LMS-based collaborative key generation method and device and LMS-based collaborative signature method and device

Abstract

The invention relates to the technical field of collaborative signature, and particularly provides an LMS-based collaborative key generation method and device and a collaborative signature method and device, and the LMS-based collaborative key generation method can comprise the steps: obtaining a client public key component, and obtaining a server public key component; calculating the client public key component and the server public key component to obtain a plurality of collaborative public key elements; and based on the plurality of collaborative public key elements, acquiring an LMS collaborative public key. Collaborative signature can be carried out subsequently through the generated collaborative key. According to the embodiment of the invention, the collaborative signature based on the LMS can be realized, and the security is relatively high.

Description

Technical Field

[0001] The present application relates to the technical field of collaborative signature, and in particular to a method and device for collaborative key generation and collaborative signature based on LMS. Background Art

[0002] Collaborative signature technology is a method of digital signature in a multi-party environment, which requires two or more users to cooperate to generate a valid signature. With the emergence of quantum-resistant digital signature algorithms, the security of hash-based digital signature algorithms in the technical route on which they are based does not depend on specific mathematical difficulties, so it has broad application prospects. In practical applications, the LMS (Leighton-Micali Signature) algorithm in the hash-based signature algorithm is an algorithm that can perform multiple signatures based on the LM-OTS algorithm. It is a stateful signature scheme. The so-called state is the state of the private key. The signer needs to record the application state of the private key to prevent the private key from being reused and affecting the security of the algorithm. However, under the requirement of security, the current LMS algorithm can only perform multiple signatures through the private key, and cannot perform collaborative signatures.

[0003] Therefore, how to provide a technical solution for a collaborative signature method based on LMS with higher security has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The purpose of some embodiments of the present application is to provide a method and device for collaborative key generation and collaborative signature based on LMS. Through the technical solutions of the embodiments of the present application, collaborative key generation and collaborative signature of the LMS algorithm can be implemented with high security.

[0005] In the first aspect, some embodiments of the present application provide a method for collaborative key generation based on LMS, which is applied to a terminal, wherein the terminal is a client or a server, and includes: obtaining a client public key component and obtaining a server public key component; wherein the client public key component is related to a client private key component parameter in a client LMS collaborative private key component; wherein the server public key component is related to a server private key component parameter in a server LMS collaborative private key component; calculating the client public key component and the server public key component to obtain a plurality of collaborative public key elements; and obtaining an LMS collaborative public key based on the plurality of collaborative public key elements.

[0006] Some embodiments of the present application can obtain multiple collaborative public key elements through the client public key component and the server public key component, and then obtain the LMS collaborative public key, so as to realize the generation of collaborative keys and provide key support for subsequent collaborative signatures, with high security and wide applicability.

[0007] In some embodiments, the terminal is the client, wherein obtaining the server public key component includes: receiving the server public key component sent by the server.

[0008] In some embodiments, the client public key component is obtained by the following method: the client randomly generates a bit string and a client private key component parameter; the client determines the client LMS collaborative private key component based on the bit string, the client private key component parameter, a hash function and a tree height; the client calculates the client private key component parameter and selected parameters to obtain the client public key component, wherein the client public key component includes multiple LM-OTS client public key component elements.

[0009] In some embodiments of the present application, the client can determine the client LMS collaborative private key component by randomly generating a bit string and client private key component parameters and combining them with other parameters, and then obtain the client public key component to provide data support for the subsequent generation of collaborative keys.

[0010] In some embodiments, the server public key component is obtained by the following method: the server receives the target parameters sent by the client, wherein the target parameters include: the client public key component, hash function, tree height, bit string and fixed parameters; the server generates a server private key component parameter and a server LMS collaborative private key component through the target parameters; the server calculates the server private key component parameter and the selected parameters to obtain the server public key component, wherein the server public key component includes multiple LM-OTS server public key component elements.

[0011] After receiving the target parameters of the client, the server of some embodiments of the present application performs a series of calculations to obtain the server public key component, thereby providing data support for the subsequent generation of the collaborative key.

[0012] In the second aspect, some embodiments of the present application provide a collaborative signature method based on LMS, which is applied to a terminal, wherein the terminal is a client or a server, and includes: obtaining a client LMS collaborative signature component and obtaining a server LMS collaborative signature component; wherein the client LMS collaborative signature component is related to the client LMS collaborative private key component, and the server LMS collaborative signature component is related to the server LMS collaborative private key component; using the client LMS collaborative signature component and the server LMS collaborative signature component to sign a signature message to obtain an initial signature result; determining a signature authentication path; and obtaining an LMS signature result through the initial signature result and the signature authentication path.

[0013] Some embodiments of the present application use the client-side LMS collaborative signature component and the server-side LMS collaborative signature component to sign the signature message, and then combine the signature authentication path to synthesize the LMS signature result, so as to ensure the security and effectiveness of the collaborative signature.

[0014] In some embodiments, when the terminal is the client, the obtaining of the server-side LMS collaborative signature component includes: receiving the server-side LMS collaborative signature component sent by the server.

[0015] In some embodiments, the client LMS collaborative signature component is obtained by:

[0016] The client calculates the message to be signed to obtain signature parameters; the client obtains the client LMS collaborative signature component based on the signature parameters, fixed parameters and private key component array elements corresponding to the client status value.

[0017] In some embodiments of the present application, the client obtains the client LMS collaborative signature component by calculating relevant parameters to provide data support for subsequent collaborative signature.

[0018] In some embodiments, the server-side LMS collaborative signature component is obtained by the following method: the server receives the signature parameters and the client status value sent by the client; the server determines the server-side LMS collaborative signature component by comparing the client status value with the server status value.

