Digital signature method, device, equipment and computer-readable storage medium

Abstract

The present invention relates to the field of data security technology, and discloses a digital signature method, apparatus, device, and computer-readable storage medium. According to key parameter information, a first type of vector group and a first part of the public key are selected from the extended domain, and a second type of vector group is selected from the base domain; based on the first type of vector group, the second type of vector group, and the first part of the public key, a private key and a second part of the public key are constructed, an interference vector is selected from the extended domain, and the interference vector and the first part of the public key are used to determine a commitment vector. The commitment vector, the private key, the interference vector, and the target message are processed based on a hash function to obtain a digital signature of the target message; the target message is a data stream converted from the message to be signed to the extended domain. The digital signature method provided by the present invention can resist quantum computing attacks and known key recovery attacks, enhance system security, and effectively shorten the signature length.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a digital signature method, apparatus, device and computer-readable storage medium. Background Art

[0002] Digital signatures are one of the most important basic cryptographic primitives, providing functions similar to handwritten signatures in digital form, such as identity authentication, non-repudiation, and tamper-proofing. They have important applications in scenarios such as e-commerce, e-government, and blockchain services. There are many technical approaches to designing digital signature schemes, such as constructing signature schemes based on difficult number theory problems such as prime factorization and solving discrete logarithms. Traditional digital signature schemes, such as RSA (Rivest-Shamir-Adleman, an asymmetric encryption algorithm) and DSS (Digital Signature Standard), are algorithms constructed based on the aforementioned difficult number theory problems. Digital signatures implemented based on these algorithms are difficult to resist quantum computing attacks.

[0003] The general decoding problem in coding theory can resist quantum computing attacks and provides important theoretical support for constructing quantum-safe digital signature schemes. However, current digital signature schemes based on coding theory often suffer from security vulnerabilities, such as being difficult to resist key recovery attacks.

[0004] It can be seen that how to improve the security of digital signatures is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of the embodiments of the present invention is to provide a digital signature method, apparatus, device and computer-readable storage medium, which can solve the problem of weak digital signature security.

[0006] To solve the above technical problems, an embodiment of the present invention provides a digital signature method, comprising:

[0007] According to the key parameter information, a first type of vector group and a first part of the public key are selected from the extended domain, and a second type of vector group is selected from the base domain;

[0008] Constructing a private key and a second part of the public key based on the first type of vector group, the second type of vector group, and the first part of the public key;

[0009] Selecting an interference vector from the extended domain, and determining a commitment vector using the interference vector and the first part of the public key;

[0010] The commitment vector, the private key, the interference vector and the target message are processed based on a hash function to obtain a digital signature of the target message; wherein the target message is a data stream converted from a message to be signed to the extended domain.

[0011] In one aspect, the key parameter information includes the subspace dimension, the number of rows and columns of the first matrix, and the number of rows and columns of the second matrix;

[0012] The key parameter information includes selecting a first type of vector group and a first part of the public key from the extended domain and selecting a second type of vector group from the base domain:

[0013] Selecting a full rank matrix from the extended field as the first part of the public key;

[0014] Selecting a subspace from the expanded domain that matches the subspace dimension;

[0015] Randomly selecting a first type of vector group from the subspace that matches the number of rows and columns of the first matrix;

[0016] A second type of vector group that matches the number of rows and columns of the second matrix is ​​randomly selected from the base domain.

[0017] On the one hand, selecting a full rank matrix from the extended field as the first part of the public key includes:

[0018] A full-rank matrix that meets the public key size is randomly selected from the extended field as the first part of the public key.

[0019] On the one hand, randomly selecting the first type of vector group that matches the number of rows and columns of the first matrix from the subspace includes:

[0020] The number of rows of the first matrix is ​​used as the length of the first-category vector, and the number of columns of the first matrix is ​​used as the number of the first-category vector;

[0021] Based on the length of the first-category vectors, a plurality of first-category vectors that match the number of the first-category vectors are randomly selected from the subspace.

[0022] On the one hand, randomly selecting a plurality of first-category vectors matching the number of the first-category vectors from the subspace based on the length of the first-category vectors includes:

[0023] Randomly select a non-zero column vector of the same length as the first-category vector from the remaining vectors of the first-category vector space; wherein the first-category vector space is a set consisting of all column vectors whose component elements are taken from the subspace and whose length is the same as the first-category vector;

[0024] The linear space spanned by all the selected non-zero column vectors on the basis domain is deleted from the first-category vector space, and the step of randomly selecting a non-zero column vector with a length of the first-category vector from the remaining vectors in the first-category vector space is returned to; until the number of selected non-zero column vectors reaches the number of the first-category vectors, the non-zero column vectors are sorted column by column to obtain the first-category vector group.

[0025] On the one hand, randomly selecting a plurality of first-category vectors matching the number of the first-category vectors from the subspace based on the length of the first-category vectors includes:

[0026] Randomly select non-zero column vectors of the same length as the first-category vectors from the first-category vector space according to the number of the first-category vectors; wherein the first-category vector space is the set of all column vectors whose component elements are taken from the subspace and whose length is the length of the first-category vector;

[0027] Determining whether all the non-zero column vectors are linearly independent on the basis domain;

[0028] In a case where all the non-zero column vectors are linearly independent on the basis domain, sorting all the non-zero column vectors column by column to obtain the first type of vector group;

[0029] In the case that all the non-zero column vectors are linearly correlated on the basis domain, all the non-zero column vectors currently selected are discarded, and the step of randomly selecting non-zero column vectors with the same length as the first category of vectors from the subspace according to the number of the first category of vectors is returned.

[0030] On the one hand, randomly selecting the second type of vector group that matches the number of rows and columns of the second matrix from the base domain includes:

[0031] The number of rows of the second matrix is ​​used as the number of second-category vectors, and the number of columns of the second matrix is ​​used as the length of the second-category vectors;

[0032] According to the length of the second-category vectors, a plurality of second-category vectors that match the number of the second-category vectors are randomly selected from the base domain.

[0033] On the one hand, randomly selecting a plurality of second-category vectors matching the number of the second-category vectors from the base domain based on the length of the second-category vectors includes:

[0034] Based on the number of the second-category vectors, randomly selecting row vectors of the same length as the second-category vectors from the second-category vector space; wherein the second-category vector space is a set consisting of all vectors whose component elements are taken from the base domain and whose length is the same as the second-category vectors;

[0035] The row vectors are sorted row by row to obtain the second type of vector group.

[0036] On the one hand, constructing a private key and a second part of the public key based on the first type of vector group, the second type of vector group, and the first part of the public key includes:

[0037] Performing a matrix multiplication operation on the first type of vector group and the second type of vector group to obtain the private key;

[0038] The second partial public key is determined based on the private key and the first partial public key.

[0039] In one aspect, determining the second part of the public key based on the private key and the first part of the public key includes:

[0040] Perform a matrix multiplication operation on the private key and the transpose of the first part of the public key to obtain the second part of the public key.

[0041] In one aspect, selecting an interference vector from the extended domain and determining a commitment vector using the interference vector and the first part of the public key includes:

[0042] Selecting an interference vector from the extended domain according to an interference vector length and an interference vector rank weight;

[0043] A vector-matrix multiplication operation is performed on the interference vector and the transpose of the first part of the public key to obtain the commitment vector.

[0044] In one aspect, the processing the commitment vector, the private key, the interference vector, and the target message based on a hash function to obtain a digital signature of the target message includes:

[0045] compressing the target message and the commitment vector using the hash function to obtain a first partial signature;

[0046] A second partial signature is constructed based on the first partial signature, the private key, and the interference vector.

