A lattice-based hierarchical fully homomorphic digital signature method and device

Abstract

The present invention relates to the field of information security and cryptography, and in particular to a lattice-based hierarchical fully homomorphic digital signature method and device. It includes: generating public parameters based on security parameters and the maximum number of messages; sampling generating polynomials and calculating public keys, solving NTRU equations and calculating and generating private keys; merging each message to be signed and the corresponding public parameters and performing hash operations to obtain a message digest; using a lattice-based post-quantum signature algorithm to generate a signature corresponding to each message, and summarizing the signatures corresponding to each message into a signature group; homomorphically verifying the signatures in the signature group to generate homomorphic signatures; generating target vectors corresponding to homomorphic signatures; using public keys to operate homomorphic signatures to determine the validity of homomorphic signatures. The present invention is based on a practical lattice-based signature scheme, which not only broadens the application field of the lattice-based signature algorithm, but also has good compatibility and applicability, can be deployed on various resource-constrained software and hardware platforms, and has a wide range of applications.

Description

Technical Field

[0001] The present invention relates to the field of information security and cryptographic technology, and in particular to a lattice-based hierarchical fully homomorphic digital signature method and device. Background Art

[0002] With the application and development of quantum computers, traditional public key cryptographic algorithms based on mathematical problems such as large integer factorization, discrete logarithms, and elliptic curves will face more threatening quantum computing attacks. In order to combat the impact of quantum computing on information security, the research and optimization of a new generation of post-quantum cryptographic algorithms that can resist quantum computing attacks is imminent.

[0003] In July 2022, the National Institute of Standards and Technology of the United States released the first batch of standardized post-quantum cryptographic algorithms, including a public key encryption algorithm CRYSTALS-Kyber and three digital signature algorithms, CRYSTALS-Dilithium, FALCON, and SPHINCS+. Among them, FALCON is a lattice signature scheme with practical potential. The underlying layer of FALCON is based on the problem of solving small integers on the ring on the unit cell and the GPV architecture, and improves the efficiency of the signature scheme by using the fast Fourier sampling algorithm.

[0004] Existing applications of the FALCON post-quantum signature algorithm mainly focus on the optimization of the algorithm itself and its application in CA and blockchain. There is no improvement and application of the homomorphic signature algorithm yet.

[0005] Most of the existing hierarchical fully homomorphic signature algorithms are based on standard lattices. The research focuses on the design of homomorphic operations. The design of the signature part is relatively simple and mostly remains at the theoretical design level, lacking practical implementation and efficiency analysis. Summary of the invention

[0006] In order to solve the problem that the signature part of the hierarchical fully homomorphic signature algorithm in the prior art is relatively simple in design and mostly remains at the theoretical design level, and is difficult to implement and apply, the embodiment of the present invention provides a lattice-based hierarchical fully homomorphic digital signature method and device. The technical solution is as follows:

[0007] On the one hand, a lattice-based hierarchical fully homomorphic digital signature method is provided, which is implemented by a lattice-based hierarchical fully homomorphic digital signature device, and the method includes:

[0008] S1. Preset security parameters and the maximum number of messages; generate public parameters based on the security parameters and the maximum number of messages;

[0009] S2, sample the generator polynomial and calculate the public key, solve the NTRU equation and calculate the private key;

[0010] S3. Obtain each message to be signed and the corresponding public parameters; merge each message to be signed and the corresponding public parameters, and perform a hash operation to obtain a message digest after merging; use the Lattice post-quantum signature algorithm to generate a signature corresponding to each message, summarize the signatures corresponding to each message, and obtain a signature group to be processed;

[0011] S4. Perform homomorphic operations on the signatures in the signature group according to the function on each message space to generate a homomorphic signature; generate a target vector corresponding to the homomorphic signature according to the function on each message and the corresponding public parameters;

[0012] S5. Use the public key to operate the homomorphic signature to determine whether the homomorphic signature corresponds to the target vector. If so, the homomorphic signature is valid; if not, the homomorphic signature is invalid.

[0013] Optionally, in S1, a security parameter and a maximum number of messages are preset; and a public parameter is generated based on the security parameter and the maximum number of messages, including:

[0014] Preset security parameters and maximum number of messages N;

[0015] According to the security parameters and the maximum number of messages N, each parameter r i The corresponding message m i Or the sequence number i is the seed, and the common parameters r1, r2…r are output through Gaussian sampling. N , the public parameter r i As the salt value and message m i After mixing, the mixed values ​​are operated by a hash function to generate a target vector for the small integer solution problem on the ring;

[0016] The number of public parameters is consistent with the maximum number of messages N.

[0017] Optionally, in S2, sampling a generating polynomial and calculating a public key, solving the NTRU equation and calculating and generating a private key include:

[0018] Construct a univariate n-order irreducible polynomial φ=x n +1 and modulus q, sample n-order polynomials f, g from discrete Gaussian distribution on integers, where polynomials f, g are random n-order polynomials, polynomial f satisfies modulus q reversibility, and the norms of polynomials g and -f satisfy:

[0019]

[0020] Based on polynomial f and polynomial g, solve the NTRU equation to obtain polynomials F and G, perform fast Fourier transform on f, g, F, G and combine them to obtain the binary matrix B;

[0021] Based on the binary matrix B, the FALCON tree T is obtained using the fast Fourier sampling algorithm; the private key s k It consists of two parts, B and T; multiply the polynomial g and the inverse of f modulo q to get the public key p k The value of h.