[0019] In some embodiments of the present application, the server determines the server LMS collaborative signature component by receiving the signature parameters and client status value of the client in combination with the local server status value, thereby providing data support for subsequent collaborative signature.

[0020] In some embodiments, the server determines the server LMS collaborative signature component by comparing the client status value with the server status value, including: when the client status value is greater than the server status value and the difference between the client status value and the server status value is within a preset range, the server status value is updated to the client status value; or, when the client status value is equal to the server status value, the server LMS collaborative signature component is obtained based on the signature parameters, fixed parameters and the private key component array elements corresponding to the server status value.

[0021] Some embodiments of the present application determine a method for obtaining a server-side LMS collaborative signature component by comparing a client status value with a server status value, thereby providing data support for subsequent collaborative signatures and ensuring the accuracy and security of collaborative signatures.

[0022] In some embodiments, after obtaining the LMS signature result through the initial signature result and the signature authentication path, the method further includes: when the terminal is the client, updating the client status value; when the terminal is the server, updating the server status value.

[0023] Some embodiments of the present application ensure the security of collaborative signature by updating relevant status values.

[0024] In the third aspect, some embodiments of the present application provide a device for collaborative key generation based on LMS, which is applied to a terminal, wherein the terminal is a client or a server, and the device includes: a first acquisition module, configured to obtain a client public key component and a server public key component; wherein the client public key component is related to a client private key component parameter in a client LMS collaborative private key component; wherein the server public key component is related to a server private key component parameter in a server LMS collaborative private key component; a calculation module, configured to calculate the client public key component and the server public key component to obtain multiple collaborative public key elements; and a generation module, configured to obtain an LMS collaborative public key based on the multiple collaborative public key elements.

[0025] In a fourth aspect, some embodiments of the present application provide a collaborative signature device based on LMS, comprising: applied to a terminal, the terminal being a client or a server, the device comprising: a second acquisition module, configured to acquire a client-side LMS collaborative signature component, and acquire a server-side LMS collaborative signature component; wherein the client-side LMS collaborative signature component is related to the client-side LMS collaborative private key component, and the server-side LMS collaborative signature component is related to the server-side LMS collaborative private key component; a first signature module, configured to use the client-side LMS collaborative signature component and the server-side LMS collaborative signature component to sign a message to be signed, and obtain an initial signature result; a determination module, configured to determine a signature authentication path; a second signature module, configured to obtain an LMS signature result through the initial signature result and the signature authentication path.

[0026] In a fifth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0027] In a sixth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement a method as described in any embodiment of the first aspect.

[0028] In a seventh aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0030] Figure 1 A schematic diagram of an LMS tree structure with a height h of 3 provided for some embodiments of the present application;

[0031] Figure 2 A schematic diagram of the LMS signature path of message M provided for some embodiments of the present application;

[0032] Figure 3 A system diagram of collaborative key generation and collaborative signature based on LMS provided for some embodiments of the present application;

[0033] Figure 4 One of the flow charts of the method for collaborative key generation based on LMS provided in some embodiments of the present application;

[0034] Figure 5 One of the flow charts of the method for collaborative signing based on LMS provided in some embodiments of the present application;

[0035] Figure 6 A second flowchart of a method for collaborative key generation based on LMS provided in some embodiments of the present application;

[0036] Figure 7 A second flowchart of a method for collaborative signing based on LMS provided for some embodiments of the present application;

[0037] Figure 8 A block diagram of a device for collaborative key generation based on LMS provided in some embodiments of the present application;

[0038] Fig. 9 A block diagram of a collaborative signature device based on LMS provided for some embodiments of the present application;

[0039] Fig.10 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0040] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0041] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0042] Due to the virtuality of cyberspace, digital signatures, as a technology with message integrity authentication, identifiability and non-repudiation, emerged in the information age and have been widely used. However, the development of information technology has also increased the diversity and complexity of information terminals, making the security of a single terminal more vulnerable, and the need for digital signatures that can resist "single point failures" has become more important.

[0043] Collaborative signature technology is usually used in scenarios that require high security and multi-party control, such as financial transactions, contract signing, key management, etc. Collaborative signature technology uses key splitting technology, so no participant can master the complete key or obtain the private key information of other participants, thereby effectively ensuring the user's key security when a single device is controlled by an attacker.

[0044] The development of quantum computing has had a great impact on the security of the widely used digital signature algorithms based on large integer factorization (such as RSA) and discrete logarithms (such as ECC), so the collaborative signature scheme based on related difficult problems is also facing serious threats. To deal with this threat, a digital signature algorithm that can resist quantum computer attacks is needed, that is, a quantum-resistant signature algorithm. Among the technical routes based on which the existing quantum-resistant digital signature algorithms are based, the security of the digital signature algorithm based on hashing does not depend on specific mathematical difficulties. It is a type of algorithm with a relatively mature technical route and relatively conservative security. Therefore, the quantum-resistant collaborative signature scheme based on hashing has broad application prospects.

[0045] At present, LM-OTS and LMS algorithms are hash-based signature algorithms. RFC 8554 and NIST 800-208 have standardized them, and ISO and the National Cryptography Standards Committee are also following up on the standardization of the algorithm. LM-OTS is a hash-based one-time signature scheme, that is, the signature private key can only be used once, otherwise it may cause security problems. Since the LM-OTS algorithm can only sign once, it is relatively limited in application. The LMS algorithm is an algorithm that can perform multiple signatures based on the LM-OTS algorithm. It is a stateful signature scheme. The so-called state is the state of the private key. The signer needs to record the application state of the private key to prevent the private key from being reused and affecting the security of the algorithm. However, in actual applications, in order to ensure the security of the signature, the LMS algorithm cannot perform collaborative signing; moreover, in the LMS algorithm, each OTS instance used can only sign one message at most, so the private key of the LMS must maintain a state, and each signature needs to update the state to ensure that each OTS instance used is signed at most once. Therefore, the application of the LMS algorithm requires the signer to perform secure and reliable private key state management. However, if the private key state is controlled and saved by only one party, when state management errors cause an OTS private key to be misused multiple times, it will lead to algorithm security issues.

