Method, device, equipment, storage medium, and program product for verifying signature value

Abstract

The present application provides a method and apparatus, device, storage medium, and program product for verifying a signature value; wherein the method includes: obtaining multiple sampling values ​​and sampling center values ​​of the sampling values, wherein the sampling values ​​and the sampling center value are obtained by recursively sampling the ffSampling module in the Falcon signature algorithm based on the input message and the private key, and the Falcon signature algorithm is used to generate the signature value of the input message based on the multiple sampling values; determining the size relationship between each sampling value and the corresponding sampling center value; and verifying whether the signature value is subjected to a first attack based on the size relationship between the multiple sampling values ​​and the corresponding sampling center values.

Description

Technical Field

[0001] The present application relates to the field of quantum technology, and is related to but not limited to methods and devices, equipment, storage media, and program products for verifying signature values. Background Art

[0002] The Fast Fourier Lattice-based Compact Signatures over NTRU (Falcon) scheme based on the Number Theory Research Unit (NTRU) has been selected as a post-quantum standard algorithm by the National Institute of Standards and Technology (NIST). Due to its high efficiency and compactness, Falcon has unique advantages in special scenarios such as embedded systems. Therefore, research on the side channel security and protection of the Falcon scheme has great practical significance. However, the current side channel security and protection methods based on the Falcon scheme are relatively complex and have low verification efficiency. Summary of the invention

[0003] The present application provides a method, apparatus, device, storage medium, and program product for verifying a signature value, wherein:

[0004] In a first aspect, an embodiment of the present application provides a method for verifying a signature value, the method comprising: obtaining multiple sampling values ​​and sampling center values ​​of the sampling values, the sampling values ​​and the sampling center values ​​are obtained by recursive sampling by the ffSampling module in the Falcon signature algorithm based on an input message and a private key, the Falcon signature algorithm is used to generate a signature value of the input message based on the multiple sampling values; determining a size relationship between each sampling value and the corresponding sampling center value; and verifying whether the signature value is subject to a first attack based on the size relationship between the multiple sampling values ​​and the corresponding sampling center values.

[0005] In a second aspect, an embodiment of the present application provides a device for verifying a signature value, the device comprising: an acquisition module, configured to acquire multiple sampling values ​​and a sampling center value of the sampling values, the sampling values ​​and the sampling center value are obtained by recursively sampling the input message and the private key by the ffSampling module in the Falcon signature algorithm, the Falcon signature algorithm is used to generate a signature value of the input message based on the multiple sampling values; a determination module, configured to determine the size relationship between each sampling value and the corresponding sampling center value; a verification module, configured to verify whether the signature value is subject to a first attack based on the size relationship between the multiple sampling values ​​and the corresponding sampling center values.

[0006] In a third aspect, an embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and when the processor executes the program, the method described in the first aspect is implemented.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the method described in the first aspect when the computer program is executed by a processor.

[0008] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the method described in the first aspect.

[0009] In the embodiment of the present application, in the process of generating a signature value based on an input message and a private key by the Falcon signature algorithm, multiple sampling values ​​and sampling center values ​​are obtained by recursively sampling the input message and the private key by the ffSampling module in the Falcon signature algorithm; according to the size relationship between the multiple sampling values ​​obtained and the corresponding sampling center values, it is verified whether the generated signature value has been attacked. In this way, it is beneficial to realize the verification of the signature value generated by the Falcon signature algorithm while controlling the impact on the performance or efficiency of the Falcon signature algorithm at a low level.

[0010] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0012] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0013] Figure 1 A schematic diagram of an integer Gaussian sampling algorithm provided in an embodiment of the present application;

[0014] Figure 2A schematic diagram of the implementation process of a method for verifying a signature value provided in an embodiment of the present application Figure 1 ;

[0015] Figure 3 A schematic diagram of the implementation process of a method for verifying a signature value provided in an embodiment of the present application Figure 2 ;

[0016] Figure 4 A schematic diagram of an implementation flow of determining a first proportion provided in an embodiment of the present application;

[0017] Figure 5 A schematic diagram of an implementation flow of updating global variables provided in an embodiment of the present application;

[0018] Figure 6 A schematic diagram of the implementation process of a method for verifying a signature value provided in an embodiment of the present application Figure 3 ;

[0019] Figure 7 A schematic diagram of the structure of a device for verifying a signature value provided in an embodiment of the present application;

[0020] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the specific technical solution of the present application will be further described in detail below in conjunction with the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application, but are not used to limit the scope of the present application.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0023] In the following description, reference is made to “some embodiments”, “this embodiment”, “embodiments of the present application” and examples, etc., which describe a subset of all possible embodiments, but it can be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0024] To facilitate understanding of the technical solutions of the embodiments of the present application, the following describes the related technologies or terms of the embodiments of the present application. The following related technologies or related terms as optional solutions can be combined with the technical solutions of the embodiments of the present application at will, and they all belong to the protection scope of the embodiments of the present application.

