Anti-quantum-attack key generation method, device and equipment and medium

Abstract

The invention discloses an anti-quantum-attack key generation method and device, equipment and a medium, which are used for improving the key generation efficiency and further improving the digital signature efficiency. The method provided by the invention comprises the following steps: determining a one-time signature type value; and respectively determining a first parameter and a second parameter used for generating a private key, generating a random number of a preset byte number, and taking the random number as a secret seed, further generating a plurality of first messages based on the one-time signature type value, a first parameter, a second parameter and a secret seed; grouping the plurality of first messages according to parameters used for representing the parallel processing capability of a preset hash function; for the first messages in each group, determining hash values corresponding to the first messages in the group in parallel by adopting the preset hash function; then, utilizing a hash value corresponding to each first message to obtain a first secret original image array; and generating a private key by using the first secret original image array.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a quantum attack-resistant key generation method, device, equipment and medium. Background Art

[0002] With the development of informatization and computer technology, while people are enjoying the many benefits brought by informatization, network security issues have become a common challenge faced by mankind in the information age. In order to resist the threat of quantum computers, quantum-resistant cryptographic algorithms are designed to remain secure even when quantum computers are widely available. The Leighton-Micali signature system (including key generation, signature generation, and signature verification) is one of them. It is a digital signature scheme based on hash functions.

[0003] The Leighton-Micali signature system is a digital signature scheme based on a hash function. This signature system belongs to the One-Time Signature (OTS) scheme, so it is referred to as LM-OTS signature. LM-OTS signature includes three aspects: key generation, signature generation, and signature verification. In LM-OTS signature, each private key can only be used to sign one message (i.e. plaintext) and generate a signed message (i.e. ciphertext).

[0004] In signature schemes based on the LM-OTS algorithm, for example, the LMS, XMSS signature systems, and their variants, such as HSS and XMSSMT, a large number of LM-OTS public and private keys are required, which requires a large number of hash operations, which greatly reduces the efficiency of public and private key generation.

[0005] For example, in a performance test on a 2.9GHz AMD EPYC-ROME server with 32 cores, when the HSS-SM3 algorithm takes the Winternitz parameter w=8, an LMS-SM3 instance with a height of h=20 takes 928.21 seconds to generate the public and private keys. It can be seen that the key generation speed is very slow. Summary of the invention

[0006] The embodiments of the present application provide a quantum attack-resistant key generation method, apparatus, device, and medium to improve the efficiency of key generation and thereby improve the efficiency of digital signatures.

[0007] An embodiment of the present application provides a quantum attack-resistant key generation method, comprising:

[0008] determining a one-time signature type value; and,

[0009] respectively determining a first parameter and a second parameter for generating a private key;

[0010] Generate a random number of a preset number of bytes, and use the random number as a secret seed;

[0011] Generate a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter and the secret seed;

[0012] Grouping the plurality of first messages according to a parameter used to represent a parallel processing capability of a preset hash function;

[0013] For the first message in each group, using the preset hash function to determine in parallel the hash values ​​corresponding to the first messages in the group;

[0014] Obtaining a first secret pre-image array using a hash value corresponding to each of the first messages;

[0015] Generate a private key using the first secret pre-image array.

[0016] In the quantum attack-resistant key generation method provided in the embodiment of the present application, a one-time signature type value is determined; and a first parameter and a second parameter for generating a private key are respectively determined to generate a random number of preset bytes, and the random number is used as a secret seed; thereby, multiple first messages can be further generated based on the one-time signature type value, the first parameter, the second parameter and the secret seed; and the multiple first messages are grouped according to a parameter used to represent the parallel processing capability of a preset hash function; for the first messages in each group, the preset hash function is used to determine in parallel the hash values ​​corresponding to the first messages in the group, thereby improving the hash calculation efficiency; then, a first secret pre-image array is obtained using the hash value corresponding to each of the first messages; and a private key is generated using the first secret pre-image array. Therefore, the method provided in the embodiment of the present application improves the private key generation efficiency, thereby improving the efficiency of the quantum-resistant signature scheme based on the LM-OTS algorithm.

[0017] In some embodiments, the number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function;

[0018] The method further comprises:

[0019] When the number of the plurality of first messages cannot be divided by T, for the last group, where the number of first messages in the last group is less than T, the hash value corresponding to each first message in the group is determined in the following first preset manner:

[0020] Using preset data, generating a padded first message so that the group includes T first messages;

[0021] Using the preset hash function to determine in parallel the hash value corresponding to each first message in the group;

[0022] Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

[0023] It can be seen that for the last group, by means of the filled first message, a preset hash function can be used to determine in parallel the hash values ​​corresponding to the first messages in the last group, thereby realizing parallel processing of the hash values ​​corresponding to the first messages in the last group, and further improving the calculation efficiency.

[0024] In some embodiments, the method further comprises:

[0025] Compare the number of first messages in the last group with 1 and T respectively;

[0026] When it is determined that the number of first messages in the last group is closer to T, the first preset method is used to determine the hash value corresponding to each first message in the last group.

[0027] It can be seen that by comparing the number of first messages in the last group with 1 and T respectively, when the number of first messages in the last group is large (that is, closer to T), the first preset method can be used to determine the hash value corresponding to each first message in the last group, thereby realizing parallel processing of the hash value corresponding to each first message in the last group and improving computing efficiency.

