An agile digital signature verification method and system

Abstract

The present application proposes an agile digital signature verification method and system. Specifically, the digital signature verification method verifies the integrity and authenticity of the message Mess by performing file verification on the message Mess sent by the sending unit and the verification code MAC of the message Mess through the receiving unit, thereby preventing the message Mess from being tampered with; at the same time, based on the one-time identity OTID shared by the sending unit and the quantum CA and the hash value H obtained by performing a hash operation on the message Mess, 1 (Mess) generates a three-party signature file Sign, and the receiving unit and quantum CA jointly verify the signature of the three-party signature file Sign; on the one hand, each signature uses a one-time identity OTID that changes once, which improves the security of signature verification; on the other hand, quantum CA is based on a fixed-length hash value H 1 (Mess) signature verification can not only ensure the non-repudiation of the message Mess, but also avoid the problem of large memory usage of quantum CA due to the excessive content of the message Mess, reduce the storage burden of quantum CA, and improve the agility of signature verification.

Description

Technical Field

[0001] The present application relates to the field of network information security technology, and in particular to an agile digital signature verification method and system. Background Art

[0002] Digital signature is a comprehensive application of encryption technology and digital summary technology. Simply put, digital signature is some data attached to the data unit, or a cryptographic transformation of the data unit. This data or transformation allows the recipient of the data unit to confirm the source and integrity of the data unit and protect the data from being forged. It is a method of signing electronic messages. Only the sender of the information can generate a digital string that cannot be forged by others. This digital string is also a valid proof of the integrity of the information sent by the sender. Digital signature technology can verify whether the message file has changed during the transmission process, ensuring the integrity, authenticity and non-repudiation of the transmitted electronic file.

[0003] At present, digital signature technology mainly includes digital signature and verification based on asymmetric key encryption system and digital signature and verification based on hash algorithm. Figure 1 As shown in the figure, the process of digital signature and verification based on asymmetric key encryption system is generally as follows: the sender first encrypts the message with its own private key to obtain a digital signature, and then sends the digital signature and the message together to the receiving unit. The receiving unit decrypts the digital signature with the sender's public key and compares the decrypted result with the received message. If they are equal, the signature verification is successful.

[0004] like Figure 2 As shown in the figure, the process of digital signature and verification based on hash algorithm is generally as follows: when sending a message, the sender generates a message digest of fixed length through hash function, and then encrypts the message digest with the sender's private key as the digital signature of the message and sends it to the receiving unit together with the message. The receiving unit first calculates the message digest from the received original message using the same hash function as the sender, and then decrypts the digital signature with the public key, and compares the decryption result with the calculated message digest. If they are equal, the receiving unit can confirm that the message is from the sender.

[0005] The above two digital signature methods are essentially dependent on asymmetric cryptographic systems, and their security is based on unproven mathematical computational problems, such as the RSA algorithm based on the large integer factorization problem and the ECC algorithm based on the elliptic curve discrete logarithm computation problem (ECDLP). With the rapid improvement of classical computing power and the explosive development of quantum algorithms, the above signcryption algorithms are gradually being cracked.

[0006] In order to solve this problem, a Chinese patent document entitled: A quantum key negotiation method, system, quantum digital signature method, system, publication number: CN114244500A proposes a quantum digital signature method, the main content of which is: sender A sends a message and a digital signature to receiver B, and receiver B sends the message and digital signature received from sender A together with its own key S1 to verifier C; after receiving the message from receiver B, verifier C sends key S2 to receiver B, and receiver B and verifier C jointly perform signature verification. This method does not rely on an asymmetric cryptographic system, and is verified by receiver B and verifier C, which greatly improves the integrity, authenticity, and non-repudiation of signature verification, and ensures the security of signature verification.

[0007] However, in the above-mentioned quantum digital signature method, after receiving the message and digital signature sent by the sender A, the receiver B needs to send the message to the verifier C, and the verifier C does not need the message itself except for signature verification. Therefore, the reception of the message by the verifier C will not only cause a large amount of its memory resources to be consumed, increasing the storage burden of the verifier C, but also reduce the signature verification efficiency of the verifier C. Summary of the invention

[0008] Based on this, it is necessary to provide an agile digital signature verification method and system to address the above technical issues.

[0009] In a first aspect, an agile digital signature verification method is provided, comprising:

[0010] The sending unit generates a message Mess;

[0011] The sending unit generates a hash value H1(Mess) based on the message Mess, generates a verification code MAC about the message Mess based on the hash value H1(Mess), and then sends the message Mess and the verification code MAC to the receiving unit;

[0012] The receiving unit receives the message and the verification code, which are recorded as message Mess′ and verification code MAC′ respectively, and then performs file verification;

[0013] The sending unit shares the one-time identity OTID with the quantum CA;

[0014] The sending unit generates a three-party signature file Sign based on the one-time identity OTID and the hash value H1(Mess), generates a hash value H2(Sign) based on the three-party signature file Sign, then generates a signature summary Abstr about the three-party signature file Sign based on the hash value H2(Sign), and sends the three-party signature file Sign and the encrypted signature summary Abstr to the receiving unit;

[0015] The receiving unit receives the three-party signature file and the encrypted signature summary, which are recorded as the three-party signature file Sign′ and the encrypted signature summary Abstr′ respectively, and then performs signature verification with the quantum CA. If the signature verification of the quantum CA and the receiving unit is passed, the receiving unit accepts the signature and stores the received message Mess′.

[0016] In a further embodiment, the sending unit generates a hash value H1(Mess) based on the message Mess, generates a verification code MAC about the message Mess based on the hash value H1(Mess), and then sends the message Mess and the verification code MAC to the receiving unit. The process includes:

[0017] The sending unit and the receiving unit share an n-bit binary random number S1 and a 2n-bit binary random number T1, where n is a positive integer greater than 0;

[0018] The sending unit locally generates an n-bit binary random number P1, and generates an irreducible polynomial P1(x) based on the random number P1, and then uses the random number S1 as an input random number and the irreducible polynomial P1(x) to generate a hash function Hash1 based on a linear shift register;

[0019] The sending unit performs a hash operation on the message Mess through a hash function Hash1 to obtain a hash value H1(Mess), and generates a file digest DIG about the message Mess based on the hash value H1(Mess), wherein the file digest DIG is expressed as: DIG=[H1(Mess), P1];

[0020] The sending unit uses the random number T1 to XOR-encrypt the file digest DIG to obtain the verification code MAC of the message Mess. The verification code MAC is expressed as: Then the message Mess and the verification code MAC are sent to the receiving unit.

[0021] By adopting the above technical solution: the security of the verification code MAC is guaranteed based on the hash function generated by the irreducible polynomial and the input random number. Before the verification code MAC about the message Mess is generated, the receiver will not know it in advance, thereby avoiding the risk of the verification code MAC being easily known by adopting other algorithms, so that the integrity of the message Mess can be guaranteed, and the message Mess can be prevented from being tampered with or implanted.

