Probability verification method applied to Hash and Sign lattice signature normal form

Abstract

The invention discloses a probability verification method applied to a Hash and Sign lattice signature normal form, which comprises the following steps: (1) Setup step: a signer takes a safety parameter as a public parameter used in an input and output method, and sends the public parameter to a verifier; (2) a KeyGen step: a signer takes a system public parameter as input and outputs a private key and a public key; (3) Sign step: a signer takes the message, the private key and the public parameter as input and outputs a signature for the message; and (4) Verify step: taking the public parameter, the signature, the message and the public key of the signer as input by a verifier, and outputting 0 / 1 to indicate that the signature is legal or illegal. According to the method, the calculation overhead is reduced by reducing the data volume involved in the verification process, and the method is suitable for some scenes which have extremely high efficiency requirements and can properly compromise security.

Description

Technical Field

[0001] The invention belongs to the field of information security and data protection, and in particular relates to a probabilistic verification method applied to a Hash and Sign signature paradigm. Background Art

[0002] Digital signature technology can verify the integrity and source of information, ensure that data has not been tampered with during transmission, and confirm the identity of the sender of the information. Whether in e-government, e-commerce, finance, law or other fields, digital signatures play an indispensable role in ensuring the authenticity, reliability and legality of digital information.

[0003] With the increasing development of quantum computing technology, Shor[1](PW Shor, "Algorithms for quantum computation; discrete logarithms and factoring," in Proceedings 35th Annual Symposium on Foundations of Computer Science, Santa Fe, NM, USA; IEEE Comput. Soc. Press, 1994, pp. 124–134.) and Grover[2](LK Grover, "Quantum Mechanics Helps in Searching for a Needle in a Haystack," Phys. Rev. Lett., vol. 79, no. 2, pp. 325–328, Jul. 1997.) discovered quantum algorithms that can effectively solve classical difficult problems, which has brought severe security challenges to traditional signature schemes. Lattice-based cryptographic systems are considered to be an effective means to resist quantum computing attacks. The security of lattice-based signatures is based on difficult problems in high-dimensional lattices, which still maintain their difficulty in quantum computing environments, thus providing a strong guarantee for data security.

[0004] Ajtai[3] (M. Ajtai, “Generating hard instances of lattice problems (extended abstract),” in Proceedings of the twenty-eighth annual ACM symposium on Theory of computing-STOC'96, Philadelphia, Pennsylvania, United States; ACM Press, 1996, pp. 99–108.) proved that the difficulty of the lattice problem in the average state on a random lattice is equivalent to the difficulty in the worst state, laying a solid foundation for the development of lattice public key cryptography. This feature is a unique advantage that other post-quantum cryptography does not have. In addition, based on the existing security proof technology, lattice cryptography can reduce the security of the scheme to the lattice hard problem. Moreover, the algebraic structure of lattice cryptography is simple and clear, the software and hardware implementation is relatively convenient, the computational complexity is low, and it is suitable for parallel computing. In addition, with the continuous development of cloud computing technology, cloud computing platforms have become the preferred data storage and processing method for many enterprises and individuals. However, the security issues of cloud computing platforms are also becoming increasingly prominent. The application of homomorphic cryptography can effectively enhance the security of cloud computing platforms and protect users' sensitive data from being leaked and abused. The rapid development of cloud computing technology has increased the demand for the design of quantum-resistant homomorphic cryptography. Lattice cryptography is a linear cryptography whose special geometric structure can be better applied to the design of homomorphic cryptography.

[0005] In summary, as a post-quantum signature algorithm, lattice signature has significant advantages in terms of security, efficiency, practicality and scalability, and is expected to play an important role in future cryptography. In 2008, Gentry et al. [4] creatively proposed a hash-and-sign signature paradigm based on difficult lattice trapdoors, and designed the classic GPV (Gentry, Peikert and Vaikuntananathan [GPV08]) signature based on the hash-and-sign signature paradigm. This signature paradigm is the first recognized secure and efficient lattice trapdoor scheme, which has greatly promoted the development of lattice digital signature technology. The work of Gentry et al. has brought new vitality and direction to the field of lattice cryptography, and has also inspired subsequent researchers to explore and innovate lattice cryptography. Since then, lattice-based digital signature schemes have begun to flourish, not only making many breakthroughs in theory, but also showing great potential and value in practical applications.