[0028] In some embodiments, the method further comprises:

[0029] Based on the private key, generating a plurality of second messages;

[0030] The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, the preset hash function is used to determine in parallel a hash value corresponding to each second message in the group;

[0031] Using the hash value corresponding to each of the second messages, a second secret pre-image array is obtained;

[0032] Determine an intermediate parameter for generating a public key using the second secret preimage array;

[0033] A public key is generated using the intermediate parameter, the one-time signature type value, the first parameter, and the second parameter.

[0034] Therefore, the embodiments of the present application can improve the efficiency of generating public keys, thereby improving the efficiency of the quantum-resistant signature scheme based on the LM-OTS algorithm.

[0035] Another quantum attack-resistant key generation method provided in an embodiment of the present application includes:

[0036] Determine the private key;

[0037] Based on the private key, generating a plurality of second messages;

[0038] The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, the preset hash function is used to determine in parallel a hash value corresponding to each second message in the group;

[0039] Using the hash value corresponding to each of the second messages, a second secret pre-image array is obtained;

[0040] Determine an intermediate parameter for generating a public key using the second secret preimage array;

[0041] A public key is generated using the intermediate parameter, as well as the one-time signature type value, the first parameter, and the second parameter used to generate the private key.

[0042] Therefore, similar to the above-mentioned improvement in the efficiency of private key generation, the embodiment of the present application can also improve the efficiency of public key generation alone.

[0043] This will improve the efficiency of the quantum-resistant signature scheme based on the LM-OTS algorithm.

[0044] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0045] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and, for each second message in each group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group, includes:

[0046] For the multiple second messages, the following processing is performed line by line:

[0047] For the p second messages in the current row, the p second messages in the current row are grouped according to a parameter used to represent the parallel processing capability of a preset hash function; for the second messages in each group, the preset hash function is used to determine in parallel the hash values ​​corresponding to the second messages in the group.

[0048] It can be seen that the embodiment of the present application can calculate the hash value of the message row by row, thereby improving the calculation efficiency.

[0049] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0050] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and, for each second message in each group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group, includes:

[0051] Determine a message sequence to be processed based on the second message in the j row and i column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0052] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and, for the second messages in each group, hash values ​​corresponding to the second messages in the group are determined in parallel using the preset hash function.

[0053] It can be seen that the embodiments of the present application can arrange the messages to be hashed in a straight line, that is, arrange them row by row in sequence, to obtain a message sequence to be processed, thereby further improving the computing efficiency.

[0054] An embodiment of the present application provides a quantum attack-resistant key generation device, comprising:

[0055] A one-time signature type value unit, used to determine a one-time signature type value;

[0056] a private key parameter unit, for respectively determining a first parameter and a second parameter for generating a private key;

[0057] A secret seed unit, used to generate a random number of a preset number of bytes, and use the random number as a secret seed;

[0058] A first message unit, configured to generate a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter and the secret seed;

[0059] A first hash calculation unit, configured to group the plurality of first messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each first message in each group, using the preset hash function to determine in parallel a hash value corresponding to each first message in the group;

[0060] A first secret original image array unit, used to obtain a first secret original image array using a hash value corresponding to each of the first messages;

[0061] A private key generation unit is used to generate a private key using the first secret original image array.

[0062] Another quantum attack-resistant key generation device provided in an embodiment of the present application includes:

[0063] A private key determination unit, used to determine a private key;

[0064] A second message unit, used to generate a plurality of second messages based on the private key;

[0065] a second hash calculation unit, configured to group the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in a group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group;

[0066] A second secret original image array unit, used to obtain a second secret original image array using a hash value corresponding to each of the second messages;

[0067] An intermediate parameter unit, used to determine an intermediate parameter for generating a public key using the second secret pre-image array;

[0068] The public key unit is used to generate a public key by using the intermediate parameter, and the one-time signature type value, the first parameter and the second parameter used to generate the private key.

[0069] Another embodiment of the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store program instructions, and the processor is used to call the program instructions stored in the memory and execute any of the above methods according to the obtained program.

[0070] Another embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute any of the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 A schematic diagram of a flow chart of a quantum attack-resistant key generation method provided in an embodiment of the present application;

[0073] Figure 2 A schematic diagram of grouping messages provided in an embodiment of the present application;

[0074] Figure 3 A schematic diagram of a flow chart of another method for generating a key resistant to quantum attacks provided in an embodiment of the present application;

[0075] Figure 4 A schematic diagram of the key generation principle provided in the embodiment of the present application;

[0076] Figure 5 A schematic diagram of a flow chart of a third method for generating a key resistant to quantum attacks provided in an embodiment of the present application;

[0077] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0078] Figure 7 A schematic diagram of the structure of a quantum attack-resistant key generation device provided in an embodiment of the present application;

[0079] Figure 8 A schematic diagram of the structure of another quantum attack-resistant key generation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0080] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0081] The embodiments of the present application provide a quantum attack-resistant key generation method, apparatus, device, and medium to improve the efficiency of key generation and thereby improve the efficiency of digital signatures.

[0082] Among them, the method and the device, equipment, and medium are based on the same application concept. Since the principles of solving problems by the method and the device, equipment, and medium are similar, the implementation of the device, equipment, medium, and method can refer to each other, and the repeated parts will not be repeated.

