A distributed quantum-resistant digital signature method and system

Abstract

The present invention relates to the field of information security technology, and in particular to a distributed quantum-resistant digital signature method and system, the method comprising: a mobile terminal and a cloud server jointly negotiate a signature public key, independently generate their own signature private keys, and use their own signature private keys to perform signature calculations, and obtain their own intermediate vectors and send them to a trusted cryptographic device; the trusted cryptographic device aggregates and calculates the received data, and returns the calculation results to the mobile terminal and the cloud server; the mobile terminal and the cloud server use the data returned by the trusted cryptographic device to generate partial signature fragments respectively; the cloud server sends the partial signature fragments generated by itself to the mobile terminal, and the mobile terminal verifies the partial signature fragments sent by the cloud server. After the verification is passed, the partial signature fragments of the two parties are aggregated to generate a complete signature. The present invention can improve the security of quantum-resistant signatures through distributed signatures of the mobile terminal, the cloud server and the trusted cryptographic device.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to a distributed quantum-resistant digital signature method and system. Background Art

[0002] Digital signature is an important part of the public key cryptography system. It has the functions of ensuring the authenticity, integrity and non-repudiation of digital information and is widely used in e-commerce, software distribution, email and other fields that require information security. With the popularity of mobile office and remote work, users' demand for secure digital signatures on mobile devices is increasing. However, in mobile devices such as mobile phones and tablets, there is usually a lack of dedicated hardware cryptographic modules to store secret information such as users' private keys, which makes it easy for attackers to obtain the signature private key stored in the local device, making it impossible to ensure the security of users' signatures on mobile devices.

[0003] With the development of quantum computing technology, traditional cryptographic algorithms are facing unprecedented security threats. Traditional public key encryption algorithms such as RSA and ECC (Elliptic Curve Cryptography) rely on the computational complexity of mathematical problems such as large integer decomposition and discrete logarithms. However, Shor's quantum algorithm can efficiently solve the above difficult problems in polynomial time, which poses a severe challenge to the security of the existing public key encryption system. Today, post-quantum cryptographic algorithms are a hot area of ​​cryptographic research. Lattice-based difficult problems and related theories can not only be used to construct public key encryption algorithms and signature algorithms, but also to implement fully homomorphic encryption schemes, which have broad application prospects. Lattice-based cryptographic algorithms have become the main research object in post-quantum cryptographic algorithms in recent years due to their advantages such as small size of public and private keys, fast calculation speed, and lightweight.

[0004] Therefore, how to improve the security of mobile terminal signatures has become an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0005] In view of this, the present invention provides a distributed quantum-resistant digital signature method and system, which can improve the security of the signature through the distributed signature of a mobile terminal, a cloud server and a trusted cryptographic device.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a distributed quantum-resistant digital signature method, in which a mobile terminal, a cloud server and a trusted cryptographic device participate in the signature process, including the following steps:

[0008] S1. The mobile terminal and the cloud server jointly negotiate the signature public key and independently generate their own signature private keys;

[0009] S2, the mobile terminal and the cloud server use their own signature private keys to perform signature calculations and obtain their own intermediate vectors and ;

[0010] S3, mobile terminal and cloud server to their respective intermediate vectors and After filling and splicing, the data is sent to the trusted cryptographic device using the Paillier homomorphic encryption algorithm and the password-based message authentication code mechanism;

[0011] S4. The trusted cryptographic device performs aggregate calculation on the received data and returns the calculation results to the mobile terminal and the cloud server;

[0012] S5. The mobile terminal and the cloud server continue to perform signature calculation using the data returned by the trusted cryptographic device, and respectively generate partial signature fragments;

[0013] S6. The cloud server sends the partial signature fragment generated by itself to the mobile terminal. The mobile terminal verifies the correctness of the partial signature fragment sent by the cloud server. If the verification is successful, the partial signature fragments of both parties are aggregated to generate a complete signature.