[0006] The hash-and-sign signature paradigm of Gentry et al. has become an important foundation in lattice signature schemes. The core idea is to use a one-way trapdoor function on the lattice to construct a digital signature. The message is summarized into a shorter hash value through a hash function, and then the hash value is sampled using the trapdoor basis to obtain the signature value. Many subsequent lattice signature schemes are designed and optimized based on the hash-and-sign signature paradigm.

[0007] In the traditional hash-and-sign signature paradigm, the complete public key matrix needs to be multiplied with the signature vector to verify whether the multiplication result is equal to the complete message hash value, which is a relatively time-consuming process. Summary of the invention

[0008] The purpose of the present invention is to provide a probabilistic verification method applied to the Hash and Sign lattice signature paradigm. The core idea of ​​the present invention is to reduce the computational overhead by reducing the amount of data to be verified. After analyzing the improved probabilistic verification scheme, we concluded that if the process of randomly selecting the public key matrix and the message hash value is sufficiently random, if the signature itself is illegal, then the probability of the signature passing the verification is negligible, and the possibility of the adversary forging the signature and passing the verification is still not negligible. In addition, the confidence in the authenticity of the signature can also be increased by performing random verification multiple times. The GPV signature scheme is the most classic lattice signature scheme constructed using the Hash and Sign lattice signature paradigm. The present invention describes the probabilistic verification method applied to the Hash and Sign lattice signature paradigm by improving the verification signature process of the GPV signature scheme.

[0009] The present invention is achieved by adopting the following technical solutions:

[0010] A probabilistic verification method applied to the Hash and Sign signature paradigm, comprising:

[0011] Step 1: Initialization step Setup(n)→(params): The trusted party takes the security parameter λ as input and outputs the public parameter params=(m,q,s,H), where m≥6nlogq is the dimension of the signature vector, a prime number Gaussian parameters is a real number; let is a secure hash function;

[0012] Step 2: Key generation step KeyGen(params)→(sk,pk): The signer takes public parameters params=(n,m,q,s,H) as input and runs the TrapGen(n,m,q) algorithm to generate the matrix Dative The trapdoor basis T of , outputs the public key pk←(A), the private key sk←(T);

[0013] Step 3: Signature step Sign(sk,pk,params,M)→e: Let the message be M∈{0,1} * , the signer calculates h = H (M), which is the "Hash" process of the Hash and Sign lattice signature paradigm; the signer calculates the vector t to satisfy At = hmodq, uses the SamplePre (T, s, -t) algorithm to output t', and calculates e = t + t'modq as the signature of the message M;

[0014] Step 4: RanCombine(pk,h)→pk',h': The verifier randomly selects k rows from the lattice matrix A and records the index of the selected row; the k row vectors are combined from top to bottom in the order of random selection to form a new lattice public key matrix Then calculate the hash value h of the message M, select the corresponding component from the vector h according to the same randomly selected index, and construct a new message hash vector h' in the same combination mode;

[0015] Step 5: Verify(params,pk',e,h') → 0 / 1: The verifier calculates whether the verification relationship between the signature e, the combined public key A' and the combined message vector h' is satisfied if and only if A'e=h′modq and When the signature e is accepted, it outputs 1, otherwise it outputs 0, which means that the signature e is rejected.

[0016] A further improvement of the present invention is that in step 2, the public key and private key used in the Hash and Sign signature paradigm are generated, and the public key is The private key is a matrix of n rows and m columns on the lattice, where n and m define the rank and dimension of the lattice with the public key matrix as the lattice basis. The private key is the trapdoor basis matrix of the dual lattice with the public key matrix as the lattice basis.

[0017] A further improvement of the present invention is that step 3 is a "Sign" process of the Hash and Sign signature paradigm.

[0018] A further improvement of the present invention is that in step 4, the verification parameters of the ordinary Hash and Sign lattice signature paradigm, namely the lattice basis matrix A and the message vector h are randomly combined and their sizes are reduced.

[0019] A further improvement of the present invention is that, in step 5, the verification is performed using the verification parameters randomly combined in step 4 according to the signature verification method of the normal Hash and Sign signature paradigm.

[0020] A further improvement of the present invention is that in step 5, the verifier randomly selects row vectors from the lattice basis matrix, and combines them from top to bottom in the order of random selection into a new lattice basis public key matrix; the verifier calculates the hash value of the message, selects the corresponding component from the hash vector according to the same randomly selected index, and constructs a new message hash vector in the same combination method.