[0083] The terms "first", "second", etc. (if any) in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than the content illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0084] The following examples and embodiments are to be understood as illustrative examples only. Although this specification may refer to "one", "an" or "some" examples or embodiments in several places, this does not mean that each such reference relates to the same example or embodiment, nor does it mean that the feature applies only to a single example or embodiment. Individual features of different embodiments may also be combined to provide other embodiments. In addition, terms such as "including" and "comprising" should be understood as not limiting the described embodiments to consisting only of those features that have been mentioned; such examples and embodiments may also include features, structures, units, modules, etc. that are not specifically mentioned.

[0085] The following is a detailed description of each embodiment of the present application in conjunction with the accompanying drawings. It should be noted that the display order of the embodiments of the present application only represents the order of the embodiments, and does not represent the advantages and disadvantages of the technical solutions provided by the embodiments.

[0086] The symbols, parameters, and marks involved in the embodiments of this application are described as follows:

[0087] ||: Data concatenation, X||Y means X is on the left and Y is on the right.

[0088] H(): The hash function used.

[0089] n: The number of bytes of the hash value output by the hash function used.

[0090] w: Winternitz parameter, for example, w=1, 2, 4, 8.

[0091] u: The output hash value of the hash function includes u w-bit strings, u = 8n / w.

[0092] v: When signing a message m using the LM-OTS algorithm, a check value about the hash value of m needs to be calculated. v is the number of w bit strings in the check value, which can be calculated as follows:

[0093]

[0094] in, represents the top function of x (taking the smallest integer not less than x), Represents the base function of x (the largest integer not greater than x).

[0095] p: The number of n-byte sequences in the secret preimage array in the private key of the LM-OTS algorithm, where:

[0096] p=u+v;

[0097] γ: During the signature generation process, a check value needs to be shifted left, so γ represents the number of bits shifted left. For example:

[0098] γ=16-vw.

[0099] The embodiments of the present application are intended to improve the efficiency of private key and public key generation, and further improve the efficiency of digital signatures based on, for example, the LM-OTS algorithm, thereby improving the efficiency of public and private key generation and digital signatures of schemes such as the Leighton-Micali signature system (LMS), the XMSS signature system, and their variants HSS and XMSSMT.

[0100] See also Figure 1 , a quantum attack-resistant key generation method provided in an embodiment of the present application includes:

[0101] S101, determining a one-time signature type (i.e., otstype) value;

[0102] For example, the otstype value is determined based on the hash function H() and the Winternitz parameter.

[0103] The otstype value is specified in, for example, standard specifications such as RFC 8554. In other words, the otstype value may be a preset value.

[0104] S102, respectively determining a first parameter and a second parameter for generating a private key;

[0105] Wherein, the first parameter, for example, I value;

[0106] The second parameter, such as a q value;

[0107] If a valid 16-byte I value is input, the input I value is determined as the I value used to generate the private key;

[0108] Otherwise (for example, no I value is entered), a 16-byte random number is generated as the I value.

[0109] The q value is a preset value.

[0110] S103, generating a random number of a preset number of bytes (e.g., n bytes), and using the random number as a secret seed (e.g., expressed as SEED);

[0111] It should be noted that the above three steps S101 to S103 can be executed in parallel without limitation on the order.

[0112] For example, in the private key generation method for LM-OTS signature provided in the embodiment of the present application, the input and output contents are as follows:

[0113] enter:

[0114] H: hash function, the length of the hash value output is n bytes. For example, if the hash function is the SM3 hash algorithm, n is 32 bytes.

[0115] w: Winternitz parameter, which can be 1, 2, 4, or 8. The Winternitz parameter (usually denoted as w) defines the number of times a numeric value is encoded as a hash value. Specifically, it determines how many times the hash function needs to be repeated during the signing process to ensure the security of the signature. In LM-OTS, the Winternitz parameter is a key parameter that determines the size, security, and efficiency of the signature.

[0116] I: a first parameter of a preset number of bytes, for example, a random value of 16 bytes.

[0117] q: a second parameter of a preset number of bytes, for example, a 4-byte value, indicating the number of a node (for example, an OTS module).

[0118] Output:

[0119] Private key (otstype, I, q, x).

[0120] S104, generating a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter and the secret seed;

[0121] The multiple first messages, such as plain text messages m1 to m p .

[0122] It should be noted that in order to distinguish the description from the message in the process of generating a public key, in the embodiment of the present application, the message in the process of generating a private key is referred to as the first message, and the message in the process of generating a public key is referred to as the second message.

[0123] S105, grouping the multiple first messages according to a parameter used to represent a parallel processing capability of a preset hash function;

[0124] For example, if the parameter used to represent the parallel processing capability of the preset hash function is T, the messages m1 to m2 can be processed in a manner that each group includes T first messages. p The messages are grouped in sequence. If the number of first messages is divisible by T, each group contains exactly T first messages. Otherwise, the number of first messages in the last group may be less than T.

[0125] S106. For each first message in each group, using the preset hash function to determine in parallel the hash values ​​corresponding to the first messages in the group;

[0126] That is to say, in order to improve the efficiency of key generation, the hash function fast execution method provided in the embodiment of the present application includes the above steps S105 and S106, which are used to quickly generate hash values ​​of multiple messages.

[0127] For example Figure 2 As shown, assuming that (m1,m2,…,m r ) There are a total of r first messages, then the output after the above two steps is: (md1,md2,…,md r ), where md i =H(m i ),i=1,2,…,r.