[0046] In view of this, some embodiments of the present application provide a method for collaborative key generation and collaborative signature based on LMS, which can first generate a collaborative key, and then perform collaborative signing through some components of the multi-terminal collaborative private key components. The collaborative signature scheme based on LMS proposed in the present application reduces the algorithm security threat caused by the client key security problem when using the LMS algorithm for digital signature. Moreover, in the present application, the private key state is jointly saved by multiple (two or more) collaborative signature participants, and the signing process is jointly participated by multiple parties. During the collaborative signing process, each participant compares, corrects and synchronizes the state q, thereby improving the security and reliability of the algorithm private key state management.

[0047] In order to help understand and implement the LMS-based collaborative key generation and collaborative signature process of the present application, the existing related algorithms involved are first described below.

[0048] In the process of implementing the collaborative key generation and collaborative signature based on LMS of this application, three algorithms are mainly involved, namely: LM-OTS algorithm, LMS algorithm and LM-OTS collaborative signature scheme. These three algorithms are described in turn below.

[0049] The following describes the implementation process of key generation, signing, and signature verification involved in the LM-OTS algorithm.

[0050] In the process of implementing the LM-OTS algorithm, H represents the hash function used by the algorithm; n is the number of output bytes of the hash function H; w is the Winternitz parameter, which can be selected from 1, 2, 4, and 8; otstype represents a four-byte string, whose value can be determined by the value of w.

[0051] Specifically, the key generation process of the LM-OTS algorithm includes:

[0052] (1) A 16-byte string I is randomly generated, and the private key of the LM-OTS algorithm is sk = (otstype, I, q, x). Among them, q is 0, x = (x[0], ..., x[p-1]) is the LM-OTS secret original image array, which is a bit string of length np bytes. The value of p can be determined by the choice of otstype. x[i] is a random bit of n bytes in length. In sk, (otstype, I, q) can be public, while x must be kept confidential. Among them, each x[i], (i = 0, ..., p-1) can be generated randomly and independently, or it can be generated using a pseudo-random function that meets sufficient security strength, which is not limited to the embodiments of the present application.

[0053] (2) Based on the private key sk = (otstype, I, q, x), K is calculated as follows:

[0054]

[0055] The above calculation method is a for loop; the brackets after for contain the results of initializing parameters i and j and the loop condition; u32str(q) represents the 32-bit representation of integer q, u16str(i) represents the 16-bit representation of integer i, and u8str(j) represents the 8-bit representation of integer j. The public key of the LM-OTS algorithm is finally calculated as pk=(otstype, I, q, K).

[0056] Specifically, the signature algorithm of the LM-OTS algorithm involves the verification algorithm Cksm. In the Cksm algorithm, for a string S of length n bytes, Cksm(S) is a 16-bit string, and its calculation method is as follows:

[0057] sum=0

[0058] for(i=0;i<8*n / w;i=i+1){

[0059] sum=sum+(2^w-1)-coef(S,i,w)

[0060] }

[0061] Cksm(S)=u16str(sum<<γ)

[0062] Among them, coef(S, i, w) represents the integer corresponding to the i-th w-bit string of the byte string S, sum<<γ means that sum is shifted to the left by γ bits, and γ is uniquely determined by n and w.

[0063] In the signature algorithm, the signer performs the following steps to calculate the signature of a message M of any length:

[0064] (1) Randomly generate a byte string C of length n, and calculate Q = H(I||u32str(q)||0x8181||C||M) based on M, I, q, C and hash function H;

[0065] (2) Based on Q and w, S = Q||Cksm(Q) is calculated based on the verification algorithm Cksm;

[0066] (3) Based on the following process, S calculates the signature lmots_sig of the message M:

[0067] a)for(i=0;i <p;i=i+1){

[0068] a=coef(S,i,w)

[0069] tmp=x[i]

[0070] for(j=0; j <a;j=j+1){

[0071] tmp=H(I||u32str(q)||u16str(i)||u8str(j)||tmp)

[0072] }

[0073] z[i]=tmp

[0074] }

[0075] b)lmots_sig=otstype||C||z[0]||...||z[p-1]

[0076] In the verification algorithm, the verifier performs the following steps:

[0077] (1) Based on the message M and its signature lmots_sig, calculate Q'=H(I||u32str(q)||0x8181||C||M);

[0078] (2) Calculate S' = Q'||Cksm(Q');

[0079] (3) K' is calculated from S' based on the following process:

[0080] for(i=0;i <p;i=i+1){

[0081] a=coef(S',i,w)

[0082] tmp=z[i]

[0083] for(j=a;j<2^w-1,j+1){

[0084] tmp=H(I||u32str(q)||u16str(i)||u8str(j)||tmp)

[0085] }

[0086] z'[i]=tmp

[0087] }

[0088] K'=H(I||q||0x8080||z'[0]||...||z'[p-1])

[0089] (4) If K'=K, the verification succeeds; otherwise, the verification fails.

[0090] The following describes the implementation process of key generation, signing, and signature verification involved in the LMS algorithm.

[0091] The LMS algorithm is a finite-time digital signature algorithm based on a hash function. It organizes 2 h LM-OTS public-private key pairs, a total of 2 h In this algorithm, lmstype represents a four-byte string, whose value is determined by the number of output bytes n of the hash function H and the height h of the LMS tree.