[0047] In one aspect, constructing a second partial signature based on the first partial signature, the private key, and the interference vector includes:

[0048] Performing a vector-matrix multiplication operation on the first partial signature and the private key to obtain an initial operation result;

[0049] An addition operation is performed on the initial operation result and the interference vector to obtain the second partial signature.

[0050] On the one hand, after processing the commitment vector, the private key, the interference vector, and the target message based on the hash function to obtain the digital signature of the target message, the method further includes:

[0051] Converting the message to be signed into a target data stream on the extended domain;

[0052] determining a potential commitment vector based on the public key and the digital signature;

[0053] compressing the potential commitment vector and the target data stream using the hash function to obtain a first portion of the potential signature;

[0054] Determining whether the first partial potential signature is consistent with the first partial signature;

[0055] In the case that the first partial potential signature is consistent with the first partial signature, the digital signature is determined to be valid.

[0056] On the one hand, converting the message to be signed into the target data stream on the extended domain includes:

[0057] Obtain the message type to which the message to be signed belongs;

[0058] The message to be signed is converted into a target data stream on the extended domain in a reversible transformation manner that matches the message type.

[0059] In one aspect, determining a potential commitment vector based on the public key and the digital signature includes:

[0060] Performing a vector-matrix multiplication operation on the transpose of the second partial signature and the first partial public key to obtain a first operation result;

[0061] Performing a vector-matrix multiplication operation on the first partial signature and the second partial public key to obtain a second operation result;

[0062] Perform a subtraction operation on the first operation result and the second operation result to obtain the potential commitment vector.

[0063] On the one hand, before converting the message to be signed into the target data stream on the extended domain, the method further includes:

[0064] Determining whether the rank weight of the second partial signature is less than or equal to a rank weight threshold; wherein the rank weight threshold is set according to the rank weight of the interference vector and the number of vectors included in the first type of vector group;

[0065] In a case where the rank weight of the second partial signature is less than or equal to the rank weight threshold, the step of converting the message to be signed into the target data stream on the extended domain is performed.

[0066] On the one hand, it also includes:

[0067] In a case where the rank weight of the second partial signature is greater than the rank weight threshold or the first partial potential signature is inconsistent with the first partial signature, the digital signature is determined to be invalid.

[0068] On the one hand, before selecting the first type of vector group and the first part of the public key from the extended domain and selecting the second type of vector group from the base domain based on the key parameter information, the method further includes:

[0069] Querying basic parameters that match the security requirements from a parameter correspondence table; wherein the basic parameters include key parameter information;

[0070] Selecting the base domain and its corresponding extended domain according to the number of expansions included in the basic parameters;

[0071] A matching hash function is selected according to the hash function output length included in the basic parameters.

[0072] The embodiment of the present invention further provides a digital signature device, comprising a vector selection unit, a construction unit, a determination unit, and a signature unit;

[0073] The vector selection unit is configured to select a first type of vector group and a first part of the public key from the extended domain and a second type of vector group from the base domain based on the key parameter information;

[0074] The construction unit is configured to construct a private key and a second part of the public key based on the first type of vector group, the second type of vector group, and the first part of the public key;

[0075] The determining unit is configured to select an interference vector from the extended domain, and determine a commitment vector using the interference vector and the first part of the public key;

[0076] The signature unit is configured to process the commitment vector, the private key, the interference vector, and the target message based on a hash function to obtain a digital signature of the target message; wherein the target message is a data stream converted from the message to be signed to the extended domain.

[0077] In one aspect, the key parameter information includes the subspace dimension, the number of rows and columns of the first matrix, and the number of rows and columns of the second matrix;

[0078] The vector selection unit is used to select a full-rank matrix from the extended domain as the first part of the public key; select a subspace that matches the dimension of the subspace from the extended domain; randomly select the first type of vector group that matches the number of rows and columns of the first matrix from the subspace; and randomly select the second type of vector group that matches the number of rows and columns of the second matrix from the base domain.

[0079] On the one hand, the vector selection unit is used to randomly select a full rank matrix that meets the public key size from the extended field as the first part of the public key.

[0080] In one aspect, the vector selection unit includes a first acting subunit and a first type vector selection subunit;

[0081] The first subunit is configured to use the number of rows of the first matrix as the length of the first-category vector and the number of columns of the first matrix as the number of the first-category vector;

[0082] The first-category vector selection subunit is configured to randomly select a plurality of first-category vectors that match the number of the first-category vectors from the subspace based on the length of the first-category vectors.

[0083] On the one hand, the first-category vector selection subunit is used to randomly select a non-zero column vector with a length of the first-category vector from the remaining vectors of the first-category vector space; delete the linear space spanned by all the selected non-zero column vectors on the basis domain from the first-category vector space, and return to the step of randomly selecting a non-zero column vector with a length of the first-category vector from the remaining vectors of the first-category vector space; until the number of selected non-zero column vectors reaches the number of the first-category vectors, then sort the non-zero column vectors column by column to obtain the first-category vector group.

[0084] On the one hand, the first-category vector selection subunit is used to randomly select non-zero column vectors whose lengths are all the lengths of the first-category vectors from the first-category vector space according to the number of the first-category vectors; wherein the first-category vector space is a set consisting of all column vectors whose component elements are taken from the subspace and whose lengths are the lengths of the first-category vectors; determine whether all the non-zero column vectors are linearly independent on the basis domain; if all the non-zero column vectors are linearly independent on the basis domain, sort all the non-zero column vectors column by column to obtain the first-category vector group; if all the non-zero column vectors are linearly dependent on the basis domain, discard all the non-zero column vectors currently selected, and return to the step of randomly selecting non-zero column vectors whose lengths are all the lengths of the first-category vectors from the subspace according to the number of the first-category vectors.

[0085] In one aspect, the vector selection unit includes a second serving subunit and a second type of vector selection subunit;

[0086] The second subunit is configured to use the number of rows of the second matrix as the number of second-type vectors and the number of columns of the second matrix as the length of the second-type vectors;

[0087] The second-category vector selection subunit is configured to randomly select a plurality of second-category vectors matching the number of the second-category vectors from the base domain based on the length of the second-category vectors.

[0088] On the one hand, the second-category vector selection subunit is used to randomly select row vectors with a length equal to the length of the second-category vector from the second-category vector space according to the number of the second-category vectors; wherein the second-category vector space is a set consisting of all vectors whose component elements are taken from the base domain and whose length is the length of the second-category vector; and sort each of the row vectors row by row to obtain the second-category vector group.

[0089] In one aspect, the construction unit includes a private key determination subunit, an as subunit, and a public key determination subunit;

[0090] The private key determination subunit is configured to perform a matrix multiplication operation on the first type of vector group and the second type of vector group to obtain the private key;

[0091] The public key determination subunit is configured to determine the second part of the public key based on the private key and the first part of the public key.

[0092] On the one hand, the public key determination subunit is used to perform a matrix multiplication operation on the private key and the transpose of the first part of the public key to obtain the second part of the public key.

[0093] On the one hand, the determination unit is used to select an interference vector from the extended domain based on the interference vector length and the interference vector rank weight; and perform a vector-matrix multiplication operation on the interference vector and the transpose of the first part of the public key to obtain the commitment vector.

[0094] In one aspect, the signature unit includes a compression subunit and a construction subunit;

[0095] The compression subunit is configured to compress the target message and the commitment vector using the hash function to obtain a first partial signature;

[0096] The construction subunit is configured to construct a second partial signature based on the first partial signature, the private key, and the interference vector.

[0097] On the one hand, the construction subunit is used to perform a vector-matrix multiplication operation on the first partial signature and the private key to obtain an initial operation result; and add the initial operation result to the interference vector to obtain the second partial signature.