[0025] (1) Falcon signature algorithm

[0026] The Falcon algorithm provides security based on difficult problems on lattices, specifically using the short integer solution problem on the NTRU lattice. The algorithm uses a trapdoor sampler called "fast Fourier sampling" to build a signature scheme on the NTRU lattice. The public key is used to verify the signature, while the private key is used to generate the signature. The private key needs to be stored securely to prevent it from being obtained by unauthorized persons.

[0027] The Falcon signature algorithm is an instantiation of the GPV hash-and-sign framework on the NTRU lattice. In this framework, the signature process of the Falcon scheme is considered to be a Gaussian sampling on the lattice with the key B as the trapdoor lattice basis and the hashed message value c as the center, and the Gaussian sampling on the lattice can be attributed to a series of integer Gaussian sampling algorithms.

[0028] (2) NTRU

[0029] In NTRU-based compact signatures on Fast Fourier lattices, NTRU is a specific mathematical construction.

[0030] In the Falcon signature algorithm, the concept of NTRU is extended to the context of signature schemes. The Falcon signature algorithm takes advantage of some properties of the NTRU lattice, such as efficient lattice sampling and polynomial multiplication, to build a compact and efficient digital signature scheme. This scheme not only maintains many advantages of the NTRU encryption algorithm (such as shorter keys and faster operation speed), but also provides higher security by combining the theory of lattice cryptography.

[0031] (3) ffSampling module

[0032] The ffSampling module is responsible for implementing the trapdoor sampling process in the Falcon signature algorithm. Specifically, it uses efficient algorithms such as the Fast Fourier Transform (FFT), combined with the private key (trapdoor information) and specific parameter settings, to generate a lattice vector that meets the requirements of the signature algorithm as part of the signature.

[0033] The ffSampling module is a Klein-GPV sampling based on a ring variant of the Fast Fourier Nearest Plane Algorithm. This module can simplify the Gaussian sampling on the grid into a series of integer Gaussian sampling. Different standard deviations and centers are required in the integer Gaussian sampling process in the ffSampling module, which can be achieved by recursively calling SamplerZ. The SamplerZ sampling module uses sign flipping to transform the half-integer Gaussian sampling BaseSampler into a bimodal Gaussian, and then uses rejection sampling to obtain the target sampling value. The half-integer Gaussian sampling BaseSampler is implemented using a table lookup, and the table used is the Reverse Cumulative Distribution Table (RCDT), with a table length of 18. First, a 72-bit value u is randomly generated, and the RCDT table is indexed in sequence, and compared with u. If it is greater than the random value u, the sampling value is increased by 1. BaseSampler sampling is implemented in constant time. For example Figure 1 As shown, ffSampling is a Gaussian sampling on a grid with a standard deviation of σ and a center vector c (D L(B),σ,c ), the sampled value of ffSampling is represented as v; SamplerZ sampling is integer Gaussian sampling with standard deviation σ' and center c (D Z,σ',c ), the sampling value of SamplerZ is represented as z; the standard deviation of BaseSampler sampling is σ max , half-integer Gaussian sampling centered at 0 ( ), the sampled value sampled by BaseSampler is represented as z + Among them, ffSampling sampling recursively calls SamplerZ sampling, and BaseSampler is called in SamplerZ sampling to sample half-integer Gaussian sampling values.

[0034] (4) Integer Gaussian sampling SamplerZ

[0035] In the Falcon signature algorithm, during the key generation phase, SamplerZ is used to generate integer samples that satisfy a specific Gaussian distribution, which will be used as part of the private key. The generation of private keys needs to ensure security and randomness, and Gaussian distribution is widely used due to its good statistical properties. During the signature generation phase, SamplerZ is also used to generate integer samples that satisfy the Gaussian distribution, which will be used as part of the signature. Through a carefully designed sampling process, it can be ensured that the generated signature meets the algorithm requirements and has high security.

