Post-quantum digital certificate application method, device, electronic device and storage medium

Abstract

The present invention provides a post-quantum digital certificate application method, device, electronic device and storage medium, which relates to the technical field of post-quantum certificates. The method includes: obtaining application information, post-quantum signature key pair and temporary post-quantum encryption key pair of an applicant to apply for a post-quantum digital certificate; constructing a certificate request based on the application information, post-quantum signature key pair and temporary post-quantum encryption key pair; obtaining a post-quantum encryption private key and a symmetric key, and constructing a sealed key structure based on the post-quantum encryption private key, the symmetric key and the temporary encryption public key; generating a post-quantum digital certificate based on the certificate request and the post-quantum encryption public key; generating a certificate response based on the sealed key structure and the post-quantum digital certificate, and feeding the certificate response back to the applicant so that the applicant can parse the certificate response to obtain a post-quantum digital certificate and a post-quantum encryption private key. The encrypted private key is securely sent to the applicant, ensuring that the applicant obtains the post-quantum digital certificate and the post-quantum encryption private key.

Description

Technical Field

[0001] The present invention relates to the field of post-quantum certificate technology, and in particular to a post-quantum digital certificate application method, device, electronic device and storage medium. Background Art

[0002] With the advent of the post-quantum era, the ability to safely apply for post-quantum digital certificates has become an urgent issue to be addressed.

[0003] It is known from the relevant technology that in the process of effectively applying for a post-quantum digital certificate, the applicant needs to download the post-quantum digital certificate and the encrypted private key corresponding to the post-quantum digital certificate. However, the post-quantum algorithms currently designed are all single-purpose algorithms, that is, an algorithm can only be used for signing or encryption. Since the key pair generated for the signature algorithm cannot be applied to the encryption algorithm, the encrypted private key cannot be securely sent to the applicant, and the applicant cannot safely apply for a post-quantum digital certificate.

[0004] Therefore, finding a post-quantum digital certificate application method that can securely send the encrypted private key to the applicant, thereby ensuring that the applicant can safely apply for a post-quantum digital certificate, has become an urgent problem to be solved. Summary of the invention

[0005] The present invention provides a post-quantum digital certificate application method, device, electronic device and storage medium, which can securely send an encrypted private key to an applicant, thereby ensuring that the applicant can securely apply for a post-quantum digital certificate.

[0006] The present invention provides a post-quantum digital certificate application method, the method comprising: respectively obtaining application information, a post-quantum signature key pair and a temporary post-quantum encryption key pair of an applicant for a post-quantum digital certificate to be applied for; constructing a certificate request based on the application information, the post-quantum signature key pair and the temporary post-quantum encryption key pair of the applicant for the post-quantum digital certificate to be applied for; obtaining a post-quantum encryption private key and a symmetric key in the post-quantum encryption key pair, and constructing a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key and the temporary encryption public key in the temporary post-quantum encryption key pair; generating a post-quantum digital certificate based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair; generating a certificate response based on the sealed key structure and the post-quantum digital certificate, and feeding the certificate response back to the applicant, so that the applicant parses the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key, and realizes the application for the post-quantum digital certificate to be applied for, wherein the post-quantum digital certificate has a corresponding relationship with the post-quantum encryption private key.

[0007] According to a post-quantum digital certificate application method provided by the present invention, the construction of a certificate request based on the application information of the applicant for the post-quantum digital certificate to be applied for, the post-quantum signature key pair and the temporary post-quantum encryption key pair specifically includes: obtaining a signature public key in the post-quantum signature key pair based on the post-quantum signature key pair; obtaining a temporary encryption public key in the temporary post-quantum encryption key pair based on the temporary post-quantum encryption key pair; obtaining certificate request information based on the application information of the applicant for the post-quantum digital certificate to be applied for, the signature public key, and the temporary encryption public key, and encoding the certificate request information to obtain an encoding result corresponding to the certificate request information; signing the encoding result corresponding to the certificate request information based on the signature private key corresponding to the signature public key to obtain a signature value of the certificate request information; obtaining the certificate request based on the certificate request information, the signature algorithm identifier corresponding to the post-quantum signature key pair, and the signature value of the certificate request information.

[0008] According to a post-quantum digital certificate application method provided by the present invention, the method of constructing a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key, and the temporary encryption public key in the temporary post-quantum encryption key pair specifically includes: encrypting the post-quantum encryption private key based on the symmetric key to obtain a post-quantum encryption private key ciphertext; encrypting the symmetric key based on the temporary encryption public key to obtain a symmetric key ciphertext; constructing a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key ciphertext, the symmetric key ciphertext, the symmetric algorithm identifier corresponding to the symmetric key, and the post-quantum encryption public key corresponding to the post-quantum encryption private key.