[0022] Optionally, in S3, each message to be signed and the corresponding public parameters are obtained; each message to be signed and the corresponding public parameters are merged, and a hash operation is performed after the merger to obtain a message digest; a signature corresponding to each message is generated using a lattice post-quantum signature algorithm, and the signatures corresponding to each message are summarized to obtain a signature group to be processed, including:

[0023] Input message m1, m2, ...m i …, m N , private key s k , system parameters r1, r2, … r i …, r N and the maximum signed square norm;

[0024] The salt value r in the public parameter i and message m i Combined into a string, after being processed by the hash function, the target vector v of the problem of solving the difficult problem of small integers on the ring is generated i ; v i Convert to FFT form and multiply it with the inverse of the matrix B in the private key to get t i ;

[0025] t i and the FALCON tree T in the private key are input into the fast Fourier sampling algorithm to obtain z i , t i and z i The difference is multiplied by the matrix B in the private key to obtain the FFT form of the signature value s i ;

[0026] Verify signature value s i Is the square norm of s less than or equal to the maximum signature square norm of the input? If not, return and resample; if satisfied, i Perform inverse FFT transform to obtain the signature vector s i1 and i2 ;

[0027] Determine the signature vector s i1 and i2 Can it be verified? If not, resample; if it is verified, take s i2 Compress and encode to get the signature value s i ; Loop the operation N times to obtain the signature group to be processed.

[0028] Optionally, in S4, performing homomorphic operations on signatures in the signature group according to a function on each message to generate a homomorphic signature; generating a target vector corresponding to the homomorphic signature according to the function on each message and corresponding public parameters includes:

[0029] Function e on the input message space, messages m1, m2, ...m i …, m N , signatures s1,s2,…s i …,s N And system parameters r1, r2, ... r i …, r N ;

[0030] For each signature s i Decompress it to get s i1 and i2 , calculate s through the hash function i The target vector value v i ;

[0031] Decompose function e into a combination of basic operations: e1, e2…e i , …e N ; Among them, the combination of basic operations includes: addition, multiplication and combination of number multiplication;

[0032] Read each basic operation separately i , as well as the signature value and target vector value corresponding to the corresponding message; input the signature value and target vector value into the corresponding basic homomorphic operation algorithm, generate a new signature value and target vector value and save them as input for the next operation;

[0033] The loop operation is repeated until all operations are completed, the obtained signature value is compressed and encoded, and the homomorphic signature value s is output. e and the corresponding target vector value v e .

[0034] Optionally, in S4, when the basic operation e(m1,m2)=m1+m2, it includes:

[0035] For the basic operation function e on the message space, a homomorphic operation s1+s2 is performed on the signatures s1 and s2 of m1 and m2 to obtain the homomorphic signature, and a homomorphic operation v1+v2 is performed on the target vectors v1 and v2 corresponding to s1 and s2 to obtain the target vector corresponding to the homomorphic signature.

[0036] Optionally, in S4, when the basic operation e(m1,m2)=m1·m2, it includes:

[0037] For the basic operation function e on the message space, a homomorphic operation s1·v2 is performed on the signatures s1 and s2 of m1 and m2 to obtain the homomorphic signatures, and a homomorphic operation v1·v2 is performed on the target vectors v1 and v2 corresponding to s1 and s2 to obtain the target vector corresponding to the homomorphic signature.

[0038] Optionally, in S4, when the basic operation e(m1)=c·m1, it includes:

[0039] For the basic operation function e on the message space, a homomorphic operation c·s1 is performed on the signature s1 of m1 to obtain the homomorphic signature, and a homomorphic operation c·v1 is performed on the target vector v1 corresponding to s1 to obtain the target vector corresponding to the homomorphic signature, where c is a constant.

[0040] Optionally, in S5, the public key is used to operate the homomorphic signature to determine whether the homomorphic signature corresponds to the target vector. If so, the homomorphic signature is valid; if not, the homomorphic signature is invalid, including:

[0041] Input homomorphic signature s e , and the corresponding target vector v e and public key p k ;

[0042] Decompress the homomorphic signature s e Get e1 ,s e2 , judge e1 ,s e2 Is the size between -q / 2 and q / 2? If not, e1 ,s e2 Perform modulo q processing so that each coefficient is within the range of -q / 2 and q / 2; if satisfied, judge s e1 ,s e2 Whether it satisfies e1 +s e2 h=v e mod(φ,q), if satisfied, the verification passes, otherwise the verification fails.

[0043] On the other hand, a lattice-based hierarchical fully homomorphic digital signature device is provided, which is applied to a lattice-based hierarchical fully homomorphic digital signature method, and the device includes:

[0044] A parameter generation module, used to preset security parameters and a maximum number of messages; and to generate common parameters based on the security parameters and the maximum number of messages;

[0045] The key calculation module is used to sample the generating polynomial and calculate the public key, solve the NTRU equation and calculate the private key;

[0046] The signature generation module is used to obtain each message to be signed and the corresponding public parameters; merge each message to be signed and the corresponding public parameters, and perform hash operation to obtain the message digest after merging; use the lattice post-quantum signature algorithm to generate the signature corresponding to each message, summarize the signatures corresponding to each message, and obtain the signature group to be processed;

[0047] A homomorphic operation module is used to perform homomorphic operations on the signatures in the signature group according to the function on each message space to generate a homomorphic signature; a target vector corresponding to the homomorphic signature is generated according to the function on each message and the corresponding public parameters;

[0048] The signature verification module is used to use the public key to operate the homomorphic signature to determine whether the homomorphic signature corresponds to the target vector. If so, the homomorphic signature is valid; if not, the homomorphic signature is invalid.