[0036] The implementation of SamplerZ is implemented as follows:

[0037] First, we need to determine the mean and standard deviation of the Gaussian distribution. The choice of these parameters will affect the statistical properties of the sampling results.

[0038] The existing random number generator is used to generate samples that satisfy the continuous Gaussian distribution.

[0039] Discretize continuous Gaussian samples into integer samples. This step can be achieved by rounding, flooring, or ceilinging. However, direct discretization may cause the sample distribution to deviate from the original Gaussian distribution. Therefore, in practical applications, more complex algorithms are usually used to ensure that the discretized samples are still close to the Gaussian distribution.

[0040] The discretized integer samples are adjusted and verified to ensure that they meet the requirements of the algorithm. This includes checking the range of the samples, distribution characteristics, etc.

[0041] (5) Zero-attack

[0042] A zeroing attack refers to a specific attack method against a signature algorithm or its implementation process, in which the attacker sets a key value or parameter (or a specific value that is conducive to the attack) to zero in some way in the hope of reducing the security of the algorithm, bypassing the verification mechanism, or forging a signature.

[0043] (6) Equality-check technology

[0044] Equality-check technology, or equivalence checking technology, is a verification method widely used in many fields, such as integrated circuit design, software development, data encryption, etc. It is mainly used to check whether two or more systems, modules, designs or data are equivalent in function, logic or behavior.

[0045] In related technologies, the Falcon signature algorithm includes: non-deterministic version and deterministic version. For the deterministic version, there are mainly the following protection solutions:

[0046] (1) A simple fault injection protection measure is to re-sign and compare the results of the first signature and the second signature. If they are different, it is considered that fault injection has been detected.

[0047] (2) For complex ffSampling, the sampling order is randomly shuffled to increase the cost of fault injection attacks.

[0048] (3) For the cryptographic algorithm of the Pseudo-Random Number Generator (PRNG), fault injection is prevented by calculating the checksum of the output.

[0049] There are several protection solutions for non-deterministic versions:

[0050] (1) Perform re-signature verification (a fixed random seed is required) and compare the results of the first signature and the second signature. If they are different, it is considered that fault injection has been detected.

[0051] (2) Prevent the generation of faulty signatures through the sign-verify method.

[0052] (3) Check that the sampling vector does not become 0 in the ffSampling algorithm.

[0053] However, the related art has the following disadvantages:

[0054] (1) Regarding the deterministic version of the protection scheme: re-signing will double the signing time; random shuffling of ffSampling requires that ffSampling can be operated in parallel, but this violates the principle of recursion; and verifying the output of the PRNG cryptographic algorithm is not a complete protection scheme.

[0055] (2) For the non-deterministic version of the protection scheme: re-signing also doubles the signature cost; it is not feasible to detect whether a fault has occurred through the sign-verify method, because the Falcon signature algorithm itself includes a check on the signature size, and the fault injection analysis of the Falcon signature algorithm can be completed under the premise of generating a valid signature; and there is no practical measure to detect 0 vectors in the ffSampling sampling algorithm.

[0056] Based on the above analysis, the present application embodiment provides a method for verifying a signature value. Figure 2 A schematic diagram of the implementation process of a method for verifying a signature value provided in an embodiment of the present application Figure 1 ,like Figure 2 As shown, the method may include the following steps 201 to 203:

[0057] Step 201, obtaining multiple sampling values ​​and sampling center values ​​of the sampling values, where the sampling values ​​and the sampling center value are obtained by recursively sampling the ffSampling module in the Falcon signature algorithm based on the input message and the private key, and the Falcon signature algorithm is used to generate a signature value of the input message based on the multiple sampling values;

[0058] Step 202, determining the magnitude relationship between each sampling value and the corresponding sampling center value;

[0059] Step 203: Verify whether the signature value is subject to the first attack based on the size relationship between the multiple sampling values ​​and the corresponding sampling center value.

[0060] It can be understood that in the embodiment of the present application, in the process of the Falcon signature algorithm generating a signature value based on the input message and the private key, multiple sampling values ​​and sampling center values ​​are obtained by recursively sampling the input message and the private key by the ffSampling module in the Falcon signature algorithm; according to the size relationship between the multiple sampling values ​​obtained and the corresponding sampling center values, it is verified whether the generated signature value has been attacked. In this way, it is beneficial to realize the verification of the signature value generated by the Falcon signature algorithm while controlling the impact on the performance or efficiency of the Falcon signature algorithm at a low level.