[0021] A further improvement of the present invention is that in step 5, the verifier uses the randomly combined lattice matrix and the message hash vector generated in step 4 to verify the legitimacy of the signature; specifically, the verifier calculates whether the relationship between the signature e, the combined public key A' and the combined message vector h' satisfies A'e = h'modq, and verifies whether the norm e of the signature satisfies

[0022] A further improvement of the present invention is that the probabilistic verification method in step 5 has potential universality for lattice signature schemes based on the Hash and Sign paradigm, and the verification process of such signature schemes involves the multiplication calculation and verification of the public key matrix and the signature vector.

[0023] The present invention has at least the following beneficial technical effects:

[0024] 1. The present invention proposes the following ideas to improve verification efficiency: randomly select a part of the row vectors from the original verification matrix, and combine these randomly selected row vectors into a new verification matrix with a smaller number of rows. At the same time, select the vector components corresponding to the new matrix from the original message hash value to form a shorter vector. Finally, use the new public key matrix and the signature vector to multiply to verify whether the result is equal to the new message vector. If they match, the signature is considered valid with a probability close to 1. This improved method can reduce the number of matrix multiplication operations in the verification process. Simply put, assuming that k rows are randomly selected from the n×m lattice matrix, the number of matrix multiplications required for verification changes from nm to km. The smaller the value of k, the more obvious the efficiency improvement.

[0025] 2. The present invention uses the classical probability model to ensure the security of the improved verification process: According to the classical probability model and Gaussian distribution related theory, the probability of forging a signature that cannot be verified by the ordinary Hash and Sign signature paradigm and passing the improved verification algorithm is negligible (which has been proved in the security analysis of the algorithm). Therefore, the improved verification method can verify the legitimacy of the signature with an overwhelming confidence level close to 1.

[0026] 3. The probabilistic verification method proposed in the present invention has potential universality for lattice signature schemes based on the Hash and Sign paradigm. The verification process of the Hash and Sign lattice signature paradigm involves the multiplication calculation and verification of the lattice matrix and the signature vector. The probabilistic verification method proposed in the present invention can effectively reduce the verification overhead of all Hash and Sign lattice signature paradigms. The advantage of this method lies in its wide applicability. It is not limited to specific signature schemes or application scenarios, but can be seamlessly integrated into any system that uses Hash and Sign lattice signatures. By introducing the concept of probabilistic verification, we have achieved a significant reduction in the computing resources and time required in the verification process while maintaining the security of the signature, thereby improving the overall efficiency. This universality means that both existing and future Hashand Sign lattice signature schemes can benefit from the method. In short, this method brings an innovative verification method to the entire Hash and Sign lattice signature field. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic diagram of probability verification.

[0028] Figure 2 It is a three-dimensional numerical diagram of k, t, and P(E) when n=512.

[0029] Figure 3 This is a schematic diagram of the k and t values ​​for P(E)≥0.01%. DETAILED DESCRIPTION

[0030] The present invention is further described in detail below in conjunction with specific embodiments, but the implementation of the present invention is not limited thereto. The following content is a further detailed description of the present invention in conjunction with specific preferred implementations, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as belonging to the protection scope of the present invention.

[0031] like Figure 1 As shown, the present invention provides a probabilistic verification method applied to the Hash and Sign signature paradigm, comprising the following steps:

[0032] Step 1: Initialization step Setup(n)→(params): The trusted party takes the security parameter λ as input and outputs the public parameter params=(m,q,s,H), where m≥6nlogq is the dimension of the signature vector, a prime number Gaussian parameters is a real number. A secure hash function.

[0033] Step 2: Key generation step KeyGen(params)→(sk,pk): The signer takes public parameters params=(n,m,q,s,H) as input and runs the TrapGen(n,m,q) algorithm to generate the matrix Dative The trapdoor basis T is used to output the public key pk←(A) and the private key sk←(T). This step generates the public key and private key required for the Hash and Sign signature paradigm. The public key is The private key is a matrix of n rows and m columns on the lattice, where n and m define the rank and dimension of the lattice with the public key matrix as the lattice basis. The private key is the trapdoor basis matrix of the dual lattice with the public key matrix as the lattice basis.

[0034] Step 3: Signature step Sign(sk,pk,params,M)→e: Let the message be M∈{0,1} * , the signer calculates h=H(M), which is the "Hash" process of the Hash and Sign lattice signature paradigm. The signer calculates the vector t to satisfy At=hmodq, uses the SamplePre(T,s,-t) algorithm to output t', and calculates e=t+t'modq as the signature of the message M. This process is the "Sign" process of the Hash and Sign lattice signature paradigm.