[0049] On the other hand, a lattice-based hierarchical fully homomorphic digital signature device is provided, comprising: a processor; a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, any one of the above-mentioned lattice-based hierarchical fully homomorphic digital signature methods is implemented.

[0050] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction is stored in the storage medium, and the at least one instruction is loaded and executed by a processor to implement any one of the above-mentioned lattice-based hierarchical fully homomorphic digital signature methods.

[0051] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0052] The method and device provided by the present invention adopt the FALCON algorithm to construct a signature scheme for a single message. The security of the signature scheme relies on the security of FALCON and has a very reliable post-quantum security guarantee, thus filling the gap of the current domestic commercial digital signature algorithm that is not resistant to quantum.

[0053] Combined with the practical lattice signature algorithm, a basic homomorphic operation algorithm is designed based on the GPV architecture. The present invention shortens the time required for a homomorphic multiplication operation, and the length of the generated homomorphic signature is similar to that of a single signature, thereby improving the efficiency of the hierarchical fully homomorphic signature scheme.

[0054] In terms of security, the present invention studies the difficulty of solving small integer problems on rings on unit cells based on number theory, rather than other difficult problems on standard lattices. The security proof is more concise, which improves the security of the solution.

[0055] The present invention is based on a practical lattice signature scheme. The signature scheme constructed thereby not only broadens the application field of the lattice signature algorithm, but also makes the scheme have good compatibility and applicability, can be deployed on various resource-constrained software and hardware platforms, and has a wide range of applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0057] Figure 1 It is a flow chart of a lattice-based hierarchical fully homomorphic digital signature method provided by an embodiment of the present invention;

[0058] Figure 2 is a schematic diagram of key generation provided by an embodiment of the present invention;

[0059] Figure 3 It is a schematic diagram of digital signature generation provided by an embodiment of the present invention;

[0060] Figure 4 It is a schematic diagram of homomorphic signature generation provided by an embodiment of the present invention;

[0061] Figure 5 It is a schematic diagram of signature verification provided by an embodiment of the present invention;

[0062] Figure 6 It is a block diagram of a lattice-based hierarchical fully homomorphic digital signature device provided by an embodiment of the present invention;

[0063] Figure 7 It is a structural schematic diagram of a lattice-based hierarchical fully homomorphic digital signature device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0064] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0065] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0066] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0067] In the embodiments of the present invention, sometimes a subscript such as W1 may be expressed in a non-subscript form such as W1. When the difference is not emphasized, the meanings to be expressed are consistent.

[0068] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0069] The embodiment of the present invention provides a lattice-based hierarchical fully homomorphic digital signature method, which can be implemented by a lattice-based hierarchical fully homomorphic digital signature device, which can be a terminal or a server. Figure 1 The flowchart of the lattice-based hierarchical fully homomorphic digital signature method shown in FIG. 1 may include the following steps:

[0070] S1. Preset security parameters and the maximum number of messages; generate public parameters based on the security parameters and the maximum number of messages.

[0071] In a feasible implementation manner, in S1, a security parameter and a maximum number of messages are preset; and a public parameter is generated based on the security parameter and the maximum number of messages, including:

[0072] Preset security parameters and maximum number of messages N;

[0073] According to the security parameters and the maximum number of messages N, each parameter r i The corresponding message m i Or the sequence number i is the seed, and the common parameters r1, r2…r are output through Gaussian sampling. N , the public parameter r i As the salt value and message m i After mixing, the mixed values ​​are operated by a hash function to generate a target vector for the small integer solution problem on the ring;

[0074] Among them, each r i and m i Combined into (r i ||m i ) format; the number of public parameters is consistent with the maximum number of messages N.

[0075] In a feasible implementation, ri As the salt value, and the message m i Mixed into (r i ||m i ) form; then (r i ||m i ) performs hash function operation, which can be expressed as hash(r i ||m i ):

[0076] v i = hash(r i ||m i ),

[0077] Among them, v i It is the target vector of the problem of solving the small integer problem on the ring. Ring Small Integer Solution (RSIS) is a difficult problem on the lattice. The design of cryptographic algorithms is usually based on some difficult problem. Cracking a cipher is usually reduced to cracking some difficult problem.

[0078] S2, sample the generator polynomial and calculate the public key, solve the NTRU equation and calculate the private key;

[0079] In a feasible implementation, Figure 2 As shown, in S2, the sampled polynomial is generated and the public key is calculated, the NTRU equation is solved and the private key is calculated, including:

[0080] Construct a univariate n-order irreducible polynomial φ=x n +1 and modulus q; sample n-order polynomials f and g from discrete Gaussian distribution on integers, where polynomials f and g are random n-order polynomials, polynomial f satisfies modulus q reversibility, and the norms of polynomials g and -f are small enough; where small enough means satisfying the following Figure 2 Calculation formula for steps 3 and 4:

[0081]

[0082] In a feasible implementation, a univariate n-order irreducible polynomial can be mathematically expressed as x n +1 is a fixed polynomial with a function similar to the modulus q mentioned later. It is used for modular operations to ensure that the highest degree of a polynomial does not exceed n.

[0083] After generating polynomials f and g, check whether polynomials f and g meet the two conditions of reversibility and sufficiently small norm; if not, generate them randomly until polynomials f and g that meet the conditions are obtained.

