the present invention;

[0054] Figure 2 This is a system parameter generation device according to an embodiment of the present invention. Schematic diagram;

[0055] Figure 3 This is a tagged trapdoor according to an embodiment of the present invention. Generating device Schematic diagram;

[0056] Figure 4 The approximate matrix of this invention embodiment Generating device Schematic diagram;

[0057] Figure 5 The first signature generation device in this embodiment of the invention Schematic diagram;

[0058] Figure 6 Approximate trapdoor expansion generation device according to an embodiment of the present invention Schematic diagram;

[0059] Figure 7 An approximate trapdoor sampling device according to an embodiment of the present invention. Schematic diagram;

[0060] Figure 8 The signature verification device of this invention Schematic diagram;

[0061] Figure 9 An approximate trapdoor sampling device according to an embodiment of the present invention. Schematic diagram;

[0062] Figure 10 The second signature generation device in this embodiment of the invention Schematic diagram. Detailed Implementation

[0063] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0064] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0065] Definitions:

[0066] In cryptography, a "security model" defines the attacker's capabilities, available resources, and the underlying assumptions of a scheme's security. It serves as the "environmental framework" for measuring a scheme's security. Cryptographic security models fall into two categories: the "standard model" and the "random oracle model." Their technical characteristics and differences are as follows:

[0067] Differences in presuppositions:

[0068] (1) The standard model relies solely on the assumptions of mathematically difficult problems (such as the large integer factorization assumption, the discrete logarithm assumption, the LWE assumption on lattices, etc.).

[0069] (2) The underlying mathematical difficulties of the random oracle model + the "idealism" of the hash function (i.e., the random oracle hypothesis). Specifically, the idealism of the hash function is to regard the hash function (such as SHA-2, SHA-3) as an ideal "black box function" that satisfies two properties: first, for any new input, it returns a uniformly random output (the output distribution is independent of the input); second, for the same input, it always returns the same output (consistency).

[0070] Therefore, the random oracle model makes stronger assumptions than the standard model and is far removed from real-world usage environments; while the standard model does not depend on the behavior of any specific algorithm (such as a hash function).

[0071] Differences in security certification:

[0072] The core of cryptographic security proofs is "reduction": transforming the ability to "break a scheme" into the ability to "solve a mathematically difficult problem." The reduction logic of the two models differs significantly:

[0073] (1) In the standard model proof process, no ideal components (such as random oracles) are called, and the strict reduction of the reduction algorithm is directly constructed. That is, if the proof is "compact and without loopholes" - as long as the mathematical assumptions are true, the solution is definitely safe in reality (without additional risks).

[0074] (2) In the process of proving the random oracle model, the reduction algorithm needs a heuristic reduction that "simulates a random oracle". That is, the proof is "conditional" - it only guarantees "safety in the ideal scenario" and does not directly guarantee "safety in the real scenario".

[0075] The basic concepts and conclusions regarding lattices in this embodiment are as follows:

[0076] (1) Rank is of Vig yes Discrete additive subgroups in [the group]. Let [the group] be [the group]. Indicates that it is defined in The specifications are as follows A set of matrices.

[0077] (2) Given linearly independent basis vectors , by basis vectors The generated lattice is represented as Given , and a modulus For any matrix sum vector , The orthogonal complement lattice and its coset are represented as follows:

[0078]

[0079]

[0080] (3) (Gaussian distribution function) Given any parameters and For vector space The Gaussian distribution function on can be defined as: ;

[0081] (4) (Discrete Gaussian distribution on a lattice) Given any real number and ,for Vig The discrete Gaussian distribution function on can be defined as: .

[0082] (5) (Smoothing parameter) for any positive real number and Vig Smoothing parameters It makes The smallest positive real number that holds true ,here Representation The dual case.

[0083] (6) For any Vig ,set up yes A lattice basis. If a parameter exists. Then for any vector ,have: .

[0084] (7) (Approximate trapdoor) for (random) matrix Its - An approximate trapdoor is defined as: if there exists a trapdoor (with time complexity equal to...) (Related) Probabilistic polynomial-time algorithm Input a string ,matrix and arbitrary vectors It can output non-zero integer vectors. satisfy And there exists a vector satisfy They satisfy , then call It is a matrix of - Similar to a trapdoor.