[0022] In a further embodiment, the receiving unit receives a message and a verification code, which are respectively recorded as a message Mess′ and a verification code MAC′, and then performs a file verification process including:

[0023] The receiving unit receives the message and the verification code, which are respectively recorded as the message Mess′ and the verification code MAC′;

[0024] The receiving unit uses its shared random number T1 to XOR decrypt the verification code MAC′ to obtain the file digest DIG′, and then obtains the hash value H′1 (Mess) and the random number P′1;

[0025] The receiving unit generates an irreducible polynomial P′1(x) based on the random number P′1, and then generates a new hash function Hash′1 based on the linear shift register based on the irreducible polynomial P′1(x) and the random number S1;

[0026] The receiving unit uses the new hash function Hash′1 to perform a hash operation on the message Mess′ to obtain a new hash value H′1(Mess′). If the new hash value H′1(Mess′) is equal to the hash value H′1(Mess), the file verification is successful, and the receiving unit stores the message Mess′ and the hash value H′1(Mess); otherwise, the file verification fails, and the receiving unit abandons the message Mess′.

[0027] By adopting the above technical solution: by comparing the new hash value H′1(Mess′) with the hash value H′1(Mess) in the decrypted MAC′, if the two are equal, it means that the message Mess′ received by the receiving unit is equal to the message Mess sent by the sending unit, thereby realizing the integrity verification of the received message Mess.

[0028] In a further embodiment, the process of the sending unit sharing the one-time identity OTID with the quantum CA includes:

[0029] The sending unit shares an m-bit binary random number S3 and a 2m-bit binary random number T3 with the quantum CA. The random number T3 is expressed as T3 = [u, v], where u and v are both m-bit binary random numbers, and m is a positive integer greater than 0.

[0030] The sending unit locally generates an m-bit random number P3, and generates an irreducible polynomial P3(x) based on the random number P3, and then uses the random number S3 as an input random number and the irreducible polynomial P3(x) to generate a hash function Hash3 based on a linear shift register;

[0031] The sending unit substitutes the private identity Pri obtained from the quantum CA into the hash function Hash3 to generate a hash value H3(Pri) of the private identity Pri;

[0032] The sending unit generates a one-time certificate OTCA based on the hash value H3(Pri), and the one-time certificate OTCA is represented as And send the one-time certificate OTCA to the quantum CA;

[0033] The quantum CA receives the one-time certificate, recorded as one-time certificate OTCA′, and performs identity authentication: If the authentication is successful, the sending unit and the quantum CA obtain the same one-time identity Otherwise, the process of sharing the one-time identity OTID between the sending unit and the quantum CA is re-executed.

[0034] By adopting the above technical solution: the one-time identity OTID is obtained based on the private identity Pri, so that the private identity Pri can be hidden and the exposure of the private identity can be avoided, thereby improving the security of the three-party signature file Sign; and the introduction of random numbers P3, S3 and T3 variables provides the possibility for the one-time change of the one-time identity OTID, further improving the security of the three-party signature file Sign, and there is no need to introduce other variables; in addition, while sharing the one-time identity OTID, the private identity of the sending unit is verified to ensure the association between the one-time identity and the private identity.

[0035] In a further embodiment, the process in which the quantum CA receives a one-time certificate, referred to as a one-time certificate OTCA′, and performs identity authentication includes:

[0036] S61: The quantum CA obtains a one-time certificate, recorded as a one-time certificate OTCA′, and decrypts the one-time certificate OTCA′ by performing an XOR operation on the random number T3, thereby obtaining a decrypted hash value H3(Pri)′ and a random number P′3;

[0037] S62: The quantum CA generates an irreducible polynomial P′3(x) according to the random number P′3, and then generates a new linear shift register-based hash function Hash′3 based on the irreducible polynomial P′3(x) and the random number S3;

[0038] S63: The quantum CA substitutes the locally stored private identity Pri into the hash function Hash′3 to obtain a new hash value H′3(Pri) of the private identity Pri; if the new hash value H′3(Pri) is equal to the decrypted hash value H3(Pri)′, the identity authentication is successful; otherwise, the identity authentication fails.

[0039] By adopting the above technical solution: by comparing the new hash value H′3(Pri) with the hash value H3(Pri)′, if the two are equal, it means that the privacy identity Pri corresponding to the one-time certificate OTCA sent by the sending unit is equal to the privacy identity Pri stored in the quantum CA, thereby realizing the identity authentication of the user unit, and then establishing the unique correspondence between the one-time identity OTID and the privacy identity Pri of the user unit, providing a guarantee for the security of the three-party signature file.

[0040] In a further embodiment, the sending unit generates a three-party signature file Sign based on the one-time identity OTID and the hash value H1(Mess), generates a hash value H2(Sign) based on the three-party signature file Sign, then generates a signature summary Abstr about the three-party signature file Sign based on the hash value H2(Sign), and sends the three-party signature file Sign and the signature summary Abstr to the receiving unit. The process includes:

[0041] The sending unit and the receiving unit negotiate a key and obtain a binary shared key X AB and shared key Y AB ; The sending unit and quantum CA perform key negotiation and obtain the binary shared key X AC and shared key Y AC ; Among them, the shared key X AB and shared key X AC The characters are the same length, and the shared key Y AB and shared key Y AC have the same character length and share the same key Y AB The character length of the shared key is X AB Twice the length of a character;

[0042] The sending unit will share the key X AB , shared key Y AB , shared key X AC and the shared key Y AC Perform XOR operation to get the key X A and key Y A , the process of XOR operation is expressed as:

[0043]

[0044]

[0045] The sending unit generates a binary random number P2 locally, and generates an irreducible polynomial P2(x) based on the random number P2, and then converts the key X A The random number is used as input together with the irreducible polynomial P2(x) to generate the hash function Hash2 based on the linear shift register;

[0046] The sending unit generates a three-party signature file Sign based on the one-time identity OTID and the hash value H1(Mess), and the three-party signature file Sign is represented by: Sign=[H1(Mess), OTID]; and performs a hash operation on the three-party signature file Sign through a hash function Hash2 to generate a hash value H2(Sign), and then generates a signature summary Abstr based on the hash value H2(Sign), and the signature summary Abstr is represented by Abstr=[H2(Sign), P2];

[0047] The sending unit passes the key Y A The signature summary Abstr is XOR-encrypted. The encryption process of the signature summary Abstr is expressed as follows: Then the three-party signature file Sign and the encrypted signature summary Abstr are sent to the receiving unit.

[0048] By adopting the above technical solution: when the sending unit conducts key negotiation with the receiving unit and the quantum CA respectively, a three-party signature file Sign about the one-time identity OTID and the hash value H1(Mess) is generated, and its hash value H2(Sign) is calculated, and then the signature summary Abstr is generated, and the one-time identity is used for signing to improve security; at the same time, it is convenient for subsequent three-party verification.