[0009] According to a post-quantum digital certificate application method provided by the present invention, the certificate response is parsed to obtain the post-quantum digital certificate and the post-quantum encryption private key, which is implemented in the following manner: the certificate response is parsed to obtain the post-quantum digital certificate, the post-quantum encryption private key ciphertext, and the symmetric key ciphertext; a temporary encryption private key corresponding to the temporary encryption public key is obtained; based on the temporary encryption private key, the symmetric key ciphertext is decrypted to obtain the symmetric key; based on the symmetric key, the post-quantum encryption private key ciphertext is decrypted to obtain the post-quantum encryption private key.

[0010] According to a post-quantum digital certificate application method provided by the present invention, the temporary post-quantum encryption key pair is generated by a cryptographic module, wherein the cryptographic module includes at least any one or more of a smart cryptographic key, a cryptographic machine, a signature verification server, an SSL gateway, an IC card, a SIM card, a cryptographic chip, and a software cryptographic module.

[0011] According to a post-quantum digital certificate application method provided by the present invention, the method also includes: deleting the temporary post-quantum encryption key pair in the cryptographic module.

[0012] The present invention also provides a post-quantum digital certificate application device, the device comprising: an acquisition module, used to respectively acquire application information, a post-quantum signature key pair, and a temporary post-quantum encryption key pair of an applicant for a post-quantum digital certificate to be applied for; a construction module, used to construct a certificate request based on the application information, the post-quantum signature key pair, and the temporary post-quantum encryption key pair of the applicant for the post-quantum digital certificate to be applied for; an issuance module, used to acquire a post-quantum encryption private key and a symmetric key in the post-quantum encryption key pair, and issue a certificate based on the post-quantum encryption private key, the symmetric key, and the temporary post-quantum encryption key pair. A post-quantum digital certificate is generated based on the certificate request and the post-quantum public key in the post-quantum encryption key pair; a response module is used to generate a certificate response based on the sealed key structure and the post-quantum digital certificate, and feed the certificate response back to the applicant, so that the applicant can parse the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key, and implement the application for the post-quantum digital certificate to be applied for, wherein the post-quantum digital certificate has a corresponding relationship with the post-quantum encryption private key.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements any of the above-described post-quantum digital certificate application methods.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the post-quantum digital certificate application methods described above.

[0015] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned post-quantum digital certificate application methods.

[0016] The post-quantum digital certificate application method, device, electronic device and storage medium provided by the present invention respectively obtain application information, a post-quantum signature key pair and a temporary post-quantum encryption key pair of an applicant for a post-quantum digital certificate to be applied for; construct a certificate request based on the application information, the post-quantum signature key pair and the temporary post-quantum encryption key pair of the applicant for the post-quantum digital certificate to be applied for; obtain a post-quantum encryption private key and a symmetric key in the post-quantum encryption key pair, and construct a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key and the temporary encryption public key in the temporary post-quantum encryption key pair; generate a post-quantum digital certificate based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair; generate a certificate response based on the sealed key structure and the post-quantum digital certificate, and feed the certificate response back to the applicant, so that the applicant parses the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key, thereby realizing the application for the post-quantum digital certificate to be applied for. Since the post-quantum encryption private key is protected by temporary encryption public key, the problem that the key pair generated by the signature algorithm in the post-quantum cryptography era cannot be applied to the encryption algorithm, resulting in the inability to download the post-quantum digital certificate, is solved. The encrypted private key can be securely sent to the applicant, thereby ensuring that the applicant can effectively apply for a post-quantum digital certificate. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a flowchart of the post-quantum digital certificate application method provided by the present invention.

[0019] Figure 2 It is a flow chart of constructing a certificate request based on the application information of an applicant for a post-quantum digital certificate, a post-quantum signature key pair, and a temporary post-quantum encryption key pair provided by the present invention.

[0020] Figure 3 It is a flow chart of constructing a sealed key structure corresponding to a post-quantum encryption private key based on a post-quantum encryption private key, a symmetric key, and a temporary encryption public key in a temporary post-quantum encryption key pair provided by the present invention.

[0021] Figure 4 It is a flow chart of parsing the certificate response provided by the present invention to obtain a post-quantum digital certificate and a post-quantum encryption private key.

[0022] Figure 5 It is a structural schematic diagram of the post-quantum digital certificate application device provided by the present invention.

[0023] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] It is known from related technologies that in the process of applying for encryption certificates, the signature key pair needs to be used for encryption and decryption purposes. This is feasible when using traditional public key algorithms (such as RSA or SM2), because traditional public key algorithms support two uses for one algorithm, that is, the same pair of keys for the SM2 algorithm can be used for signature verification and encryption and decryption. However, in the post-quantum era, the post-quantum algorithms currently designed are all single-purpose algorithms, that is, an algorithm can only be used for signatures (such as the Dilithium algorithm) or can only be used for encryption (such as the Kyber algorithm). The key pair generated for the signature algorithm cannot be applied to the encryption algorithm, that is, the signature key pair cannot be used for encryption and decryption purposes, which results in the inability to securely pass the encryption private key to the applicant, and thus makes the post-quantum digital certificate unable to be downloaded.