[0014] Furthermore, S1 includes:

[0015] S11. The server runs the Paillier key generation algorithm to generate a 2048-bit prime number , get the private key of the Paillier homomorphic encryption algorithm and the public key , the public key Send to mobile terminal;

[0016] S12. The mobile terminal uniformly and randomly selects a 256-bit random number , and generate random numbers through the SHAKE-256 function , ;

[0017] Will Execute the matrix expansion algorithm as input, generating the matrix , where k and l are the number of rows and columns of the matrix respectively, express The polynomial ring of ;

[0018] Will As input to the key generation algorithm, the private key vector is obtained and ,in, Represents the value range of the key. express The polynomial ring of ;

[0019] calculate ,Will and Send to cloud server;

[0020] S13, the cloud server uniformly and randomly selects a 256-bit random number , and generate random numbers through the SHAKE-256 function , ;

[0021] Will Execute the matrix expansion algorithm as input, generating the matrix ;

[0022] Will As the input of the key generation algorithm, the private key vector is obtained and ;

[0023] calculate ;Will and Send to mobile terminal;

[0024] S14. Random calculation of mobile terminals and , and the calculation results and and Sent to the cloud server, where For vector The string formed by concatenating the polynomial coefficients in;

[0025] S15, Random Computing on Cloud Servers and , and the calculation results and and Sent to a mobile terminal, where For vector The string formed by concatenating the polynomial coefficients in;

[0026] S16, the mobile terminal and the cloud server verify the data according to the hash value. If the verification fails, the protocol is terminated and S11-S16 are re-executed;

[0027] S17, Mobile Terminal Computing , , ,get and the signing private key ;

[0028] Cloud Server Computing , , , get the public key and the signing private key ,in, Represents the matrix expansion algorithm.

[0029] Furthermore, S2 includes:

[0030] Mobile terminal randomly generates polynomial vector , calculate the intermediate vector , and for the intermediate vector Fill and concatenate the coefficients to get an integer ;

[0031] Cloud server randomly generates polynomial vectors , calculate the intermediate vector , and for the intermediate vector Fill and concatenate the coefficients to get an integer ,in, Representation vector The range of the coefficients, Representation model The polynomial ring of ;

[0032] For the middle vector and The filling and splicing are performed in the same way, for vector For each element in, that is, each 255-degree polynomial, let one of the polynomial coefficients be , the length of each coefficient is The mobile terminal fills each coefficient with 0 to form a 24-bit integer, and then pieces together the filled values ​​into a 3072-bit integer in groups of 128 coefficients. The first group of results after the pieces are .

[0033] Furthermore, S3 includes:

[0034] The mobile terminal uses the Paillier homomorphic encryption algorithm to perform block encryption and obtain the ciphertext , execute the HMAC algorithm to generate a message authentication code , the ciphertext and Message Authentication Code Sent to a trusted cryptographic device, where Represents the message digest algorithm, H represents the SHAKE-256 function;

[0035] The cloud server uses the Paillier homomorphic encryption algorithm to perform block encryption and obtain the ciphertext , execute the HMAC algorithm to generate a message authentication code , the ciphertext and Message Authentication Code Sent to a trusted cryptographic device.

[0036] Furthermore, S4 includes:

[0037] After receiving the data sent by the mobile terminal and the cloud server, the trusted cryptographic device executes the Vrfy algorithm to authenticate the message. Authentication is performed, where represent and ,like , then execute the following secret calculation operation:

[0038]

[0039] Utilizing private keys Decrypt the data:

[0040]

[0041] in, Represents the Paillier decryption algorithm;

[0042] For integers Group by 24 bits to restore the polynomial vector ,Will The low bits of the coefficients are discarded and the calculation is ,in, Indicates the function of taking the high-order bit. is the modulus, Indicates the length of discarding low-order data;

[0043] calculate And sent to the mobile terminal and cloud server respectively, where: A string representing the message to be signed.

[0044] Furthermore, S5 includes:

[0045] Mobile terminal computing , ,if or , then discard the result, where Indicates the function of taking the low bit. Represents a partial signature fragment of a mobile terminal, Represents a polynomial vector The maximum value range of the coefficient is express The maximum value range of express Low bit value;

[0046] Cloud Server Computing , ,if or , then discard the result, Represents a partial signature fragment of a cloud server; express Low order bit value.

[0047] Furthermore, S6 includes:

[0048] The cloud server will and Send to mobile terminal;

[0049] Mobile terminal verification equation Is it true? If so, accept the result, otherwise discard it;

[0050] After verification, the mobile terminal aggregates the signatures of both parties to generate a complete signature: .

[0051] Furthermore, it also includes:

[0052] Calculation of signature verifiers ,verify and Are all of them true? If so, the signature is valid, otherwise it is invalid.