[0098] On the one hand, it also includes a conversion unit, a potential commitment vector determination unit, a processing unit, a judgment unit and a determination unit;

[0099] The conversion unit is configured to convert the message to be signed into a target data stream on the extended domain;

[0100] The potential commitment vector determining unit is configured to determine a potential commitment vector based on the public key and the digital signature;

[0101] The processing unit is configured to compress the potential commitment vector and the target data stream using the hash function to obtain a first partial potential signature;

[0102] The judging unit is configured to judge whether the first partial potential signature is consistent with the first partial signature;

[0103] The determination unit is configured to determine that the digital signature is valid when the first partial potential signature is consistent with the first partial signature.

[0104] On the one hand, the conversion unit is used to obtain the message type to which the message to be signed belongs; and convert the message to be signed into a target data stream on the extended domain according to a reversible transformation method matching the message type.

[0105] On the one hand, the potential commitment vector determination unit is used to perform a vector-matrix multiplication operation on the transpose of the second part signature and the first part public key to obtain a first operation result; perform a vector-matrix multiplication operation on the first part signature and the second part public key to obtain a second operation result; and perform a subtraction operation on the first operation result and the second operation result to obtain the potential commitment vector.

[0106] On the one hand, it also includes a rank weight judgment unit;

[0107] The rank weight judgment unit is used to judge whether the rank weight of the second partial signature is less than or equal to a rank weight threshold; wherein the rank weight threshold is set according to the rank weight of the interference vector and the number of vectors included in the first type of vector group;

[0108] In a case where the rank weight of the second partial signature is less than or equal to the rank weight threshold, the conversion unit is triggered to execute the step of converting the message to be signed into the target data stream on the extended domain.

[0109] On the one hand, it also includes invalid units;

[0110] The invalidation unit is configured to determine that the digital signature is invalid if the rank weight of the second partial signature is greater than the rank weight threshold or the first partial potential signature is inconsistent with the first partial signature.

[0111] On the one hand, it also includes a query unit, an expansion unit and a matching unit;

[0112] The query unit is configured to query basic parameters matching the security requirements from a parameter correspondence table; the basic parameters include the key parameter information;

[0113] The expansion unit is configured to select the base domain and its corresponding expanded domain according to the number of expansions included in the basic parameters;

[0114] The matching unit is configured to select a matching hash function according to the output length of the hash function included in the basic parameters.

[0115] An embodiment of the present invention further provides a digital signature device, comprising:

[0116] Memory for storing computer programs;

[0117] A processor is used to execute the computer program to implement the steps of the above-mentioned digital signature method.

[0118] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned digital signature method are implemented.

[0119] It can be seen from the above technical solution that, based on the key parameter information, a first type of vector group and a first part of the public key are selected from the extended domain, and a second type of vector group is selected from the base domain; based on the first type of vector group, the second type of vector group and the first part of the public key, a private key and a second part of the public key are constructed. An interference vector is selected from the extended domain, and the interference vector and the first part of the public key are used to determine the commitment vector. The commitment vector, the private key, the interference vector and the target message are processed based on the hash function to obtain the digital signature of the target message; wherein the target message is the data stream converted from the message to be signed to the extended domain. The beneficial effect of the present invention is that, in the key generation stage, by randomly selecting the first type of vector group and the second type of vector group based on the key parameter information, the private key and public key constructed thereby can resist the key recovery attack based on the LRPC code decoding algorithm, and can avoid known structured attacks aimed at recovering the key, thereby enhancing the security of the system. In the digital signature stage, through the hash operation, the computational complexity of the signature algorithm can be effectively reduced, thereby improving the computational efficiency of the digital signature. The nonlinearity of the hash function also destroys the linear relationship between the digital signature and the private key, making it impossible to derive the private key based on this linear relationship, further enhancing the security of the private key. Furthermore, the digital signature method provided by the present invention can be applied to the signing of multiple messages, rather than being limited to a single signature, further improving the efficiency of digital signatures. BRIEF DESCRIPTION OF THE DRAWINGS

[0120] In order to more clearly illustrate the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0121] Figure 1 A flowchart of a digital signature method provided by an embodiment of the present invention;

[0122] Figure 2 A flowchart of a method for selecting a first-category vector from a subspace provided by an embodiment of the present invention;

[0123] Figure 3 A flowchart of another method for selecting a first-category vector from a subspace provided by an embodiment of the present invention;

[0124] Figure 4 A flowchart of a digital signature verification method provided by an embodiment of the present invention;

[0125] Figure 5 A schematic structural diagram of a digital signature device provided by an embodiment of the present invention;

[0126] Figure 6A structural diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0127] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0128] The terms "including" and "having," as used in the specification and claims of the present invention and in the accompanying drawings, and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements and may include steps or elements that are not listed.

[0129] In order to enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0130] Next, a digital signature method provided by an embodiment of the present invention is introduced in detail. Figure 1 A flowchart of a digital signature method provided in an embodiment of the present invention, the method comprising:

[0131] S101: According to the key parameter information, a first type of vector group and a first part of the public key are selected from the extended domain, and a second type of vector group is selected from the base domain.

[0132] In an embodiment of the present invention, public parameters can be pre-set based on security requirements. The public parameters may include basic parameters, a hash function, a base domain, and a corresponding extended domain. The extended domain can be obtained by expanding the base domain.

[0133] In practical applications, different security requirements will lead to different requirements for public parameters. Security requirements can be determined based on security strength. The higher the security strength, the larger the corresponding public parameter value.

[0134] In order to quickly and easily determine the basic parameters that match the current security requirements, a parameter mapping table can be pre-established in actual applications. This table can record the basic parameters corresponding to different security requirements. When a message needs to be digitally signed, the basic parameters that match the security requirements can be queried from the parameter mapping table.

[0135] The basic parameters mainly include the length, rank weight and other parameters of vectors and matrices required for generating keys and digital signatures.

[0136] In the embodiment of the present invention, the matrix required for key generation can be selected based on the base field and its extended field. In practical applications, the base field and its corresponding extended field can be selected according to the number of expansions included in the basic parameters.

[0137] For ease of description, we can use Represents the base domain, and q represents the number of elements contained in the base domain. represents the expansion domain, and m represents the number of expansion times.

[0138] It should be noted that the expansion from the base domain to the extended domain can be a one-time process. The 3rd expansion domain can be obtained by selecting The cubic irreducible polynomial on , then take The polynomial ring above can be obtained modulo the third-order irreducible polynomial, but it cannot be obtained by successively expanding it for the first, second, and third times.

[0139] The extension domain can be viewed as a linear space on the base domain, such as Considered as The m-dimensional linear space on . exist A k-dimensional subspace on is defined by The k in Linearly independent elements in The linear space spanned on it.

[0140] The data output length required under different security requirements is different, and the output length corresponding to hash functions of different security strengths is different. Therefore, a matching hash function can be selected based on the hash function output length included in the basic parameters.

[0141] In an embodiment of the present invention, the private key can be determined by multiplying the first type of vector group and the second type of vector group. Therefore, in practical applications, the number of columns of the first type of vector group and the number of rows of the second type of vector group included in the key parameter information must be the same.

[0142] The first-class vector group contains multiple first-class vectors. These first-class vectors form a first-class vector group that is presented in the form of a matrix, so the first-class vector group can be called a first matrix. Similarly, the second-class vector group contains multiple second-class vectors. These second-class vectors form a second-class vector group that is presented in the form of a matrix, so the second-class vector group can be called a second matrix.

[0143] The key parameter information may include the subspace dimension, the number of rows and columns of the first matrix, and the number of rows and columns of the second matrix.