[0061] It should be understood that in the Falcon signature algorithm, the private key is used to generate the signature. Specifically, the input message is first hashed to obtain a message digest, and then the message digest is encrypted using the private key (through the ffSampling module) to finally generate the signature. The multiple sampling values ​​generated by the ffSampling module based on the private key and the input message are an important part of the signature. These sampling values ​​are combined with the message digest through specific mathematical operations (such as fast Fourier transform) to form a signature that is difficult to forge and can be verified.

[0062] A zeroing attack refers to a specific attack method against a signature algorithm or its implementation process, in which the attacker sets a key value or parameter (or a specific value that is conducive to the attack) to zero in some way in the hope of reducing the security of the algorithm, bypassing the verification mechanism, or forging a signature.

[0063] Considering that when the Falcon signature algorithm is not attacked by zero-attack, the sampling value of SamplerZ conforms to the integer Gaussian distribution. Then, if the sampling value of SamplerZ does not conform to the integer Gaussian distribution, it means that the signature algorithm has been attacked by zeroing.

[0064] Therefore, compared with the re-signature verification scheme, the method for verifying the signature value provided in the embodiment of the present application is more efficient and convenient, and will basically not have a significant impact on the performance of the Falcon signature algorithm. In addition, it will basically not change the control flow of the original program of the Falcon signature algorithm. Therefore, it is possible to achieve better protection effects while making the smallest possible changes to the original code of the Falcon signature algorithm.

[0065] The following describes further optional implementations and related terms of each of the above steps.

[0066] In step 201, multiple sampling values ​​and sampling center values ​​of the sampling values ​​are obtained. The sampling values ​​and the sampling center value are obtained by recursively sampling the input message and the private key by the ffSampling module in the Falcon signature algorithm. The Falcon signature algorithm is used to generate a signature value of the input message based on multiple sampling values.

[0067] In some embodiments, the ffSampling module is implemented by recursively calling integer Gaussian sampling SamplerZ N times; the multiple sampling values ​​include: obtained by recursively calling the tail of the integer Gaussian sampling SamplerZ N times; wherein the integer Gaussian sampling SamplerZ is a bimodal Gaussian sampling.

[0068] It should be understood that in the embodiment of the present application, since the integer Gaussian sampling SamplerZ is a bimodal Gaussian sampling, the number of sampling values ​​obtained by recursively calling the tail of the integer Gaussian sampling SamplerZ N times is 2N, that is, the sampling values ​​obtained by recursively calling the tail of the integer Gaussian sampling SamplerZ each time include: a first sampling value and a second sampling value.

[0069] In step 202, the magnitude relationship between each sampling value and the corresponding sampling center value is determined.

[0070] In some embodiments, determining the size relationship between each sampling value and the corresponding sampling center value includes: determining whether the size relationship between each sampling value and the corresponding sampling center value rounded down is a first relationship; the first relationship is an equal relationship.

[0071] In other embodiments, determining the size relationship between each sampling value and the corresponding sampling center value includes: determining whether the size relationship between each sampling value and the corresponding sampling center value rounded up is a first relationship; the first relationship is an equal relationship.

[0072] In some other embodiments, determining the size relationship between each sampling value and the corresponding sampling center value includes: determining whether the size relationship of the rounded result of each sampling value and the corresponding sampling center value is a first relationship; the first relationship is an equal relationship.

[0073] In some embodiments, Figure 3 As shown, it is possible to verify whether the signature value is subjected to the first attack of zeroing attack through the following steps 301 to 303:

[0074] Step 301, determining the cumulative number of sample values ​​of the first relationship;

[0075] Step 302, determining a first proportion of the cumulative quantity in the plurality of sample values;

[0076] Step 303: Based on the first proportion, verify whether the signature value is subjected to a first attack which is a zeroing attack.

[0077] In some embodiments, Figure 4 As shown, the first proportion may be determined through the following steps 401 to 404:

[0078] Step 401, setting the initial value of a first global variable to a first value;

[0079] Step 402, obtaining the tail of the i-th recursive call of the integer Gaussian sampling SamplerZ, and obtaining the first sampling value and the corresponding first sampling center value and the second sampling value and the corresponding second sampling center value;

[0080] Wherein, i is greater than 0 and less than or equal to N;

[0081] Step 403, updating the value of the first global variable according to whether the magnitude relationship between the first sampling value and the result of rounding down the first sampling center value is the first relationship, and whether the magnitude relationship between the second sampling value and the result of rounding down the second sampling center value is the first relationship, until the tail of the integer Gaussian sampling SamplerZ is recursively called for the Nth time;

[0082] Step 404: determine a first proportion of the value of the first global variable in the plurality of sample values.