[0085] (8) (Problem of learning with error) Given , Modulus Distribution of secret vector, common matrix and error vector , , .choose , , Calculate and output LWE samples .

[0086] Error-based learning decision problem This refers to distinguishing between the LWE samples generated above and those from the distribution. Random samples are not feasible.

[0087] The theorems and conclusions involved in this embodiment include:

[0088] (9) The security construction theorem for the master common matrix and the master approximate trapdoor;

[0089] (9-1) Approximate trapdoor generation device Return a pair of approximate proxy trapdoors ;

[0090] (9-2) Based on the above-generated , with any parameters and To obtain by approximate preimage sampling The four-tuples formed and the randomly generated four-tuples are statistically indistinguishable:

[0091] ;

[0092] .

[0093] (9-3) Furthermore, assuming The problem is difficult; in the second distribution mentioned above, the matrix... It is computationally indistinguishable from a random distribution.

[0094] (10) The security construction theorem for extended common matrices and extended approximate trapdoors;

[0095] (10-1) Approximate trapdoor expansion generation device return Corresponding approximate proxy trapdoor ;

[0096] (10-2) Based on the above-generated , with any parameters , as well as , (equivalent land) To obtain approximate preimage sampling The four-tuples formed and the randomly generated four-tuples are statistically indistinguishable:

[0097] ;

[0098] .

[0099] (10-3) Furthermore, assuming The problem is difficult; in the second distribution mentioned above, the matrix... It is computationally indistinguishable from a random distribution.

[0100] The symbols used in this embodiment are explained in Table 1:

[0101] Table 1

[0102] Represent real numbers, Represents an integer; Representing algebraic number fields The modulus used to define the lattice, its Number base expansion , right Rounding up results in an integer. For example... Modulus of Number of bits required for number system representation mold Integer ring Modulus of Vector representation in base: , From Before cutting It is obtained from a number of lower-order terms. The number of lower-order terms truncated. Approximate component (gadget) matrix, its size is , ; , The number of lower-order terms truncated; It is defined in Discrete Gaussian distribution on ,Require To meet certain size requirements, such that the master common matrix... The defined LWE problem is difficult to solve, at which point it is required that . Especially when ,express . :exist above Randomly select an element according to a discrete Gaussian distribution. ; From the distribution Randomly and independently selected element And form vectors in order. ; From the distribution Randomly and independently selected List And form a matrix in order. . matrix The maximum singular value, . Uppercase letters represent matrices; matrix specifications are clearly indicated in the patent. Representing vectors The vector dimension is clearly indicated in the patent. Representation Algorithm by Input is, output is The specific algorithm used depends on the patent context. It represents k vectors Zhang Cheng / Generated Linear Space A string, where each bit is denoted as String Size / bit length Length is 0-1 string vector L2 norm Representation matrix The normal form of the longest vector in the middle, i.e. Representation matrix Schmitt orthogonalization matrix This indicates that for any c > 0, it is O(nc). Overwhelming probability The probability is That is, it is almost certain to happen. Representation ,here vector Defined orthogonal complement Accompanying group ; , yes Any coset represents an element. There is a set of short bases: In particular, if Form, , . Representation The dual lattice is defined in the patent. grid The smoothing parameters are defined in the patent for general applications. , .that is, the grid The upper bound of the smoothness parameter is Defined in the patented original image sampling device In particular, when hour, . Gaussian function Defined as Discrete Gaussian distribution, defined as In the collection Above, with smoothing parameters ,according to Extracting a discrete Gaussian distribution to obtain a vector Threshold value in Example 1 ,satisfy ,and in For the signature vector, For the extended matrix, For Ge Pei Ji The representative element, also known as the "target vector", is... In Example 1: , . Threshold value in Example 2 : , ; .

[0103] like Figure 1 As shown, this embodiment provides a digital signature method based on an approximate trapdoor under the lattice standard model, including:

[0104] Based on the system security parameters, public parameters, master public key, and master private key are generated through the system parameter generation device.

[0105] Based on the master public key, master private key, and the message to be signed, a signature vector for the message to be signed is generated by a signature generation device.

[0106] The validity of the signature is verified by a signature verification device based on the master public key, the message to be signed, and the signature vector.