[0092] Specifically, the key generation process of the LMS algorithm includes:

[0093] (1) Randomly generate a 16-byte string I;

[0094] (2) Generate 2 h The secret preimage array x of the LM-OTS private key is x = {x0,...,x {2^h-1}}, where x i =(x i [0],…,x i [p-1])(each x i It can be generated randomly and independently, or it can be generated by a pseudo-random function that meets sufficient security strength, which is not restricted here). The private key of LMS is sk = (lmstype, otstype, I, q, x), where q is an integer and the initial state is 0;

[0095] (3) The private key of LMS corresponds to 2 h LM-OTS private key (otstype, I, q, x q ), where 0≤q≤2 h , using the method of calculating the LM-OTS public key from the LM-OTS private key to obtain 2 h LM-OTS public key (otstype, I, q, K q );

[0096] (4) Using the above 2 h LM-OTS public key to construct a tree with 2 h A perfect binary tree with leaf nodes (called an LMS tree), such as Figure 1 As shown, each node of the tree is numbered in sequence, T[1] represents the root node, (T[2 h ],...,T[2 h+1 -1]) is a leaf node, and the value of each node can be calculated according to the following formula, where r is an integer:

[0097]

[0098] (5) The public key of LMS is pk = (lmstype,otstype,I,T[1]).

[0099] The signature process of the LMS algorithm includes: assuming that x = {x0, ..., x {2^h-1}} corresponding to the qth LM-OTS private key (otstype, I, q, x q ) To sign any long message M, the signer performs the following steps:

[0100] (1) According to (otstype,I,q,x q ) Calculate the signature result lmots_sig of message M according to the LM-OTS signature process;

[0101] (2) Select h nodes with heights h, h-1, ..., 1 and record them as path[0], path[1], ..., path[h-1], so that the LM-OTS private key (otstype, I, q, x q ) corresponding to the public key (otstype,I,q,K q ) and path = (path[0], path[1], ..., path[h-1]) can calculate the root node T[1] (such as Figure 2As shown: Taking the LMS tree with h=3 as an example, when q=1, path=(T[8],T[5],...,T[3])). The signature of the signed message M is lms_sig=(u32str(q),lmots_sig,lmstype,path);

[0102] (3) After the calculation is completed, the private key of LMS is updated to (lmstype,otstype,I,q+1,x).

[0103] In the verification algorithm, the verifier performs the following steps:

[0104] (1) According to M and lmots_sig and q in lms_sig, combined with the verification method of LM-OTS, the qth leaf node T'[2 h +q];

[0105] (2) Using T'[2 h +q] and path path are calculated based on the formula T[r] to obtain T'[1];

[0106] (3) If T'[1] = T[1], the verification succeeds; otherwise, the verification fails.

[0107] The following is an explanation of the key generation and signature implementation process involved in the LM-OTS collaborative signature scheme. In the collaborative key generation phase, the client and server each generate a portion of the LM-OTS secret preimage array as part of their own private key component. The collaborative key generation process of the client and server is as follows.

[0108] The client performs the following steps:

[0109] (1) The randomly generated length is Byte bit string and the bit string I, whose private key component is sk c_ots =(otstype, I, q, x c_ots );

[0110] (2) Using x c_ots and other selected parameters, according to the calculation process a) of step (2) of the LM-OTS key generation algorithm above, the length is calculated to be Byte bit string Then get its public key component pk c_ots =(otstype, I, q, y c_ots );

[0111] (3) The client converts (H, w, I, y c_ots ) is sent to the server.

[0112] The server performs the following steps:

[0113] (1) Receive (H, w, I, y) from the client c_ots ), the output length n of H can be known from the hash algorithm H, and then the randomly generated length is Byte bit string Since H, n, and w can determine a unique otstype, we can get otstype, and then get its private key component sk s_ots =(otstype, I, q, x s_ots );

[0114] (2) Using x s_ots and other known parameters, according to the calculation process a) of step (2) of the LM-OTS key generation algorithm, the length is calculated to be Byte bit string

[0115] Then get its public key component pk s_ots =(otstype,I,q,y s_ots );

[0116] (3) y s_ots Sent to the client.

[0117] Afterwards, the client and server are based on (I, q, y c_ots ,y s_ots ) can be obtained according to the calculation process c) of step (2) of the LM-OTS key generation algorithm, according to the following formula: K = H(I||u32str(q)||0x8080||y) = H(I||u32str(q)||0x8080||y c_ots ||y s_ots ). Finally, we get the LM-OTS public key pk ots =(otstype,I,q,K).

[0118] In the LM-OTS collaborative signing phase, the client and the server respectively use their own private key components sk c_ots and sk s_ots Combined with other parameters to calculate the collaborative signature component z c_ots and z s_ots , and the final signature result is formed through message passing between the two parties.

[0119] Specifically, in the LM-OTS collaborative signing phase, the client and server perform the following steps:

[0120] (1) The client uses the message to be signed M to execute steps (1-2) of the LM-OTS signature algorithm to obtain S, and sends S to the server;

[0121] (2) The server obtains S from the client and the server private key component And the known w is calculated according to the calculation process of step (3) of the LM-OTS signature algorithm And z s_ots Send to the client;

[0122] (3) The client consists of S, w, and the client private key According to the calculation process of step (3) of the LM-OTS signature algorithm, it is calculated And combined with the server data s_ots The final signature result is: lmots_sig = otstype||C||z c_ots ||z s_ots =otstype||C||z[0]||...||z[p-1].

[0123] The following is combined with Figure 3 The overall composition structure of the collaborative key generation and collaborative signature system based on LMS provided by some embodiments of the present application is exemplified.