[0128] In step S105, according to a preset hash function parallel capability (capability of executing multiple hash function operations simultaneously, i.e., capability of obtaining multiple hash values ​​simultaneously) parameter T, the r first messages are divided into groups, and every T messages are combined into one group. The last group may be a complete group (if r mod T = 0) or may not be a complete group (if r mod T≠0).

[0129] For example, SIMD (Single Instruction Multiple Data) instruction AVX512 can be used to perform hash calculations. The processing capacity of one instruction is 512 bits, and the hash function used is SM3. The processing word length of SM3 is 32 bits. The parameter T used to represent the parallel processing capacity of the hash function is T=512 / 32=16. If the number of first messages to be processed r=100, then r mod T=100mod 16=4≠0, and the last group is an incomplete group containing 4 first messages. If the number of messages r=256, then r mod T=256mod 16=0, and the last group is a complete group containing 16 first messages. Among them, SIMD is a single instruction multiple data stream technology that allows one instruction to operate on multiple data at the same time, thereby improving computing efficiency.

[0130] Then, after the grouping is completed, in step S106, for each complete message in the group, it is recorded as:

[0131] (msg1,msg2,…,msg T );

[0132] SIMD parallel capability T, executes the hash function H (H based on SIMD instructions SIMD ), and calculate the hash values ​​of the T first messages at the same time. For example, if SIMD is AVX512 and the hash function is SM3, the H SIMD SM3 algorithm implemented using AVX512 instructions AVX512 , it can process 16 hash tasks at the same time (there is no interdependence between the tasks), that is, for each group, it outputs the following results (hash values) at the same time:

[0133] (h1,h2,…,h 16 )=SM3 AVX512 (msg1,msg2,…,msg 16 );

[0134] That is to say, in the embodiment of the present application, multiple messages in each group can be processed in parallel, and the hash values ​​corresponding to the messages in the group can be obtained at the same time. Different groups can perform hash calculations in sequence, and of course there is no requirement for the sequence, that is, there may be no need to perform hash calculations in sequence between groups. For example, the private key generation process involves 96 messages, which are divided into 6 groups. It doesn't matter which of the 6 groups performs hash calculations first or later, and it can be determined according to actual needs.

[0135] In some embodiments, the number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function;

[0136] The method further comprises:

[0137] When the number of the plurality of first messages cannot be divided by T, for the last group, where the number of first messages in the last group is less than T, the hash value corresponding to each first message in the group is determined in the following first preset manner:

[0138] Using preset data (which may be filled with any data, such as all-zero data), generating a padded first message, so that the group includes T first messages;

[0139] Using the preset hash function to determine in parallel the hash value corresponding to each first message in the group;

[0140] Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

[0141] In some embodiments, when the number of the plurality of first messages is not divisible by T, for the last group, a second preset method may be used to determine the hash value corresponding to each first message in the group. The second preset method is to calculate the hash value corresponding to each message in the last group one by one.

[0142] In some embodiments, the method further comprises:

[0143] Compare the number of first messages in the last group with 1 and T respectively;

[0144] When it is determined that the number of first messages in the last group is closer to T, the first preset method is used to determine the hash value corresponding to each first message in the last group.

[0145] That is to say, if the number of messages in the last incomplete group is close to the parallel capacity T, the first preset method is preferentially adopted; if the number of messages in the last incomplete group is close to 1, the second preset method is preferentially adopted.

[0146] For example, the last group is incomplete, only 3 messages need to perform hash calculation, and the parallel capability parameter T = 4. Then, fill this group into a complete group, that is, fill 1 data block, ensure that it is the same length as the first three data, and make up 4 data to be hashed, and then use the preset hash function to parallelly calculate the hash value of this complete group of T = 4 messages, and finally discard the hash value corresponding to the filled message, that is, do not need the fourth hash value, and only keep the hash value of the non-filled message, that is, keep the first to third hash values.

[0147] If the last group is incomplete, only one message needs to perform hash calculation, and the parallel capability parameter is T=4, 1 is not close to 4, so it is more appropriate to select the second preset method mentioned above and perform ordinary hash calculation, that is, only the hash value of one data block needs to be calculated.

[0148] In summary, when step S106 is executed, the hash values ​​of all first messages are output:

[0149] (md1,md2,…,md r ).

[0150] S107, obtaining a first secret pre-image array using the hash value corresponding to each of the first messages;

[0151] S108. Generate a private key using the first secret original image array.

[0152] For example, if the input of step S105 includes the following message:

[0153] m1=I||u8str(q)||u16str(0)||0xFF||SEED,

[0154] m2=I||u8str(q)||u16str(1)||0xFF||SEED,

[0155] …

[0156] m p =I||u8str(q)||u16str(p-1)||0xFF||SEED.

[0157] The output of step S106 includes the following hash values ​​corresponding to each message:

[0158] x[0]=H(m1),

[0159] x[1]=H(m2),

[0160] …

[0161] x[p-1]=H(m p ).

[0162] Then, the secret original image array of LM-OTS generated in step S107 is as follows:

[0163] x=(x[0],x[1],…,x[p-1]);

[0164] in:

[0165] x[j]=H(I||u8str(q)||u16str(j)||0xFF||SEED), j=0,1,…,p-1.

[0166] For example, if the Winternitz parameter w in the embodiment of the present application is 8, the output hash value of the hash function SM3 includes u=8n / w=32 w=8-bit strings, and the number of w=8-bit strings in the check value is v=2. Then, in the private key of LM-OTS, the number of n=32 byte sequences in the secret original image array is p=u+v=34.

