System and method for requesting and generating post-quantum cryptography dual usage certificate

Abstract

A system and method for applying for and producing post-quantum cryptographic multipurpose credentials are provided. The method includes the following steps: a terminal device generates a post-quantum cryptographic multipurpose credential application request, and the terminal device transmits the post-quantum cryptographic multipurpose credential application request to a credential center, wherein the post-quantum cryptographic multipurpose credential application request includes at least subject information, a signature value, the digital signature algorithm public key of the terminal device, and the gold key encapsulation mechanism public key of the terminal device; and the credential center produces a multipurpose credential based on the post-quantum cryptographic multipurpose credential application request, wherein the multipurpose credential includes at least a digital signature algorithm identifier, a credential serial number, subject information, a credential validity period, subject public key information, extended information, and a signature value.

Claims

1. A system for applying for and producing post-quantum cryptographic multipurpose credentials, comprising: Terminal equipment; The system includes a certificate center, which is communicatively connected to the terminal device. The terminal device generates a post-quantum cryptography multi-purpose certificate application request and transmits it to the certificate center. The post-quantum cryptography multi-purpose certificate application request includes at least subject information, a signature value, the terminal device's digital signature algorithm public key, and the terminal device's key encapsulation mechanism public key. The certificate center generates a multi-purpose certificate based on the post-quantum cryptography multi-purpose certificate application request. The multi-purpose certificate includes at least a digital signature algorithm identifier, a certificate serial number, the subject information, the certificate validity period, subject public key information, extended information, and the signature value.

2. The system as described in claim 1, wherein the credential center obtains the subject information from the post-quantum cryptography multipurpose credential application request, and obtains the digital signature algorithm public key and the key encapsulation mechanism public key of the terminal device; the credential center, based on the digital signature algorithm identifier, uses its private key to execute the digital signature algorithm on the content to be signed of the multipurpose credential to generate the signature value; the extended information includes at least the purpose of the key, and the purpose of the key includes at least digital signature; the subject public key information includes at least the digital signature algorithm public key; the multipurpose credential includes at least the key encapsulation mechanism public key.

3. The system as described in claim 2, wherein the subject public key information further includes the public key of the key encapsulation mechanism; and the purpose of the key further includes data encryption.

4. The system as described in claim 2, wherein the extended information further includes subject-optional public key information; the subject-optional public key information includes at least the public key of the key encapsulation mechanism; and the purpose of the key further includes data encryption.

5. The system as described in claim 2, wherein the extended information further includes a Delta certificate; the subject public key information in the Delta certificate includes at least the public key of the key encapsulation mechanism; and the purpose of the key in the Delta certificate includes at least data encryption.

6. The system as described in claim 5, wherein the Delta credential includes the digital signature algorithm identifier and the signature value; the credential center uses the private key of the credential center to perform the digital signature algorithm on the content to be signed of the multipurpose credential based on the digital signature algorithm identifier in the Delta credential to generate the signature value in the Delta credential.

7. The system as described in claim 2, wherein the public key of the digital signature algorithm is one of an ML-DSA (Module-Lattice-Based Digital Signature Algorithm) public key, an SLH-DSA (Stateless Hash-Based Digital Signature Algorithm) public key, and a Falcon public key.

8. The system as described in claim 2, wherein the public key of the key encapsulation mechanism is an ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) public key.

9. The system as described in claim 1, wherein the credential center produces a post-quantum cryptographic multipurpose credential response.

10. The system as described in claim 9, wherein the post-quantum cryptographic multipurpose credential response includes key encapsulation information, a key package, and the ciphertext of the multipurpose credential; the credential center generates a first symmetric key and a second symmetric key; the credential center uses the public key of the key encapsulation mechanism of the terminal device to encrypt the first symmetric key to obtain the key encapsulation information; the credential center uses the first symmetric key to encrypt the second symmetric key to obtain the key package; the credential center uses the second symmetric key to encrypt the multipurpose credential to obtain the ciphertext of the multipurpose credential.

11. The system as described in claim 10, wherein the terminal device generates a post-quantum cryptographic multipurpose credential verification; the post-quantum cryptographic multipurpose credential verification includes a hash value of the post-quantum cryptographic multipurpose credential application request and the hash value of the multipurpose credential; the terminal device uses a hash function to calculate the hash value of the post-quantum cryptographic multipurpose credential application request; after receiving the post-quantum cryptographic multipurpose credential response, the terminal device uses its key encapsulation mechanism private key to decrypt the key encapsulation information to obtain the first symmetric key; the terminal device uses the first symmetric key to decrypt the key encapsulation to obtain the second symmetric key; the terminal device uses the second symmetric key to decrypt the ciphertext of the multipurpose credential to obtain the multipurpose credential; the terminal device uses the hash function to calculate the hash value of the multipurpose credential; thereby achieving proof of ownership (PoP) of the key encapsulation mechanism private key.

12. The system as described in claim 9, wherein the post-quantum cryptographic multipurpose credential response includes key encapsulation information, a key package, and ciphertext of a credential compression file; the credential center produces a digital signature credential and a key encapsulation credential, and the credential center compresses the digital signature credential and the key encapsulation credential to obtain the credential compression file; the credential center produces a first symmetric key and a second symmetric key; the credential center uses the public key of the key encapsulation mechanism of the terminal device to encrypt the first symmetric key to obtain the key encapsulation information; the credential center uses the first symmetric key to encrypt the second symmetric key to obtain the key package; the credential center uses the second symmetric key to encrypt the credential compression file to obtain the ciphertext of the credential compression file.

13. The system as described in claim 12, wherein the terminal device generates a post-quantum cryptographic multipurpose credential verification; the post-quantum cryptographic multipurpose credential verification includes the hash value of the post-quantum cryptographic multipurpose credential application request and the hash value of the key-encapsulated credential; the terminal device uses a hash function to calculate the hash value of the post-quantum cryptographic multipurpose credential application request; after receiving the post-quantum cryptographic multipurpose credential response, the terminal device uses its key-encapsulation mechanism private key to decrypt the key-encapsulation information to obtain the first symmetric key; the terminal device uses the first symmetric key to decrypt the key package to obtain the second symmetric key; the terminal device uses the second symmetric key to decrypt the ciphertext of the credential compressed file to obtain the credential compressed file; the terminal device decompresses the credential compressed file to obtain the digital signature credential and the key-encapsulated credential; The terminal device uses the hash function to calculate the hash value of the key-encapsulated credential; thereby achieving proof of ownership (PoP) of the private key of the key-encapsulation mechanism.

14. A method for applying for and producing a post-quantum cryptographic multipurpose credential, suitable for a system including a terminal device and a credential center, wherein the method includes the following steps: the terminal device produces a post-quantum cryptographic multipurpose credential application request, and the terminal device transmits the post-quantum cryptographic multipurpose credential application request to the credential center, wherein the post-quantum cryptographic multipurpose credential application request includes at least subject information, a signature value, the digital signature algorithm public key of the terminal device, and the key encapsulation mechanism public key of the terminal device; and the credential center produces a multipurpose credential based on the post-quantum cryptographic multipurpose credential application request, wherein the multipurpose credential includes at least a digital signature algorithm identifier, a credential serial number, the subject information, a credential validity period, subject public key information, extended information, and the signature value.

Images