[0049] In a further embodiment, the receiving unit receives the three-party signature file and the encrypted signature summary, which are respectively recorded as the three-party signature file Sign′ and the encrypted signature summary Abstr′, and then performs signature verification with the quantum CA, including:

[0050] The receiving unit receives the three-party signature file and the encrypted signature summary, which are recorded as the three-party signature file Sign′ and the encrypted signature summary Abstr′ respectively, and then transmits the three-party signature file Sign′ and the encrypted signature summary Abstr′ together with the shared key X AB and the shared key Y AB Send them to the quantum CA through the authentication channel together;

[0051] Quantum CA receives the three-party signature file, encrypted signature summary, and shared key X AB and the shared key Y AB , respectively recorded as the three-party signature file Sign″, the encrypted signature summary Abstr″, and the shared key X′ AB and the shared key Y′ AB , then the shared key X′ AB , shared key Y′ AB , shared key X AC and the shared key Y AC Perform XOR operation to get the key XC and key Y C , the process of XOR operation is expressed as:

[0052]

[0053]

[0054] Quantum CA uses key Y C Decrypt the encrypted signature summary Abstr″ to obtain the signature summary [H2(Sign)″, P2″], and then obtain the hash value H2(Sign)″ and the random number P″2; then generate the irreducible polynomial P″2(x) based on the random number P″2, and then use the key X C As input random number and irreducible polynomial P″2(x), a hash function Hash″2 based on linear shift register is generated;

[0055] The quantum CA performs a hash operation on the received three-party signature file Sign" through the hash function Hash2", generates a hash value H"2(Sign"), and compares the hash value H"2(Sign") obtained by the operation with the hash value H2(Sign)" obtained by decryption: If they are the same, the signature verification of the quantum CA is passed, and the quantum CA will share the shared key X AC and shared key Y AC Together with the signature verification result of the quantum CA, it is sent to the receiving unit through the authentication channel; otherwise, the signature verification of the quantum CA fails, and the quantum CA directly sends its signature verification result to the receiving unit through the authentication channel.

[0056] By adopting the above technical solution: during the verification process, the receiving unit sends the three-party signature file Sign based on the one-time identity OTID to the quantum CA for signature verification, without sending the received message Mess′ to the quantum CA, thereby avoiding excessive memory occupation of the quantum CA due to the excessive content of the received message Mess′, reducing the storage burden of the quantum CA, and improving the efficiency of signature verification.

[0057] In a further embodiment, the receiving unit receives the three-party signature file and the encrypted signature summary, which are respectively recorded as the three-party signature file Sign′ and the encrypted signature summary Abstr′, and then performs signature verification with the quantum CA, and the process further includes:

[0058] The receiving unit receives the signature verification result of the quantum CA. If the signature verification result is a verification failure, the receiving unit refuses to sign and abandons the storage of the message Mess′; if the signature verification result is a verification success, the receiving unit receives the shared key X AC and shared key Y AC , respectively denoted as shared key X′AC and the shared key Y′ AC , and share the key X AB , shared key Y AB , shared key X′ AC and the shared key Y′ AC Perform XOR operation to get the key X B and key Y B , the process of XOR operation is expressed as:

[0059]

[0060]

[0061] The receiving unit uses the key Y B Decrypt the encrypted signature summary Abstr′ to obtain the signature summary [H2(Sign)′, P′2], and then obtain the decrypted hash value H2(Sign)′ and the random number P′2; then generate the irreducible polynomial P′2(x) based on the random number P′2, and convert the key X B As input random number and irreducible polynomial P′2(x), a hash function Hash′2 based on linear shift register is generated;

[0062] The receiving unit performs a hash operation on the received three-party signature file Sign′ through the hash function Hash′2 to generate a hash value H′2(Sign′), and compares the hash value H′2(Sign′) with the decrypted hash value H2(Sign)′: if they are the same, the signature verification of the receiving unit is passed and the receiving unit accepts the signature; otherwise, the signature verification of the receiving unit fails, the receiving unit refuses to sign, and abandons the storage of the message Mess′.

[0063] By adopting the above technical solution: on the basis of the quantum CA signature verification, the receiving unit performs signature verification. If the verification is successful, it indicates that the signature verification is successful, thereby ensuring the non-repudiation of the message Mess signature.

[0064] In the second aspect, an agile digital signature verification system is provided, including a sending unit, a receiving unit and a quantum CA interconnected by a quantum security network;

[0065] The sending unit is configured to generate a message Mess, and generate a hash value H1(Mess) based on the message Mess, and then generate a verification code MAC about the message Mess based on the hash value H1(Mess), and finally send the message Mess and the verification code MAC to the receiving unit; the sending unit is also configured to share a one-time identity OTID with the quantum CA, and generate a three-party signature file Sign based on the one-time identity OTID and the hash value H1(Mess), and then generate a hash value H2(Sign) based on the three-party signature file Sign, and finally generate a signature summary Abstr about the three-party signature file Sign based on the hash value H2(Sign), and send the three-party signature file Sign and the encrypted signature summary Abstr to the receiving unit;

[0066] The receiving unit is configured to receive a message and a verification code sent by the sending unit, which are respectively recorded as a message Mess′ and a verification code MAC′, and then perform file verification; the receiving unit is also configured to receive a three-party signature file and an encrypted signature summary sent by the sending unit, which are respectively recorded as a three-party signature file Sign′ and an encrypted signature summary Abstr′, and then perform signature verification together with the quantum CA;

[0067] The quantum CA is configured to provide the sending unit with the user's public certificate CA and the private identity Pri.

[0068] According to a third aspect, a computer device is provided, comprising:

[0069] a memory storing a computer program;

[0070] The processor is configured to implement the digital signature verification method provided in the first aspect when executing the computer program.

[0071] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the digital signature verification method provided in the first aspect is implemented.

[0072] In a fifth aspect, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the digital signature verification method provided in the first aspect.

[0073] Beneficial effects: The agile digital signature verification method provided by the present application performs file verification on the message Mess sent by the sending unit and the verification code MAC about the message Mess through the receiving unit, determines the integrity and authenticity of the message Mess, and prevents the message Mess from being tampered with; at the same time, a three-party signature file Sign is generated based on the one-time identity OTID shared by the sending unit and the quantum CA and the hash value H1(Mess) of the hash operation on the message Mess, and the three-party signature file Sign is jointly signed and verified by the receiving unit and the quantum CA; on the one hand, each signature uses a one-time identity OTID that changes once, which improves the security of signature verification; on the other hand, the quantum CA performs signature verification based on the fixed-length hash value H1(Mess), which can not only ensure the non-repudiation of the message Mess, but also avoid the problem that the quantum CA memory is occupied in large quantities due to the excessive content of the message Mess, thereby reducing the storage burden of the quantum CA and improving the efficiency and agility of signature verification. At the same time, in this application, the sending unit and the quantum CA can share the one-time identity OTID while verifying the private identity Pri of the sending unit, avoiding the introduction of too many variables and further improving efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 This is a flowchart of digital signature and verification based on asymmetric key encryption system.