[0107] In the signature generation process, an approximate trapdoor expansion generation device and an approximate trapdoor sampling device are used. The approximate trapdoor sampling device performs geometric compensation for the distribution deviation caused by the use of the approximate trapdoor, so that the output distribution of the signature vector is statistically indistinguishable from the ideal spherical discrete Gaussian distribution.

[0108] Furthermore, the system parameter generation device is used to perform the following operations:

[0109] Receive system security parameters as input;

[0110] Determine the system parameter set, which includes the modulus, lattice dimension, truncation parameter, and error distribution parameter;

[0111] Generate a master public key, which includes a master common matrix, an approximate component matrix, a set of expansion factor matrices, and a target vector;

[0112] Generate the master private key, which includes the master approximate trapdoor matrix;

[0113] Output the master public key, master private key, and system parameter set.

[0114] Furthermore, the generation process of the master public key and master private key includes:

[0115] Using a labeled trapdoor generation device, a main common matrix and a main approximate trapdoor matrix are generated based on system security parameters, lattice dimension parameters, truncation parameters, and a label matrix.

[0116] An approximate component matrix and its explicit basis for the orthogonal complement lattice are generated using an approximate matrix generation device based on the lattice dimension parameter and the truncation parameter.

[0117] The master common matrix is ​​obtained by subtracting the master approximation trapdoor matrix from the product of the label matrix and the approximate component matrix, and satisfies an approximate equality relationship rather than an exact equality relationship.

[0118] Furthermore, the truncation parameter is set to half the logarithmic modulus;

[0119] The number of columns in the master approximation trapdoor matrix is ​​half the number of columns in the exact trapdoor scheme;

[0120] The approximate component matrix is ​​obtained based on the difference between the number of columns in the master common matrix and the truncation parameter.

[0121] Furthermore, the signature generation device is used to perform the following operations:

[0122] Receive the master public key, master private key, and the message to be signed as input;

[0123] Calculate the extended matrix based on the bit values ​​of the message to be signed;

[0124] An extended approximate trapdoor matrix is ​​generated using an approximate trapdoor extension generation device based on the main common matrix, the main approximate trapdoor matrix, and the extension matrix.

[0125] A signature vector is generated using an approximate trapdoor sampling device based on the extended matrix, the extended approximate trapdoor matrix, and the target vector.

[0126] Furthermore, the approximate trapdoor expansion generation apparatus is used to perform the following operations:

[0127] It receives the main common matrix, the main approximation trapdoor matrix, the approximation component matrix, and the message to be signed as input;

[0128] Based on the binary form of the message to be signed, as well as the main common matrix and the expansion factor matrix, generate the extended common matrix;

[0129] For each column of the approximate component matrix, the approximate trapdoor sampling device is invoked to generate the corresponding column vector of the extended trapdoor;

[0130] The column vectors of the extended trapdoor are combined in order to obtain the extended trapdoor matrix corresponding to the extended matrix.

[0131] Furthermore, when the approximate trapdoor sampling device is used to generate an extended approximate trapdoor, the following operations are performed:

[0132] It receives the main common matrix, the main approximation trapdoor matrix, the label matrix, the target vector, and the first Gaussian parameters as input;

[0133] In the linear space defined by the master common matrix, sampling is performed using a spherical discrete Gaussian distribution controlled by the first Gaussian parameter;

[0134] Generate short vectors as column vectors of the extended approximate trapdoor matrix, such that the product of the main common matrix and the short vectors is approximately equal to the target vector, and the error does not exceed the first threshold value.

[0135] Furthermore, when the approximate trapdoor sampling device is used to generate the signature vector, the following operations are performed:

[0136] It receives the extended matrix, the extended approximate trapdoor matrix, the label matrix, the target vector, and the second Gaussian parameters as input;

[0137] Sampling is performed in the linear space defined by the extended matrix using a spherical discrete Gaussian distribution controlled by the second Gaussian parameter.

[0138] Generate a short vector as the signature vector, such that the product of the extended matrix and the signature vector is approximately equal to the target vector, and the error does not exceed the second threshold value.