[0124] like Figure 3 As shown, some embodiments of the present application provide a collaborative key generation and collaborative signature system based on LMS, and the collaborative key generation and collaborative signature system based on LMS includes: a client 100 and a server 200. The client 100 and the server 200 can first generate the corresponding client LMS collaborative private key component, the server LMS collaborative private key component and the LMS collaborative public key through interaction. Then, the client LMS collaborative signature component and the server LMS collaborative signature component are calculated by combining the client LMS collaborative private key component and the server LMS collaborative private key component with other parameters to achieve collaborative signing of the signed message. It should be noted that Figure 3 In addition to the two ends listed, the system shown can also execute the following method embodiments between multiple participants (more than two parties). The execution principle is the same as the following embodiments. For ease of understanding, the following is an illustrative explanation using the interaction between the two ends as an example.

[0125] In addition, the HSS algorithm is also a tree structure of multi-layer LMS tree cascades, and the method based on this application can also construct a collaborative HSS signature scheme, and the specific principle is similar to the following method embodiment. It should be understood that the embodiment of this application is not limited to this.

[0126] The following is combined with Figure 4 The implementation process of LMS-based collaborative key generation performed by a terminal provided by some embodiments of the present application is exemplarily described, wherein the terminal may be a client 100 or a server 200 .

[0127] Please see attached Figure 4 , Figure 4 A flow chart of a method for collaborative key generation based on LMS is provided for some embodiments of the present application. The method for collaborative key generation based on LMS may include: S410, obtaining a client public key component, and obtaining a server public key component; wherein the client public key component is related to a client private key component parameter in a client LMS collaborative private key component; wherein the server public key component is related to a server private key component parameter in a server LMS collaborative private key component. S420, calculating the client public key component and the server public key component to obtain a plurality of collaborative public key elements. S430, obtaining an LMS collaborative public key based on the plurality of collaborative public key elements.

[0128] For example, in some embodiments of the present application, in the early stage, the client public key component y c_lms and the server public key component y s_lms After the preparation is completed, the final LMS collaborative public key pk lms It may be calculated on the client 100 or on the server 200.

[0129] Specifically, the terminal can solve K according to the above formula based on y c_lms and s_lms Calculated to be 2 h LM-OTS collaborative signature public key elements (K0,...,K i ...,K 2^h-1 ) (as a specific example of multiple collaborative public key elements), where K i =H(I||u32str(q)||0x8080||y c_ots_i ||y s_ots_i ). Then, T[1] can be calculated by solving the formula for T[r] in the above text. Finally, the LMS signature public key pk of the LMS collaboration solution lms =(lmstype,otstype,I,T[1]).

[0130] In some embodiments of the present application, when the terminal is the client 100, S410 may include: receiving the server public key component sent by the server.

[0131] For example, in some embodiments of the present application, when pk is finally generated on the client 100 lms When the server 200 gets y s_lms Then it can be sent to the client 100.

[0132] The following is an example of the client public key component y c_lmsand the server public key component y s_lms The acquisition process.

[0133] In some embodiments of the present application, the client public key component y c_lms The client 100 executes the following method to obtain:

[0134] S401, the client randomly generates a bit string and the client private key component parameters.

[0135] For example, in some embodiments of the present application, the client 100 randomly generates a bit string I and a client private key component parameter x c_lms , x c_lms =(x c,0 ,...,x c,i ,...,x c,2h-1 ),in,

[0136] S402, the client determines the client LMS collaborative private key component based on the bit string, the client private key component parameters, the hash function and the tree height.

[0137] For example, in some embodiments of the present application, based on other selected parameters, such as hash function H and tree height h, combined with I and x c_lms , determine the client LMS collaborative private key component sk of client 100 c_lms For sk c_lms =(lmstype,otstype,I,q,x c_lms ), where q is an integer and its initial value is 0.

[0138] S403, the client calculates the client private key component parameters and the selected parameters to obtain the client public key component, wherein the client public key component includes multiple LM-OTS client public key component elements.

[0139] For example, in some embodiments of the present application, using x c_lms and other selected parameters, according to the calculation process a) of step (2) of the LM-OTS key generation algorithm above, the client's client public key component y is calculated c_lms , which includes 2 h LM-OTS client public key component elements (as a specific example of multiple LM-OTS client public key component elements.

[0140] Specifically, c_lms =(y c_ ots_0,...,y c_ ots_i,...,y c_ots_2h-1 ).

[0141] In some embodiments of the present application, the server public key component y s_lms It is obtained by executing the following method on the server 200:

[0142] S404, the server receives the target parameters sent by the client, wherein the target parameters include: the client public key component, hash function, tree height, bit string and fixed parameters.

[0143] For example, in some embodiments of the present application, the client 100 can c_lms ) (as a specific example of a target parameter) is sent to the server 200.

[0144] S405, the server generates the server private key component parameters and the server LMS collaborative private key component through the target parameters.

[0145] For example, in some embodiments of the present application, the server 200 randomly generates a server private key component parameter x based on the target parameter. s_lms , in, Based on other known parameters, the server-side LMS collaborative private key component sk s_lms :sk s_lms =(lmstype,otstype,I,q,x s_lms ), where q is an integer and its initial value is 0.

[0146] S406, the server calculates the server private key component parameter and the selected parameter to obtain the server public key component, wherein the server public key component includes multiple LM-OTS server public key component elements.

[0147] For example, in some embodiments of the present application, using x s_lms and other selected parameters, according to the calculation process a) of step (2) of the LM-OTS key generation algorithm above, the server public key component y of the server 200 is calculated. s_lms , which includes 2 h LM-OTS server public key component elements (as a specific example of multiple LM-OTS server public key component elements.