[0053] Furthermore, before S1, it also includes:

[0054] The mobile terminal generates a key for the message authentication code ,in, is the password value of the mobile terminal, Contains the unique identification information of the mobile terminal device, The password value of the cloud server;

[0055] The mobile terminal sends the key Upload to the cloud server in advance.

[0056] In a second aspect, the present invention provides a distributed quantum-resistant digital signature system, which adopts the distributed quantum-resistant digital signature method as described above, including:

[0057] The public and private key generation module is used to enable the mobile terminal and the cloud server to jointly negotiate the signature public key and independently generate their own signature private keys;

[0058] The intermediate vector calculation module is used to enable the mobile terminal and the cloud server to use their respective signature private keys to perform signature calculations and obtain their respective intermediate vectors. and ;

[0059] The splicing module is used to enable the mobile terminal and the cloud server to align their respective intermediate vectors. and After filling and splicing, the data is sent to the trusted cryptographic device using the Paillier homomorphic encryption algorithm and the password-based message authentication code mechanism;

[0060] The aggregation module is used to enable the trusted cryptographic device to perform aggregation calculation on the received data and return the calculation results to the mobile terminal and the cloud server;

[0061] A partial signature module, used to enable the mobile terminal and the cloud server to continue the signature calculation using the data returned by the trusted cryptographic device, and to generate partial signature fragments respectively;

[0062] The complete signature module is used to enable the cloud server to send the partial signature fragment generated by itself to the mobile terminal. The mobile terminal verifies the correctness of the partial signature fragment sent by the cloud server. If the verification is successful, the partial signature fragments of both parties are aggregated to generate a complete signature.

[0063] It can be seen from the above technical solutions that, compared with the prior art, the present invention has the following beneficial effects:

[0064] (1) The terminal device and the cloud server of the present invention jointly negotiate the public key and independently generate their own partial signature private keys. Even if an attacker obtains the private key stored in the user terminal device, he cannot generate a correct signature. This significantly improves the overall security of the scheme. It can be applied to cryptographic products such as collaborative signature servers, cryptographic machines, and cryptographic cards to resist quantum attacks and enhance the security of cryptographic devices.

[0065] (2) The present invention adopts a trusted cryptographic device to perform secret aggregation of secret parameters. During data transmission, by performing special processing and arrangement on polynomials, the faster Paillier additive homomorphic encryption algorithm can be used to replace the inefficient lattice-based BFV and other fully homomorphic encryption algorithms. This improves the execution efficiency of the scheme while achieving confidentiality protection of the secret parameters, thereby ensuring the security of data during transmission.

[0066] (3) The present invention adopts a password-based message authentication code mechanism. The user uses the password, the CPU serial number of the mobile terminal, the network card serial number and other information to generate a unique HMAC (Hash Message Authentication Code) key using the SM3 algorithm and upload it to the cloud server in advance. This method not only protects the integrity of the secret parameters and ensures that the data will not be tampered with or leaked during transmission, but also ensures that the user's password and other private information cannot be mastered by the cloud server. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0068] Figure 1 A flow chart of the distributed quantum-resistant digital signature method provided by the present invention;

[0069] Figure 2 A schematic diagram of key generation for a mobile terminal and a cloud server provided by the present invention;

[0070] Figure 3 A schematic diagram of distributed signature between a mobile terminal, a cloud server and a trusted cryptographic device provided by the present invention;

[0071] Figure 4 This is a schematic diagram of the signature verification provided by the present invention. DETAILED DESCRIPTION

[0072] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0073] like Figure 1 As shown, the embodiment of the present invention discloses a distributed quantum-resistant digital signature method, which is characterized in that a mobile terminal, a cloud server and a trusted cryptographic device participate in the signature process, including the following steps:

[0074] S1. The mobile terminal and the cloud server jointly negotiate the signature public key and independently generate their own signature private keys;

[0075] S2, the mobile terminal and the cloud server use their own signature private keys to perform signature calculations and obtain their own intermediate vectors and ;

[0076] S3, mobile terminal and cloud server to their respective intermediate vectors and After filling and splicing, the data is sent to the trusted cryptographic device using the Paillier homomorphic encryption algorithm and the password-based message authentication code mechanism;

[0077] S4. The trusted cryptographic device performs aggregate calculation on the received data and returns the calculation results to the mobile terminal and the cloud server;

[0078] S5. The mobile terminal and the cloud server continue to perform signature calculation using the data returned by the trusted cryptographic device, and respectively generate partial signature fragments;

[0079] S6. The cloud server sends the partial signature fragment generated by itself to the mobile terminal. The mobile terminal verifies the correctness of the partial signature fragment sent by the cloud server. If the verification is successful, the partial signature fragments of both parties are aggregated to generate a complete signature.