[0075] Figure 2 This is a flowchart of digital signature and verification based on hash algorithm.

[0076] Figure 3 It is a structural diagram of the digital signature verification system in Example 1.

[0077] Figure 4 It is a flowchart of the digital signature verification method in Example 1. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0079] At present, digital signature technology mainly includes digital signature and verification based on asymmetric key encryption system and digital signature and verification based on hash algorithm. Both of these digital signature methods essentially rely on asymmetric cryptographic system, and their security is based on unproven mathematical calculation problems. With the rapid improvement of classical computing power and the explosive development of quantum algorithms, this signcryption method based on mathematical calculation problems is prone to key decryption, resulting in security risks in digital signature verification.

[0080] In order to solve this problem, our company has submitted an invention patent application, the name of which is: a quantum key negotiation method, system, quantum digital signature method, system, and the publication number is: CN114244500A. This patent application proposes a quantum digital signature method, the main content of which is: sender A sends a message and a digital signature to receiver B, and receiver B sends the message and digital signature received from sender A together with its own key S1 to verifier C; after receiving the message from receiver B, verifier C sends key S2 to receiver B, and receiver B and verifier C jointly perform signature verification. This method does not rely on an asymmetric cryptographic system, and is jointly verified by receiver B and verifier C, which greatly improves the integrity, authenticity, and non-repudiation of signature verification, ensuring the security of signature verification. However, after receiving the message and digital signature sent by the sender, the receiver B needs to send the entire message file to the verifier C. In addition to signature verification, the verifier C does not actually need the message itself. Therefore, receiving the message by the verifier C will not only cause a large amount of its memory resources to be consumed, increasing the storage burden of the verifier C, but also reduce the signature verification efficiency of the verifier C.

[0081] To this end, the present application provides an agile digital signature verification method and system to improve the existing digital signature verification technology.

[0082] Example 1

[0083] This embodiment provides an agile digital signature verification method. In order to facilitate the implementation of the digital signature verification method, Figure 3 As shown, this embodiment provides an agile digital signature verification system. The digital signature verification system includes a sending unit, a receiving unit and a quantum CA; and the sending unit, the receiving unit and the quantum CA are in communication with each other. Preferably, the sending unit, the receiving unit and the quantum CA are in communication with each other through a quantum security network. The quantum security network mentioned here is a secure communication network constructed by using a quantum communication network and a classical communication network. Among them, the quantum communication network is a secure communication network that uses quantum cryptography. As Figure 4 As shown, this embodiment will describe in detail the specific process of digital signature verification in conjunction with the digital signature verification system:

[0084] S1: The sending unit generates a message Mess.

[0085] Specifically, the sending unit can generate a message Mess according to the content of the business. The message Mess includes a message file Doc and a user public certificate CA. The message file Doc is used to record the actual content of the business, such as information content involving transactions, academics, medical diagnosis, education science, etc. The user public certificate CA is issued by an authoritative organization and is mainly used to identify the true public identity of the user unit. Of course, the message Mess also includes a timestamp, and the key content in the message Mess can be time-marked by the timestamp. For example, in this embodiment, the timestamp is set to include a first timestamp Time1 and / or a second timestamp Time2. Among them, the first timestamp Time1 is used to mark the generation time of the message Mess. The second timestamp Time2 is used to identify the verification time limit of the message Mess. Within this time limit, the verification is valid; if it exceeds this time limit, the verification is invalid. By setting the verification time, the problem of the receiving unit or quantum CA not verifying for a long time can be effectively prevented, thereby improving the efficiency of signature verification. In addition, the message Mess can also include the business number TXID of the message file. The index relationship between the message Mess, the verification code MAC, the one-time certificate OTCA or the one-time identity OTID is established through the service number TXID.

[0086] S2: The sending unit generates a hash value H1(Mess) based on the message Mess, and generates a verification code MAC for the message Mess based on the hash value H1(Mess), and then sends the message Mess and the verification code MAC to the receiving unit.

[0087] Specifically, the sending unit and the receiving unit share an n-bit binary random number S1 and a 2n-bit binary random number T1, where n is a positive integer greater than 0, and in this embodiment, n is 128. The sending unit and the quantum CA relay the random number S1 and the random number T1 through a quantum security network.

[0088] The sending unit locally generates an n-bit binary random number P1, and generates an irreducible polynomial P1(x) based on the random number P1. Specifically, the sending unit uses n as the coefficient of each term in the polynomial except the highest term corresponding to each bit of the random number P1 to generate an n-order polynomial in the GF(2) field. And the coefficient of the highest term is 1. For example: Assume that the random number P1 can be expressed as [P n-1 , P n-2 , ..., P1, P0]. At the same time, set P0 = 1. Then the polynomial P1(x) = x n +P n-1 x n-1 +P n-2 x n-2+…+Px+1. Of course, the generated polynomial P1(x) needs to be verified to determine whether it is an irreducible polynomial. The verification process is expressed as verification Is it true? In the formula, the function gcd(a,b) means finding the greatest common divisor of a and b on the GF(2) field, a and b represent any two polynomials; [n / 2] represents the integer of n / 2. If the verification is true, it means that the polynomial P1(x) is an irreducible polynomial. Otherwise, it means that the obtained polynomial P1(x) is not an irreducible polynomial, and the random number P1 needs to be regenerated to construct the irreducible polynomial P1(x). Then, the random number S1 is used as the input random number together with the irreducible polynomial P1(x) to generate the hash function Hash1 based on the linear feedback shift register.

[0089] The sending unit performs a hash operation on the message Mess through the hash function Hash1 to obtain an n-bit hash value H1(Mess). Then, based on the hash value H1(Mess), a file digest DIG about the message Mess is generated. The file digest DIG is expressed as: DIG = [H1(Mess), P1]. That is, the file digest DIG is concatenated by [H1(Mess) string and P1 string, which can be expressed as H1(Mess)+P1 or P1+H1(Mess), and the value of the file digest DIG finally obtained is 2n bits. The sending unit uses the 2n-bit random number T1 to XOR-encrypt the file digest DIG to obtain the verification code MAC of the message Mess. The verification code MAC is expressed as: Then the message Mess and the verification code MAC are sent to the receiving unit. In order to reduce the transmission pressure, the message Mess and the verification code MAC are transmitted through the classic authentication channel, that is, through the classic communication network.