[0144] In a specific implementation, a full-rank matrix can be selected from the extended domain as the first part of the public key. A subspace matching the subspace dimension can be selected from the extended domain. A first-class vector group matching the number of rows and columns of the first matrix can be randomly selected from the subspace. A second-class vector group matching the number of rows and columns of the second matrix can be randomly selected from the base domain.

[0145] For the convenience of description, we can use t to represent the subspace dimension, and use Represents a selected subspace. In practical applications, The elements in can be taken from And in The above constitutes a t-dimensional linear space.

[0146] The way to select each element of the subspace from the extended domain can be uniform random selection, that is, exist Any t-dimensional subspace on is chosen as The probability of is equal. This probability can be expressed as Among them, q represents the number of elements contained in the base domain, m represents the number of expansions, i represents a non-negative integer ranging from 0 to t-1, t represents the subspace dimension, and q m represents q to the power of m, q i represents q to the power of i, q t It represents q to the power of t.

[0147] S102: Construct a private key and a second part of the public key based on the first type of vector group, the second type of vector group, and the first part of the public key.

[0148] After selecting the first type of vector group and the second type of vector group, a matrix multiplication operation can be performed on the first type of vector group and the second type of vector group to obtain a private key; based on the private key and the first part of the public key, the second part of the public key is determined.

[0149] For the convenience of description, we can use S * Represents the first type of vector group, uses U to represent the second type of vector group, uses S to represent the private key, S=S * U. H is used to represent the first part of the public key, and T is used to represent the second part of the public key.

[0150] The first-category vector group contains multiple first-category vectors. w1 can be used to denote the number of first-category vectors in the first-category vector group, and l can be used to denote the length of the first-category vectors. The second-category vector group contains multiple second-category vectors. w2 can be used to denote the number of second-category vectors in the second-category vector group, and n1 can be used to denote the length of the second-category vectors. w1 and w2 have the same value and can be denoted by w. The private key can be obtained by matrix multiplication of the first-category vector group and the second-category vector group. Therefore, the size of the private key is l × n1.

[0151] In the embodiment of the present invention, a full rank matrix that satisfies the public key size can be randomly selected from the extended domain as the first part of the public key. The private key and the transpose of the first part of the public key are multiplied to obtain the second part of the public key, that is, T = SH T .

[0152] Since the size of the private key is l×n1, in order to satisfy the transposition of the private key and the first part of the public key and to perform a matrix multiplication operation, the size of the public key included in the basic parameters is (n1-k)×n1.

[0153] In practical applications, a uniformly random method can be used to select a (n1-k)×n1 full-rank matrix from the extended field as the first part of the public key. That is, the probability of any (n1-k)×n1 full-rank matrix on the extended field being selected as the first part of the public key is the same, and the probability can be expressed as Among them, j represents the selection method of the j-th row vector when constructing a full rank matrix. kind, represents q to the power of mn1, q mj Represents q to the power of mj.

[0154] The first part of the public key and the second part of the public key together constitute the public key, that is, the output public key is (H, T).

[0155] S103: Select an interference vector from the extended domain, and use the interference vector and the first part of the public key to determine a commitment vector.

[0156] In an embodiment of the present invention, an interference vector can be selected from the extended domain based on the interference vector length and interference vector rank weight included in the interference vector parameter information; the interference vector and the transpose of the first part of the public key are subjected to a vector-matrix multiplication operation to obtain a commitment vector.

[0157] For ease of description, n2 can be used to represent the interference vector length, r to represent the interference vector rank weight, e to represent the interference vector, and y to represent the commitment vector. The commitment vector is calculated by vector-matrix multiplication using the interference vector and the transpose of the first part of the public key, that is, y = eH T .

[0158] In the above description, the size of the first public key is (n1-k)×n1. Because the commitment vector is calculated by vector-matrix multiplication using the interference vector and the transpose of the first public key, in practice, n1=n2 and can be represented by a unified symbol n.

[0159] S104: Processing the commitment vector, the private key, the interference vector, and the target message based on a hash function to obtain a digital signature of the target message.

[0160] In this embodiment of the present invention, relevant vectors for generating private keys, public keys, and digital signatures are selected over the extended domain. To process the message to be signed, after obtaining it, it is necessary to convert it into a data stream over the extended domain. This data stream is referred to as the target message. In other words, the target message is the data stream converted from the message to be signed into the extended domain.

[0161] In an embodiment of the present invention, in order to improve the security of a digital signature, two parts of a digital signature may be generated separately when generating a digital signature, namely a first part of the digital signature and a second part of the digital signature.

[0162] In order to effectively control the length of the digital signature, a hash function can be used to compress the target message and the commitment vector to obtain the first part of the signature; based on the first part of the signature, the private key and the interference vector, the second part of the signature is constructed.

[0163] It should be noted that the compression processing mentioned above refers to converting information of arbitrary length into a string of fixed length, but the form is random and meaningless because the hash function is a randomized mapping.

[0164] For ease of description, we can use c to represent the first part of the signature and A to represent the target message. The first part of the signature can be calculated by hashing. in, represents the hash function, and || represents the sequential concatenation of the target message and the commitment vector.

[0165] A key property of hash functions is their extreme sensitivity to input: a small change in the input can lead to a significant change in the output. Therefore, even if the commitment vector is maliciously tampered with or imitated, the correct first-part signature cannot be calculated. Hash functions can be used to convert large amounts of target messages into smaller first-part signatures, improving computational efficiency. Furthermore, the nonlinearity of hash functions can be exploited to disrupt linear associations between messages to be signed, thereby enhancing their security.

[0166] In practical applications, the first part of the signature can be vector-matrix multiplied with the private key to obtain an initial operation result; the initial operation result and the interference vector are added to obtain the second part of the signature.

[0167] For ease of description, z may be used to represent the second part of the signature. In a specific implementation, the second part of the signature may be calculated according to z=cS+e.

[0168] As can be seen from the above technical solution, based on key parameter information, a first-category vector group and a first-part public key are selected from the extended domain, and a second-category vector group is selected from the base domain. A private key and a second-part public key are constructed based on the first and second-category vector groups and the first-part public key. An interference vector is selected from the extended domain, and a commitment vector is determined using the interference vector and the first-part public key. The commitment vector, private key, interference vector, and target message are processed using a hash function to obtain a digital signature of the target message; the target message is a data stream converted from the message to be signed into the extended domain. The beneficial effect of the present invention is that, during the key generation phase, the private and public keys constructed by randomly selecting the first and second-category vector groups based on key parameter information are resistant to key recovery attacks based on LRPC code decoding algorithms and can avoid known structured attacks aimed at key recovery, thereby enhancing system security. During the digital signature phase, hash operations can effectively reduce the computational complexity of the signature algorithm, improving the computational efficiency of the digital signature. Furthermore, the nonlinearity of the hash function is utilized to disrupt the linear relationship between the digital signature and the private key, thereby resisting certain potential attacks. Furthermore, the digital signature method provided by the present invention can be applied to the signature of multiple messages and is not limited to a single signature, thereby further improving the efficiency of digital signatures.

[0169] In this embodiment of the present invention, a first-category vector group can be selected from the subspace based on the number of rows and columns of the first matrix. In practical applications, the number of rows of the first matrix can be used as the length of the first-category vectors, and the number of columns of the first matrix can be used as the number of first-category vectors. Based on the length of the first-category vectors, multiple first-category vectors that match the number of first-category vectors are randomly selected from the subspace.

[0170] Figure 2 A flowchart of a method for selecting a first-category vector from a subspace provided in an embodiment of the present invention, the method comprising:

[0171] S201: Randomly select a non-zero column vector with a length equal to the length of the first-category vector from the remaining vectors in the first-category vector space.