[0080] The present invention is essentially a post-quantum distributed collaborative signature method based on the Module-SIS (Module Smallest Integer Solution) difficulty problem. The entire signature process is composed of multiple parties including a mobile terminal, a cloud server and a trusted cryptographic device, which together complete a secure distributed signature.

[0081] Mobile Terminal :When users sign through mobile phones, computers, etc., there is a risk of leakage of the private key stored in the mobile terminal. Therefore, the entire signing process is completed by multiple parties such as mobile terminals and cloud servers.

[0082] Cloud Server : In order to protect the private key of the signature, the mobile terminal and the cloud server independently generate some private keys for the signature during the key generation phase. The private key held by the cloud server is difficult for attackers to obtain, thereby ensuring the overall security of the digital signature.

[0083] Trusted cryptographic device :The trusted cryptographic device acts as a trusted third party in the signing process. The mobile terminal and the cloud server encrypt the data and send it to the trusted cryptographic device, which performs calculations and returns the calculation results to both parties to prevent private data from being leaked to the other party.

[0084] The above steps are further described below.

[0085] The signature method of the present invention is based on the improvement of the Dilithium signature algorithm. The theoretical security of the algorithm relies on the SIS (least integer solution) problem. The key generation, signature verification and other processes are in the uniform polynomial ring. Operate on , , Can be divided by n. To further improve the execution efficiency of the distributed signature algorithm, NTT (number theoretic transform) can be used to perform fast polynomial multiplication.

[0086] Before the signing process, the mobile terminal generates a key for the message authentication code ,in, is the password value of the user's mobile terminal, It contains the unique identification information of the user's mobile terminal device, such as the CPU serial number, network card serial number, etc. is the password value of the cloud server, and then the mobile terminal will Upload to the cloud server in advance.

[0087] The specific signing process includes:

[0088] S1. The mobile terminal and the cloud server jointly negotiate the signature public key and independently generate their own signature private keys. The specific key generation process is as follows: Figure 2 As shown, including:

[0089] S11. The server runs the Paillier key generation algorithm and randomly generates two 2048-bit prime numbers. , and further obtain the private key of the Paillier homomorphic encryption algorithm and the public key , the public key Send to the mobile terminal and send the private key Send to a trusted cryptographic device;

[0090] S12. The mobile terminal uniformly and randomly selects a 256-bit random number , and generate random numbers through the SHAKE-256 function , ; Among them, SHAKE is a type of SHA3 algorithm, which is a direct application of the Keccak sponge function and can output hash values ​​of any length;

[0091] Will Execute the matrix expansion algorithm as input, generating the matrix , where k and l are the number of rows and columns of the matrix respectively, express The polynomial ring of ;

[0092] Will As input to the key generation algorithm, the private key vector is obtained and ,in, Represents the value range of the key. express The polynomial ring of ;

[0093] calculate ,Will and Send to cloud server;

[0094] S13, the cloud server uniformly and randomly selects a 256-bit random number , and generate random numbers through the SHAKE-256 function , ;

[0095] Will Execute the matrix expansion algorithm as input, generating the matrix ;

[0096] Will As the input of the key generation algorithm, the private key vector is obtained and ;

[0097] calculate ;Will and Send to mobile terminal;

[0098] S14. Random calculation of mobile terminals and , and the calculation results and and Sent to the cloud server, where For vector The string formed by concatenating the polynomial coefficients in;

[0099] S15, Random Computing on Cloud Servers and , and the calculation results and and Sent to a mobile terminal, where For vector The string formed by concatenating the polynomial coefficients in;

[0100] S16, the mobile terminal and the cloud server verify the data according to the hash value. If the verification fails, the protocol is terminated and S11-S16 are re-executed;

[0101] S17, Mobile Terminal Computing , , ,get and the signing private key ;

[0102] Cloud Server Computing , , , get the public key and the signing private key ,in, Represents the matrix expansion algorithm.