[0083] In some embodiments, updating the value of the first global variable according to whether the size relationship between the first sampling value and the result of rounding off the first sampling center value is the first relationship, and whether the size relationship between the second sampling value and the result of rounding off the second sampling center value is the first relationship, includes: updating the value of the first global variable when the size relationship between the first sampling value and the result of rounding off the first sampling center value is the first relationship, and / or when the size relationship between the second sampling value and the result of rounding off the second sampling center value is the first relationship.

[0084] Step 203: Verify whether the signature value is subject to the first attack based on the size relationship between the multiple sampling values ​​and the corresponding sampling center value.

[0085] In some embodiments, the verifying, based on the first proportion, whether the signature value is subjected to a first attack which is a zeroing attack includes: when the first proportion is greater than a proportion threshold, determining that the signature value is subjected to the zeroing attack; when the first proportion is less than or equal to the proportion threshold, determining that the signature value is not subjected to the zeroing attack.

[0086] It should be understood that in the embodiments of the present application, the percentage threshold is not limited. In some embodiments, the percentage threshold includes: any value from 20% to 56%.

[0087] It should be noted that in the embodiments of the present application, the percentage threshold may change due to certain parameters in the Falcon signature algorithm, so the above example is only for illustrating the percentage threshold, and does not limit the specific value of the percentage threshold. For example: in some embodiments, the percentage threshold is 16% or 58%, although 16% and 58% do not belong to 20% to 56%, they should also be included in the protection scope of the present application.

[0088] Exemplarily, as a possible implementation, when the first proportion is greater than 28%, it is determined that the signature value is subject to the zeroing attack; when the first proportion is less than or equal to 28%, it is determined that the signature value is not subject to the zeroing attack.

[0089] The following examples describe possible implementations of the shooting methods described in one or more of the above embodiments.

[0090] An embodiment of the present application provides a method for verifying a signature value. The method is based on a simple and effective equality-check technology to mitigate fault injection attacks caused by integer Gaussian sampling in the Falcon signature algorithm, thereby designing a practical and efficient fault injection protection for the Falcon signature algorithm.

[0091] Specifically, based on the results of ffSampling (recursion of integer Gaussian sampling SamplerZ) in the Falcon signature algorithm, effective protection against zero-attack fault injection attacks is provided by performing equality-checks on the integer value and sampling value of the SamplerZ sampling center without substantially affecting the Falcon signature algorithm.

[0092] The method for verifying signature values ​​provided in the embodiments of the present application is dedicated to designing efficient, feasible and universal fault injection protection measures for the Falcon signature algorithm. At the same time, the solutions for both deterministic and non-deterministic versions can mitigate zero-attack fault injection attacks.

[0093] The method for verifying the signature value provided in the embodiment of the present application adds a fault protection measure to the Falcon signature algorithm. The method is based on equality-check to protect the key part ffSamping sampling in the scheme. The method is simple and effective, and basically will not have a great impact on the performance of the Falcon signature algorithm. In addition, it will basically not change the control flow of the original program of the Falcon signature algorithm. Therefore, it is possible to achieve better protection effects under the premise of making the smallest possible changes to the original code of the Falcon signature algorithm.

[0094] In the Falcon signature algorithm, the ffSampling module is crucial. The ffSampling module is completed by recursively calling the integer Gaussian sampling SamplerZ. The implementation process is relatively complicated, which makes the cost of random shuffling or resampling (re-sampling) usually high, so easy-to-implement and efficient fault protection is a better choice. In the existing analysis of the Falcon signature algorithm, the zero-attack on the ffSampling module will reduce the attack cost of the Falcon signature algorithm, so the method of verifying the signature value mainly targets ffSampling sampling for fault injection protection.

[0095] The core idea of ​​this application is to perform an equality check on the center and the sampled value at the end of each recursive call, thereby alleviating zero-attacks caused by fault injection. Specifically, each time SamplerZ sampling is performed, the sampled value z0 and the center t0 are rounded down for equality check, and the sampled value z1 and the center t1 are rounded down for equality check. If they are equal, zero_counter is increased by 1. When implementing, zero_counter should be set as a global variable and initialized to 0. When the Falcon signature algorithm is not attacked by zero-attack, the SamplerZ sampling value conforms to the integer Gaussian distribution, so the probability that the sampling value is directly equal to the center rounded down is 20% to 28%. If the Falcon signature algorithm is subjected to zero-attack, the probability that the sampling value is directly equal to the center rounded down is abnormal, that is, much greater than 28%, then it is considered that a zero-attack has occurred.