[0139] Furthermore, the approximate trapdoor sampling device achieves geometric compensation through the following three types of perturbations:

[0140] Generate the first perturbation vector to compensate for the distribution deviation of the short vector in the column space of the extended matrix;

[0141] A second perturbation vector is generated to compensate for the distribution deviation caused by the truncation of lower-order terms in the label matrix space due to the approximate component matrix.

[0142] A third perturbation vector is generated to compensate for the distribution deviation in the error space caused by the approximation deviation between the product of the master approximation trapdoor matrix and the approximation component matrix;

[0143] The first perturbation vector, the second perturbation vector, the third perturbation vector, and the linear transformation result are superimposed to obtain the final output vector.

[0144] Furthermore, the approximate trapdoor sampling device merges the second and third perturbation vectors into a single perturbation vector. The merging operation includes:

[0145] The sum of the label matrix and the approximate deviation matrix is ​​used as the merged perturbation matrix;

[0146] Calculate the combined covariance matrix based on the combined perturbation matrix;

[0147] A single discrete Gaussian sampling is performed in the label matrix space based on the merged covariance matrix to generate a single perturbation vector.

[0148] Example 1

[0149] As a preferred implementation, this embodiment provides a digital signature method based on an approximate trapdoor under the lattice standard model, specifically including:

[0150] I. System Parameter Generation Device The detailed description of the device is as follows: Figure 2 As shown:

[0151] 1. (Primary Unit) System Parameter Generation Device The detailed description is as follows:

[0152] enter:

[0153] : System security parameters; used to determine the system's security level, and to determine parameters such as the module. Grid Dimension The size of parameters;

[0154] Output:

[0155] Public Key ;

[0156] private key ;

[0157] System parameters ,in , ;

[0158] 2. (Secondary device) Trap door with label Generating device The specific description is as follows, and the detailed description of the device is as follows: Figure 3 As shown:

[0159] enter :

[0160] These are security parameters of the signature system; ; The number of lower-order terms truncated; ;

[0161] Tag matrix yes An invertible matrix on [the given surface].

[0162] Output:

[0163] matrix: , , , , ;

[0164] Master private key / master trapdoor matrix , ;

[0165] because ,so .

[0166] satisfy , ;

[0167] Maximum Singularity :

[0168]

[0169] If execution fails, return " ".

[0170] 3. (Three-stage device) Approximate matrix Generating device The specific description is as follows, and the detailed description of the device is as follows: Figure 4 As shown:

[0171] enter:

[0172] :matrix The elements come from ; For matrix number of rows; For matrix The number of columns;

[0173] Output:

[0174] matrix as well as ,satisfy .in:

[0175] From Before cutting It is obtained from a number of lower-order terms. Number of lower-order terms truncated ;

[0176] ,satisfy It is Defined orthogonal complement The explicit base (which can be written directly) takes the following form:

[0177] ;

[0178] here , .

[0179] matrix Its corresponding orthogonal complement explicit bases:

[0180]

[0181] II. Signature Generation Device

[0182] 1. (Level 1 Device) Signature Generation Device The detailed description of the device is as follows: Figure 5 As shown:

[0183] enter:

[0184] Public Key ;

[0185] Master private key ;

[0186] Plain text message awaiting signature , ,Right now The binary representation of;

[0187] Output:

[0188] Execution successful, output signature vector ,satisfy ,and , ;

[0189] Execution failed, output " ”;

[0190] 2. (Secondary device) Approximate trapdoor expansion generation device The detailed description of the device is as follows: Figure 6 As shown:

[0191] enter:

[0192] Main trap door opposite as well as ,in satisfy ;

[0193] Requested expansion of trapdoor Extended matrix ,in From plain text The decision;

[0194] Gaussian sampling parameters ;

[0195] Threshold :Right now ,and ;

[0196] Output:

[0197] Extended matrix Approximate extended trapdoor and threshold value ,satisfy:

[0198] ① It is an extended matrix Corresponding approximate trapdoor:

[0199]

[0200] ②For each There is A Its error satisfies ,and , .

[0201] Execution failed, output " "

[0202] 3-1. (Three-stage device) Approximate trapdoor sampling device The specific description is as follows, and the detailed description of the device is as follows: Figure 7 As shown:

[0203] This device, as the core of this embodiment, is summarized as follows based on the two types of parameters and their different uses:

[0204] Category 1: Used from the main trapdoor Generate extended trapdoor Approximate trapdoor expansion generation device Called;

[0205] Given a labeled master common matrix ( Its approximate main trapdoor Tag matrix and target vector , Sample a short vector , making (i.e., error) ,and ).