[0103] S2-S5 introduces the distributed signature process, such as Figure 3 As shown, including:

[0104] S2, the mobile terminal and the cloud server use their own signature private keys to perform signature calculations and obtain their own intermediate vectors and ;

[0105] Mobile terminal randomly generates polynomial vector , calculate the intermediate vector , and for the intermediate vector Fill and concatenate the coefficients to get an integer ,in, Representation vector The range of the coefficients, Representation model The polynomial ring of ;

[0106] Cloud server randomly generates polynomial vectors , calculate the intermediate vector , and for the intermediate vector Fill and concatenate the coefficients to get an integer .

[0107] Among them, for the intermediate vector and The filling and splicing are performed in the same way, with the intermediate vector Take the filling process as an example to illustrate:

[0108] Targeting vector For each element in, that is, each 255-degree polynomial, let one of the polynomial coefficients be , the length of each coefficient is (same as the number of matrix columns); the mobile terminal fills each coefficient with 0 to form a 24-bit integer, and piece together the filled values ​​into 3072-bit integers in groups of 128 coefficients; the first group of results after pieced together is .

[0109] S3, mobile terminal and cloud server to their respective intermediate vectors and After filling and splicing, the data is sent to the trusted cryptographic device using the Paillier homomorphic encryption algorithm and the password-based message authentication code mechanism. Including:

[0110] The mobile terminal uses the Paillier homomorphic encryption algorithm to perform block encryption and obtain the ciphertext , execute the HMAC algorithm to generate a message authentication code , the ciphertext and Message Authentication Code Sent to a trusted cryptographic device, where Represents the message digest algorithm, H represents the SHAKE-256 function;

[0111] The cloud server uses the Paillier homomorphic encryption algorithm to perform block encryption and obtain the ciphertext , execute the HMAC algorithm to generate a message authentication code , the ciphertext and Message Authentication Code Sent to a trusted cryptographic device.

[0112] S4. The trusted cryptographic device performs aggregate calculation on the received data and returns the calculation results to the mobile terminal and the cloud server; including:

[0113] After receiving the data sent by the mobile terminal and the cloud server, the trusted cryptographic device executes the Vrfy (Verify, a broad definition of verification algorithm) algorithm to verify the message authentication code. Authentication is performed, where represent and ,like , then execute the following secret calculation operation:

[0114]

[0115] Utilizing private keys Decrypt the data:

[0116]

[0117] in, Represents the Paillier decryption algorithm;

[0118] For integers Group by 24 bits to restore the polynomial vector ,Will The low bits of the coefficients are discarded and the calculation is ,in, Indicates the function of taking the high-order bit. is the modulus, Indicates the length of discarding low-order data;

[0119] calculate And sent to the mobile terminal and cloud server respectively, where: A string representing the message to be signed.

[0120] S5. The mobile terminal and the cloud server continue to perform signature calculation using the data returned by the trusted cryptographic device, and generate partial signature fragments respectively; including:

[0121] Mobile terminal computing , ,if or , then discard the result, where Indicates the function of taking the low bit. Represents a partial signature fragment of a mobile terminal, Represents a polynomial vector The maximum value range of the coefficient is express The maximum value range of express Low bit value;

[0122] Cloud Server Computing , ,if or , then discard the result, Represents a partial signature fragment of a cloud server; express Low order bit value.

[0123] S6. The cloud server sends the partial signature fragment generated by itself to the mobile terminal. The mobile terminal verifies the correctness of the partial signature fragment sent by the cloud server. If the verification is successful, the partial signature fragments of both parties are aggregated to generate a complete signature, including:

[0124] The cloud server will and Send to mobile terminal;

[0125] Mobile terminal verification equation Is it true? If so, accept the result, otherwise discard it;

[0126] After verification, the mobile terminal aggregates the signatures of both parties to generate a complete signature: .

[0127] Afterwards, the validity of the above signature needs to be verified. The specific verification process is as follows: Figure 4 As shown, the signature verifier calculates ,verify and Are all of them true? If so, the signature is valid, otherwise it is invalid.