[0084] In a feasible implementation, based on polynomial f and polynomial g, the NTRU equation is solved to obtain polynomials F and G, and f, g, F, G are fast Fourier transformed and then combined to obtain a binary matrix B;

[0085] Based on the binary matrix B, the FALCON tree T is obtained using the fast Fourier sampling algorithm; the private key sk consists of two parts, B and T; the inverse of the polynomial g and f is multiplied modulo q: g*f -1 modq, get the public key p k The value h, that is, sk = (B, T), pk = h = gf -1 .

[0086] S3. Obtain each message to be signed and the corresponding public parameters; merge each message to be signed and the corresponding public parameters, and perform a hash operation to obtain a message digest after merging; use the Lattice post-quantum signature algorithm to generate a signature corresponding to each message, summarize the signatures corresponding to each message, and obtain a signature group to be processed;

[0087] In a feasible implementation, Figure 3 As shown, in S3, each message to be signed and the corresponding public parameters are obtained; each message to be signed and the corresponding public parameters are merged, and a hash operation is performed after the merger to obtain a message digest; a signature corresponding to each message is generated using a lattice post-quantum signature algorithm, and the signatures corresponding to each message are summarized to obtain a signature group to be processed, including:

[0088] Input message m1, m2, ...m i …, m N , private key s k , system parameters r1, r2, … r i …, r N and the maximum signed square norm;

[0089] The salt value r in the public parameter i and message m i Combined into a string, after being processed by the hash function, the target vector v of the problem of solving the difficult problem of small integers on the ring is generated i ; v i Convert to FFT form and multiply it with the inverse of the matrix B in the private key to get t i , that is, v i = hash(r i ||m i ), t i =FFT(v i ,0)·B -1 ;

[0090] t iand the FALCON tree T in the private key are input into the fast Fourier sampling algorithm to obtain z i , t i and z i The difference is multiplied by the matrix B in the private key to obtain the FFT form of the signature value s i , that is, z i =ffSampling n (t i ,T),s′ i =(t i -z i )·B;

[0091] Verify signature value s i Is the square norm of less than or equal to the maximum signed square norm of the input: If it is not satisfied, then return to resample; if it is satisfied, then s i Perform inverse FFT transform to obtain the signature vector s i1 and i2 :

[0092] Determine the signature vector s i1 and i2 Whether it can be verified, that is, to judge whether s i1 and i2 Does it satisfy the equation If not, resample; if the verification passes, take s i2 Compress and encode to get the signature value s i ; Loop the operation N times to obtain the signature group to be processed.

[0093] S4. Perform homomorphic operations on the signatures in the signature group according to the function on each message to generate a homomorphic signature; generate a target vector corresponding to the homomorphic signature according to the function on each message and the corresponding public parameters;

[0094] In a feasible implementation, Figure 4 As shown, in S4, a homomorphic operation is performed on the signatures in the signature group according to the function on each message to generate a homomorphic signature; a target vector corresponding to the homomorphic signature is generated according to the function on each message and the corresponding public parameters, including:

[0095] Function e (evaluation) on the input message space, messages m1, m2, ...m i …, m N , signatures s1,s2,…s i …,s N And system parameters r1, r2, ... r i …, r N ;

[0096] Decompress each signature si to obtain s i1 and i2 , calculate the target vector value vi of si through the hash function;

[0097] Decompose function e into a combination of basic operations: e1, e2…e i , …e N ; Among them, the combination of basic operations includes: addition, multiplication and combination of number multiplication;

[0098] Read each basic operation separately i , as well as the signature value and target vector value corresponding to the corresponding message; input the signature value and target vector value into the corresponding basic homomorphic operation algorithm, generate a new signature value and target vector value and save them as input for the next operation;

[0099] The loop operation is repeated until all operations are completed, the obtained signature value is compressed and encoded, and the homomorphic signature value s is output. e and the corresponding target vector value v e .

[0100] In a feasible implementation, the signature generated by the signature generation module is usually compressed before being transmitted to the homomorphic operation module and the signature verification module in order to reduce overhead and improve efficiency;

[0101] Then decompression is performed before processing in the homomorphic operation module and the signature verification module; here is the homomorphic operation module, the previous step is the signature verification module, and the processing of si to obtain si1\si2 is the decompression operation, and vice versa is the compression operation.

[0102] In a feasible implementation, in S4, when the basic operation e(m1,m2)=m1+m2, it includes:

[0103] For the basic operation function e on the message space, a homomorphic operation s1+s2 is performed on the signatures s1 and s2 of m1 and m2 to obtain the homomorphic signature, and a homomorphic operation v1+v2 is performed on the target vectors v1 and v2 corresponding to s1 and s2 to obtain the target vector corresponding to the homomorphic signature.

[0104] In a feasible implementation, in S4, when the basic operation e(m1,m2)=m1·m2, it includes:

[0105] For the basic operation function e on the message space, a homomorphic operation s1·v2 is performed on the signatures s1 and s2 of m1 and m2 to obtain the homomorphic signatures, and a homomorphic operation v1·v2 is performed on the target vectors v1 and v2 corresponding to s1 and s2 to obtain the target vector corresponding to the homomorphic signature.

[0106] In a feasible implementation, in S4, when the basic operation e(m1)=c·m1, it includes:

[0107] For the basic operation function e on the message space, a homomorphic operation c·s1 is performed on the signature s1 of m1 to obtain the homomorphic signature, and a homomorphic operation c·v1 is performed on the target vector v1 corresponding to s1 to obtain the target vector corresponding to the homomorphic signature, where c is a constant.