[0035] Step 4: RanCombine(pk,h)→pk',h': The verifier randomly selects k rows from the lattice matrix A and records the index of the selected row. Combine the k row vectors from top to bottom in the order of random selection to form a new lattice public key matrix Then the hash value h of the message M is calculated, the corresponding components are selected from the vector h according to the same randomly selected index, and a new message hash vector h' is constructed in the same combination. This step randomly combines the verification parameters (lattice basis matrix A and message vector h) of the trivial Hashand Sign lattice signature paradigm and reduces its size, which is the key to improving verification efficiency.

[0036] Step 5: Verify(params,pk',e,h') → 0 / 1: The verifier calculates whether the verification relationship between the signature e, the combined public key A' and the combined message vector h' is satisfied if and only if A'e=h'modq and When , the output is 1, indicating that the signature e is accepted, otherwise it outputs 0, indicating that the signature e is rejected. This step follows the signature verification method of the normal Hash and Sign signature paradigm, using the verification parameters randomly combined in step 4 for verification.

[0037] In step 4, the present invention requires the verifier to randomly select row vectors from the lattice matrix and combine them from top to bottom into a new lattice public key matrix in the order of random selection; the verifier is required to calculate the hash value of the message, select the corresponding component from the hash vector according to the same randomly selected index, and construct a new message hash vector in the same combination mode. This step randomly combines the verification parameters (lattice matrix and message vector) of the ordinary Hash and Sign lattice signature paradigm, reduces its size, and reduces the number of matrix multiplication operations in the verification process, which is the key to improving verification efficiency.

[0038] In step 5 of the present invention, the verifier needs to use the randomly combined lattice matrix and message hash vector generated in step 4 to verify the legitimacy of the signature. Specifically, the verifier calculates whether the relationship between the signature e, the combined public key A' and the combined message vector h' satisfies A'e = h'modq, and verifies whether the norm e of the signature satisfies Step 5 utilizes the idea of ​​probabilistic verification and, based on the classical probability model, can determine the legitimacy of the signature with an overwhelming confidence rate.

[0039] The probabilistic verification method in step 5 of the present invention has potential universality for lattice signature schemes based on the Hash and Sign paradigm. The verification process of such signature schemes usually involves the multiplication calculation and verification of the public key matrix and the signature vector. Therefore, by adopting a similar probabilistic verification strategy, it is expected to reduce the verification calculation overhead of such signatures.

[0040] Correctness analysis of the algorithm:

[0041] Gentry et al. have proved the correctness of the Hash and Sign lattice signature paradigm in the literature [4] (C. Gentry, C. Peikert, and V. Vaikuntanathan, "Trapdoors for hard lattices and new cryptographic constructions," in Proceedings of the fortieth annual ACM symposium on Theory of computing, Victoria British Columbia Canada; ACM, May 2008, pp. 197–206.). In the improved signature algorithm, the idea of ​​probabilistic verification is used. K rows are randomly selected from the public key matrix A, and the corresponding components are selected from the vector h(M) to verify the signature e. If e is a legitimate signature, it naturally satisfies A'e=h(M)'modq and conditions.

[0042] Security analysis of the algorithm:

[0043] Analyzing the signing process, for the hash value h(M) of the message M, we first use the Gaussian elimination method to calculate a long vector Satisfies At=h(M)modq. Then we need to use the SamplePre(A,T,s,-t) algorithm to output the original image t′ of -t, where t′ is the dual lattice. The grid points on the grid satisfy t′+s=-t, where s is a short perturbation vector extracted from a relatively narrow Gaussian distribution. Reference [4] has proved that the process of input t', perturbation vector s, and output -t can be regarded as a sampleable preimage function, which has the following properties:

[0044] (1) The perturbation vector s is drawn from a relatively narrow Gaussian distribution, under which the output -t is statistically close to a uniform distribution in the range.

[0045] (2) The process of sampling the pre-image is not to simply find any pre-image of -t, but actually to sample all its pre-images according to The discrete Gaussian distribution on .