[0172] A vector space of the first kind is the set of all column vectors whose components are taken from the subspace and whose length is the length of the vector of the first kind.

[0173] In the initial state, a non-zero column vector with the same length as the first-class vector can be randomly selected from the first-class vector space in a uniform random manner. For ease of description, we can use represents the first non-zero column vector selected.

[0174] The number of vectors of the first type is w1, so w1 non-zero column vectors need to be selected. For all selected non-zero column vectors, they can be expressed as

[0175] S202: Delete the linear space spanned by all the selected non-zero column vectors on the basis domain from the first-category vector space, and return to the step of randomly selecting a non-zero column vector with a length equal to the length of the first-category vector from the remaining vectors in the first-category vector space.

[0176] To ensure that all non-zero column vectors are linearly independent on the basis domain, after selecting the first non-zero column vector, the linear space spanned by the first non-zero column vector on the basis domain can be deleted from the first-category vector space, and then a second non-zero column vector with a length equal to the length of the first-category vector can be randomly selected from the remaining vectors in the first-category vector space. The linear space spanned by the first and second non-zero column vectors on the basis domain can be deleted from the first-category vector space, and then a third non-zero column vector with a length equal to the length of the first-category vector can be randomly selected from the remaining vectors in the first-category vector space, and so on, until the number of selected non-zero column vectors reaches the number of first-category vectors, and then S203 is executed.

[0177] S203: until the number of the selected non-zero column vectors reaches the number of first-category vectors, the non-zero column vectors are sorted column by column to obtain a first-category vector group.

[0178] After selecting w1 non-zero column vectors, we can Arranged column by column into an l×w1 matrix, the l×w1 matrix can be used as a first-class vector group, using the symbol S * Represents a first-class vector group.

[0179] In the embodiment of the present invention, in addition to using Figure 2 In addition to selecting the first type of vectors as shown, you can also select them according to Figure 3 The first type of vector is selected in the manner shown.

[0180] Figure 3 A flowchart of another method for selecting a first-category vector from a subspace provided by an embodiment of the present invention, the method comprising:

[0181] S301: According to the number of first-category vectors, randomly select non-zero column vectors whose lengths are all the same as the lengths of first-category vectors from the first-category vector space.

[0182] A vector space of the first kind is the set of all column vectors whose components are taken from the subspace and whose length is the length of the vector of the first kind.

[0183] In the initial state, non-zero column vectors whose lengths are all the lengths of the first-category vectors can be randomly selected from the first-category vector space by uniform random selection according to the number of the first-category vectors.

[0184] S302: Determine whether all non-zero column vectors are linearly independent in the basis domain.

[0185] In the case that all non-zero column vectors are linearly independent on the basis domain, S303 may be performed to sort all non-zero column vectors column by column to obtain a first type vector group.

[0186] When all non-zero column vectors are linearly correlated in the basis domain, all currently selected non-zero column vectors are discarded, and the process returns to S301 to execute the step of randomly selecting non-zero column vectors with the same length as the first category vector from the subspace according to the number of the first category vectors.

[0187] S303: Sort all non-zero column vectors column by column to obtain a first type vector group.

[0188] When the number of current vectors reaches the number of first-class vectors, the non-zero column vectors can be sorted column by column to obtain the first-class vector group, that is, Arrange them column by column into an l×w1 matrix, which can be used as a first-class vector group.

[0189] Regarding the selection of the second-category vector group, in practical applications, the number of rows of the second matrix can be used as the number of second-category vectors, and the number of columns of the second matrix can be used as the length of the second-category vectors; based on the length of the second-category vectors, multiple second-category vectors that match the number of second-category vectors are randomly selected from the basis domain.

[0190] After determining the length and number of the second-category vectors, the second-category vectors can be selected by randomly selecting row vectors of the same length from the second-category vector space based on the number of second-category vectors. The second-category vector space is the set of all vectors whose component elements are taken from the basis domain and whose length is the length of the second-category vector. The row vectors are sorted row by row to obtain a second-category vector group.

[0191] In practical applications, the number of columns of the second matrix and the number of columns of the full rank matrix may be the same, since the number of columns of the second matrix is ​​n1.

[0192] For example, you can choose the base domain w2 vectors u1,u2,...,u of length n1 w2 , each second type vector u1,u2,...,u w1 The w2×n1 matrix arranged row by row can use U to represent the second type of vector group.

[0193] The second type of vectors can be selected from the base domain in an independent uniform random manner, that is, the base domain Any vector of length n1 is selected as the second type vector u i The probabilities of (i=1,2,...,w2) are equal.

[0194] In an embodiment of the present invention, a uniform random selection method is adopted in the subspace, and the linear independence between the first-class vectors is guaranteed. A plurality of second-class vectors are obtained by uniform random selection in the base domain. This can limit the column rank of the first-class vector group in the base domain. In addition, the second-class vector group is taken from the base domain, thereby limiting the column rank of the private key in the base domain. Ultimately, the rank weight of the initial operation result is sufficiently small, resulting in a large loss of the rank support information of the private key, thereby being able to resist the key recovery attack of the low-rank parity check (LRPC) code decoding algorithm and improving the security of the private key.

[0195] In an embodiment of the present invention, after the commitment vector, the private key, the interference vector, and the target message are processed based on a hash function to obtain a digital signature of the target message, the digital signature may be further verified to determine the correctness of the digital signature.

[0196] Figure 4 A flowchart of a digital signature verification method provided by an embodiment of the present invention, the method comprising:

[0197] S401: Determine whether the rank weight of the second partial signature is less than or equal to a rank weight threshold.

[0198] The rank weight threshold is set according to the rank weight of the interference vector and the number of vectors included in the first type of vector group.

[0199] For ease of description, the interference vector rank weight can be expressed as r. The number of vectors contained in the first type of vector group is w1, and the rank weight threshold can be w1+r. The rank weight of the second part of the signature can be expressed as wt R (z) indicates.

[0200] In wt R When (z)≤w+r, it means that the current second part of the signature meets the requirements, and S402 can be executed at this time.

[0201] S402: Convert the message to be signed into a target data stream on the extended domain.

[0202] The message type to be signed can include video, text, audio, and so on. The corresponding conversion methods for different message types vary. In this embodiment of the present invention, the message type of the message to be signed can be obtained. The message to be signed is then converted into the target data stream on the extended domain using a reversible transformation method that matches the message type.

[0203] In practical applications, to more quickly and conveniently convert the message to be signed, you can pre-establish reversible transformation methods for different message types. The reversible transformation methods for each message type are currently well-established technologies and will not be detailed here.

[0204] After obtaining the message to be signed, you can directly query the reversible transformation method that matches the current message type from the pre-established reversible transformation methods corresponding to different message types based on the message type of the message to be signed, and then use this reversible transformation method to convert the message to be signed into the target data stream on the extended domain.

[0205] S403: Determine a potential commitment vector based on the public key and the digital signature.

[0206] A potential commitment vector refers to a possible commitment vector inferred from an existing public key and digital signature. In an embodiment of the present invention, a vector-matrix multiplication operation can be performed on the transpose of the second signature and the first public key to obtain a first operation result; a vector-matrix multiplication operation can be performed on the first signature and the second public key to obtain a second operation result; and a subtraction operation can be performed on the first and second operation results to obtain the potential commitment vector.

[0207] In practical applications, we can use the formula y′=zH T -cT calculates the potential commitment vector, where y′ represents the potential commitment vector, z represents the second-part signature, H represents the first-part public key, c represents the first-part signature, and T represents the second-part public key.

[0208] S404: Using a hash function to compress the potential commitment vector and the target data stream to obtain a first portion of the potential signature.