[0167] Finally, step S108 generates and outputs the private key of LM-OTS using the secret original image array:

[0168] (otstype,I,q,x).

[0169] In some embodiments, see Figure 3 , the method further comprises:

[0170] S109, generating multiple second messages based on the private key;

[0171] See also Figure 4 For example, in the private key (otstype, I, q, x), x = (x[0], x[1], ..., x[p-1]), then based on the private key, the generated multiple second messages include: m 0,0 ~m2 w -1,p-1 , that is, a total of 2 w Multiply by p second messages.

[0172] That is to say, Figure 4 As shown, the second message used to generate the public key includes the second message of row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret preimage arrays corresponding to the private key, and w is a preset value, namely the Winternitz parameter, which can be 1, 2, 4, or 8, for example;

[0173] S110, grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in the group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group;

[0174] That is to say, similar to steps S105 and S106 in the above-mentioned process of generating a private key, in the process of generating a public key, the embodiment of the present application may also first group the input messages, and for the messages in each group, use a preset hash function to determine the hash values ​​corresponding to the messages in the group in parallel.

[0175] S111, using the hash value corresponding to each of the second messages, obtaining a second secret pre-image array;

[0176] The second secret pre-image array, for example, y=(y[0], y[1], ..., y[p-1]).

[0177] S112, using the second secret pre-image array, determining an intermediate parameter for generating a public key;

[0178] The intermediate parameter, i.e., the K value required to calculate the public key, is, for example:

[0179] K=H(I||u32str(q)||0x8080||y[0]||y[1]||…||y[p-1]);

[0180] Among them, I and q use the relevant values ​​of the private key, that is, the first parameter and the second parameter respectively.

[0181] S113. Generate a public key using the intermediate parameter, the one-time signature type value, the first parameter, and the second parameter.

[0182] For example, generate and output the public key of LM-OTS:

[0183] (otstype,I,q,K);

[0184] Among them, otstype, I, and q use the relevant values ​​of the private key.

[0185] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0186] The step S110 includes:

[0187] For the multiple second messages, the following processing is performed line by line:

[0188] For the p second messages in the current row, the p second messages in the current row are grouped according to a parameter used to represent the parallel processing capability of a preset hash function; for the second messages in each group, the preset hash function is used to determine in parallel the hash values ​​corresponding to the second messages in the group.

[0189] That is, in one embodiment, the hash value may be calculated row by row, for example, see Figure 4 , complete the hash calculation in the first row of dotted boxes, then perform the hash calculation in the second row of dotted boxes, and so on. Iteration 2 is required w -1 hash calculation (i.e. numbering from 0 to 2 w -2, total 2 w -1 hash calculation), each time the hash value of a line of messages (p messages per line) is calculated.

[0190] Among them, for any row (j is used to identify the row), the p plaintext messages (m j,0 ,m j,1 ,…,m j,p-1 ), the current j (0<=j<2 w -1) line of p second messages (m j,0 ,m j,1 ,…,m j,p-1 ) for grouping; for the second messages in each group, a preset hash function is used to determine in parallel the hash values ​​corresponding to the second messages in the group.

[0191] Among them, any plaintext m j,i =I||u32str(q)||u16str(i)||u8str(j)||tj,i , where 0<=i <p;

[0192] The HASH value of p plaintext messages in any j rows is:

[0193] (t j+1,0 ,t j+1,1 ,…,t j+1,p-1 )=(H(m j,0 ),H(m j,1 ),…,H(m j,p-1 )).

[0194] Calculate the hash value of the message in each row one by one, and finally get the hash value of all messages in all rows.

[0195] Then, let Among them, i=0,1,…,p-1, and the second secret pre-image array is obtained, that is, y=(y[0],y[1],…,y[p-1]).

[0196] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0197] The step S110 includes:

[0198] Determine a message sequence to be processed based on the second message in the j row and i column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0199] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and, for the second messages in each group, hash values ​​corresponding to the second messages in the group are determined in parallel using the preset hash function.

[0200] That is, see for example Figure 4 In some embodiments, Figure 4 Arrange the messages to be hashed in the sequence, that is, arrange them row by row, to obtain the message sequence to be processed. This breaks the restriction of having to complete one row before moving on to the next, and makes execution more efficient.

[0201] Among them, m j,i =I||u32str(q)||u16str(i)||u8str(j)||t j,i , 0<=i <p,0<=j<2 w -1, so the message sequence to be processed includes (2 w-1) p second messages.

[0202] For the (2 w -1) p second messages, group them according to the parameter T used to represent the parallel processing ability of the preset hash function. And for each second message within each group, use the preset hash function to parallelly determine the hash value corresponding to each second message within the group, that is, calculate (2 w -1) p HASH values:

[0203]

[0204] Let 0 <= i < p, and finally obtain the second secret preimage array, that is, y = (y[0], y[1], …, y[p - 1]).

[0205] Refer to Figure 5 , another key generation method against quantum attacks provided by the embodiments of the present application includes:

[0206] S201. Determine the private key;

[0207] The determined private key can be the completely stored (otstype, I, q, x).

[0208] Alternatively, the compressed-stored private key (otstype, I, q, SEED) can also be obtained. Then, further, the hash function fast execution method provided by the embodiments of the present application can be used to generate the secret preimage array of LM-OTS by using the n-byte randomly generated secret seed SEED:

[0209] x = (x[0], x[1], …, x[p - 1]);

[0210] Wherein:

[0211] x[j] = H(I || u8str(q) || u16str(j) || 0xFF || SEED), j = 0, 1, …, p - 1.