[0096] Figure 5 A schematic diagram of an implementation flow of updating global variables provided in an embodiment of the present application is shown as follows: Figure 5 As shown, the method includes the following steps 501 to 509:

[0097] Step 501, input t=(t0, t1), Falcon tree;

[0098] Among them, the target vector value t=(t0, t1) provides the center value for the SamplerZ sampling procedure, and the Falcon tree is used to provide the standard deviation of the SamplerZ sampling procedure;

[0099] Step 502, determine the recursive dimension n, and set the global variable zero_counter;

[0100] Step 503, determine if n==1; if yes, execute step 504;

[0101] Step 504, determine the standard deviation σ' of SamplerZ through T.value, obtain the first sampling value z0 and the corresponding first sampling center value t0 and the second sampling value z1 and the corresponding second sampling center value t1 obtained by recursively calling the tail of integer Gaussian sampling SamplerZ;

[0102] Step 505, determine if z0==[t0]; if yes, go to step 506, otherwise go to step 507;

[0103] Step 506, zero_counter++;

[0104] Step 507, determine if z1==[t1]; if yes, go to step 508, otherwise go to step 509;

[0105] Step 508, zero_counter++;

[0106] Step 509, output z=(z0, z1).

[0107] Combined with the overall protection measures of the Falcon signature algorithm, first set the global variable zero_counter=0. During the running of the Falcon signature algorithm, the ffSampling sampling algorithm with the added equality-check protection measures will also be called at the same time. If the conditions are met, zero_counter will be increased by 1. After running the signature algorithm, calculate the probability zero_counter / (2*n), where the sampling length is 2*n. If the probability is greater than the set threshold (an example of a percentage threshold) (generally set to a value greater than 28% of the normal probability, such as 35%, 40%...), it is considered that zero-attack has occurred, and the signature generated by the signature algorithm cannot be considered a valid signature, because the signature may expose the private key information. After each Falcon signature algorithm ends, the global variable zero_counter needs to be set to 0 for the next equality-check.

[0108] Figure 6 A schematic diagram of the implementation process of a method for verifying a signature value provided in an embodiment of the present application Figure 3 ,like Figure 6 As shown, the method includes the following steps 601 to 605:

[0109] Step 601, input message m, private key sk;

[0110] Step 602, determine the polynomial dimension n=512 or 1024, and set the global variable zero_counter=0;

[0111] Step 603, during the running of the Falcon signature algorithm, the ffSampling sampling algorithm with the added equality-check protection measure is called at the same time to obtain the signature value s; wherein Falcon.sign() indicates that during the running of the Falcon signature algorithm, the ffSampling sampling algorithm with the added equality-check protection measure is called at the same time;

[0112] Step 604, determine whether zero_counter / (2*n)>threshold; if yes, execute step 605, otherwise end;

[0113] In step 605, the signature value is zero-attacked.

[0114] It should be noted that although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.; or, steps in different embodiments may be combined into a new technical solution.

[0115] Based on the foregoing embodiments, an embodiment of the present application provides a device for allocating requests, which includes the modules included and the units included in the modules, and can be implemented by a processor; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be an AI acceleration engine (such as NPU, etc.), GPU, central processing unit (CPU), microprocessor (MPU), digital signal processor (DSP) or field programmable gate array (FPGA), etc.

[0116] Figure 7 A schematic diagram of a device for verifying a signature value provided in an embodiment of the present application is shown in FIG. Figure 7 As shown, the device 70 for allocating a request includes an acquisition module 701, a determination module 702 and a verification module 703, wherein:

[0117] An acquisition module 701 is configured to acquire a plurality of sampling values ​​and a sampling center value of the sampling values, wherein the sampling values ​​and the sampling center value are obtained by recursively sampling an input message and a private key by an ffSampling module in a Falcon signature algorithm, and the Falcon signature algorithm is used to generate a signature value of the input message based on the plurality of sampling values;

[0118] A determination module 702 is configured to determine a magnitude relationship between each sampling value and a corresponding sampling center value;

[0119] The verification module 703 is configured to verify whether the signature value is subjected to a first attack according to the magnitude relationship between the multiple sampling values ​​and the corresponding sampling center values.