[0148] Specifically,

[0149] It can be seen from the above embodiments that in the collaborative key generation stage of LMS, the client and the server can generate LMS collaborative keys based on different splitting methods of the LM-OTS secret original image array. In the collaborative key generation stage, the client 100 and the server 200 can perform a variety of different splitting methods on the LM-OTS secret original image array. For example, in addition to the splitting methods provided in the above embodiments, it can also include:

[0150] For example, x c_i =(x i [0],x i [2],x i [4],...,x i [p-2] / x i [p-1])(p is even / odd);

[0151] x s_i =(x i [1],x i [3],x i [5],...,x i [p-1] / x i [p-2])(p is an even number / odd number).

[0152] In practical applications, the splitting method of the LM-OTS secret pre-image array can be selected according to actual conditions, and the embodiments of the present application are not specifically limited here.

[0153] The following is combined with Figure 5 The specific process of LMS-based collaborative signature performed by a terminal provided in some embodiments of the present application is exemplarily described, wherein the terminal may be a client 100 or a server 200 .

[0154] Please see attached Figure 5 , Figure 5 A flowchart of a collaborative signature method based on LMS is provided for some embodiments of the present application. The collaborative signature method based on LMS may include:

[0155] S510, obtain the client LMS collaborative signature component, and obtain the server LMS collaborative signature component; wherein the client LMS collaborative signature component is related to the client LMS collaborative private key component, and the server LMS collaborative signature component is related to the server LMS collaborative private key component.

[0156] For example, in some embodiments of the present application, when performing collaborative signing, it is first necessary to obtain the collaborative signature component, wherein the client LMS collaborative signature component z c_qc It is through sk c_lms Calculated; server-side LMS collaborative signature component zs_qs It is through sk s_lms Calculated.

[0157] In some embodiments of the present application, when the terminal is the client 100, S510 may include: receiving a server-side LMS collaborative signature component sent by the server.

[0158] For example, in some embodiments of the present application, when the client 100 is finally signed, the server 200 obtains z s_qs Then it can be sent to the client 100.

[0159] The following is an example of the client LMS collaborative signature component z c_qc Collaborate with the server LMS to sign component z s_qs The acquisition process.

[0160] In some embodiments of the present application, the client LMS cooperates with the signature component z c_qc The client 100 executes the following method to obtain:

[0161] S501: The client calculates the message to be signed to obtain signature parameters.

[0162] For example, in some embodiments of the present application, the client 100 executes steps (1-2) of the above LM-OTS signature algorithm to obtain the signature parameter S.

[0163] S502, the client obtains the client LMS collaborative signature component based on the signature parameters, fixed parameters and private key component array elements corresponding to the client status value.

[0164] For example, in some embodiments of the present application, the client 100 has a known S, a fixed parameter w, and a secret original image array element x corresponding to the client state value qc. c,qc (i.e. x c_lms ), using the calculation process of step (3) of the LM-OTS signature algorithm, we can calculate z c_qc .

[0165] In some embodiments of the present application, the server LMS cooperates with the signature component z s_qs It is obtained by executing the following method on the server 200:

[0166] S503: The server receives the signature parameter and the client status value sent by the client.

[0167] For example, in some embodiments of the present application, the client 100 sends S and qc to the server 200.

[0168] S504. The server determines the server LMS collaborative signature component by comparing the client status value with the server status value.

[0169] For example, in some embodiments of the present application, the server 200 can compare qc with its current server status value qs to determine z s_qs The acquisition method.

[0170] In some embodiments of the present application, S504 may include: when the client status value is greater than the server status value and the difference between the client status value and the server status value belongs to a preset range, and the server status value is updated to the client status value, or when the client status value is equal to the server status value, based on the signature parameter, the fixed parameter, and the private key component array element corresponding to the server status value, the server LMS collaborative signature component is obtained.

[0171] For example, in some embodiments of the present application, if qc > qs and the difference between qc and qs is within a certain preset range, the server 200 updates qs to qc to synchronize qs with qc. Or when qc = qs, the updated secret preimage array element x s,qs (i.e., x s_lms in the elements), based on the calculation process of step (3) of the LM-OTS signature algorithm, z is calculated s_qs . In addition, if qc < qs, the server 200 returns an error message and qs and terminates this signature. If qc > qs, however, the difference between qc and qs exceeds the preset range, other mechanisms (such as the administrator intervention mechanism) are used for signature.

[0172] Subsequently, after the server 200 sends z s_qs to the client 100, qs is updated, and the update method is to add one to the original basis.

[0173] Through the above embodiments, the client 100 and the server 200 reduce the security problems caused by the private key being misused multiple times by comparing, correcting errors, and synchronizing the status value q during each signature; by restricting the error correction and synchronization window range of the status value q of the client 100 and the server 200 through a preset fixed value (i.e., the preset range), the robustness of the system is improved.

[0174] S520. Sign the message to be signed using the client LMS collaborative signature component and the server LMS collaborative signature component to obtain an initial signature result.

[0175] For example, in some embodiments of the present application, through zc_qc and z s_qs Treat the signature message M as signature, and obtain the signature result lmots_sig of LM-OTS (as a specific example of the initial signature result), lmots_sig = otstype||C||z c,qc ||z s_qs .

[0176] S530, determining a signature authentication path.

[0177] For example, in some embodiments of the present application, taking the terminal as the client 100 as an example, the client 100 can be based on (K0, ..., K i ...,K 2^h-1 ) and the above T[r] formula to obtain 2 h The leaf node value is T = (T[2 h ],...,T[2 h+1 -1]); then calculate the signature authentication path path = (path[0], path[1], ..., path[h-1]) based on T, and use it as part of the final signature result.

[0178] S540, obtaining the LMS signature result through the initial signature result and the signature authentication path.

[0179] For example, in some embodiments of the present application, taking the terminal as the client 100 as an example, the client 100 finally obtains the LMS signature result lms_sig as:

[0180] lms_sig=(u32str(qc),lmots_sig,lmstype,(path[0],path[1],...,path[h-1])).