[0090] S3: The receiving unit receives the message and the verification code, which are recorded as message Mess′ and verification code MAC′, respectively, and then performs file verification. In order to better illustrate this embodiment, this embodiment briefly explains the marking of file transmission and reception: suppose that unit I transmits file K to unit J, and the file received by unit J may not be exactly the same as the file sent by unit I. Therefore, the file received by unit J is set to be K′. If the file has not been tampered with or implanted during the transmission process, file K′ is equal to file K; if the file has been tampered with or implanted, file K′ is not equal to file K. Therefore, the message and verification code received by the receiving unit are recorded as message Mess′ and verification code MAC′, respectively.

[0091] The receiving unit uses the random number T1 shared with the sending unit to perform XOR decryption on the verification code MAC' to obtain the file digest DIG'. The process of XOR decryption of the verification code MAC' is expressed as: When the verification code MAC′ is decrypted, an n-bit hash value H′1(Mess) and an n-bit random number P′1 are obtained. The receiving unit generates an irreducible polynomial P′1(x) based on the random number P′1. The specific process of generating the irreducible polynomial P′1(x) refers to the irreducible polynomial P1(x) and will not be described here. Then, a new hash function Hash′1 based on a linear feedback shift register is generated based on the irreducible polynomial P′1(x) and the shared random number S1. Finally, the receiving unit uses the new hash function Hash′1 to perform a hash operation on the message Mess′ to obtain a new hash value H′1(Mess'). At this time, if the new hash value H′1(Mess′) is equal to the hash value H′1(Mess) in the MAC′ obtained by decryption, the file verification is passed, which means that the message Mess′ received by the receiving unit has not been tampered with, implanted with other content, or lost compared to the message Mess sent by the sending unit, so that the integrity verification of the received message Mess′ can be realized, and the receiving unit stores the message Mess′ and the hash value H′1(Mess). If the new hash value H′1(Mess′) is not equal to the hash value H′1(Mess) in the MAC′ obtained by decryption, the file verification fails, which means that the message Mess′ received by the receiving unit has been tampered with, implanted with other content, or lost compared to the message Mess sent by the sending unit, and the receiving unit abandons the message Mess′. Before generating the verification code MAC about the message Mess, the receiving unit cannot know the irreducible polynomial in advance, thereby increasing the security guarantee of the verification code MAC and avoiding the risk of the verification code MAC being easily known due to the use of other algorithms, so that the integrity of the message Mess can be guaranteed and the message Mess can be prevented from being tampered with or implanted.

[0092] S4: The sending unit shares the one-time identity OTID with the quantum CA.

[0093] The sending unit shares an m-bit binary random number S3 and a 2m-bit binary random number T3 with the quantum CA. Where m is a positive integer greater than 0. Specifically, T3 can be regarded as a combination of two m-bit binary random numbers u and v, then the random number T3 can be expressed as T3 = [u, v], where the number of bits of u and v is equal to the number of bits of m, both of which are 128 bits. Then, the sending unit locally generates an m-bit binary random number P3, and generates an irreducible polynomial P3(x) based on the random number P3. The process of generating the irreducible polynomial P3(x) refers to the irreducible polynomial P1(x). After the irreducible polynomial P3(x) is generated, the random number S3 is used as the input random number and the irreducible polynomial P3(x) is used to generate a hash function Hash3 based on a linear feedback shift register. The sending unit substitutes the private identity Pri obtained from the quantum CA into the hash function Hash3 to generate a hash value H3(Pri) about the private identity Pri. The sending unit generates a one-time certificate OTCA based on the hash value H3(Pri), and the one-time certificate OTCA is represented as Then, the sending unit sends the generated one-time certificate OTCA to the quantum CA.

[0094] The quantum CA receives the one-time certificate and records it as the one-time certificate OTCA′. Then, the quantum CA performs an XOR operation on the one-time certificate OTCA′ using the random number T3, that is, Then, a hash value H3(Pri)′ and a random number P′3 are obtained. Furthermore, the quantum CA generates an irreducible polynomial P′3(x) based on the random number P′3, and uses the random number S3 shared with the sending unit as the input random number and the irreducible polynomial P′3(x) to generate a new hash function Hash′3 based on a linear feedback shift register. Since the sending unit obtains the private identity Pri from the quantum CA, the quantum CA locally stores the private identity Pri of the sending unit. Therefore, after the quantum CA generates the hash function Hash′3, the quantum CA substitutes the locally stored private identity Pri into the hash function Hash′3 to obtain a new hash value H′3(Pri) for the private identity Pri, and then performs identity authentication. If the new hash value H′3(Pri) is equal to the hash value H3(Pri)′, the identity authentication is passed, and the sending unit and the quantum CA obtain the same one-time identity OTID. The one-time identity OTID is expressed as or If the new hash value H′3(Pri) is not equal to the hash value H3(Pri)′, the identity authentication fails, and the sending unit and the quantum CA re-execute the step of sharing the one-time identity OTID.

[0095] Since the one-time identity OTID is obtained by performing a hash operation on the private identity Pri through a hash function H3(Pri) based on a linear feedback shift register, and performing XOR encryption. Its security depends on the irreducible polynomial P3(x), the random number S3 as the input random number, and the random number T3 for XOR encryption, and the irreducible polynomial P3(x) depends on the random number P3 generated locally by the sending unit. Before the one-time certificate OTID is generated, the quantum CA and other recipients cannot know it, so the security of the one-time identity OTID can be guaranteed. In the case of using the one-time identity OTID, the private identity Pri can be hidden to avoid the exposure of the private identity Pri, thereby improving the security of the three-party signature file Sign. In addition, the introduction of the random number P3, S3 and T3 variables can provide the possibility of a one-time change of the one-time identity OTID, further improving the security of the three-party signature file Sign, and there is no need to introduce other variables. While this implementation of sharing the one-time identity OTID between the sending unit and the quantum CA can authenticate the private identity of the sending unit and ensure the association between the one-time identity and the private identity. By authenticating the user unit, a unique correspondence between the one-time identity OTID and the user unit's private identity Pri can be established, providing a guarantee for the security of the three-party signature file. The three-party signature mentioned in this application refers to one party generating a signature file, and the other two parties receiving the signature and performing signature verification.

[0096] S5: The sending unit generates a three-party signature file Sign based on the one-time identity OTID and the hash value H1(Mess), and generates a hash value H2(Sign) based on the three-party signature file Sign, and then generates a signature summary Abstr about the three-party signature file Sign based on the hash value H2(Sign), and sends the three-party signature file Sign and the encrypted signature summary Abstr to the receiving unit.

[0097] First, the sending unit and the receiving unit negotiate a key and obtain a binary shared key X. AB and shared key Y AB ; And, the sending unit and the quantum CA perform key negotiation to obtain the binary shared key X AC and shared key Y AC Among them, the shared key X AB and shared key X AC The character length of is the same as that of the shared key X, which is set to i bits. i is a positive integer greater than 0. In this embodiment, i is 128 bits. AB and shared key Y AC The characters of are the same length, which is set to j bits. Shared key Y AB The character length of the shared key is X ABTwice the length of the character, i.e. j = 2i. In this case, the shared key Y AC The character length of the shared key is X AC Twice the character length of .