[0046] Finally, we get the signature e = t' + tmodq. Therefore, even if we sample -t1 and -t2 for the same two t1 and t2, the obtained t'1 and t'2 are still uniformly random. In the signature scheme, the hash function It is safe, which means that if there are two very close M1 and M2, the h(M)1 and h(M)2 obtained after hash mapping are also uniformly random, so that the long vectors t1 and t2 that make At1=h(M1)modq and At2=h(M2)modq are also uniformly random, that is, t'1 and t'2 obtained by sampling the original image of -t1 and -t2 are also uniformly random, so the corresponding signatures e1 and e2 are also uniformly random. Therefore, for two different messages M1 and M2, as long as M1≠M2, the corresponding e1 and e2 are uniformly random.

[0047] Given a random uniform matrix Integer parameters m, n, q, short vector e1, message vector h, satisfying Ae1 = hmodq, let is the i-th row vector of A, h i is the i-th component of h. Analysis For another illegal signature e2, there are t rows a1,...a i …a t Make a i e2=h i For convenience, let

[0048] Each row in A is independent. Let's first consider a specific row a. i and vector e2. Since A is uniformly random, a i is also uniformly random. Given a i The result of e2modq is evenly distributed in Therefore, for any particular h i , there is a i e2≡h i The probability of modq is Since each row a i are independent, the probability that all t rows meet the condition is the probability that these t independent events occur simultaneously, that is There are C(n,t) ways to select t rows from n rows. The probability that there are t rows that meet the condition is defined as

[0049] In the probabilistic verification method, it is necessary to randomly select k rows (k < n) from A to form a new matrix A', and select the corresponding k components from h to form a vector h'. When n = 4 and k = 2, the extraction method is as follows Figure 1 As shown:

[0050] Define event E as e2 passing verification, and P(E) is the probability that A'e2=h'modq holds:

[0051]

[0052] Obviously, if t<k, then event E will never occur. Event E will only occur when k≤t.

[0053] When n=512, Figure 2 Show the relationship between P(E) and different values ​​of k and t. Figure 2 The red part in the middle indicates that P(E)≤1 -4 The values ​​of k and t. Figure 3 Indicates that when P(E)≥1 -4 Plane diagram of the k and t values ​​when .

[0054] P(A) decreases exponentially as t increases, and even when t = 1, P(A) is a probability value close to 0. Obviously, no matter what k is, P(E|A) = P(E)P(A) is also a negligible probability value close to 0.

[0055] Therefore, if the e2 signature is not a legal signature, then the probability of it passing the probabilistic verification is negligible, and the "if and only if" in the verification condition is proved.

[0056] 1. Definition of symbols in the present invention:

[0057] In the present invention, bold lowercase letters are used to represent vectors, such as vector b. Bold uppercase letters are used to represent matrices, such as matrix A. Represents the number field, represents the domain of integers modulo q. Given two vectors e1 and e2 of the same dimension,<e1,e2> represents the inner product of a vector. Let constant c>0, use ω(f(n)) to represent a function that grows faster than cf(n), and use poly(n) to represent a polynomial function f(n)=O(n c ). Use ||·|| to represent the Euclidean norm (L2 norm) of a vector. Define the norm of a matrix as the norm of its longest column vector, such as the matrix S = {s1,…,s k}, use ||S|| to represent the length of the longest column vector, that is, ||S||=max i ||s i ||, i∈[1,k]. For any matrix S, represents the matrix after Gram-Schmidt orthogonalization, Denotes the Gram-Schmidt norm. D Λ,s,c represents a Gaussian distribution with c as the center and s as the Gaussian parameter on the grid Λ. The logarithms used in the method are all based on 2.

[0058] 2. Basic knowledge

[0059] Trapdoor Generation Algorithm

[0060] TrapGen algorithm for trapdoor generation; given matrix parameters n, m, q satisfying q = poly(n) and m ≥ 5nlogq, there exists a probabilistic polynomial time algorithm TrapGen(m, n, q) that outputs a matrix and a full-rank set The distribution of the matrix A is statistically close to uniform distribution, and ||S||≤O(nlogq), and the set S can be effectively transformed into a grid The trapdoor base T.

[0061] Pre-image sampling function

[0062] Given an n-dimensional lattice Λ(A), a trapdoor basis T, Gaussian parameters s, and a vector y, there exists a probabilistic polynomial-time algorithm SamplePre(T,s,y) that follows a Gaussian distribution D Λ(A),s,y Output a vector x∈Λ(A) that is close to y.