[0026] The post-quantum digital certificate application method provided by the present invention generates a temporary post-quantum encryption key pair, and encrypts and protects the generated post-quantum encryption private key based on the public key of the temporary key pair, thereby solving the problem that the relevant technologies in the post-quantum cryptography era cannot be applied, resulting in the inability to download post-quantum digital certificates. The method is simple and easy to implement, has good security, and has low implementation costs. It is easy to expand on the existing process, and only needs to upgrade and transform the bottom layer (such as the password module, the control that calls the password module, and the CA system), without adding new network transmission or interaction processes. For business system integration or end users, it can be done without perception.

[0027] Figure 1 It is a flowchart of the post-quantum digital certificate application method provided by the present invention.

[0028] The following will be combined Figure 1 The process of the post-quantum digital certificate application method provided by the present invention is described.

[0029] In an exemplary embodiment of the present invention, Figure 1 It can be seen that the post-quantum digital certificate application method may include steps 110 to 150, and each step will be introduced below.

[0030] In step 110, the application information, post-quantum signature key pair, and temporary post-quantum encryption key pair of the applicant who is to apply for the post-quantum digital certificate are obtained respectively.

[0031] In step 120, a certificate request is constructed based on the application information of the applicant for the post-quantum digital certificate, the post-quantum signature key pair, and the temporary post-quantum encryption key pair.

[0032] In one embodiment, application information of an applicant who is to apply for a post-quantum digital certificate, a post-quantum signature key pair, and a temporary post-quantum encryption key pair may be obtained respectively.

[0033] Among them, the post-quantum digital certificate to be applied for refers to the post-quantum digital certificate that the applicant wants to successfully download. It should be noted that if the applicant wants to successfully download the post-quantum digital certificate, he / she needs to download the post-quantum encryption private key corresponding to the post-quantum digital certificate. If the post-quantum encryption private key corresponding to the post-quantum digital certificate cannot be effectively downloaded, the post-quantum digital certificate to be applied for cannot be effectively downloaded.

[0034] In one embodiment, the application information may be relevant information representing the identity of the applicant, such as name, organization, province, city, country, etc. It should be noted that the application information is filled in by the applicant himself or is available only after the applicant's authorization. In another embodiment, the applicant may also refer to the application entity, such as the entity holding the certificate, and the application entity may be a natural person, a device, or a website, etc.

[0035] In another example, the post-quantum signature key pair may be a post-quantum signature key pair generated by calling a cryptographic module (e.g., a key pair of a Dilithium signature algorithm); the temporary post-quantum encryption key pair may be a temporary post-quantum encryption key pair generated by calling a cryptographic module (e.g., a key pair of a Keyber encryption algorithm).

[0036] In step 130, a post-quantum encryption private key and a symmetric key in a post-quantum encryption key pair are obtained, and a sealed key structure corresponding to the post-quantum encryption private key is constructed based on the post-quantum encryption private key, the symmetric key, and a temporary encryption public key in the temporary post-quantum encryption key pair.

[0037] In step 140, a post-quantum digital certificate is generated based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair.

[0038] In step 150, a certificate response is generated based on the sealed key structure and the post-quantum digital certificate, and the certificate response is fed back to the applicant, so that the applicant can parse the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key, thereby realizing a valid application for the post-quantum digital certificate to be applied for.

[0039] In one embodiment, a post-quantum digital certificate may be generated based on a certificate request.

[0040] In another embodiment, a pair of post-quantum encryption keys is newly generated by the CA organization, for example, by calling the KMC key management center, and the post-quantum encryption private key in the post-quantum encryption key is obtained, and the symmetric key K generated by the CA organization is obtained. Further, based on the post-quantum encryption private key, the symmetric key K, and the temporary encryption public key in the temporary post-quantum encryption key pair, a sealed key structure corresponding to the post-quantum encryption private key is constructed.

[0041] In another embodiment, a certificate response can be generated based on a sealed key structure and a post-quantum digital certificate, and the certificate response can be fed back to the applicant, so that the applicant can parse the certificate response, obtain a post-quantum digital certificate and a post-quantum encryption private key, and realize a valid application for the post-quantum digital certificate to be applied for. It should be noted that, since the post-quantum encryption private key is encrypted and protected by a temporary encryption public key, the key pair generated by the signature algorithm in the post-quantum cryptography era cannot be applied to the encryption algorithm, which leads to the problem that the post-quantum digital certificate cannot be downloaded, and the encryption private key can be securely sent (also called feedback) to the applicant, so that the applicant can effectively apply for the post-quantum digital certificate. Among them, the post-quantum digital certificate and the post-quantum encryption private key have a corresponding relationship. In other words, to complete the valid application for the post-quantum digital certificate to be applied for, the applicant needs to download the post-quantum digital certificate and the post-quantum encryption private key at the same time, and both are indispensable.

[0042] It should be noted that the digital certificate application method involved in the present invention can also be extrapolated to other directions, that is, it is not limited to post-quantum algorithms. In applications, any other public key cryptographic algorithm with only one purpose of signing or encryption can be analogized or processed similarly using the digital certificate application method involved in the present invention.