[0120] In some embodiments, the determination module 702 is configured to determine whether the size relationship between each sampling value and the result of rounding down the corresponding sampling center value is a first relationship; the first relationship is an equality relationship; the verification module 703 is configured to determine the cumulative number of sampling values ​​that are the first relationship; determine a first proportion of the cumulative number in the multiple sampling values; based on the first proportion, verify whether the signature value is subject to a first attack which is a zeroing attack.

[0121] In some embodiments, the ffSampling module is implemented by recursively calling integer Gaussian sampling SamplerZ N times; the multiple sampling values ​​include: obtained by recursively calling the tail of the integer Gaussian sampling SamplerZ N times; wherein the integer Gaussian sampling SamplerZ is a bimodal Gaussian sampling.

[0122] In some embodiments, the verification module 703 is configured to set the initial value of the first global variable to a first value; obtain the tail of the i-th recursive call to the integer Gaussian sampling SamplerZ to obtain the first sampling value and the corresponding first sampling center value and the second sampling value and the corresponding second sampling center value; wherein i is greater than 0 and less than or equal to N; update the value of the first global variable according to whether the size relationship between the first sampling value and the result of rounding down the first sampling center value is the first relationship, and whether the size relationship between the second sampling value and the result of rounding down the second sampling center value is the first relationship, until the tail of the N-th recursive call to the integer Gaussian sampling SamplerZ; determine the first proportion of the value of the first global variable in the multiple sampling values.

[0123] In some embodiments, the verification module 703 is configured to update the value of the first global variable when the relationship between the first sampling value and the result of rounding down the first sampling center value is the first relationship, and / or when the relationship between the second sampling value and the result of rounding down the second sampling center value is the first relationship.

[0124] In some embodiments, the verification module 703 is configured to determine that the signature value has been attacked by the zeroing when the first proportion is greater than a proportion threshold; and to determine that the signature value has not been attacked by the zeroing when the first proportion is less than or equal to the proportion threshold.

[0125] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0126] It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit. It may also be implemented in the form of a combination of software and hardware.

[0127] It should be noted that in the embodiments of the present application, if the above method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product, which is stored in a storage medium and includes several instructions for enabling an electronic device to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0128] An embodiment of the present application provides an electronic device, Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, the electronic device 80 includes a memory 801 and a processor 802, wherein the memory 801 stores a computer program that can be run on the processor 802, and the processor 802 implements the steps in the method provided in the above embodiment when executing the program.

[0129] It should be noted that the memory 801 is configured to store instructions and applications executable by the processor 802, and can also cache data to be processed or already processed by the processor 802 and various modules in the electronic device 80 (for example, image data, audio data, voice communication data, and video communication data), which can be implemented through flash memory (FLASH) or random access memory (Random Access Memory, RAM).

[0130] An embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the method provided in the above embodiment are implemented.

[0131] An embodiment of the present application provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the steps of the method provided in the above method embodiment.

[0132] It should be noted here that the description of the above electronic device, storage medium and computer program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the electronic device, storage medium and computer program product embodiments of this application, please refer to the description of the method embodiment of this application for understanding.

[0133] It should be understood that "one embodiment" or "an embodiment" or "some embodiments" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in one embodiment" or "in some embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments. The above description of each embodiment tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. For the sake of brevity, this article will not repeat them.

[0134] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, object A and / or object B can represent three situations: object A exists alone, object A and object B exist at the same time, and object B exists alone.

[0135] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0136] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as: multiple modules or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or modules can be electrical, mechanical or other forms.

[0137] The modules described above as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules; they may be located in one place or distributed on multiple network units; some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0138] In addition, all functional modules in the embodiments of the present application may be integrated into one processing unit, or each module may be a separate unit, or two or more modules may be integrated into one unit; the above-mentioned integrated modules may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0139] A person skilled in the art can understand that: all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, read-only memories (ROM), magnetic disks or optical disks.