[0108] In a feasible implementation manner, homomorphic addition, homomorphic multiplication, and homomorphic number multiplication in this article can be understood as the operation corresponding to the basic addition and multiplication of two numbers or number multiplication operations; homomorphic addition corresponds to the basic addition operation, and homomorphic multiplication corresponds to multiplication; here e refers to the combination of basic addition, multiplication, etc. operations; e1, e2…e i , …e N is to decompose e into individual operations such as addition and multiplication. i Represents a basic operation such as addition or multiplication;

[0109] Homomorphic addition, homomorphic multiplication, and homomorphic number multiplication refer to special operations corresponding to the signature value based on the basic addition, multiplication, and number multiplication in e, that is, homomorphic operations.

[0110] S5. Use the public key to operate the homomorphic signature to determine whether the homomorphic signature corresponds to the target vector. If so, the homomorphic signature is valid; if not, the homomorphic signature is invalid.

[0111] In a feasible implementation, Figure 5 As shown, in S5, the public key is used to operate the homomorphic signature to determine whether the homomorphic signature corresponds to the target vector. If so, the homomorphic signature is valid; if not, the homomorphic signature is invalid, including:

[0112] Input homomorphic signature s e , and the corresponding target vector v e and public key p k ;

[0113] Decompress the homomorphic signature s e Get e1 ,s e2 , judge e1 ,s e2 Is the size between -q / 2 and q / 2? If not, e1 ,s e2 Perform modulo q processing so that each coefficient is within the range of -q / 2 and q / 2; if satisfied, judge s e1 ,s e2 Whether it satisfies e1 +s e2 h=ve mod(φ,q), if satisfied, the verification passes, otherwise the verification fails.

[0114] In a feasible implementation manner, the module q processing includes: e1 ,s e2 Actually, it is a vector. Modulo q processing is to mod each value in the vector by q. Here, each value should be between -q / 2 and q / 2. Therefore, if the value in the vector is greater than q / 2 after modulo q, then q / 2 is subtracted.

[0115] The present invention adopts the FALCON algorithm to construct a signature scheme for a single message. The security of the signature scheme relies on the security of FALCON and has a very reliable post-quantum security guarantee, filling the gap of the current domestic commercial digital signature algorithm that is not resistant to quantum.

[0116] Combined with the practical lattice signature algorithm, a basic homomorphic operation algorithm is designed based on the GPV architecture. The present invention shortens the time required for a homomorphic multiplication operation, and the length of the generated homomorphic signature is similar to that of a single signature, thereby improving the efficiency of the hierarchical fully homomorphic signature scheme.

[0117] In terms of security, the present invention studies the difficulty of solving small integer problems on rings on unit cells based on number theory, rather than other difficult problems on standard lattices. The security proof is more concise, which improves the security of the solution.

[0118] The present invention is based on a practical lattice signature scheme. The signature scheme constructed thereby not only broadens the application field of the lattice signature algorithm, but also makes the scheme have good compatibility and applicability, can be deployed on various resource-constrained software and hardware platforms, and has a wide range of applications.

[0119] Figure 6 1 is a block diagram of a lattice-based hierarchical fully homomorphic digital signature device according to an exemplary embodiment, and the device is used in a lattice-based hierarchical fully homomorphic digital signature method. Figure 6 The device includes a parameter generation module 310, a key calculation module 320, a signature generation module 330, a homomorphic operation module 340, and a signature verification module 350. Among them:

[0120] A parameter generation module 310 is used to preset security parameters and a maximum number of messages; and to generate common parameters based on the security parameters and the maximum number of messages;

[0121] The key calculation module 320 is used to sample the generator polynomial and calculate the public key, solve the NTRU equation and calculate the private key;

[0122] The signature generation module 330 is used to obtain each message to be signed and the corresponding public parameters; merge each message to be signed and the corresponding public parameters, and perform a hash operation after merging to obtain a message digest; use the lattice post-quantum signature algorithm to generate a signature corresponding to each message, summarize the signatures corresponding to each message, and obtain a signature group to be processed;

[0123] The homomorphic operation module 340 is used to perform homomorphic operation on the signatures in the signature group according to the function on each message to generate a homomorphic signature; and to generate a target vector corresponding to the homomorphic signature according to the function on each message and the corresponding public parameters;

[0124] The signature verification module 350 is used to use the public key to operate the homomorphic signature to determine whether the homomorphic signature corresponds to the target vector. If so, the homomorphic signature is valid; if not, the homomorphic signature is invalid.

[0125] Optionally, a parameter generation module 310 is used to preset security parameters and a maximum number of messages N;

[0126] According to the security parameters and the maximum number of messages N, each parameter r i The corresponding message m i Or the sequence number i is the seed, and the common parameters r1, r2…r are output through Gaussian sampling. N , the public parameter r i As the salt value and message m i After mixing, the mixed values ​​are operated by a hash function to generate a target vector for the small integer solution problem on the ring;

[0127] The number of public parameters is consistent with the maximum number of messages N.

[0128] Optionally, the key calculation module 320 is used to construct a univariate n-order irreducible polynomial φ=x n +1 and modulus q, sample n-order polynomials f, g from discrete Gaussian distribution on integers, where polynomials f, g are random n-order polynomials, polynomial f satisfies modulus q reversibility, and the norms of polynomials g and -f satisfy:

[0129]

[0130] Based on polynomial f and polynomial g, solve the NTRU equation to obtain polynomials F and G, perform fast Fourier transform on f, g, F, G and combine them to obtain the binary matrix B;

[0131] Based on the binary matrix B, the FALCON tree T is obtained using the fast Fourier sampling algorithm; the private key s k It consists of two parts, B and T; multiply the polynomial g and the inverse of f modulo q to get the public key p k The value of h.