[0098] The sending unit will then share the key X AB , shared key Y AB , shared key X AC and the shared key Y AC Perform XOR operation to get the key X A and key Y A , the process of XOR operation is expressed as:

[0099]

[0100]

[0101] In addition, the sending unit generates a binary random number P2 locally, and generates an irreducible polynomial P2(x) based on the random number P2. The specific generation process can refer to the generation process of the irreducible polynomial P1(x). On the basis of generating the irreducible polynomial P2(x), the key X A The random number is used as input together with the irreducible polynomial P2(x) to generate the hash function Hash2 based on the linear feedback shift register.

[0102] Then, the sending unit generates a three-party signature file Sign based on the one-time identity OTID and the hash value H1 (Mess). The three-party signature file Sign is specifically expressed as: Sign = [H1 (Mess), OTID]. The three-party signature file Sign represents the concatenation of the character string of the hash value H1 (Mess) and the character string of the OTID. Of course, in practical applications, the three-party signature file Sign should also include other necessary fields, which include but are not limited to information such as timestamp and / or business number. On this basis, the three-party signature file Sign is hashed by the hash function Hash2 to generate a hash value H2 (Sign). Thus, a signature summary Abstr about the hash value H2 (Sign) is generated, and the signature summary Abstr is specifically expressed as Abstr = [H2 (Sign), P2].

[0103] Finally, the sending unit passes the key Y A The signature summary Abstr is XOR-encrypted. The encryption process of the signature summary Abstr is expressed as follows: Then the sending unit sends the three-party signature file Sign and the encrypted signature summary Abstr to the receiving unit through the classic authentication channel. The one-time identity OTID is used to sign the hash value H1(Mess) to form the three-party signature file Sign, which can achieve one-time change at the same time as the signature, thereby improving the security of the signature. And further by calculating its hash value H2(Sign), and then generating the signature summary Abstr, it is encrypted and sent to the receiving unit, further improving the security for subsequent signature verification.

[0104] S6: The receiving unit receives the three-party signature file and the signature summary, which are recorded as the three-party signature file Sign′ and the encrypted signature summary Abstr′ respectively, and then performs signature verification with the quantum CA. If the signature verification of the quantum CA and the receiving unit is passed, the receiving unit accepts the signature and stores the received message Mess′.

[0105] Specifically, the receiving unit receives the three-party signature file and the signature summary, which are recorded as the three-party signature file Sign′ and the signature summary Abstr′ respectively. At this time, the receiving unit cannot verify, but first sends the three-party signature file Sign′ and the encrypted signature summary Abstr′ together with the shared key X AB and the shared key Y AB Send them together to Quantum CA.

[0106] The quantum CA receives the three-party signature file, encrypted signature summary, and shared key X sent by the receiving unit. AB and the shared key Y AB , respectively recorded as the three-party signature file Sign″, the encrypted signature summary Abstr″, and the shared key X′ AB and the shared key Y′ AB At this point, the quantum CA has obtained four complete shared keys, so it first AB , shared key Y′ AB , shared key X AC and the shared key Y AC Perform XOR operation to get the key X C and key Y C , the process of XOR operation is expressed as:

[0107]

[0108]

[0109] Then, the quantum CA uses the key Y C Decrypt the encrypted signature digest Abstr″: Get the signature summary [H2(Sign)″, P″2]. Thus, we get the hash value H2(Sign)″ and the random number P″2. Generate the irreducible polynomial P″2(x) through the random number P2″. ​​The specific generation process will not be repeated here. Finally, the key X C The random number as input is used together with the irreducible polynomial P″2(x) to generate the hash function Hash″2 based on the linear feedback shift register.

[0110] Finally, the quantum CA performs a hash operation on the received three-party signature file Sign" through the hash function Hash"2 to generate a hash value H"2(Sign"), and compares the hash value H"2(Sign") obtained by the operation with the hash value H2(Sign)" obtained by decryption: If they are the same, the quantum CA passes the signature verification of the hash value H1(Mess), and the quantum CA will share the shared key X AC and shared key Y AC Together with the verification result of the verification, it is sent to the receiving unit. If they are different, the signature verification of the quantum CA fails, and the quantum CA directly sends the failed signature verification result to the receiving unit through the classic authentication channel.

[0111] The receiving unit receives the signature verification result of the quantum CA. If the signature verification result of the quantum CA is a verification failure, the digital signature verification fails, the receiving unit refuses to accept the signature, and abandons storing the received message Mess′. If the signature verification result of the quantum CA is a verification success, the receiving unit receives the shared key X AC and shared key Y AC , respectively denoted as shared key X′ AC and the shared key Y′ AC The receiving unit also obtains the four complete shared keys. Then the receiving unit uses the shared key X AB , shared key Y AB , shared key X′ AC and the shared key Y′ AC Perform XOR operation to get the key X B and key Y B , the process of XOR operation is expressed as:

[0112]

[0113]

[0114] The receiving unit uses the key Y B Decrypt the encrypted signature digest Abstr′: Get the signature summary [H2(Sign)′, P′2], and then get the hash value H2(Sign)′ and the random number P′2. Generate the irreducible polynomial P′2(x) through the random number P′2, and convert the key X B As the input random number, it is used together with the irreducible polynomial P′2(x) to generate the hash function Hash′2 based on the linear feedback shift register. The receiving unit performs a hash operation on the received three-party signature file Sign′ through the hash function Hash′2 to generate a hash value H′2(Sign′), and compares the hash value H′2(Sign′) with the hash value H2(Sign)′: if they are the same, the verification is passed, the receiving unit verifies the signature of the hash value H1(Mess), the receiving unit accepts the signature, and stores the message Mess′, which is the message Mess sent by the sending unit; otherwise, the verification fails, the receiving unit refuses to sign, and gives up storing the message Mess′, and ends the digital signature verification process or re-executes the digital signature verification process. On the basis of the quantum CA signature verification, the receiving unit performs signature verification. If the verification is successful, it indicates that the signature verification is successful, thereby ensuring the non-repudiation of the message Mess. Moreover, in the process of the above-mentioned digital signature verification, the three-party signature file Sign based on the one-time identity OTID is sent to the quantum CA for signature verification through the receiving unit, without sending the received message Mess to the quantum CA, thereby avoiding excessive memory occupation of the quantum CA due to the excessive content of the message Mess, reducing the storage burden of the quantum CA, and improving the efficiency of signature verification, greatly improving the agility of digital signature verification. The agility mentioned here refers to the processing efficiency of signature verification.

[0115] The implementation of the present invention adopts one-time pad technology and one-time global hash technology to ensure file verification, identity verification and signature verification, which can resist the attack threat brought by the improvement of computer computing power. In order to further improve the security of the entire signature verification process, the random number in this embodiment preferably adopts quantum random number, so that the security of signature verification reaches the quantum security level.