[0140] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling an electronic device to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0141] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0142] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0143] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0144] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A method for verifying a signature value, characterized in that: The method comprises: Acquire multiple sampling values ​​and sampling center values ​​of the sampling values, wherein the sampling values ​​and the sampling center value are obtained by recursively sampling the ffSampling module in the Falcon signature algorithm based on the input message and the private key, and the Falcon signature algorithm is used to generate the signature value of the input message based on the multiple sampling values; Determine the magnitude relationship between each sampling value and the corresponding sampling center value; Verifying whether the signature value is subject to a first attack according to the magnitude relationships between the multiple sampling values ​​and the corresponding sampling center values; The step of determining the magnitude relationship between each sampling value and the corresponding sampling center value includes: Determine whether the magnitude relationship between each sampling value and the result of rounding down the corresponding sampling center value is a first relationship; the first relationship is an equal relationship; or, Determine whether the magnitude relationship between each sampling value and the result of rounding up the corresponding sampling center value is a first relationship; the first relationship is an equal relationship; or, Determine whether the magnitude relationship between each sampling value and the result of rounding off the corresponding sampling center value is a first relationship; the first relationship is an equal relationship; The verifying, according to the magnitude relationships between the multiple sampling values ​​and the corresponding sampling center values, whether the signature value is subjected to the first attack includes: determining a cumulative number of sample values ​​for said first relationship; Determine a first proportion of the cumulative number in the plurality of sample values; Based on the first proportion, it is verified whether the signature value is subjected to a first attack which is a zeroing attack.

2. The method according to claim 1, characterized in that The ffSampling module is implemented by recursively calling integer Gaussian sampling SamplerZ N times; The multiple sampling values ​​include: those obtained by recursively calling the tail of the integer Gaussian sampling SamplerZ N times; wherein the integer Gaussian sampling SamplerZ is a bimodal Gaussian sampling.

3. The method according to claim 2, characterized in that The determining a first proportion of the cumulative number in the plurality of sampling values ​​comprises: Set the initial value of the first global variable to the first value; Obtain the tail of the i-th recursive call of the integer Gaussian sampling SamplerZ to obtain a first sampling value and a corresponding first sampling center value and a second sampling value and a corresponding second sampling center value; wherein i is greater than 0 and less than or equal to N; According to whether the magnitude relationship between the first sampling value and the result of rounding down the first sampling center value is the first relationship, and whether the magnitude relationship between the second sampling value and the result of rounding down the second sampling center value is the first relationship, updating the value of the first global variable until the tail of the integer Gaussian sampling SamplerZ is recursively called for the Nth time; A first proportion of the value of the first global variable in the plurality of sample values ​​is determined.

4. The method according to claim 3, characterized in that The updating of the value of the first global variable according to whether the magnitude relationship between the first sampling value and the result of rounding down the first sampling center value is the first relationship, and whether the magnitude relationship between the second sampling value and the result of rounding down the second sampling center value is the first relationship, includes: When the magnitude relationship between the first sampling value and the result of rounding down the first sampling center value is the first relationship, and / or when the magnitude relationship between the second sampling value and the result of rounding down the second sampling center value is the first relationship, update the value of the first global variable.

5. The method according to any one of claims 2 to 4, characterized in that: The verifying, based on the first proportion, whether the signature value is subjected to a first attack that is a zeroing attack includes: When the first proportion is greater than the proportion threshold, determining that the signature value is subject to the zeroing attack; When the first proportion is less than or equal to the proportion threshold, it is determined that the signature value has not been subjected to the zeroing attack.

6. A device for verifying a signature value, the device comprising: an acquisition module configured to acquire a plurality of sampling values ​​and a sampling center value of the sampling values, wherein the sampling values ​​and the sampling center value are obtained by recursively sampling an input message and a private key by an ffSampling module in a Falcon signature algorithm, and the Falcon signature algorithm is used to generate a signature value of the input message based on the plurality of sampling values; A determination module is configured to determine the size relationship between each sampling value and the corresponding sampling center value; wherein, the determining the size relationship between each sampling value and the corresponding sampling center value includes: determining whether the size relationship between each sampling value and the result of rounding down the corresponding sampling center value is a first relationship; the first relationship is an equal relationship; or, determining whether the size relationship between each sampling value and the result of rounding up the corresponding sampling center value is a first relationship; the first relationship is an equal relationship; or, determining whether the size relationship between each sampling value and the result of rounding off the corresponding sampling center value is a first relationship; the first relationship is an equal relationship; A verification module is configured to verify whether the signature value is subject to a first attack based on the size relationships between the multiple sampling values ​​and the corresponding sampling center values; wherein, the verification of whether the signature value is subject to a first attack based on the size relationships between the multiple sampling values ​​and the corresponding sampling center values ​​includes: determining the cumulative number of sampling values ​​with the first relationship; determining a first proportion of the cumulative number in the multiple sampling values; and based on the first proportion, verifying whether the signature value is subject to a first attack which is a zeroing attack.

7. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

9. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images