[0212] For example, as Figure 4 shown, the input and output contents of the public key generation scheme of the LM-OTS signature provided by the embodiments of the present application are as follows:

[0213] Input:

[0214] H: Hash function, with the output hash length of n bytes;

[0215] w: Winternitz parameter, which can take values of 1, 2, 4, 8.

[0216] Private key (otstype,I,q,x) or (otstype,I,q,SEED)

[0217] Output:

[0218] Public key (otstype, I, q, K).

[0219] That is to say, the private key determined in this step can be a private key determined using the method provided in the above-mentioned embodiment of the present application, or it can be a pre-stored private key.

[0220] S202, generating multiple second messages based on the private key;

[0221] S203, grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in the group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group;

[0222] For example, if the SIMD instruction used is AVX512, and the processing capability of one instruction is 512 bits, then for the preset hash function SM3, the processing word length of SM3 is 32 bits, and the parallel capability parameter T=512 / 32=16.

[0223] S204, obtaining a second secret pre-image array using the hash value corresponding to each of the second messages;

[0224] S205, using the second secret pre-image array, determining an intermediate parameter for generating a public key;

[0225] S206: Generate a public key using the intermediate parameter, the one-time signature type value, the first parameter, and the second parameter used to generate the private key.

[0226] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0227] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and, for each second message in each group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group, includes:

[0228] For the multiple second messages, the following processing is performed line by line:

[0229] For the p second messages in the current row, the p second messages in the current row are grouped according to a parameter used to represent the parallel processing capability of a preset hash function; for the second messages in each group, the preset hash function is used to determine in parallel the hash values ​​corresponding to the second messages in the group.

[0230] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0231] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and, for each second message in each group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group, includes:

[0232] Determine a message sequence to be processed based on the second message in the j row and i column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0233] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and, for the second messages in each group, hash values ​​corresponding to the second messages in the group are determined in parallel using the preset hash function.

[0234] In summary, the technical solution provided by the embodiment of the present application can improve the efficiency of LM-OTS private key generation. Originally, generating LM-OTS private key requires performing p hash calculations. If the embodiment of the present application uses the SIMD optimization implementation of AVX512 instructions, only p hash calculations are required. The performance is improved by nearly 16 times. If the SIMD optimization implementation of AVX2 instructions is used, only The performance is improved by nearly 8 times.

[0235] Similarly, the technical solution provided in the embodiment of the present application can also improve the efficiency of LM-OTS public key generation. Originally, generating LM-OTS public key requires executing (2 w -1) p small packet hash calculations and 1 large packet hash calculation (i.e., calculation K). If the embodiment of the present application uses the SIMD optimization implementation of AVX512 instructions, only The performance improvement is close to 16 times; if the embodiment of the present application uses the SIMD optimization implementation of AVX2 instructions, only The performance improvement is nearly 8 times with two small packet hash calculations and one large packet hash calculation.

[0236] Furthermore, the embodiments of the present application can further improve the implementation efficiency of the LM-OTS-based signature scheme by improving the key generation efficiency, for example, improving the efficiency of public and private key generation of the Leighton-Micali signature system (LMS), the XMSS signature system, and their variants HSS and XMSSMT.

[0237] The following is an introduction to the equipment or device provided in the embodiments of the present application, in which the explanations or examples of technical features that are the same or corresponding to those described in the above method will not be repeated later.

[0238] An electronic device provided in an embodiment of the present application, see Figure 6 , for example:

[0239] The processor 600 is used to read the program in the memory 620 and execute the following process:

[0240] determining a one-time signature type value; and,

[0241] respectively determining a first parameter and a second parameter for generating a private key;

[0242] Generate a random number of a preset number of bytes, and use the random number as a secret seed;

[0243] Generate a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter and the secret seed;

[0244] Grouping the plurality of first messages according to a parameter used to represent a parallel processing capability of a preset hash function;

[0245] For the first message in each group, using the preset hash function to determine in parallel the hash values ​​corresponding to the first messages in the group;

[0246] Obtaining a first secret pre-image array using a hash value corresponding to each of the first messages;

[0247] Generate a private key using the first secret pre-image array.

[0248] In some embodiments, the number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function;

[0249] The processor 600 is further configured to read the program in the memory 620 and execute the following process:

[0250] When the number of the plurality of first messages cannot be divided by T, for the last group, where the number of first messages in the last group is less than T, the hash value corresponding to each first message in the group is determined in the following first preset manner:

[0251] Using preset data, generating a padded first message so that the group includes T first messages;

[0252] Using the preset hash function to determine in parallel the hash value corresponding to each first message in the group;

[0253] Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

[0254] In some embodiments, the processor 600 is further configured to read a program in the memory 620 and execute the following process:

[0255] Compare the number of first messages in the last group with 1 and T respectively;

[0256] When it is determined that the number of first messages in the last group is closer to T, the first preset method is used to determine the hash value corresponding to each first message in the last group.

[0257] In some embodiments, the processor 600 is further configured to read a program in the memory 620 and execute the following process:

[0258] Based on the private key, generating a plurality of second messages;

[0259] The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, the preset hash function is used to determine in parallel a hash value corresponding to each second message in the group;

[0260] Using the hash value corresponding to each of the second messages, a second secret pre-image array is obtained;

[0261] Determine an intermediate parameter for generating a public key using the second secret preimage array;

[0262] A public key is generated using the intermediate parameter, the one-time signature type value, the first parameter, and the second parameter.