[0043] The post-quantum digital certificate application method provided by the present invention respectively obtains application information, a post-quantum signature key pair, and a temporary post-quantum encryption key pair of an applicant for a post-quantum digital certificate to be applied for; constructs a certificate request based on the application information, the post-quantum signature key pair, and the temporary post-quantum encryption key pair of the applicant for the post-quantum digital certificate to be applied for; obtains a post-quantum encryption private key and a symmetric key in the post-quantum encryption key pair, and constructs a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key, and the temporary encryption public key in the temporary post-quantum encryption key pair; generates a post-quantum digital certificate based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair; generates a certificate response based on the sealed key structure and the post-quantum digital certificate, and feeds the certificate response back to the applicant, so that the applicant parses the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key, thereby realizing the application for the post-quantum digital certificate to be applied for. Since the post-quantum encryption private key is protected by temporary encryption public key, the problem that the key pair generated by the signature algorithm in the post-quantum cryptography era cannot be applied to the encryption algorithm, resulting in the inability to download the post-quantum digital certificate, is solved. The encrypted private key can be securely sent to the applicant, thereby ensuring that the applicant can effectively apply for a post-quantum digital certificate.

[0044] Figure 2 It is a flow chart of constructing a certificate request based on the application information of an applicant for a post-quantum digital certificate, a post-quantum signature key pair, and a temporary post-quantum encryption key pair provided by the present invention.

[0045] The following will be combined Figure 2 The present invention provides a process for constructing a certificate request based on the application information of an applicant for a post-quantum digital certificate, a post-quantum signature key pair, and a temporary post-quantum encryption key pair.

[0046] In an exemplary embodiment of the present invention, Figure 2 It can be seen that based on the application information of the applicant for the post-quantum digital certificate, the post-quantum signature key pair and the temporary post-quantum encryption key pair, constructing the certificate request may include steps 210 to 250, and each step will be introduced below.

[0047] In step 210, based on the post-quantum signature key pair, a signature public key in the post-quantum signature key pair is obtained.

[0048] In step 220, based on the temporary post-quantum encryption key pair, a temporary encryption public key in the temporary post-quantum encryption key pair is obtained.

[0049] In one embodiment, a cryptographic module may be called to generate a post-quantum signature key pair (such as a key pair of a Dilithium signature algorithm), and further, based on the post-quantum signature key pair, a signature public key in the post-quantum signature key pair may be derived.

[0050] In another embodiment, the cryptographic module may be called to generate a temporary post-quantum encryption key pair (such as a key pair of the Keyber encryption algorithm). Further, based on the temporary post-quantum encryption key pair, a temporary encryption public key in the temporary post-quantum encryption key pair is derived.

[0051] In step 230, based on the application information, signature public key, and temporary encryption public key of the applicant of the quantum digital certificate to be applied for, the certificate request information is obtained, and the certificate request information is encoded to obtain an encoding result corresponding to the certificate request information.

[0052] In one embodiment, the application information, signature public key, and temporary encryption public key of the applicant for the post-quantum digital certificate can be organized into a CertificationRequestInfo structure, and the temporary encryption public key can be placed in attributes, or a new similar structure (such as adding a new tempPKInfo node), so as to obtain the certificate request information. Further, the certificate request information is DER encoded to obtain the encoding result corresponding to the certificate request information. Through DER encoding, it can be ensured that the certificate request information can only produce a unique serialized encoding result.

[0053] In step 240, based on the signature private key corresponding to the signature public key, the encoding result corresponding to the certificate request information is signed to obtain the signature value of the certificate request information.

[0054] In step 250, a certificate request is obtained based on the certificate request information, the signature algorithm identifier corresponding to the post-quantum signature key pair, and the signature value of the certificate request information.

[0055] In another embodiment, the encoding result corresponding to the certificate request information can be signed based on the signature private key corresponding to the signature public key to obtain the signature value of the certificate request information. Further, the obtained certificate request information, the signature algorithm identifier corresponding to the post-quantum signature key pair, and the signature value of the certificate request information are organized into a CertificationRest structure to generate a certificate request CSR.

[0056] Figure 3 It is a flow chart of constructing a sealed key structure corresponding to a post-quantum encryption private key based on a post-quantum encryption private key, a symmetric key, and a temporary encryption public key in a temporary post-quantum encryption key pair provided by the present invention.

[0057] The following will be combined Figure 3 The present invention provides a method for constructing a sealed key structure corresponding to a post-quantum encryption private key based on a post-quantum encryption private key, a symmetric key, and a temporary encryption public key in a temporary post-quantum encryption key pair.

[0058] In an exemplary embodiment of the present invention, Figure 3 It can be seen that based on the post-quantum encryption private key, the symmetric key, and the temporary encryption public key in the temporary post-quantum encryption key pair, constructing a sealed key structure corresponding to the post-quantum encryption private key can include steps 310 to 330, and each step will be introduced below.