[0209] In practical applications, the summary of the result obtained by sequentially connecting the potential commitment vector and the target data stream can be calculated, that is, the first part of the potential signature can be calculated Where A' represents the target data stream, and c' represents the first potential signature.

[0210] It should be noted that, in the embodiment of the present invention, in order to distinguish it from the target message in the digital signature generation stage, in the digital signature verification stage, the data stream converted from the message to be signed can be called the target data stream.

[0211] S405: Determine whether the first potential signature is consistent with the first signature.

[0212] When the first potential signature is consistent with the first partial signature, it indicates that the digital signature is valid, and S406 can be executed.

[0213] S406: Determine whether the digital signature is valid.

[0214] When the rank weight of the second part signature is greater than the rank weight threshold or the first part potential signature is inconsistent with the first part signature, it means that the digital signature is invalid. At this time, the digital signature can be determined to be invalid and the digital signature can be directly rejected.

[0215] In this embodiment of the present invention, a digital signature verification mechanism is implemented to infer a potential commitment vector based on the generated public key and digital signature. Based on the principle of generating the same signature as the first part, a hash function is used to compress the potential commitment vector and the target data stream, thereby generating the first part of the potential signature. By comparing the first part of the signature with the first part of the potential signature to determine their consistency, the validity of the digital signature generated during the digital signature generation phase can be determined, thereby preventing the impact of erroneous digital signatures on subsequent operations and ensuring system security.

[0216] Figure 5 A schematic structural diagram of a digital signature device provided in an embodiment of the present invention, comprising a vector selection unit 51, a construction unit 52, a determination unit 53, and a signature unit 54;

[0217] A vector selection unit 51 is configured to select a first type of vector group and a first part of the public key from the extended domain and a second type of vector group from the base domain based on the key parameter information;

[0218] A construction unit 52 is configured to construct a private key and a second part of the public key based on the first type of vector group, the second type of vector group, and the first part of the public key;

[0219] a determination unit 53 configured to select an interference vector from the extended domain and determine a commitment vector using the interference vector and the first part of the public key;

[0220] The signature unit 54 is configured to process the commitment vector, the private key, the interference vector, and the target message based on a hash function to obtain a digital signature of the target message; wherein the target message is a data stream converted from the message to be signed to the extended domain.

[0221] In some embodiments, the key parameter information includes the subspace dimension, the number of rows and columns of the first matrix, and the number of rows and columns of the second matrix;

[0222] The vector selection unit is used to select a full-rank matrix from the extended domain as the first part of the public key; select a subspace that matches the subspace dimension from the extended domain; randomly select a first type of vector group that matches the number of rows and columns of the first matrix from the subspace; and randomly select a second type of vector group that matches the number of rows and columns of the second matrix from the base domain.

[0223] In some embodiments, the vector selection unit is used to randomly select a full-rank matrix that meets the public key size from the extended field as the first part of the public key.

[0224] In some embodiments, the vector selection unit includes a first as subunit and a first type vector selection subunit;

[0225] The first is a subunit, used to use the number of rows of the first matrix as the length of the first-category vector and the number of columns of the first matrix as the number of the first-category vector;

[0226] The first-category vector selection subunit is used to randomly select a plurality of first-category vectors that match the number of the first-category vectors from the subspace according to the length of the first-category vectors.

[0227] In some embodiments, the first-category vector selection subunit is used to randomly select a non-zero column vector with a length of the first-category vector from the remaining vectors of the first-category vector space; wherein the first-category vector space is a set consisting of all column vectors whose component elements are taken from the subspace and whose length is the length of the first-category vector; delete the linear space spanned by all the selected non-zero column vectors on the basis domain from the first-category vector space, and return to the step of randomly selecting a non-zero column vector with a length of the first-category vector from the remaining vectors of the first-category vector space; until the number of selected non-zero column vectors reaches the number of first-category vectors, then sort the non-zero column vectors column by column to obtain a first-category vector group.

[0228] In some embodiments, the first-category vector selection subunit is used to randomly select non-zero column vectors of the length of the first-category vector from the first-category vector space according to the number of first-category vectors; wherein the first-category vector space is a set consisting of all column vectors whose component elements are taken from the subspace and whose length is the length of the first-category vector; determine whether all non-zero column vectors are linearly independent on the basis domain; when all non-zero column vectors are linearly independent on the basis domain, sort all non-zero column vectors column by column to obtain a first-category vector group; when all non-zero column vectors are linearly dependent on the basis domain, discard all currently selected non-zero column vectors, and return to the step of randomly selecting non-zero column vectors of the length of the first-category vector from the subspace according to the number of first-category vectors.

[0229] In some embodiments, the vector selection unit includes a second serving subunit and a second type of vector selection subunit;

[0230] The second is a subunit, used to use the number of rows of the second matrix as the number of second-type vectors and the number of columns of the second matrix as the length of the second-type vectors;

[0231] The second type vector selection subunit is used to randomly select a plurality of second type vectors that match the number of the second type vectors from the base domain according to the length of the second type vectors.

[0232] In some embodiments, the second-category vector selection subunit is used to randomly select row vectors of length equal to the length of the second-category vector from the second-category vector space in sequence according to the number of the second-category vectors; wherein the second-category vector space is a set consisting of all vectors whose component elements are taken from the basis domain and whose length is equal to the length of the second-category vector; and sort the row vectors row by row to obtain a second-category vector group.

[0233] In some embodiments, the construction unit includes a private key determination subunit and a public key determination subunit;

[0234] a private key determination subunit, configured to perform a matrix multiplication operation on the first type of vector group and the second type of vector group to obtain a private key;

[0235] The public key determination subunit is used to determine the second part of the public key based on the private key and the first part of the public key.

[0236] In some embodiments, the public key determination subunit is configured to perform a matrix multiplication operation on the private key and the transpose of the first part of the public key to obtain the second part of the public key.

[0237] In some embodiments, the determination unit is configured to select an interference vector from the extended domain based on the interference vector length and the interference vector rank weight; and perform a vector-matrix multiplication operation on the interference vector and the transpose of the first part of the public key to obtain a commitment vector.

[0238] In some embodiments, the signature unit includes a compression subunit and a construction subunit;

[0239] A compression subunit, configured to compress the target message and the commitment vector using a hash function to obtain a first partial signature;

[0240] The construction subunit is used to construct the second part of the signature based on the first part of the signature, the private key and the interference vector.

[0241] In some embodiments, the construction subunit is used to perform a vector-matrix multiplication operation on the first partial signature and the private key to obtain an initial operation result; and perform an addition operation on the initial operation result and the interference vector to obtain the second partial signature.

[0242] In some embodiments, further comprising a conversion unit, a potential commitment vector determination unit, a processing unit, a judgment unit, and a determination unit;

[0243] A conversion unit, configured to convert a message to be signed into a target data stream on the extended domain;

[0244] a potential commitment vector determining unit, configured to determine a potential commitment vector based on the public key and the digital signature;

[0245] a processing unit, configured to compress the potential commitment vector and the target data stream using a hash function to obtain a first portion of the potential signature;

[0246] a judgment unit, configured to judge whether the first potential signature is consistent with the first partial signature;

[0247] The determination unit is configured to determine that the digital signature is valid when the first partial potential signature is consistent with the first partial signature.

[0248] In some embodiments, the conversion unit is configured to obtain a message type to which the message to be signed belongs; and convert the message to be signed into a target data stream on the extended domain according to a reversible transformation method that matches the message type.