[0263] In some embodiments, the processor 600 is configured to read the program in the memory 620 and perform the following process:

[0264] Determine the private key;

[0265] Based on the private key, generating a plurality of second messages;

[0266] The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, the preset hash function is used to determine in parallel a hash value corresponding to each second message in the group;

[0267] Using the hash value corresponding to each of the second messages, a second secret pre-image array is obtained;

[0268] Determine an intermediate parameter for generating a public key using the second secret preimage array;

[0269] A public key is generated using the intermediate parameter, as well as the one-time signature type value, the first parameter, and the second parameter used to generate the private key.

[0270] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0271] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and, for each second message in each group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group, includes:

[0272] For the multiple second messages, the following processing is performed line by line:

[0273] For the p second messages in the current row, the p second messages in the current row are grouped according to a parameter used to represent the parallel processing capability of a preset hash function; for the second messages in each group, the preset hash function is used to determine in parallel the hash values ​​corresponding to the second messages in the group.

[0274] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0275] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and, for each second message in each group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group, includes:

[0276] Determine a message sequence to be processed based on the second message in the j row and i column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0277] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and, for the second messages in each group, hash values ​​corresponding to the second messages in the group are determined in parallel using the preset hash function.

[0278] The transceiver 610 is configured to receive and send data under the control of the processor 600 .

[0279] Among them, Figure 6 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 600 and various circuits of memory represented by memory 620 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 610 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, including wireless channels, wired channels, optical cables, and other transmission media. For different user devices, the user interface 630 may also be an interface capable of externally and internally connecting required devices, and the connected devices include but are not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

[0280] The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 can store data used by the processor 600 when performing operations.

[0281] In some embodiments, the processor 600 may be a CPU (central processing unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array) or a CPLD (Complex Programmable Logic Device), and the processor may also adopt a multi-core architecture.

[0282] The processor calls the computer program stored in the memory to execute any of the methods provided in the embodiments of the present application according to the obtained executable instructions. The processor and the memory can also be arranged physically separately.

[0283] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0284] See also Figure 7 , a quantum attack-resistant key generation device provided in an embodiment of the present application includes:

[0285] A one-time signature type value unit 11, used to determine a one-time signature type value;

[0286] A private key parameter unit 12, configured to respectively determine a first parameter and a second parameter for generating a private key;

[0287] A secret seed unit 13, used to generate a random number of a preset number of bytes, and use the random number as a secret seed;

[0288] A first message unit 14, configured to generate a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter and the secret seed;

[0289] The first hash calculation unit 15 is used to group the plurality of first messages according to a parameter representing a parallel processing capability of a preset hash function; and, for the first messages in each group, use the preset hash function to determine in parallel the hash values ​​corresponding to the first messages in the group;

[0290] A first secret original image array unit 16, used to obtain a first secret original image array using a hash value corresponding to each of the first messages;

[0291] The private key generating unit 17 is used to generate a private key using the first secret original image array.

[0292] In some embodiments, the number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function;

[0293] The first hash calculation unit 15 is also used for:

[0294] When the number of the plurality of first messages cannot be divided by T, for the last group, where the number of first messages in the last group is less than T, the hash value corresponding to each first message in the group is determined in the following first preset manner:

[0295] Using preset data, generating a padded first message so that the group includes T first messages;

[0296] Using the preset hash function to determine in parallel the hash value corresponding to each first message in the group;

[0297] Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

[0298] In some embodiments, the first hash calculation unit 15 is further configured to:

[0299] Compare the number of first messages in the last group with 1 and T respectively;

[0300] When it is determined that the number of first messages in the last group is closer to T, the first preset method is used to determine the hash value corresponding to each first message in the last group.

[0301] In some embodiments, see Figure 8 , the device further comprises:

[0302] A private key determination unit 21, used to determine a private key, for example, to obtain a private key generated by the private key generation unit 17;

[0303] A second message unit 22, configured to generate a plurality of second messages based on the private key;

[0304] The second hash calculation unit 23 is used to group the plurality of second messages according to a parameter indicating a parallel processing capability of a preset hash function; and for each second message in each group, use the preset hash function to determine in parallel a hash value corresponding to each second message in the group;

[0305] A second secret original image array unit 24, used to obtain a second secret original image array using a hash value corresponding to each of the second messages;

[0306] An intermediate parameter unit 25, used to determine an intermediate parameter for generating a public key using the second secret pre-image array;

[0307] The public key unit 26 is used to generate a public key using the intermediate parameter, and the one-time signature type value, the first parameter and the second parameter used to generate the private key.

[0308] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0309] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and, for each second message in each group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group, includes:

[0310] For the multiple second messages, the following processing is performed line by line:

[0311] For the p second messages in the current row, the p second messages in the current row are grouped according to a parameter used to represent the parallel processing capability of a preset hash function; for the second messages in each group, the preset hash function is used to determine in parallel the hash values ​​corresponding to the second messages in the group.

[0312] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value;

[0313] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in each group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group, comprises:

[0314] Determine a message sequence to be processed based on the second message in the j row and i column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0315] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and, for the second messages in each group, hash values ​​corresponding to the second messages in the group are determined in parallel using the preset hash function.