[0206] Category 2: Used for expanding trapdoors Generate message signature Signature generation device Called;

[0207] Given a labeled extended matrix ( Its approximate extended trapdoor Tag matrix and target vector , Sample a short vector , making (i.e., error) ,and ).

[0208] Furthermore, the following are the detailed steps, including the specifications of each matrix / vector, sampling parameters, and core logic:

[0209] enter:

[0210] Public key master matrix , , , ;or,

[0211] Extended matrix , , , ;

[0212] Corresponding public key master matrix Approximate main trapdoor ;or,

[0213] Extended matrix The corresponding extended trapdoor ;

[0214] Tag matrix , Invertible matrix;

[0215] Target vector It is the image that sampling aims to achieve;

[0216] Discrete Gaussian parameters According to the first parameter :

[0217] ① (Generating extended trapdoor case) It is in the main common matrix Defined space Above, by radius Control the sampling distribution of a spherical discrete Gaussian;

[0218] ② (Signature generation case), it is in the extended matrix Defined space Above, by radius Control the sampling distribution of a spherical discrete Gaussian;

[0219] Threshold : ,and .

[0220] Output:

[0221] short vector ,satisfy and , This represents the upper limit of the error.

[0222] Execution failed, output " ”;

[0223] III. Signature Verification Device ;

[0224] 1. (Level 1 Device) Signature Verification Device The detailed description of the device is as follows: Figure 8 As shown:

[0225] enter:

[0226] Public Key = Plain text message Threshold value ,

[0227] Corresponding signature , ;

[0228] Output:

[0229] Execution successful, output "0";

[0230] Execution failed, output " ”;

[0231] Example 2

[0232] Furthermore, as another possible implementation, a "near-trapdoor labeled sampling device" "This is the core of the entire signature algorithm in this embodiment. In the first embodiment above, the computational complexity of this device is dominated by the generation of three perturbations, which are crucial to the security of the entire signature algorithm:"

[0233] ,in ;

[0234] The dimension is Therefore, in Discrete Gaussian upsampling The computational complexity is .

[0235] , . The dimension is Therefore, in Discrete Gaussian upsampling The computational complexity is .

[0236] , . The dimension is Therefore, in Discrete Gaussian upsampling The computational complexity is .

[0237] The core idea of ​​this embodiment, while keeping the other devices unchanged, is to... and The sampling is combined into one spatial sampling. "Compensation" This improves the computational efficiency of the approximate trapdoor labeled sampling device by nearly [percentage missing]. The specific description is as follows:

[0238] 3-2, (Three-stage device) Approximate trapdoor sampling device The specific description is as follows, and the detailed description of the device is as follows: Figure 9 As shown:

[0239] enter:

[0240] Public key master matrix , , , ;or,

[0241] Extended matrix , , , ;

[0242] Corresponding public key master matrix Approximate main trapdoor ;or,

[0243] Extended matrix The corresponding extended trapdoor ;

[0244] Tag matrix , Invertible matrix;

[0245] Target vector It is the image that sampling aims to achieve, a part of the public key;

[0246] Discrete Gaussian parameters According to the first parameter :

[0247] ① (Generating extended trapdoor case) It is in the main common matrix Defined space Above, by radius Control the sampling distribution of a spherical discrete Gaussian;

[0248] ② (Signature generation case), it is in the extended matrix Defined space Above, by radius Control the sampling distribution of a spherical discrete Gaussian;

[0249] Threshold : ,and .

[0250] Output:

[0251] short vector ,satisfy and .

[0252] Execution failed, output " ".

[0253] For example, this embodiment represents a real-world application scenario for a digital signature system as follows:

[0254] The National Big Data Administration needs to ensure that government data reported by departments at all levels is not tampered with during transmission and storage, such as population statistics and economic indicators. Each department... Each holds a pair of lattice-based public and private keys issued by the system.

[0255] When department A key data point needs to be reported. At that time, it will use its own private key. Data Perform a signature and generate a digital signature. Then combine the data with the signature. The report was submitted to the National Big Data Platform.