[0249] In some embodiments, the potential commitment vector determination unit is used to perform a vector-matrix multiplication operation on the transpose of the second part of the signature and the first part of the public key to obtain a first operation result; perform a vector-matrix multiplication operation on the first part of the signature and the second part of the public key to obtain a second operation result; and perform a subtraction operation on the first operation result and the second operation result to obtain a potential commitment vector.

[0250] In some embodiments, a rank weight determination unit is further included;

[0251] A rank weight judgment unit, configured to judge whether the rank weight of the second part of the signature is less than or equal to a rank weight threshold; wherein the rank weight threshold is set according to the rank weight of the interference vector and the number of vectors included in the first type of vector group;

[0252] In a case where the rank weight of the second partial signature is less than or equal to the rank weight threshold, the conversion unit is triggered to execute the step of converting the message to be signed into a target data stream on the extended domain.

[0253] In some embodiments, further comprising an invalidation unit;

[0254] The invalidation unit is used to determine that the digital signature is invalid when the rank weight of the second part signature is greater than the rank weight threshold or the first part potential signature is inconsistent with the first part signature.

[0255] In some embodiments, it further includes a query unit, an expansion unit, and a matching unit;

[0256] A query unit, configured to query basic parameters that match security requirements from a parameter correspondence table; the basic parameters include key parameter information;

[0257] An expansion unit, configured to select a base domain and its corresponding expansion domain according to the expansion times included in the basic parameters;

[0258] The matching unit is used to select a matching hash function according to the output length of the hash function included in the basic parameters.

[0259] Figure 5 The description of the features in the corresponding embodiment can be found in Figures 1 to 4 The relevant descriptions of the corresponding embodiments will not be repeated here one by one.

[0260] It can be seen from the above technical solution that, based on the key parameter information, a first type of vector group and a first part of the public key are selected from the extended domain, and a second type of vector group is selected from the base domain; based on the first type of vector group, the second type of vector group and the first part of the public key, a private key and a second part of the public key are constructed. An interference vector is selected from the extended domain, and the interference vector and the first part of the public key are used to determine the commitment vector. The commitment vector, the private key, the interference vector and the target message are processed based on the hash function to obtain the digital signature of the target message; wherein the target message is the data stream converted from the message to be signed to the extended domain. The beneficial effect of the present invention is that, in the key generation stage, by randomly selecting the first type of vector group and the second type of vector group based on the key parameter information, the private key and public key constructed thereby can resist the key recovery attack based on the LRPC code decoding algorithm, and can avoid known structured attacks aimed at recovering the key, thereby enhancing the security of the system. In the digital signature stage, through the hash operation, the computational complexity of the signature algorithm can be effectively reduced, thereby improving the computational efficiency of the digital signature. The nonlinearity of the hash function also destroys the linear relationship between the digital signature and the private key, making it impossible to derive the private key based on this linear relationship, further enhancing the security of the private key. Furthermore, the digital signature method provided by the present invention can be applied to the signing of multiple messages, rather than being limited to a single signature, further improving the efficiency of digital signatures.

[0261] Figure 6 A structural diagram of an electronic device provided by an embodiment of the present invention, such as Figure 6 As shown, the electronic device includes: a memory 60 for storing computer programs;

[0262] The processor 61 is configured to implement the steps of the digital signature method in the above embodiment when executing a computer program.

[0263] The electronic device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer, or a desktop computer.

[0264] Among them, the processor 61 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 61 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 61 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 61 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 61 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0265] The memory 60 may include one or more computer-readable storage media, which may be non-transitory. The memory 60 may also include high-speed random access memory, and non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 60 is at least used to store the following computer program 601, wherein, after the computer program is loaded and executed by the processor 61, it can implement the relevant steps of the digital signature method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 60 may also include an operating system 602 and data 603, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 602 may include Windows, Unix, Linux, etc. The data 603 may include but is not limited to public parameters, private keys, the first part of the public key and the second part of the public key, the message to be signed, the digital signature of the target message, etc.

[0266] In some embodiments, the electronic device may further include a display screen 62 , an input / output interface 63 , a communication interface 64 , a power supply 65 , and a communication bus 66 .

[0267] Those skilled in the art will understand that Figure 6 The structure shown in the figure does not constitute a limitation to the digital signature device, and may include more or fewer components than shown in the figure.

[0268] It is understandable that if the digital signature method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the current technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium and performs all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, a magnetic disk or an optical disk, and other media that can store program code.

[0269] Based on this, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned digital signature method are implemented.

[0270] The above describes in detail a digital signature method, apparatus, device, and computer-readable storage medium provided by embodiments of the present invention. The various embodiments are described in a progressive manner throughout this specification, with each embodiment focusing on its differences from other embodiments. References to the same or similar portions between the various embodiments will be sufficient. The apparatus disclosed in the embodiments is described briefly because it corresponds to the method disclosed in the embodiments. For relevant details, refer to the method description.

[0271] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0272] The above is a detailed introduction to the digital signature method, device, equipment, and computer-readable storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only intended to help understand the method and core concept of the present invention. It should be noted that, for those skilled in the art, various improvements and modifications may be made to the present invention without departing from the principles of the present invention, and such improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A digital signature method, characterized in that: include: According to the key parameter information, a first type of vector group and a first part of the public key are selected from the extended domain, and a second type of vector group is selected from the base domain; Constructing a private key and a second part of the public key based on the first type of vector group, the second type of vector group, and the first part of the public key; Selecting an interference vector from the extended domain, and determining a commitment vector using the interference vector and the first part of the public key; Processing the commitment vector, the private key, the interference vector, and the target message based on a hash function to obtain a digital signature of the target message; wherein the target message is a data stream converted from the message to be signed to the extended domain; The key parameter information includes the subspace dimension, the number of rows and columns of the first matrix, and the number of rows and columns of the second matrix; Based on the key parameter information, a first type of vector group and a first part of the public key are selected from the extended domain, and a second type of vector group is selected from the base domain, including: Selecting a full rank matrix from the extended field as the first part of the public key; Selecting a subspace from the expanded domain that matches the subspace dimension; Randomly selecting a first type of vector group from the subspace that matches the number of rows and columns of the first matrix; Randomly selecting a second type of vector group from the base domain that matches the number of rows and columns of the second matrix; The selecting an interference vector from the extended domain and determining a commitment vector using the interference vector and the first part of the public key includes: Selecting an interference vector from the extended domain according to an interference vector length and an interference vector rank weight; performing a vector-matrix multiplication operation on the interference vector and the transpose of the first part of the public key to obtain the commitment vector; The processing of the commitment vector, the private key, the interference vector, and the target message based on a hash function to obtain a digital signature of the target message includes: compressing the target message and the commitment vector using the hash function to obtain a first partial signature; Constructing a second partial signature based on the first partial signature, the private key, and the interference vector; The constructing a second partial signature based on the first partial signature, the private key, and the interference vector includes: Performing a vector-matrix multiplication operation on the first partial signature and the private key to obtain an initial operation result; performing an addition operation on the initial operation result and the interference vector to obtain the second partial signature; After processing the commitment vector, the private key, the interference vector, and the target message based on the hash function to obtain the digital signature of the target message, the method further includes: Converting the message to be signed into a target data stream on the extended domain; determining a potential commitment vector based on the public key and the digital signature; compressing the potential commitment vector and the target data stream using the hash function to obtain a first portion of the potential signature; Determining whether the first partial potential signature is consistent with the first partial signature; In the case that the first partial potential signature is consistent with the first partial signature, the digital signature is determined to be valid.

2. The digital signature method according to claim 1, wherein: The selecting a full rank matrix from the extended field as the first part of the public key includes: A full-rank matrix that meets the public key size is randomly selected from the extended field as the first part of the public key.