[0316] It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0317] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words contribute to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0318] Any of the devices or apparatuses provided in the embodiments of the present application may specifically be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), etc. It may include a central processing unit (CPU), a memory, an input / output device, etc. The input device may include a keyboard, a mouse, a touch screen, etc. The output device may include a display device, such as a liquid crystal display (LCD), a cathode ray tube (CRT), etc.

[0319] The memory may include a read-only memory (ROM) and a random access memory (RAM), and provides the processor with program instructions and data stored in the memory. In an embodiment of the present application, the memory may be used to store the program of any of the methods provided in the embodiments of the present application.

[0320] The processor calls the program instructions stored in the memory, and the processor is used to execute any of the methods provided in the embodiments of the present application according to the obtained program instructions.

[0321] The present application embodiment also provides a computer program product or computer program, which includes a computer instruction, which is stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction so that the computer device executes any of the methods described in the above embodiments. The program product can use any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0322] The embodiment of the present application provides a computer-readable storage medium for storing computer program instructions used by the apparatus provided in the embodiment of the present application, which includes a program for executing any of the methods provided in the embodiment of the present application. The computer-readable storage medium may be a non-transitory computer-readable medium.

[0323] The computer-readable storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

[0324] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0325] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0326] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0327] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0328] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A quantum attack-resistant key generation method, characterized in that: The method comprises: determining a one-time signature type value; and, respectively determining a first parameter and a second parameter for generating a private key; Generate a random number of a preset number of bytes, and use the random number as a secret seed; Generate a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter and the secret seed; Grouping the plurality of first messages according to a parameter used to represent a parallel processing capability of a preset hash function; For each first message in the group, using the preset hash function to determine in parallel the hash values ​​corresponding to the first messages in the group; Obtaining a first secret pre-image array using a hash value corresponding to each of the first messages; Generate a private key using the first secret pre-image array.

2. The method according to claim 1, characterized in that The number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function; The method further comprises: When the number of the plurality of first messages cannot be divided by T, for the last group, where the number of first messages in the last group is less than T, the hash value corresponding to each first message in the group is determined in the following first preset manner: Using preset data, generating a padded first message so that the group includes T first messages; Using the preset hash function to determine in parallel the hash value corresponding to each first message in the group; Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

3. The method according to claim 2, characterized in that The method further comprises: Compare the number of first messages in the last group with 1 and T respectively; When it is determined that the number of first messages in the last group is closer to T, the first preset method is used to determine the hash value corresponding to each first message in the last group.

4. The method according to claim 1, characterized in that The method further comprises: Based on the private key, generating a plurality of second messages; The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, the preset hash function is used to determine in parallel a hash value corresponding to each second message in the group; Using the hash value corresponding to each of the second messages, a second secret pre-image array is obtained; Determine an intermediate parameter for generating a public key using the second secret preimage array; A public key is generated using the intermediate parameter, the one-time signature type value, the first parameter, and the second parameter.

5. A quantum attack-resistant key generation method, characterized in that: The method comprises: Determine the private key; Based on the private key, generating a plurality of second messages; The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, the preset hash function is used to determine in parallel a hash value corresponding to each second message in the group; Using the hash value corresponding to each of the second messages, a second secret pre-image array is obtained; Determine an intermediate parameter for generating a public key using the second secret preimage array; A public key is generated using the intermediate parameter, as well as the one-time signature type value, the first parameter, and the second parameter used to generate the private key.

6. The method according to claim 5, characterized in that The plurality of second messages include a second message in row j and column i, wherein 0<=i <p,0<=j<2 w -1; p represents the number of secret original image arrays corresponding to the private key, and w is a preset value; The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and, for each second message in each group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group, includes: For the multiple second messages, the following processing is performed line by line: For the p second messages in the current row, the p second messages in the current row are grouped according to a parameter used to represent the parallel processing capability of a preset hash function; for the second messages in each group, the preset hash function is used to determine in parallel the hash values ​​corresponding to the second messages in the group.

7. A quantum attack-resistant key generation device, characterized in that: The device comprises: A one-time signature type value unit, used to determine a one-time signature type value; a private key parameter unit, for respectively determining a first parameter and a second parameter for generating a private key; A secret seed unit, used to generate a random number of a preset number of bytes, and use the random number as a secret seed; A first message unit, configured to generate a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter and the secret seed; A first hash calculation unit, configured to group the plurality of first messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each first message in each group, using the preset hash function to determine in parallel a hash value corresponding to each first message in the group; A first secret original image array unit, used to obtain a first secret original image array using a hash value corresponding to each of the first messages; A private key generation unit is used to generate a private key using the first secret original image array.

8. A key generation device resistant to quantum attacks, characterized in that: The device comprises: A private key determination unit, used to determine a private key; A second message unit, used to generate a plurality of second messages based on the private key; a second hash calculation unit, configured to group the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in a group, using the preset hash function to determine in parallel a hash value corresponding to each second message in the group; A second secret original image array unit, used to obtain a second secret original image array using a hash value corresponding to each of the second messages; An intermediate parameter unit, used to determine an intermediate parameter for generating a public key using the second secret pre-image array; The public key unit is used to generate a public key by using the intermediate parameter, and the one-time signature type value, the first parameter and the second parameter used to generate the private key.

9. An electronic device, characterized in that: include: A memory for storing program instructions; A processor, configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 6 according to the obtained program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the method according to any one of claims 1 to 6.

Images