[0128] In other embodiments, the present invention further provides a distributed quantum-resistant digital signature system, which adopts the distributed quantum-resistant digital signature method as described above, including:

[0129] The public and private key generation module is used to enable the mobile terminal and the cloud server to jointly negotiate the signature public key and independently generate their own signature private keys;

[0130] The intermediate vector calculation module is used to enable the mobile terminal and the cloud server to use their respective signature private keys to perform signature calculations and obtain their respective intermediate vectors. and ;

[0131] The splicing module is used to enable the mobile terminal and the cloud server to align their respective intermediate vectors. and After filling and splicing, the data is sent to the trusted cryptographic device using the Paillier homomorphic encryption algorithm and the password-based message authentication code mechanism;

[0132] The aggregation module is used to enable the trusted cryptographic device to perform aggregation calculation on the received data and return the calculation results to the mobile terminal and the cloud server;

[0133] A partial signature module, used to enable the mobile terminal and the cloud server to continue the signature calculation using the data returned by the trusted cryptographic device, and to generate partial signature fragments respectively;

[0134] The complete signature module is used to enable the cloud server to send the partial signature fragment generated by itself to the mobile terminal. The mobile terminal verifies the correctness of the partial signature fragment sent by the cloud server. If the verification is successful, the partial signature fragments of both parties are aggregated to generate a complete signature.

[0135] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0136] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A distributed quantum-resistant digital signature method, characterized in that: The signing process involves the mobile terminal, cloud server and trusted cryptographic device, which includes the following steps: S1. The mobile terminal and the cloud server jointly negotiate the signature public key and independently generate their own signature private keys; S2, the mobile terminal and the cloud server use their own signature private keys to perform signature calculations and obtain their own intermediate vectors and ; S3, mobile terminal and cloud server to their respective intermediate vectors and After filling and splicing, the data is sent to the trusted cryptographic device using the Paillier homomorphic encryption algorithm and the password-based message authentication code mechanism; S4. The trusted cryptographic device performs aggregate calculation on the received data and returns the calculation results to the mobile terminal and the cloud server; S5. The mobile terminal and the cloud server continue to perform signature calculation using the data returned by the trusted cryptographic device, and respectively generate partial signature fragments; S6. The cloud server sends the partial signature fragment generated by itself to the mobile terminal. The mobile terminal verifies the correctness of the partial signature fragment sent by the cloud server. If the verification is successful, the partial signature fragments of both parties are aggregated to generate a complete signature.

2. The distributed quantum-resistant digital signature method according to claim 1, characterized in that: S1 includes: S11. The server runs the Paillier key generation algorithm to generate a 2048-bit prime number , get the private key of the Paillier homomorphic encryption algorithm and the public key , the public key Send to mobile terminal; S12. The mobile terminal uniformly and randomly selects a 256-bit random number , and generate random numbers through the SHAKE-256 function , ; Will Execute the matrix expansion algorithm as input, generating the matrix , where k and l are the number of rows and columns of the matrix respectively, express The polynomial ring of ; Will As input to the key generation algorithm, the private key vector is obtained and ,in, Represents the value range of the key. express The polynomial ring of ; calculate ,Will and Send to cloud server; S13, the cloud server uniformly and randomly selects a 256-bit random number , and generate random numbers through the SHAKE-256 function , ; Will Execute the matrix expansion algorithm as input, generating the matrix ; Will As the input of the key generation algorithm, the private key vector is obtained and ; calculate ;Will and Send to mobile terminal; S14. Random calculation of mobile terminals and , and the calculation results and and Sent to the cloud server, where For vector The string formed by concatenating the polynomial coefficients in; S15, Random Computing on Cloud Servers and , and the calculation results and and Sent to a mobile terminal, where For vector The string formed by concatenating the polynomial coefficients in; S16, the mobile terminal and the cloud server verify the data according to the hash value. If the verification fails, the protocol is terminated and S11-S16 are re-executed; S17, Mobile Terminal Computing , , ,get and the signing private key ; Cloud Server Computing , , , get the public key and the signing private key ,in, Represents the matrix expansion algorithm.