[0116] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless clearly stated herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. For example, step S1 can be executed before step S3, can be executed synchronously with step S3, or even after step S3. In addition, at least a portion of the steps in the flowcharts involved in the above-mentioned embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0117] Example 2

[0118] This embodiment provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the digital signature verification method in the above-mentioned embodiment 1 when executing the computer program.

[0119] Example 3

[0120] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the digital signature verification method in the above-mentioned embodiment 1 is implemented.

[0121] Example 4

[0122] This embodiment provides a computer program product, including a computer program, which implements the digital signature verification method in the above-mentioned embodiment 1 when executed by a processor.

[0123] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An agile digital signature verification method, characterized in that: include: The sending unit generates a message Mess; The sending unit generates a hash value H1(Mess) based on the message Mess, generates a verification code MAC about the message Mess based on the hash value H1(Mess), and then sends the message Mess and the verification code MAC to the receiving unit; The receiving unit receives the message and the verification code, which are recorded as message Mess′ and verification code MAC′ respectively, and then performs file verification; The sending unit shares the one-time identity OTID with the quantum CA; The sending unit generates a three-party signature file Sign based on the one-time identity OTID and the hash value H1(Mess), generates a hash value H2(Sign) based on the three-party signature file Sign, then generates a signature summary Abstr about the three-party signature file Sign based on the hash value H2(Sign), and sends the three-party signature file Sign and the encrypted signature summary Abstr to the receiving unit; The receiving unit receives the three-party signature file and the encrypted signature summary, which are recorded as the three-party signature file Sign′ and the encrypted signature summary Abstr′ respectively, and then performs signature verification together with the quantum CA. If the signature verification of the quantum CA and the receiving unit is passed, the receiving unit accepts the signature and stores the received message Mess′; The sending unit generates a hash value H1(Mess) based on the message Mess, generates a verification code MAC about the message Mess based on the hash value H1(Mess), and then sends the message Mess and the verification code MAC to the receiving unit. The process includes: The sending unit and the receiving unit share an n-bit binary random number S1 and a 2n-bit binary random number T1, where n is a positive integer greater than 0; The sending unit locally generates an n-bit binary random number P1, and generates an irreducible polynomial P1(x) based on the random number P1, and then uses the random number S1 as an input random number and the irreducible polynomial P1(x) to generate a hash function Hash1 based on a linear shift register; The sending unit performs a hash operation on the message Mess through a hash function Hash1 to obtain a hash value H1(Mess), and generates a file digest DIG about the message Mess based on the hash value H1(Mess), wherein the file digest DIG is expressed as: DIG=[H1(Mess), P1]; The sending unit uses the random number T1 to XOR-encrypt the file digest DIG to obtain the verification code MAC of the message Mess. The verification code MAC is expressed as: MAC = DIG ⊕ T1, and then sends the message Mess and the verification code MAC to the receiving unit; The receiving unit receives the message and the verification code, which are respectively recorded as the message Mess′ and the verification code MAC′, and then performs the file verification process including: The receiving unit receives the message and the verification code, which are respectively recorded as the message Mess′ and the verification code MAC′; The receiving unit uses the random number T1 to XOR decrypt the verification code MAC' to obtain the file digest DIG', and then obtains the hash value H ′ 1(Mess) and random number P1 ′ ; The receiving unit is based on the random number P1 ′ Generate irreducible polynomial P1 ′ (x), then based on the irreducible polynomial P1 ′ (x) and random number S1 generate a new hash function Hash based on linear shift register ′ 1; The receiving unit uses the new hash function Hash ′ 1 Perform hash operation on the message Mess′ to obtain a new hash value - H ′ 1(Mess′), if the new hash value is H ′ 1(Mess′) and hash value H ′ 1(Mess), the file verification is successful, and the receiving unit stores the message Mess′ and the hash value H ′ 1 (Mess); otherwise, the file verification fails and the receiving unit abandons the message Mess′; The process of the sending unit sharing the one-time identity OTID with the quantum CA includes: The sending unit shares an m-bit binary random number S3 and a 2m-bit binary random number T3 with the quantum CA. The random number T3 is expressed as T3 = [u, v], where u and v are both m-bit binary random numbers, and m is a positive integer greater than 0. The sending unit locally generates an m-bit random number P3, and generates an irreducible polynomial P3(x) based on the random number P3, and then uses the random number S3 as an input random number and the irreducible polynomial P3(x) to generate a hash function Hash3 based on a linear shift register; The sending unit substitutes the private identity Pri obtained from the quantum CA into the hash function Hash3 to generate a hash value H3(Pri) of the private identity Pri; The sending unit generates a one-time certificate OTCA based on the hash value three H3(Pri), wherein the one-time certificate OTCA is expressed as OTCA=[H3(Pri), P3]⊕T3, and sends the one-time certificate OTCA to the quantum CA; The quantum CA receives the one-time certificate, recorded as the one-time certificate OTCA′, and performs identity authentication: if the authentication is successful, the sending unit and the quantum CA obtain the same one-time identity OTID = [H3(Pri), P3] ⊕ u; otherwise, the process of sharing the one-time identity OTID between the sending unit and the quantum CA is re-executed; The sending unit generates a three-party signature file Sign based on the one-time identity OTID and a hash value H1(Mess), generates a hash value H2(Sign) based on the three-party signature file Sign, then generates a signature summary Abstr about the three-party signature file Sign based on the hash value H2(Sign), and sends the three-party signature file Sign and the signature summary Abstr to the receiving unit. The process includes: The sending unit and the receiving unit negotiate a key and obtain a binary shared key X AB and shared key Y AB ; The sending unit and quantum CA perform key negotiation and obtain the binary shared key X AC and shared key Y AC ; Among them, the shared key X AB and shared key X AC The characters are the same length, and the shared key Y AB and shared key Y AC have the same character length and share the same key Y AB The character length of the shared key is X AB Twice the length of a character; The sending unit will share the key X AB , shared key Y AB , shared key X AC and the shared key Y AC Perform XOR operation to get the key X A and key Y A , the process of XOR operation is expressed as: X A =X AB ⊕X AC , AND A =And AB ⊕And AC ; The sending unit generates a binary random number P2 locally, and generates an irreducible polynomial P2(x) based on the random number P2, and then converts the key X A The random number is used as input together with the irreducible polynomial P2(x) to generate the hash function Hash2 based on the linear shift register; The sending unit generates a three-party signature file Sign based on the one-time identity OTID and the hash value H1(Mess), and the three-party signature file Sign is represented by: Sign=[H1(Mess), OTID]; and performs a hash operation on the three-party signature file Sign through a hash function Hash2 to generate a hash value H2(Sign), and then generates a signature summary Abstr based on the hash value H2(Sign), and the signature summary Abstr is represented by Abstr=[H2(Sign), P2]; The sending unit passes the key Y A The signature summary Abstr is encrypted by XOR. The encryption process of the signature summary Abstr is expressed as: Abstr⊕Y A , and then send the three-party signature file Sign and the encrypted signature summary Abstr to the receiving unit; The receiving unit receives the three-party signature file and the encrypted signature summary, which are respectively recorded as the three-party signature file Sign′ and the encrypted signature summary Abstr′, and then performs signature verification with the quantum CA, including: The receiving unit receives the three-party signature file and the encrypted signature summary, which are recorded as the three-party signature file Sign′ and the encrypted signature summary Abstr′ respectively, and then transmits the three-party signature file Sign′ and the encrypted signature summary Abstr′ together with the shared key X AB and the shared key Y AB Send them to the quantum CA through the authentication channel together; Quantum CA receives the three-party signature file, encrypted signature summary, and shared key X AB and the shared key Y AB , respectively recorded as the three-party signature file Sign″, the encrypted signature summary Abstr″, and the shared key X ′ AB and the shared key Y ′ AB , then the shared key X ′ AB , shared key Y ′ AB , shared key X AC and the shared key Y AC Perform XOR operation to get the key X C and key Y C , the process of XOR operation is expressed as: X C =X ′ AB ⊕X AC , AND C =And ′ AB ⊕And AC ; Quantum CA uses key Y C Decrypt the encrypted signature summary Abstr″ to obtain the signature summary [H2(Sign)″, P2″], and then obtain the hash value H2(Sign)″ and the random number P2″; then generate the irreducible polynomial P2″(x) based on the random number P2″, and then convert the key X C As the input random number and the irreducible polynomial P2″(x), a hash function based on a linear shift register is generated. ′ 2 ′ ; Quantum CA uses hash function Hash ′ 2 ′ Perform a hash operation on the received three-party signature file Sign″ to generate a hash value H ′ 2 ′ (Sign″), and the hash value obtained by the operation is H ′ 2 ′ (Sign″) is compared with the hash value H2(Sign)″ obtained by decryption: If they are the same, the signature verification of Quantum CA is passed, and Quantum CA will share the key X AC and shared key Y AC Together with the signature verification result of the quantum CA, it is sent to the receiving unit through the authentication channel; otherwise, the signature verification of the quantum CA fails, and the quantum CA directly sends its signature verification result to the receiving unit through the authentication channel.