[0059] In step 310, the post-quantum encryption private key is encrypted based on the symmetric key to obtain a post-quantum encryption private key ciphertext.

[0060] In one embodiment, a symmetric key K may be generated based on a CA organization. Furthermore, based on the symmetric key K, the post-quantum encryption private key is encrypted to obtain a post-quantum encryption private key ciphertext.

[0061] In step 320, the symmetric key is encrypted based on the temporary encryption public key to obtain a symmetric key ciphertext.

[0062] In step 330, based on the post-quantum encryption private key ciphertext, the symmetric key ciphertext, the symmetric algorithm identifier corresponding to the symmetric key, and the post-quantum encryption public key corresponding to the post-quantum encryption private key, a sealed key structure corresponding to the post-quantum encryption private key is constructed.

[0063] In yet another embodiment, the symmetric key K may be encrypted based on a temporary encryption public key derived from a temporary post-quantum encryption key pair, thereby obtaining a symmetric key ciphertext.

[0064] In another embodiment, the post-quantum encryption private key ciphertext, the symmetric key ciphertext, the symmetric algorithm identifier corresponding to the symmetric key, and the post-quantum encryption public key corresponding to the post-quantum encryption private key can be packaged together, so as to obtain a sealed key structure corresponding to the post-quantum encryption private key. It can be understood that since the symmetric key in the sealed key structure is encrypted (corresponding to the symmetric key ciphertext), it can be ensured that the post-quantum encryption private key encrypted by the symmetric key (corresponding to the post-quantum encryption private key ciphertext) can be securely transmitted to the applicant, thereby ensuring that the applicant can effectively apply for a post-quantum digital certificate.

[0065] Figure 4 It is a flow chart of parsing the certificate response provided by the present invention to obtain a post-quantum digital certificate and a post-quantum encryption private key.

[0066] The following will be combined Figure 4 The process of parsing the certificate response to obtain the post-quantum digital certificate and post-quantum encryption private key is explained.

[0067] In an exemplary embodiment of the present invention, Figure 4 It can be seen that parsing the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key may include steps 410 to 440, and each step will be introduced below.

[0068] In step 410, the certificate response is parsed to obtain a post-quantum digital certificate, a post-quantum encrypted private key ciphertext, and a symmetric key ciphertext.

[0069] In step 420, a temporary encryption private key corresponding to the temporary encryption public key is obtained.

[0070] In step 430, the symmetric key ciphertext is decrypted based on the temporary encryption private key to obtain the symmetric key.

[0071] In step 440, the post-quantum encrypted private key ciphertext is decrypted based on the symmetric key to obtain the post-quantum encrypted private key.

[0072] In one embodiment, the certificate response can be parsed to obtain a post-quantum digital certificate, a post-quantum encrypted private key ciphertext, and a symmetric key ciphertext. A temporary encrypted private key corresponding to a temporary encrypted public key can be obtained; further, based on the temporary encrypted private key, the symmetric key ciphertext is decrypted to obtain a symmetric key K. Since the post-quantum encrypted private key ciphertext is encrypted by the symmetric key K, the post-quantum encrypted private key ciphertext can be decrypted based on the symmetric key K to obtain a post-quantum encrypted private key, thereby enabling the applicant to securely download the post-quantum encrypted private key and the post-quantum digital certificate, and realizing the applicant's valid application for the post-quantum digital certificate.

[0073] In another exemplary embodiment of the present invention, the above-mentioned embodiment is continued as an example for explanation. After obtaining the post-quantum digital certificate and the post-quantum encryption private key, the post-quantum digital certificate application method may further include the following steps:

[0074] Import the post-quantum digital certificate and post-quantum encryption private key into the preset storage space.

[0075] In another embodiment, the post-quantum digital certificate and the post-quantum encryption private key can also be imported into a preset storage space. The preset storage space can be a password module (such as a USB Key). In the present invention, the preset storage space is not specifically limited, and it can be adjusted accordingly according to actual conditions. Through this embodiment, the post-quantum digital certificate and the post-quantum encryption private key are imported into the USB Key, which can facilitate users to use it safely and conveniently.

[0076] In another exemplary embodiment of the present invention, a temporary post-quantum encryption key pair can be generated by a cryptographic module, wherein the cryptographic module includes at least any one or more of a smart cryptographic key, a cryptographic machine, a signature verification server, an SSL gateway, an IC card, a SIM card, a cryptographic chip, and a software cryptographic module.

[0077] Continuing with the above-mentioned embodiment as an example, the post-quantum digital certificate application method may further include the following steps:

[0078] Delete the temporary post-quantum encryption key pair in the cryptographic module.

[0079] In one embodiment, the temporary post-quantum encryption key pair stored in the cryptographic module can be deleted, which can save the storage space of the cryptographic module on the one hand, and prevent the leakage of the temporary post-quantum encryption key pair on the other hand, avoiding the problem of data insecurity.