[0256] The audit nodes of the national big data platform received Afterwards, according to the department Public key Then, the signature verification algorithm is run: if the verification passes, the data is considered valid. It was not tampered with during transmission and is indeed from the department. Provided; otherwise, discarded and left to the department. Re-upload.

[0257] To further optimize the technical solution, as an additional implementation method, in the above implementation method, the signature generation device... As the most frequently used device in signature algorithms, its computational complexity directly determines the efficiency of a signature method.

[0258] In Example 1, for each plaintext to be signed... The device must generate an extended trapdoor that matches the plaintext. :because It is to call the approximate trapdoor sampling device column by column. This is equivalent to the generation of the Gepei set. Do on Multiple discrete Gaussian samplings, with a computational complexity of 1 / 2 * 1 / 3 ... This generates an extended trapdoor. The computational load is The calculation is very time-consuming.

[0259] In response to this, the core idea behind the optimization in this second embodiment is to break the plaintext. With extended trapdoor The one-to-one correspondence between them, that is, directly from the main trapdoor to the plaintext. Perform the signing. The specific method is as follows:

[0260] For the main trapdoor , fill in 0 construction :

[0261] ,here

[0262]

[0263] The above Use the main trapdoor directly Add to indivual It is obtained from the vector rows, therefore This has a smaller norm than Example 1, thus reducing the computational cost of generating the original extended trapdoor. ), and the generated signature Shorter.

[0264] It should be noted that in the following signature method, in the original embodiment one:

[0265] Approximate trapdoor expansion generation device It can be omitted;

[0266] Approximate trapdoor sampling device Only the second type of functionality is needed; the first type of functionality is not required.

[0267] Everything else remained unchanged.

[0268] A detailed description of the device is as follows: Figure 10 As shown:

[0269] enter:

[0270] Public Key ;

[0271] Master private key ;

[0272] Plain text message awaiting signature , ,Right now The binary representation of;

[0273] Output:

[0274] Successful execution, output signature vector. ,satisfy ,and , ;

[0275] Execution failed, output " ”;

[0276] This embodiment achieves significant compression of public key and signature size. Based on the worst-case difficulty of the lattice problem, it proves strong unforgeability under the Standard Model, making it suitable for post-quantum secure communication scenarios and providing an efficient signature solution for quantum-resistant cryptography.

[0277] This embodiment constructs a secure signature scheme under the standard model, rather than under the random oracle model, thus narrowing the gap between the scheme and real-world applications. Given the current level of lattice public key technology, this embodiment minimizes the size of the public key, private key, system parameters, and signature in the lattice signature algorithm.

[0278] This embodiment corrects the flawed construction method based on approximate trapdoors and the resulting partial leakage of secret information; it constructs correct preimage sampling and a correct and efficient compensation method for the spatial skew distribution of the sampled data, thereby proving its security under the standard model.

[0279] This embodiment eliminates the loss of integrity / authenticity of the original basic data, prevents errors in the transmission of calculation results, and prevents the leakage of partial secret information through signature distribution; it is also resistant to quantum computer attacks. This embodiment designs a signature algorithm based on an approximate trapdoor under the standard model, and compared with similar works, it has the advantages of small public / private key and signature sizes, and provable security under the standard model.

[0280] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A digital signature method based on approximate trapdoor in lattice-based standard model, characterized in that, Comprise: According to the system security parameters, the public parameters, the main public key and the main private key are generated by the system parameter generation device; According to the main public key, the main private key and the message to be signed, the signature vector of the message to be signed is generated by the signature generation device; According to the main public key, the message to be signed and the signature vector, the validity of the signature is verified by the signature verification device; Wherein, in the signature generation process, the approximate trapdoor expansion generation device and the approximate trapdoor sampling device are adopted, and the distribution deviation caused by the use of approximate trapdoor is geometrically compensated by the approximate trapdoor sampling device, so that the output distribution of the signature vector is statistically indistinguishable from the ideal spherical discrete Gaussian distribution.

2. The method of claim 1, wherein: The system parameter generation device is configured to perform the following operations: Receive system security parameters as input; Determine a set of system parameters, including modulus, lattice dimension, truncation parameter and error distribution parameter; Generate a main public key, including a main public matrix, an approximate component matrix, a set of expansion factor matrices and a target vector; Generate a main private key, including a main approximate trapdoor matrix; Output the main public key, the main private key and the set of system parameters.