2. The agile digital signature verification method according to claim 1, characterized in that: The message Mess includes: a message file Doc and a user public certificate CA.

3. The agile digital signature verification method according to claim 1, characterized in that: The process in which the quantum CA receives a one-time certificate, recorded as a one-time certificate OTCA′, and performs identity authentication includes: The quantum CA obtains a one-time certificate, recorded as a one-time certificate OTCA′, and decrypts the one-time certificate OTCA′ by XOR operation through the random number T3, and then obtains the decrypted hash value H3(Pri)′ and the random number P3 ′ ; Quantum CA based on random number P3 ′ Generate irreducible polynomial P3 ′ (x), then based on the irreducible polynomial P3 ′ (x) and random number S3 generate a new hash function Hash based on linear shift register ′ 3; The quantum CA substitutes the locally stored private identity Pri into the hash function Hash ′ 3. Get a new hash value H for the private identity Pri ′ 3(Pri); if the new hash value is three H ′ 3(Pri) is equal to the decrypted hash value H3(Pri)′, the authentication succeeds; otherwise, the authentication fails.

4. The agile digital signature verification method according to claim 1, characterized in that: The receiving unit receives the three-party signature file and the encrypted signature summary, which are recorded as the three-party signature file Sign′ and the encrypted signature summary Abstr′ respectively, and then performs signature verification with the quantum CA, and the process also includes: The receiving unit receives the signature verification result of the quantum CA. If the signature verification result is a verification failure, the receiving unit refuses to sign and abandons the storage of the message Mess′; if the signature verification result is a verification success, the receiving unit receives the shared key X AC and shared key Y AC , respectively denoted as shared key X ′ AC and shared key Y ′ AC , and share the key X AB , shared key Y AB , shared key X ′ AC and the shared key Y ′ AC Perform XOR operation to get the key X B and key Y B , the process of XOR operation is expressed as: X B =X AB ⊕X ′ AC , AND B =And AB ⊕And ′ AC ; The receiving unit uses the key Y B Decrypt the encrypted signature summary Abstr′ to obtain the signature summary [H2(Sign)′, P2 ′ ], and then obtain the decrypted hash value H2(Sign)′ and the random number P2 ′ ; Then based on the random number P2 ′ Generate irreducible polynomial P2 ′ (x), and the key X B As input random number and irreducible polynomial P2 ′ (x) Jointly generate a hash function Hash based on a linear shift register ′ 2; The receiving unit uses the hash function Hash ′ 2 Perform a hash operation on the received three-party signature file Sign′ to generate a hash value H ′ 2(Sign′), and the hash value is H ′ 2(Sign′) is compared with the decrypted hash value H2(Sign)′: if they are the same, the signature verification of the receiving unit is passed and the receiving unit accepts the signature; otherwise, the signature verification of the receiving unit fails, the receiving unit refuses to sign, and abandons storing the message Mess′.

5. An agile digital signature verification system based on the agile digital signature verification method according to any one of claims 1 to 4, characterized in that: It includes a sending unit, a receiving unit and a quantum CA; The sending unit is configured to generate a message Mess, and generate a hash value H1(Mess) based on the message Mess, and then generate a verification code MAC about the message Mess based on the hash value H1(Mess), and finally send the message Mess and the verification code MAC to the receiving unit; the sending unit is also configured to share a one-time identity OTID with the quantum CA, and generate a three-party signature file Sign based on the one-time identity OTID and the hash value H1(Mess), and then generate a hash value H2(Sign) based on the three-party signature file Sign, and finally generate a signature summary Abstr about the three-party signature file Sign based on the hash value H2(Sign), and send the three-party signature file Sign and the encrypted signature summary Abstr to the receiving unit; The receiving unit is configured to receive a message and a verification code sent by the sending unit, which are respectively recorded as a message Mess′ and a verification code MAC′, and then perform file verification; the receiving unit is also configured to receive a three-party signature file and an encrypted signature summary sent by the sending unit, which are respectively recorded as a three-party signature file Sign′ and an encrypted signature summary Abstr′, and then perform signature verification together with the quantum CA; The quantum CA is configured to provide the sending unit with the user's public certificate CA and the private identity Pri.

6. A computer device, characterized in that: include: a memory storing a computer program; The processor is configured to implement the digital signature verification method described in any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the digital signature verification method according to any one of claims 1 to 4 is implemented.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the digital signature verification method described in any one of claims 1 to 4 is implemented.

Images