3. The distributed quantum-resistant digital signature method according to claim 2, characterized in that S2 include: Mobile terminal randomly generates polynomial vector , calculate the intermediate vector , and for the intermediate vector Fill and concatenate the coefficients to get an integer ; Cloud server randomly generates polynomial vectors , calculate the intermediate vector , and for the intermediate vector Fill and concatenate the coefficients to get an integer ,in, Representation vector The range of the coefficients, Representation model The polynomial ring of ; For the middle vector and The filling and splicing are performed in the same way, for vector For each element in, that is, each 255-degree polynomial, let one of the polynomial coefficients be , the length of each coefficient is The mobile terminal fills each coefficient with 0 to form a 24-bit integer, and then pieces together the filled values ​​into a 3072-bit integer in groups of 128 coefficients. The first group of results after the pieces are .

4. The distributed quantum-resistant digital signature method according to claim 3, characterized in that S3 include: The mobile terminal uses the Paillier homomorphic encryption algorithm to perform block encryption and obtain the ciphertext , execute the HMAC algorithm to generate a message authentication code , the ciphertext and Message Authentication Code Sent to a trusted cryptographic device, where Represents the message digest algorithm, H represents the SHAKE-256 function; The cloud server uses the Paillier homomorphic encryption algorithm to perform block encryption and obtain the ciphertext , execute the HMAC algorithm to generate a message authentication code , the ciphertext and Message Authentication Code Sent to a trusted cryptographic device.

5. The distributed quantum-resistant digital signature method according to claim 4, characterized in that: S4 include: After receiving the data sent by the mobile terminal and the cloud server, the trusted cryptographic device executes the Vrfy algorithm to authenticate the message. Authentication is performed, where represent and ,like , then execute the following secret state calculation operation: ； Utilizing private keys Decrypt the data: ； in, Represents the Paillier decryption algorithm; For integers Group by 24 bits to restore the polynomial vector ,Will The low bits of the coefficients are discarded and the calculation is ,in, Indicates the function of taking the high bit. is the modulus, Indicates the length of discarding low-order data; calculate And sent to the mobile terminal and cloud server respectively, where: A string representing the message to be signed.

6. The distributed quantum-resistant digital signature method according to claim 5, characterized in that S5 include: Mobile terminal computing , ,if or , then discard the result, where Indicates the function of taking the low bit. Represents a partial signature fragment of a mobile terminal, Represents a polynomial vector The maximum value range of the coefficient is express The maximum value range of express Low bit value; Cloud Server Computing , ,if or , then discard the result, Represents a partial signature fragment of a cloud server; express Low order bit value.

7. The distributed quantum-resistant digital signature method according to claim 6, characterized in that S6 include: Cloud servers will and Send to mobile terminal; Mobile terminal verification equation Is it true? If so, accept the result, otherwise discard it; After verification, the mobile terminal aggregates the signatures of both parties to generate a complete signature: .

8. The distributed quantum-resistant digital signature method according to claim 7, characterized in that: Also includes: Calculation of signature verifiers ,verify and Are all of them true? If so, the signature is valid, otherwise it is invalid.

9. The distributed quantum-resistant digital signature method according to claim 1, characterized in that: Prior to S1, this also included: The mobile terminal generates a key for the message authentication code ,in, is the password value of the mobile terminal, Contains the unique identification information of the mobile terminal device, The password value of the cloud server; The mobile terminal will Upload to the cloud server in advance.

10. A distributed quantum-resistant digital signature system, characterized in that: It adopts the distributed quantum-resistant digital signature method according to any one of claims 1 to 9, including: The public and private key generation module is used to enable the mobile terminal and the cloud server to jointly negotiate the signature public key and independently generate their own signature private keys; The intermediate vector calculation module is used to enable the mobile terminal and the cloud server to use their respective signature private keys to perform signature calculations and obtain their respective intermediate vectors. and ; The splicing module is used to enable the mobile terminal and the cloud server to align their respective intermediate vectors. and After filling and splicing, the data is sent to the trusted cryptographic device using the Paillier homomorphic encryption algorithm and the password-based message authentication code mechanism; The aggregation module is used to enable the trusted cryptographic device to perform aggregation calculation on the received data and return the calculation results to the mobile terminal and the cloud server; A partial signature module, used to enable the mobile terminal and the cloud server to continue the signature calculation using the data returned by the trusted cryptographic device, and to generate partial signature fragments respectively; The complete signature module is used to enable the cloud server to send the partial signature fragment generated by itself to the mobile terminal. The mobile terminal verifies the correctness of the partial signature fragment sent by the cloud server. If the verification is successful, the partial signature fragments of both parties are aggregated to generate a complete signature.

Images