[0080] As a variation, if the post-quantum public key encryption algorithm (usually only able to encrypt small data, such as tens or hundreds of bytes) can support direct encryption of post-quantum private key data (usually large, such as several KB), then the steps of symmetric key generation and encryption can be omitted, that is, the exported temporary post-quantum encryption public key is used to encrypt the newly generated post-quantum encryption private key to form an encrypted private key ciphertext, and then the encrypted private key ciphertext, encrypted public key, and encryption algorithm identifier are packaged together, so that a sealed key structure corresponding to the post-quantum encryption private key can be obtained. Then the temporary post-quantum encryption private key in the cryptographic module is called to decrypt the "encrypted private key ciphertext" to obtain the post-quantum encryption private key, so as to complete the secure import of the post-quantum encryption private key, so that the encrypted private key can be securely sent to the applicant, thereby ensuring that the applicant can effectively apply for a post-quantum digital certificate.

[0081] According to the foregoing description, the post-quantum digital certificate application method provided by the present invention obtains the application information, post-quantum signature key pair and temporary post-quantum encryption key pair of the applicant for the post-quantum digital certificate to be applied for respectively; constructs a certificate request based on the application information, post-quantum signature key pair and temporary post-quantum encryption key pair of the applicant for the post-quantum digital certificate to be applied for; obtains the post-quantum encryption private key and the symmetric key in the post-quantum encryption key pair, and constructs a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key and the temporary encryption public key in the temporary post-quantum encryption key pair; generates a post-quantum digital certificate based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair; generates a certificate response based on the sealed key structure and the post-quantum digital certificate, and feeds the certificate response back to the applicant, so that the applicant parses the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key, and realizes the application for the post-quantum digital certificate to be applied for. Since the post-quantum encryption private key is protected by temporary encryption public key, the problem that the key pair generated by the signature algorithm in the post-quantum cryptography era cannot be applied to the encryption algorithm, resulting in the inability to download the post-quantum digital certificate, is solved. The encrypted private key can be securely sent to the applicant, thereby ensuring that the applicant can effectively apply for a post-quantum digital certificate.

[0082] The post-quantum digital certificate application device provided by the present invention is described below. The post-quantum digital certificate application device described below and the post-quantum digital certificate application method described above can be referenced to each other.

[0083] Figure 5 It is a structural schematic diagram of the post-quantum digital certificate application device provided by the present invention.

[0084] In an exemplary embodiment of the present invention, Figure 5 It can be seen that the post-quantum digital certificate application device may include an acquisition module 510, a construction module 520, an issuance module 530, a generation module 540, and a response module 550. Each module will be introduced below.

[0085] The acquisition module 510 may be configured to respectively acquire application information, a post-quantum signature key pair, and a temporary post-quantum encryption key pair of an applicant for a post-quantum digital certificate;

[0086] The construction module 520 may be configured to construct a certificate request based on the application information of the applicant for the post-quantum digital certificate to be applied for, the post-quantum signature key pair, and the temporary post-quantum encryption key pair;

[0087] The issuing module 530 may be configured to obtain a post-quantum encryption private key and a symmetric key in a post-quantum encryption key pair, and construct a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key, and a temporary encryption public key in the temporary post-quantum encryption key pair;

[0088] The generating module 540 may be configured to generate a post-quantum digital certificate based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair;

[0089] The response module 550 can be configured to generate a certificate response based on the sealed key structure and the post-quantum digital certificate, and feed the certificate response back to the applicant, so that the applicant can parse the certificate response, obtain the post-quantum digital certificate and the post-quantum encryption private key, and apply for the post-quantum digital certificate to be applied for, wherein the post-quantum digital certificate and the post-quantum encryption private key have a corresponding relationship.

[0090] In an exemplary embodiment of the present invention, the construction module 520 can construct a certificate request based on the application information of the applicant for the post-quantum digital certificate to be applied for, the post-quantum signature key pair, and the temporary post-quantum encryption key pair in the following manner:

[0091] Based on the post-quantum signature key pair, obtaining a signature public key in the post-quantum signature key pair;

[0092] Based on the temporary post-quantum encryption key pair, obtaining a temporary encryption public key in the temporary post-quantum encryption key pair;

[0093] Based on the application information of the applicant of the post-quantum digital certificate to be applied for, the signature public key, and the temporary encryption public key, certificate request information is obtained, and the certificate request information is encoded to obtain an encoding result corresponding to the certificate request information;

[0094] Based on the signature private key corresponding to the signature public key, the encoding result corresponding to the certificate request information is signed to obtain a signature value of the certificate request information;

[0095] The certificate request is obtained based on the certificate request information, a signature algorithm identifier corresponding to the post-quantum signature key pair, and a signature value of the certificate request information.