[0181] In some embodiments of the present application, after executing S540, the LMS-based collaborative signature method further includes: when the terminal is the client, updating the client status value; when the terminal is the server, updating the server status value.

[0182] For example, in some embodiments of the present application, taking the terminal as the client 100, the client 100 updates qc by adding one to the original value. When the terminal is the server 200, the updating principle is the same.

[0183] The following is combined with Figure 6 The specific process of LMS-based collaborative key generation interactively performed by the client 100 and the server 200 provided in some embodiments of the present application is exemplified.

[0184] Please see attached Figure 6 , Figure 6 A flow chart of a method for collaborative key generation based on LMS is provided for some embodiments of the present application.

[0185] The above implementation process is described below by way of example.

[0186] S610, the client 100 randomly generates a bit string I and a client private key component parameter x c_lms .

[0187] S620, the client 100 is based on I, x c_lms , hash function H and tree height h, determine the client LMS collaborative private key component sk c_lms .

[0188] S630, the client 100 uses the LM-OTS key generation algorithm to generate x c_lms Calculate with the selected parameters to get the client public key component y c_lms .

[0189] S640, the client 100 sends the target parameters (H, h, w, I, y c_lms ).

[0190] S650, the server 200 randomly generates a server private key component parameter x based on the target parameter s_lms , and combined with the known parameters to obtain the server-side LMS collaborative private key component sk s_lms .

[0191] S660, the server 200 uses the LM-OTS key generation algorithm to generate x s_lms Calculate with the selected parameters to get the server public key component y s_lms .

[0192] S670, the server 200 sends y to the client 100 s_lms .

[0193] S680, client 100 based on y c_lms and s_lms Calculated to be 2 h LM-OTS collaborative signature public key elements (K0,...,K i ...,K 2^h-1 ).

[0194] S690, the client 100 calculates multiple collaborative public key elements to obtain the LMS collaborative public key pk lms .

[0195] In another embodiment, the collaborative public key pk lmsThe generation of can also be completed by the server 200. It should be noted that the specific implementation process of S610 to S690 can refer to the method embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0196] The following is combined with Figure 7 The specific process of LMS-based collaborative signing interactively performed by the client 100 and the server 200 provided in some embodiments of the present application is exemplified.

[0197] Please see attached Figure 7 , Figure 7 A flow chart of a collaborative signature method based on LMS is provided for some embodiments of the present application.

[0198] The above implementation process is described below by way of example.

[0199] S710, the client 100 calculates the message M to be signed and obtains a signature parameter S.

[0200] S720, the client 100 sends S and the client status value qc to the server 200.

[0201] S730, the server 200 compares qc with the server status value qs to determine the server LMS collaborative signature component z s_qs .

[0202] S740, the server 200 sends z to the client 100 s_qs , and update qs.

[0203] S750, the client 100 calculates the secret original image array element x corresponding to S, w and qc. c,qc , calculate z c_qc .

[0204] S760, the client 100 uses z s_qs and z c_qc , sign M and obtain the initial signature result lmots_sig.

[0205] S770, the client 100 determines the signature authentication path.

[0206] S780, the client 100 obtains the LMS signature result through the initial signature result and the signature authentication path.

[0207] In another embodiment, the acquisition of the LMS signature result can also be completed by the server 200. That is, the client can first obtain z c_qc , and sent to the server 200, the server 200 calculates z s_qs Then, combine z c_qc, sign M, obtain the initial signature result, and then determine the signature authentication path to synthesize the LMS signature result. It should be noted that the specific implementation process of S710 to S780 can refer to the method embodiment provided above. To avoid repetition, the detailed description is appropriately omitted here.

[0208] Through some of the embodiments of the present application described above, it can be known that the present application implements the LMS collaborative signature scheme, including collaborative key generation and collaborative signature. The construction of the scheme does not change the structure of the LMS algorithm. The messages related to the private key transmitted between the client and the server are the results of multiple hash iterations of the private key. The one-way nature of the hash function ensures that it will not destroy the security of the private key; the LMS collaborative signature scheme reduces the algorithm security threats caused by client key security issues. In the LMS collaborative signature scheme, the state value q of the private key is jointly controlled by the client and the server. Each time the client and the server sign, they will perform comparison, error correction and synchronization of the state q, reducing the risk of multiple misuse of the private key.

[0209] Please refer to Figure 8 , Figure 8 The block diagram of the composition of the device for collaborative key generation based on LMS provided by some embodiments of the present application is shown. It should be understood that the device for collaborative key generation based on LMS corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the device for collaborative key generation based on LMS can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0210] Figure 8 The device for collaborative key generation based on LMS includes at least one software functional module that can be stored in a memory in the form of software or firmware or solidified in the device for collaborative key generation based on LMS. The device for collaborative key generation based on LMS includes: a first acquisition module 810, configured to obtain a client public key component and a server public key component; wherein the client public key component is related to a client private key component parameter in a client LMS collaborative private key component; wherein the server public key component is related to a server private key component parameter in a server LMS collaborative private key component; a calculation module 820, configured to calculate the client public key component and the server public key component to obtain a plurality of collaborative public key elements; and a generation module 830, configured to obtain an LMS collaborative public key based on the plurality of collaborative public key elements.