[0063] GPV Signature

[0064] Setup: Given parameters (n, m, q, s), use the TrapGen algorithm to generate a grid And its trapdoor basis T. The public key is (n,m,q,s,A), the private key is T, and a secure hash function is defined

[0065] Sign: The signer calculates the hash value H(M) of the message M and generates a vector Satisfy At=H(M)modq. Use SamplePre(T,s,-t) algorithm to output t'. Calculate e=t'+tmodq as the signature of the message.

[0066] Verify: The verifier calculates the hash value H(M) of the message M. If and only if Ae=H(M)modq and Accept signature e.

[0067] Although the present invention has been described in detail above with general descriptions and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements may be made thereto based on the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all fall within the scope of protection claimed by the present invention.

Claims

1. A probabilistic verification method applied to the Hash and Sign signature paradigm, characterized in that: include: Step 1: Initialization step Setup(n)→(params): The trusted party takes the security parameter λ as input and outputs the public parameter params=(m,q,s,H), where m≥6nlogq is the dimension of the signature vector, a prime number Gaussian parameters is a real number; let is a secure hash function; Step 2: Key generation step KeyGen(params)→(sk,pk): The signer takes public parameters params=(n,m,q,s,H) as input and runs the TrapGen(n,m,q) algorithm to generate the matrix Dative The trapdoor basis T of , outputs the public key pk←(A), the private key sk←(T); Step 3: Signing step Sign(sk,pk,params,M)→e: Let the message be M-{0,1} * , the signer calculates h = H (M), which is the "Hash" process of the Hash and Sign lattice signature paradigm; the signer calculates the vector t to satisfy At = h mod q, uses the SamplePre (T, s, -t) algorithm to output t', and calculates e = t + t'mod q as the signature of the message M; Step 4: RanCombine(pk,h)→pk',h': The verifier randomly selects k rows from the lattice matrix A and records the index of the selected row; the k row vectors are combined from top to bottom in the order of random selection to form a new lattice public key matrix Then calculate the hash value h of the message M, select the corresponding component from the vector h according to the same randomly selected index, and construct a new message hash vector h' in the same combination mode; Step 5: Verify(params,pk',e,h') → 0 / 1: The verifier calculates whether the verification relationship between the signature e, the combined public key A' and the combined message vector h' is satisfied if and only if A'e=h′mod q and When the signature e is accepted, it outputs 1, otherwise it outputs 0, which means the signature e is rejected.

2. According to claim 1, a probabilistic verification method applied to the Hash and Sign signature paradigm is characterized in that: In step 2, generate the public key and private key used in the Hash and Sign signature paradigm. The public key is The private key is a matrix of n rows and m columns on the lattice, where n and m define the rank and dimension of the lattice with the public key matrix as the lattice basis. The private key is the trapdoor basis matrix of the dual lattice with the public key matrix as the lattice basis.

3. The probabilistic verification method applied to the Hash and Sign signature paradigm according to claim 1, characterized in that: In step 3, it is the "Sign" process of the Hash and Sign signature paradigm.

4. The probabilistic verification method applied to the Hash and Sign signature paradigm according to claim 1, characterized in that: In step 4, the verification parameters of the trivial Hash and Sign lattice signature paradigm, namely the lattice basis matrix A and the message vector h, are randomly combined and their size is reduced.

5. The probabilistic verification method applied to the Hash and Sign signature paradigm according to claim 1, characterized in that: In step 5, the signature verification method of the normal Hash and Sign signature paradigm is used to verify the randomly combined verification parameters in step 4.

6. A probabilistic verification method applied to the Hash and Sign signature paradigm according to claim 5, characterized in that: In step 5, the verifier randomly selects row vectors from the lattice basis matrix and combines them from top to bottom in the order of random selection to form a new lattice basis public key matrix; the verifier calculates the hash value of the message, selects the corresponding component from the hash vector according to the same randomly selected index, and constructs a new message hash vector in the same combination method.

7. The probabilistic verification method applied to the Hash and Sign signature paradigm according to claim 5, characterized in that: In step 5, the verifier uses the randomly combined lattice matrix and the message hash vector generated in step 4 to verify the legitimacy of the signature; specifically, the verifier calculates whether the relationship between the signature e, the combined public key A' and the combined message vector h' satisfies A'e = h'mod q, and verifies whether the norm of the signature e satisfies 8. The probabilistic verification method applied to the Hash and Sign signature paradigm according to claim 5, characterized in that: The probabilistic verification method in step 5 is potentially universal for lattice signature schemes based on the Hash and Sign paradigm. The verification process of such signature schemes involves the multiplication and verification of the public key matrix and the signature vector.

Images