[0096] In an exemplary embodiment of the present invention, the issuing module 530 can construct a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key, and the temporary encryption public key in the temporary post-quantum encryption key pair in the following manner:

[0097] Based on the symmetric key, encrypting the post-quantum encryption private key to obtain a post-quantum encryption private key ciphertext;

[0098] Based on the temporary encryption public key, encrypt the symmetric key to obtain a symmetric key ciphertext;

[0099] Based on the post-quantum encryption private key ciphertext, the symmetric key ciphertext, the symmetric algorithm identifier corresponding to the symmetric key, and the post-quantum encryption public key corresponding to the post-quantum encryption private key, a sealed key structure corresponding to the post-quantum encryption private key is constructed.

[0100] In an exemplary embodiment of the present invention, the response module 550 may parse the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key in the following manner:

[0101] Parsing the certificate response to obtain the post-quantum digital certificate, the post-quantum encrypted private key ciphertext, and the symmetric key ciphertext;

[0102] Obtaining a temporary encryption private key corresponding to the temporary encryption public key;

[0103] Decrypting the symmetric key ciphertext based on the temporary encryption private key to obtain the symmetric key;

[0104] Based on the symmetric key, the post-quantum encrypted private key ciphertext is decrypted to obtain the post-quantum encrypted private key.

[0105] In an exemplary embodiment of the present invention, the temporary post-quantum encryption key pair is generated by a cryptographic module, wherein the cryptographic module includes at least any one or more of a smart cryptographic key, a cryptographic machine, a signature verification server, an SSL gateway, an IC card, a SIM card, a cryptographic chip, and a software cryptographic module;

[0106] In an exemplary embodiment of the present invention, the response module 550 may also be configured to:

[0107] The temporary post-quantum encryption key pair in the cryptographic module is deleted.

[0108] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6As shown, the electronic device may include: a processor 610, a communications interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communications interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the post-quantum digital certificate application method, the method comprising: respectively obtaining the application information of the applicant for the post-quantum digital certificate to be applied for, the post-quantum signature key pair and the temporary post-quantum encryption key pair; constructing a certificate request based on the application information of the applicant for the post-quantum digital certificate to be applied for, the post-quantum signature key pair and the temporary post-quantum encryption key pair; obtaining the post-quantum encryption private key and the symmetric key in the post-quantum encryption key pair, and based on the post-quantum encryption private key, the symmetric key and the temporary post-quantum encryption key pair The temporary encryption public key in the post-quantum encryption key pair is used to construct a sealed key structure corresponding to the post-quantum encryption private key; a post-quantum digital certificate is generated based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair; a certificate response is generated based on the sealed key structure and the post-quantum digital certificate, and the certificate response is fed back to the applicant, so that the applicant parses the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key, and applies for the post-quantum digital certificate to be applied for, wherein the post-quantum digital certificate has a corresponding relationship with the post-quantum encryption private key.

[0109] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0110] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the post-quantum digital certificate application method provided by the above methods, the method comprising: obtaining application information, a post-quantum signature key pair, and a temporary post-quantum encryption key pair of an applicant for a post-quantum digital certificate to be applied for; constructing a certificate request based on the application information, the post-quantum signature key pair, and the temporary post-quantum encryption key pair of the applicant for the post-quantum digital certificate to be applied for; obtaining a post-quantum encryption private key and a symmetric key in the post-quantum encryption key pair, and Based on the post-quantum encryption private key, the symmetric key, and the temporary encryption public key in the temporary post-quantum encryption key pair, a sealed key structure corresponding to the post-quantum encryption private key is constructed; based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair, a post-quantum digital certificate is generated; based on the sealed key structure and the post-quantum digital certificate, a certificate response is generated, and the certificate response is fed back to the applicant, so that the applicant parses the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key, and implements the application for the post-quantum digital certificate to be applied for, wherein the post-quantum digital certificate and the post-quantum encryption private key have a corresponding relationship.

[0111] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the post-quantum digital certificate application method provided by the above methods, the method comprising: obtaining application information, a post-quantum signature key pair, and a temporary post-quantum encryption key pair of an applicant for a post-quantum digital certificate to be applied for, respectively; constructing a certificate request based on the application information, the post-quantum signature key pair, and the temporary post-quantum encryption key pair of the applicant for the post-quantum digital certificate to be applied for; obtaining a post-quantum encryption private key and a symmetric key in the post-quantum encryption key pair, and generating a certificate request based on the post-quantum encryption private key, the symmetric key pair, and the temporary post-quantum encryption key pair; The method comprises the following steps: a first step is to generate a post-quantum digital certificate based on the certificate request and the post-quantum public key in the post-quantum encryption key pair; a second step is to generate a certificate response based on the certificate request and the post-quantum digital certificate, and the second step is to feed back the certificate response to the applicant, so that the applicant can parse the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key, and apply for the post-quantum digital certificate to be applied for, wherein the post-quantum digital certificate has a corresponding relationship with the post-quantum encryption private key.