[0211] Please refer to Fig. 9 , Fig. 9The block diagram of the composition of the collaborative signature device based on LMS provided by some embodiments of the present application is shown. It should be understood that the collaborative signature device based on LMS corresponds to the above method embodiment and can execute each step involved in the above method embodiment. The specific functions of the collaborative signature device based on LMS can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0212] Fig. 9 The collaborative signature device based on LMS includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the collaborative signature device based on LMS. The collaborative signature device based on LMS includes: a second acquisition module 910, configured to obtain a client LMS collaborative signature component and a server LMS collaborative signature component; wherein the client LMS collaborative signature component is related to the client LMS collaborative private key component, and the server LMS collaborative signature component is related to the server LMS collaborative private key component; a first signature module 920, configured to use the client LMS collaborative signature component and the server LMS collaborative signature component to sign the signature message to obtain an initial signature result; a determination module 930, configured to determine a signature authentication path; a second signature module 940, configured to obtain an LMS signature result through the initial signature result and the signature authentication path.

[0213] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0214] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0215] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0216] like Fig.10 As shown, some embodiments of the present application provide an electronic device 1000, which includes: a memory 1010, a processor 1020, and a computer program stored in the memory 1010 and executable on the processor 1020, wherein the processor 1020 can implement a method as described in any of the above embodiments when reading the program from the memory 1010 through a bus 1030 and executing the program.

[0217] Processor 1020 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 1020 can be a microprocessor.

[0218] The memory 1010 may be used to store instructions executed by the processor 1020 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 1020 of the disclosed embodiment may be used to execute instructions in the memory 1010 to implement the method shown above. The memory 1010 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0219] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0220] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0221] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for collaborative key generation based on LMS, characterized in that: Applied to a terminal, the terminal being a client or a server, the method comprises: Obtain a client public key component and a server public key component; wherein the client public key component is related to a client private key component parameter in the client LMS collaborative private key component; and the server public key component is related to a server private key component parameter in the server LMS collaborative private key component; Calculating the client public key component and the server public key component to obtain a plurality of collaborative public key elements; Based on the multiple collaborative public key elements, the LMS collaborative public key is obtained.

2. The method according to claim 1, characterized in that The terminal is the client, wherein obtaining the server public key component includes: Receive the server public key component sent by the server.

3. The method according to claim 1 or 2, characterized in that The client public key component is obtained by the following method: The client randomly generates a bit string and the client private key component parameters; The client determines the client LMS collaborative private key component based on the bit string, the client private key component parameters, the hash function and the tree height; The client calculates the client private key component parameter and the selected parameter to obtain the client public key component, wherein the client public key component includes multiple LM-OTS client public key component elements.

4. The method according to claim 3, characterized in that The server public key component is obtained by the following method: The server receives the target parameters sent by the client, wherein the target parameters include: the client public key component, hash function, tree height, bit string and fixed parameters; The server generates the server private key component parameters and the server LMS collaborative private key component through the target parameters; The server calculates the server private key component parameter and the selected parameter to obtain the server public key component, wherein the server public key component includes multiple LM-OTS server public key component elements.

5. A collaborative signature method based on LMS, characterized in that: Applied to a terminal, the terminal being a client or a server, the method comprises: Obtain the client LMS collaborative signature component and the server LMS collaborative signature component; wherein the client LMS collaborative signature component is related to the client LMS collaborative private key component, and the server LMS collaborative signature component is related to the server LMS collaborative private key component; Sign the signature message using the client LMS collaborative signature component and the server LMS collaborative signature component to obtain an initial signature result; Determine the signature authentication path; The LMS signature result is obtained through the initial signature result and the signature authentication path.

6. The method according to claim 5, characterized in that When the terminal is the client, the obtaining of the server-side LMS collaborative signature component includes: Receive the server-side LMS collaborative signature component sent by the server.

7. The method according to claim 5 or 6, characterized in that The client LMS collaborative signature component is obtained by the following method: The client calculates the message to be signed to obtain signature parameters; The client obtains the client LMS collaborative signature component based on the signature parameters, fixed parameters and private key component array elements corresponding to the client status value.

8. The method according to claim 7, characterized in that The server-side LMS collaborative signature component is obtained by the following method: The server receives the signature parameter and the client status value sent by the client; The server determines the server-side LMS collaborative signature component by comparing the client status value with the server status value.

9. The method according to claim 8, characterized in that The server determines the server LMS collaborative signature component by comparing the client status value with the server status value, including: When the client status value is greater than the server status value and the difference between the client status value and the server status value is within a preset range, the server status value is updated to the client status value; or, when the client status value is equal to the server status value, the server LMS collaborative signature component is obtained based on the signature parameters, fixed parameters and the private key component array elements corresponding to the server status value.

10. The method according to claim 8, characterized in that After obtaining the LMS signature result through the initial signature result and the signature authentication path, the method further includes: When the terminal is the client, updating the client status value; When the terminal is the server, the server status value is updated.

11. A collaborative key generation device based on LMS, characterized in that: Applied to a terminal, the terminal being a client or a server, the device comprises: A first acquisition module is configured to acquire a client public key component and a server public key component; wherein the client public key component is related to a client private key component parameter in a client LMS collaborative private key component; and the server public key component is related to a server private key component parameter in a server LMS collaborative private key component; A calculation module, configured to calculate the client public key component and the server public key component to obtain a plurality of collaborative public key elements; The generation module is configured to obtain the LMS collaborative public key based on the multiple collaborative public key elements.

12. A collaborative signature device based on LMS, characterized in that: Applied to a terminal, the terminal being a client or a server, the device comprises: A second acquisition module is configured to acquire a client LMS collaborative signature component and a server LMS collaborative signature component; wherein the client LMS collaborative signature component is related to the client LMS collaborative private key component, and the server LMS collaborative signature component is related to the server LMS collaborative private key component; The first signature module is configured to sign the signature message using the client LMS collaborative signature component and the server LMS collaborative signature component to obtain an initial signature result; a determination module configured to determine a signature authentication path; The second signature module is configured to obtain the LMS signature result through the initial signature result and the signature authentication path.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 10 when executed by a processor.

14. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 10 when being run by the processor.

15. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 10 when executed by a processor.

Images