[0132] Optionally, the signature generation module 330 is used to input messages m1, m2, ...m i …, m N , private key s k , system parameters r1, r2, … r i …, r N and the maximum signed square norm;

[0133] The salt value r in the public parameter i and message m i Combined into a string, after being processed by the hash function, the target vector v of the problem of solving the difficult problem of small integers on the ring is generated i ; v i Convert to FFT form and multiply it with the inverse of the matrix B in the private key to get t i ;

[0134] t i and the FALCON tree T in the private key are input into the fast Fourier sampling algorithm to obtain z i , t i and z i The difference is multiplied by the matrix B in the private key to obtain the FFT form of the signature value s i ;

[0135] Verify signature value s i Is the square norm of s less than or equal to the maximum signature square norm of the input? If not, return and resample; if satisfied, i Perform inverse FFT transform to obtain the signature vector s i1 and i2 ;

[0136] Determine the signature vector s i1 and i2 Can it be verified? If not, resample; if it is verified, take s i2 Compress and encode to get the signature value s i ; Loop the operation N times to obtain the signature group to be processed.

[0137] Optionally, the homomorphic operation module 340 is used to input the function e on the message space, the messages m1, m2, ...m i …, m N , signatures s1,s2,…s i …,s N And system parameters r1, r2, ... r i …, r N ;

[0138] Decompress each signature si to obtain s i1 and i2, calculate the target vector value vi of si through the hash function;

[0139] Decompose function e into a combination of basic operations: e1, e2…e i , …e N ; Among them, the combination of basic operations includes: addition, multiplication and combination of number multiplication;

[0140] Read each basic operation separately i , as well as the signature value and target vector value corresponding to the corresponding message; input the signature value and target vector value into the corresponding basic homomorphic operation algorithm, generate a new signature value and target vector value and save them as input for the next operation;

[0141] The loop operation is repeated until all operations are completed, the obtained signature value is compressed and encoded, and the homomorphic signature value s is output. e and the corresponding target vector value v e .

[0142] Optionally, when the basic operation e(m1,m2)=m1+m2, it includes:

[0143] For the basic operation function e on the message space, a homomorphic operation s1+s2 is performed on the signatures s1 and s2 of m1 and m2 to obtain the homomorphic signature, and a homomorphic operation v1+v2 is performed on the target vectors v1 and v2 corresponding to s1 and s2 to obtain the target vector corresponding to the homomorphic signature.

[0144] Optionally, when the basic operation e(m1,m2)=m1·m2, it includes:

[0145] For the basic operation function e on the message space, a homomorphic operation s1·v2 is performed on the signatures s1 and s2 of m1 and m2 to obtain the homomorphic signatures, and a homomorphic operation v1·v2 is performed on the target vectors v1 and v2 corresponding to s1 and s2 to obtain the target vector corresponding to the homomorphic signature.

[0146] Optionally, when the basic operation e(m1)=c·m1, it includes:

[0147] For the basic operation function e on the message space, a homomorphic operation c·s1 is performed on the signature s1 of m1 to obtain the homomorphic signature, and a homomorphic operation c·v1 is performed on the target vector v1 corresponding to s1 to obtain the target vector corresponding to the homomorphic signature, where c is a constant.

[0148] Optionally, the signature verification module 350 is used to input the homomorphic signature s e , and the corresponding target vector v e and public key p k ;

[0149] Decompress the homomorphic signature s eGet e1 ,s e2 , judge e1 ,s e2 Is the size between -q / 2 and q / 2? If not, e1 ,s e2 Perform modulo q processing so that each coefficient is within the range of -q / 2 and q / 2; if satisfied, judge s e1 ,s e2 Whether it satisfies e1 +s e2 h=v e mod(φ,q), if satisfied, the verification passes, otherwise the verification fails.

[0150] The device provided by the present invention adopts the FALCON algorithm to construct a signature scheme for a single message. The security of the signature scheme relies on the security of FALCON and has a very reliable post-quantum security guarantee, filling the gap of the current domestic commercial digital signature algorithm that is quantum-resistant.

[0151] Combined with the practical lattice signature algorithm, a basic homomorphic operation algorithm is designed based on the GPV architecture. The present invention shortens the time required for a homomorphic multiplication operation, and the length of the generated homomorphic signature is similar to that of a single signature, thereby improving the efficiency of the hierarchical fully homomorphic signature scheme.

[0152] In terms of security, the present invention studies the difficulty of solving small integer problems on rings on unit cells based on number theory, rather than other difficult problems on standard lattices. The security proof is more concise, which improves the security of the solution.

[0153] The present invention is based on a practical lattice signature scheme. The signature scheme constructed thereby not only broadens the application field of the lattice signature algorithm, but also makes the scheme have good compatibility and applicability, can be deployed on various resource-constrained software and hardware platforms, and has a wide range of applications.

[0154] Figure 7 is a schematic diagram of the structure of a lattice-based hierarchical fully homomorphic digital signature device provided by an embodiment of the present invention, such as Figure 7 As shown, the lattice-based hierarchical fully homomorphic digital signature device may include the above Figure 6 Optionally, the lattice-based hierarchical fully homomorphic digital signature device 410 may include a first processor 2001 .