[0112] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0113] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A post-quantum digital certificate application method, characterized in that: The method comprises: Obtain application information, a post-quantum signature key pair, and a temporary post-quantum encryption key pair of an applicant for a post-quantum digital certificate respectively; Constructing a certificate request based on the application information of the applicant for the post-quantum digital certificate, the post-quantum signature key pair, and the temporary post-quantum encryption key pair; Obtaining a post-quantum encryption private key and a symmetric key in a post-quantum encryption key pair, and constructing a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key, and a temporary encryption public key in the temporary post-quantum encryption key pair; Generate a post-quantum digital certificate based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair; Based on the sealed key structure and the post-quantum digital certificate, a certificate response is generated, and the certificate response is fed back to the applicant, so that the applicant parses the certificate response, obtains the post-quantum digital certificate and the post-quantum encryption private key, and applies for the post-quantum digital certificate to be applied for, wherein the post-quantum digital certificate and the post-quantum encryption private key have a corresponding relationship, wherein the application information of the applicant for the post-quantum digital certificate to be applied for, the post-quantum signature key pair and the temporary post-quantum encryption key pair are used to construct a certificate request, specifically including: Based on the post-quantum signature key pair, obtaining a signature public key in the post-quantum signature key pair; Based on the temporary post-quantum encryption key pair, obtaining a temporary encryption public key in the temporary post-quantum encryption key pair; Based on the application information of the applicant of the post-quantum digital certificate to be applied for, the signature public key, and the temporary encryption public key, certificate request information is obtained, and the certificate request information is encoded to obtain an encoding result corresponding to the certificate request information; Based on the signature private key corresponding to the signature public key, the encoding result corresponding to the certificate request information is signed to obtain the signature value of the certificate request information; The certificate request is obtained based on the certificate request information, the signature algorithm identifier corresponding to the post-quantum signature key pair, and the signature value of the certificate request information, wherein: The step of constructing a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key, and the temporary encryption public key in the temporary post-quantum encryption key pair specifically includes: Based on the symmetric key, encrypting the post-quantum encryption private key to obtain a post-quantum encryption private key ciphertext; Based on the temporary encryption public key, encrypt the symmetric key to obtain a symmetric key ciphertext; Based on the post-quantum encryption private key ciphertext, the symmetric key ciphertext, the symmetric algorithm identifier corresponding to the symmetric key, and the post-quantum encryption public key corresponding to the post-quantum encryption private key, a sealed key structure corresponding to the post-quantum encryption private key is constructed.

2. The post-quantum digital certificate application method according to claim 1, characterized in that: Parsing the certificate response to obtain the post-quantum digital certificate and the post-quantum encryption private key is implemented in the following manner: Parsing the certificate response to obtain the post-quantum digital certificate, the post-quantum encrypted private key ciphertext, and the symmetric key ciphertext; Obtaining a temporary encryption private key corresponding to the temporary encryption public key; Decrypting the symmetric key ciphertext based on the temporary encryption private key to obtain the symmetric key; Based on the symmetric key, the post-quantum encrypted private key ciphertext is decrypted to obtain the post-quantum encrypted private key.

3. The post-quantum digital certificate application method according to any one of claims 1-2, characterized in that: The temporary post-quantum encryption key pair is generated by a cryptographic module, wherein the cryptographic module includes at least any one or more of a smart cryptographic key, a cryptographic machine, a signature verification server, an SSL gateway, an IC card, a SIM card, a cryptographic chip, and a software cryptographic module.

4. The post-quantum digital certificate application method according to claim 3, characterized in that: The method further includes: deleting the temporary post-quantum encryption key pair in the cryptographic module.

5. A post-quantum digital certificate application device, characterized in that: The device is used to implement the post-quantum digital certificate application method according to any one of claims 1 to 4, and the device includes: An acquisition module, used to respectively acquire application information, a post-quantum signature key pair, and a temporary post-quantum encryption key pair of an applicant to apply for a post-quantum digital certificate; A construction module, configured to construct a certificate request based on the application information of the applicant for the post-quantum digital certificate to be applied for, the post-quantum signature key pair, and the temporary post-quantum encryption key pair; An issuing module, configured to obtain a post-quantum encryption private key and a symmetric key in a post-quantum encryption key pair, and construct a sealed key structure corresponding to the post-quantum encryption private key based on the post-quantum encryption private key, the symmetric key, and a temporary encryption public key in the temporary post-quantum encryption key pair; A generation module, configured to generate a post-quantum digital certificate based on the certificate request and the post-quantum encryption public key in the post-quantum encryption key pair; A response module is used to generate a certificate response based on the sealed key structure and the post-quantum digital certificate, and feed back the certificate response to the applicant, so that the applicant can parse the certificate response, obtain the post-quantum digital certificate and the post-quantum encryption private key, and apply for the post-quantum digital certificate to be applied for, wherein the post-quantum digital certificate and the post-quantum encryption private key have a corresponding relationship.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the post-quantum digital certificate application method as described in any one of claims 1 to 4 is implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the post-quantum digital certificate application method as described in any one of claims 1 to 4 is implemented.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the post-quantum digital certificate application method as described in any one of claims 1 to 4 is implemented.

Images