3. The method of claim 1, wherein: The generation process of the main public key and the main private key comprises: By the labeled trapdoor generation device, according to the system security parameters, the lattice dimension parameters, the truncation parameters and the label matrix, the main public matrix and the main approximate trapdoor matrix are generated; By the approximate matrix generation device, according to the lattice dimension parameters and the truncation parameters, the approximate component matrix and the explicit basis of its orthogonal complement lattice are generated; Wherein, the main public matrix is obtained by the product of the label matrix and the approximate component matrix minus the linear transformation of the main approximate trapdoor matrix, and it satisfies the approximate equality relationship rather than the exact equality relationship.

4. The method of claim 3, wherein: The value of the truncation parameter is one half of the logarithmic modulus; The number of columns of the main approximate trapdoor matrix is one half of the number of columns of the exact trapdoor scheme; The approximate component matrix is obtained according to the difference between the number of columns of the main public matrix and the truncation parameter.

5. The method of claim 1, wherein: The signature generation device is configured to perform the following operations: Receive the main public key, the main private key and the message to be signed as input; According to the bit value of the message to be signed, the expansion matrix is calculated; By the approximate trapdoor expansion generation device, according to the main public matrix, the main approximate trapdoor matrix and the expansion matrix, the expansion approximate trapdoor matrix is generated; By the approximate trapdoor sampling device, according to the expansion matrix, the expansion approximate trapdoor matrix and the target vector, the signature vector is generated.

6. The method of claim 1, wherein: The approximate trapdoor expansion generation device is configured to perform the following operations: Receive the main public matrix, the main approximate trapdoor matrix, the approximate component matrix and the message to be signed as input; According to the binary form of the message to be signed, and the main public matrix and the expansion factor matrix, the expansion public matrix is generated; For each column of the approximate component matrix, the approximate trapdoor sampling device generates a corresponding extended trapdoor column vector; The extended trapdoor column vectors are combined in order to obtain an extended matrix corresponding to the extended trapdoor matrix.

7. The method of claim 1, wherein, When the approximate trapdoor sampling device is used to generate an extended approximate trapdoor, the following operations are performed: Receiving a master public matrix, a master approximate trapdoor matrix, a label matrix, a target vector, and a first Gaussian parameter as inputs; Sampling in a linear space defined by the master public matrix with a spherical discrete Gaussian distribution controlled by the first Gaussian parameter; Generating a short vector as a column vector of the extended approximate trapdoor matrix, such that the product of the master public matrix and the short vector is approximately equal to the target vector with an error not exceeding a first threshold.

8. The method of claim 1, wherein, When the approximate trapdoor sampling device is used to generate a signature vector, the following operations are performed: Receiving an extended matrix, an extended approximate trapdoor matrix, a label matrix, a target vector, and a second Gaussian parameter as inputs; Sampling in a linear space defined by the extended matrix with a spherical discrete Gaussian distribution controlled by the second Gaussian parameter; Generating a short vector as the signature vector, such that the product of the extended matrix and the signature vector is approximately equal to the target vector with an error not exceeding a second threshold.

9. The method of claim 1, wherein, The approximate trapdoor sampling device implements the geometric compensation through three types of perturbations: Generating a first perturbation vector to compensate for the distribution deviation of a short vector in the column space of an extended matrix; Generating a second perturbation vector to compensate for the distribution deviation in the label matrix space caused by the truncation of low-order terms in the approximate component matrix; Generating a third perturbation vector to compensate for the distribution deviation in the error space caused by the approximation deviation between the product of the master approximate trapdoor matrix and the approximate component matrix; Superimposing the first, second, and third perturbation vectors on the linear transformation result to obtain a final output vector.

10. The method of claim 9, wherein, The approximate trapdoor sampling device combines the second and third perturbation vectors into a single perturbation vector, and the combining operation includes: Taking the sum of the label matrix and the approximation deviation as a combined perturbation matrix; Calculating a combined covariance matrix according to the combined perturbation matrix; Generating the single perturbation vector through a single discrete Gaussian sampling in the label matrix space according to the combined covariance matrix.

Images