[0155] Optionally, the lattice-based hierarchical fully homomorphic digital signature device 410 may also include a memory 2002 and a transceiver 2003 .

[0156] The first processor 2001, the memory 2002 and the transceiver 2003 may be connected via a communication bus.

[0157] Combine the following Figure 7 The components of the lattice-based hierarchical fully homomorphic digital signature device 410 are specifically introduced:

[0158] The first processor 2001 is the control center of the lattice-based hierarchical fully homomorphic digital signature device 410, and can be a processor or a general term for multiple processing elements. For example, the first processor 2001 is one or more central processing units (CPUs), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (field programmable gate arrays, FPGAs).

[0159] Optionally, the first processor 2001 can perform various functions of the lattice-based hierarchical fully homomorphic digital signature device 410 by running or executing a software program stored in the memory 2002 and calling data stored in the memory 2002.

[0160] In a specific implementation, as an embodiment, the first processor 2001 may include one or more CPUs, such as Figure 7 CPU0 and CPU1 are shown in FIG.

[0161] In a specific implementation, as an embodiment, the lattice-based hierarchical fully homomorphic digital signature device 410 may also include multiple processors, such as Figure 7 The first processor 2001 and the second processor 2004 are shown in FIG. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0162] The memory 2002 is used to store the software program for executing the solution of the present invention, and is controlled to be executed by the first processor 2001. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0163] Optionally, the memory 2002 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2002 may be integrated with the first processor 2001, or may exist independently, and may be connected to the first processor 2001 through the interface circuit ( Figure 7 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0164] The transceiver 2003 is used to communicate with a network device or a terminal device.

[0165] Optionally, the transceiver 2003 may include a receiver and a transmitter ( Figure 7 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0166] Optionally, the transceiver 2003 may be integrated with the first processor 2001, or may exist independently and communicate with the first processor 2001 through the interface circuit ( Figure 7 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0167] It should be noted that Figure 7 The structure of the lattice-based hierarchical fully homomorphic digital signature device 410 shown in the figure does not constitute a limitation on the router. The actual knowledge structure recognition device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0168] In addition, the technical effects of the lattice-based hierarchical fully homomorphic digital signature device 410 can refer to the technical effects of the lattice-based hierarchical fully homomorphic digital signature method described in the above method embodiment, and will not be repeated here.

[0169] It should be understood that the first processor 2001 in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0170] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0171] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0172] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0173] In the present invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0174] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0175] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0176] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0177] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0178] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0179] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0180] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0181] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A lattice-based hierarchical fully homomorphic digital signature method, It is characterized in that The method comprises: S1. Preset security parameters and the maximum number of messages; generate public parameters based on the security parameters and the maximum number of messages; S2, sample the generator polynomial and calculate the public key, solve the NTRU equation and calculate the private key; S3. Obtain each message to be signed and the corresponding public parameter; merge each message to be signed and the corresponding public parameter, and perform a hash operation on the merged message to obtain a message digest; use the Lattice post-quantum signature algorithm to generate a signature corresponding to each message, summarize the signatures corresponding to each message, and obtain a signature group to be processed; In S3, each message to be signed and the corresponding public parameter are obtained; each message to be signed and the corresponding public parameter are merged, and a hash operation is performed after the merger to obtain a message digest; a signature corresponding to each message is generated using a lattice post-quantum signature algorithm, and the signature corresponding to each message is summarized to obtain a signature group to be processed, including: Input message m 1 , m 2 ,…m i …, m N , private key s k , system parameter r 1 , r 2 ,…r i …, r N and the maximum signed square norm; The salt value r in the public parameter i and message m i Combined into a string, after being processed by the hash function, the target vector v of the problem of solving the difficult problem of small integers on the ring is generated i ; v i Convert to FFT form and multiply it with the inverse of the matrix B in the private key to get t i ; t i and the FALCON tree T in the private key are input into the fast Fourier sampling algorithm to obtain z i , t i and z i The difference is multiplied by the matrix B in the private key to obtain the FFT form of the signature value s i ; Verify signature value s i Is the square norm of s less than or equal to the maximum signature square norm of the input? If not, return and resample; if satisfied, i Perform inverse FFT transform to obtain the signature vector s i1 and i2 ; Determine the signature vector s i1 and i2 Can it be verified? If not, resample; if it is verified, take s i2 Compress and encode to get the signature value s i ; Loop operation N times to obtain the signature group to be processed; S4, performing homomorphic operations on the signatures in the signature group according to the function on each message space to generate a homomorphic signature; generating a target vector corresponding to the homomorphic signature according to the function on each message and the corresponding public parameters; In S4, performing homomorphic operations on the signatures in the signature group according to the function on each message to generate a homomorphic signature; generating a target vector corresponding to the homomorphic signature according to the function on each message and the corresponding public parameters, including: Input function e on message space, message m 1 , m 2 ,…m i …, m N , Signatures 1 ,s 2 ,…s i …,s N And the system parameter r 1 , r 2 ,…r i …, r N ; For each signature s i Decompress it to get s i1 and i2 , calculate s through the hash function i The target vector value v i ; Decompose the function e into basic operations, namely addition, multiplication and multiplication of numbers: e 1 e 2 …e t ; Read each basic operation separately t , as well as the signature value and target vector value corresponding to the corresponding message; input the signature value and target vector value into the corresponding basic homomorphic operation algorithm, generate a new signature value and target vector value and save them as input for the next operation; The loop operation is repeated until all operations are completed, the obtained signature value is compressed and encoded, and the homomorphic signature value s is output. e and the corresponding target vector value v e ; S5. Use the public key to operate the homomorphic signature to determine whether the homomorphic signature corresponds to the target vector. If so, the homomorphic signature is valid; if not, the homomorphic signature is invalid.