3. The digital signature method according to claim 1, wherein: The randomly selected first type of vector group matching the number of rows and columns of the first matrix from the subspace includes: The number of rows of the first matrix is ​​used as the length of the first-category vector, and the number of columns of the first matrix is ​​used as the number of the first-category vector; Based on the length of the first-category vectors, a plurality of first-category vectors that match the number of the first-category vectors are randomly selected from the subspace.

4. The digital signature method according to claim 3, wherein: Randomly selecting a plurality of first-category vectors matching the number of the first-category vectors from the subspace based on the length of the first-category vectors includes: Randomly select a non-zero column vector of the same length as the first-category vector from the remaining vectors of the first-category vector space; wherein the first-category vector space is a set consisting of all column vectors whose component elements are taken from the subspace and whose length is the same as the first-category vector; Deleting the linear space spanned by all the selected non-zero column vectors on the basis domain from the first-category vector space, and returning to the step of randomly selecting a non-zero column vector having a length equal to the length of the first-category vector from the remaining vectors in the first-category vector space; Until the number of the selected non-zero column vectors reaches the number of the first type of vectors, the non-zero column vectors are sorted column by column to obtain the first type of vector group.

5. The digital signature method according to claim 3, wherein: Randomly selecting a plurality of first-category vectors matching the number of the first-category vectors from the subspace based on the length of the first-category vectors includes: Randomly select non-zero column vectors of the same length as the first-category vectors from the first-category vector space according to the number of the first-category vectors; wherein the first-category vector space is the set of all column vectors whose component elements are taken from the subspace and whose length is the length of the first-category vector; Determining whether all the non-zero column vectors are linearly independent on the basis domain; In a case where all the non-zero column vectors are linearly independent on the basis domain, sorting all the non-zero column vectors column by column to obtain the first type of vector group; In the case that all the non-zero column vectors are linearly correlated on the basis domain, all the non-zero column vectors currently selected are discarded, and the step of randomly selecting non-zero column vectors with the length of the first category vector from the first category vector space according to the number of the first category vectors is returned.

6. The digital signature method according to claim 1, wherein: The second type of vector group randomly selected from the base domain to match the number of rows and columns of the second matrix includes: The number of rows of the second matrix is ​​used as the number of second-category vectors, and the number of columns of the second matrix is ​​used as the length of the second-category vectors; According to the length of the second-category vectors, a plurality of second-category vectors that match the number of the second-category vectors are randomly selected from the base domain.

7. The digital signature method according to claim 6, wherein: Randomly selecting a plurality of second-category vectors matching the number of the second-category vectors from the base domain according to the length of the second-category vectors includes: Based on the number of the second-category vectors, randomly selecting row vectors of the same length as the second-category vectors from the second-category vector space; wherein the second-category vector space is a set consisting of all vectors whose component elements are taken from the base domain and whose length is the same as the second-category vectors; The row vectors are sorted row by row to obtain the second type of vector group.

8. The digital signature method according to claim 1, wherein: The constructing a private key and a second part of the public key based on the first type of vector group, the second type of vector group, and the first part of the public key includes: Performing a matrix multiplication operation on the first type of vector group and the second type of vector group to obtain the private key; The second partial public key is determined based on the private key and the first partial public key.

9. The digital signature method according to claim 8, wherein: Determining the second part of the public key based on the private key and the first part of the public key includes: Perform a matrix multiplication operation on the private key and the transpose of the first part of the public key to obtain the second part of the public key.

10. The digital signature method according to claim 1, wherein: Converting the message to be signed into the target data stream on the extended domain includes: Obtain the message type to which the message to be signed belongs; The message to be signed is converted into a target data stream on the extended domain in a reversible transformation manner that matches the message type.

11. The digital signature method according to claim 1, wherein: Determining a potential commitment vector based on the public key and the digital signature includes: Performing a vector-matrix multiplication operation on the transpose of the second partial signature and the first partial public key to obtain a first operation result; Performing a vector-matrix multiplication operation on the first partial signature and the second partial public key to obtain a second operation result; Perform a subtraction operation on the first operation result and the second operation result to obtain the potential commitment vector.

12. The digital signature method according to claim 1, wherein: Before converting the message to be signed into the target data stream on the extended domain, the method further includes: Determining whether the rank weight of the second partial signature is less than or equal to a rank weight threshold; wherein the rank weight threshold is set according to the rank weight of the interference vector and the number of vectors included in the first type of vector group; In a case where the rank weight of the second partial signature is less than or equal to the rank weight threshold, the step of converting the message to be signed into the target data stream on the extended domain is performed.

13. The digital signature method according to claim 12, wherein: Also includes: In a case where the rank weight of the second partial signature is greater than the rank weight threshold or the first partial potential signature is inconsistent with the first partial signature, the digital signature is determined to be invalid.

14. The digital signature method according to any one of claims 1 to 13, characterized in that: Before selecting the first type of vector group and the first part of the public key from the extended domain and selecting the second type of vector group from the base domain based on the key parameter information, the method further includes: Querying basic parameters that match security requirements from a parameter correspondence table; wherein the basic parameters include key parameter information; Selecting the base domain and its corresponding extended domain according to the number of expansions included in the basic parameters; A matching hash function is selected according to the hash function output length included in the basic parameters.

15. A digital signature device, characterized in that: It includes parameter selection unit, vector selection unit, construction unit, determination unit and signature unit; The vector selection unit is configured to select a first type of vector group and a first part of the public key from the extended domain and a second type of vector group from the base domain based on the key parameter information; The construction unit is configured to construct a private key and a second part of the public key based on the first type of vector group, the second type of vector group, and the first part of the public key; The determining unit is configured to select an interference vector from the extended domain, and determine a commitment vector using the interference vector and the first part of the public key; The signing unit is configured to process the commitment vector, the private key, the interference vector, and the target message based on a hash function to obtain a digital signature of the target message; wherein the target message is a data stream converted from the message to be signed into the extended domain; The key parameter information includes the subspace dimension, the number of rows and columns of the first matrix, and the number of rows and columns of the second matrix; The vector selection unit is used to select a full-rank matrix from the extended domain as the first part of the public key; select a subspace matching the dimension of the subspace from the extended domain; randomly select a first type of vector group matching the number of rows and columns of the first matrix from the subspace; and randomly select a second type of vector group matching the number of rows and columns of the second matrix from the base domain; The determining unit is configured to select an interference vector from the extended domain according to an interference vector length and an interference vector rank weight; perform a vector-matrix multiplication operation on the interference vector and the transpose of the first part of the public key to obtain the commitment vector; The signature unit includes a compression subunit and a construction subunit; The compression subunit is configured to compress the target message and the commitment vector using the hash function to obtain a first partial signature; The construction subunit is configured to construct a second partial signature based on the first partial signature, the private key, and the interference vector; The construction subunit is configured to perform a vector-matrix multiplication operation on the first partial signature and the private key to obtain an initial operation result; and perform an addition operation on the initial operation result and the interference vector to obtain the second partial signature; It also includes a conversion unit, a potential commitment vector determination unit, a processing unit, a judgment unit, and a determination unit; The conversion unit is configured to convert the message to be signed into a target data stream on the extended domain; The potential commitment vector determining unit is configured to determine a potential commitment vector based on the public key and the digital signature; The processing unit is configured to compress the potential commitment vector and the target data stream using the hash function to obtain a first partial potential signature; The judging unit is configured to judge whether the first partial potential signature is consistent with the first partial signature; The determination unit is configured to determine that the digital signature is valid when the first partial potential signature is consistent with the first partial signature.

16. A digital signature device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the digital signature method according to any one of claims 1 to 14.

17. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the digital signature method according to any one of claims 1 to 14.

Images