2. The lattice-based hierarchical fully homomorphic digital signature method according to claim 1, It is characterized in that In S1, the security parameters and the maximum number of messages are preset; Generating a public parameter based on the security parameter and the maximum number of messages includes: Preset security parameters and maximum number of messages N; According to the security parameters and the maximum number of messages N, each parameter r i The corresponding message m i Or the sequence number i is the seed, and the public parameter r is output through Gaussian sampling 1 , r 2 …r N , the public parameter r i As the salt value and message m i After mixing, the mixed values ​​are operated by a hash function to generate a target vector for the small integer solution problem on the ring; The number of public parameters is consistent with the maximum number of messages N.

3. The lattice-based hierarchical fully homomorphic digital signature method according to claim 2, It is characterized in that In S2, sampling the generating polynomial and calculating the public key, solving the NTRU equation and calculating the generating private key include: Construct a univariate n-order irreducible polynomial φ=x n +1 and modulus q, sample n-order polynomials f, g from discrete Gaussian distribution on integers, where polynomials f, g are random n-order polynomials, polynomial f satisfies modulus q reversibility, and the norms of polynomials g and -f satisfy: Based on the polynomial f and the polynomial g, the NTRU equation is solved to obtain polynomials F and G; f, g, F, G are fast Fourier transformed and then combined to obtain a binary matrix B; Based on the binary matrix B, a FALCON tree T is obtained using a fast Fourier sampling algorithm; the private key sk consists of two parts, B and T; the value h of the public key pk is obtained by multiplying the inverse of the polynomial g and f modulo q.

4. The lattice-based hierarchical fully homomorphic digital signature method according to claim 3, It is characterized in that In S4, when the basic operation e(m 1 ,m 2 )=m 1 +m 2 When including: For the basic operation function e on the message space, 1 ,m 2 Signatures 1 ,s 2 Perform homomorphic operations 1 +s 2 Get the homomorphic signature, for s 1 ,s 2 The corresponding target vector v 1 ,v 2 Perform homomorphic operation v 1 +v 2 Get the target vector corresponding to the homomorphic signature.

5. The lattice-based hierarchical fully homomorphic digital signature method according to claim 3, It is characterized in that In S4, when the basic operation e(m 1 ,m 2 )=m 1 ·m 2 When including: For the basic operation function e on the message space, 1 ,m 2 Signatures 1 ,s 2 Perform homomorphic operations 1 ·v 2 Get the homomorphic signature, for s 1 ,s 2 The corresponding target vector v 1 ,v 2 Perform homomorphic operation v 1 ·v 2 Get the target vector corresponding to the homomorphic signature.

6. The lattice-based hierarchical fully homomorphic digital signature method according to claim 3, It is characterized in that In S4, when the basic operation e(m 1 )=c·m 1 When including: For the basic operation function e on the message space, 1 Signatures 1 Perform homomorphic operation c·s 1 Get the homomorphic signature, for s 1 The corresponding target vector v 1 Perform homomorphic operation c·v 1 Get the target vector corresponding to the homomorphic signature, where c is a constant.

7. The lattice-based hierarchical fully homomorphic digital signature method according to claim 4, 5 or 6, It is characterized in that In S5, the homomorphic signature is operated using the public key to determine whether the homomorphic signature corresponds to the target vector. If so, the homomorphic signature is valid. If they cannot correspond, the homomorphic signature is invalid, including: Input homomorphic signature s e , and the corresponding target vector v e and public key p k ; Decompress the homomorphic signature s e Get e1 ,s e2 , judge e1 ,s e2 Is the size between -q / 2 and q / 2? If not, e1 ,s e2 Perform modulo q processing so that each coefficient is within the range of -q / 2 and q / 2; if satisfied, judge s e1 ,s e2 Whether it satisfies e1 +s e2 h=v e mod(φ,q), if satisfied, the verification passes, otherwise the verification fails.

8. A lattice-based hierarchical fully homomorphic digital signature device, the lattice-based hierarchical fully homomorphic digital signature device is used to implement the lattice-based hierarchical fully homomorphic digital signature method as claimed in any one of claims 1 to 7, It is characterized in that The device comprises: A parameter generation module, used for presetting security parameters and a maximum number of messages; generating common parameters based on the security parameters and the maximum number of messages; The key calculation module is used to sample the generating polynomial and calculate the public key, solve the NTRU equation and calculate the private key; The signature generation module is used to obtain each message to be signed and the corresponding public parameters; merge each message to be signed and the corresponding public parameters, and perform a hash operation to obtain a message digest after merging; use the lattice post-quantum signature algorithm to generate a signature corresponding to each message, summarize the signatures corresponding to each message, and obtain a signature group to be processed; A homomorphic operation module is used to perform homomorphic operations on the signatures in the signature group according to the function on each message space to generate a homomorphic signature; a target vector corresponding to the homomorphic signature is generated according to the function on each message and the corresponding public parameters; The signature verification module is used to use the public key to operate the homomorphic signature to determine whether the homomorphic signature corresponds to the target vector. If so, the homomorphic signature is valid; if not, the homomorphic signature is invalid.

Images