A quantum attack-resistant key generation method, device, equipment and medium

Abstract

The present application discloses a quantum attack-resistant key generation method, apparatus, device, and medium for improving key generation efficiency and, thereby, digital signature efficiency. The method provided by the present application includes: determining a one-time signature type value; and, respectively, determining a first parameter and a second parameter for generating a private key, generating a random number of a preset number of bytes, and using the random number as a secret seed; further generating multiple first messages based on the one-time signature type value, the first parameter, the second parameter, and the secret seed; and grouping the multiple first messages according to a parameter representing the parallel processing capability of a preset hash function; for each first message in the group, using the preset hash function to determine in parallel the hash value corresponding to each first message in the group; then, using the hash value corresponding to each first message to obtain a first secret pre-image array; and using the first secret pre-image array to generate a private key.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, apparatus, device, and medium for generating a key that is resistant to quantum attacks. Background Art

[0002] While the development of informatization and computer technology has brought numerous benefits to humanity, cybersecurity has become a common challenge facing humanity in the information age. To mitigate the threat of quantum computers, quantum-resistant cryptographic algorithms are designed to remain secure even when quantum computers become widely available. The Leighton-Micali signature system (which includes key generation, signature generation, and signature verification) is one such system. It is a digital signature scheme based on hash functions.

[0003] The Leighton-Micali signature system is a hash-based digital signature scheme. This signature system is a one-time signature (OTS) scheme, hence the abbreviation LM-OTS. LM-OTS signatures involve three aspects: key generation, signature generation, and signature verification. In LM-OTS signatures, each private key can only be used to sign a single message (i.e., plaintext) and generate a signed message (i.e., ciphertext).

[0004] In signature schemes based on the LM-OTS algorithm, for example, the LMS and XMSS signature systems, and their variants such as HSS and XMSSMT, a large number of LM-OTS public and private keys are required, which requires a large number of hash operations, greatly reducing the efficiency of public and private key generation.

[0005] For example, in a performance test on a 32-core AMD EPYC-ROME server with a 2.9GHz processor, using the Winteritz parameter w = 8 for the HSS-SM3 algorithm, an LMS-SM3 instance with a height of h = 20 took 928.21 seconds to generate the public and private keys. This indicates that key generation is very slow. Summary of the Invention

[0006] The embodiments of the present application provide a quantum attack-resistant key generation method, apparatus, device, and medium to improve key generation efficiency and thereby improve digital signature efficiency.

[0007] The present invention provides a method for generating a key that is resistant to quantum attacks, including:

[0008] Determine the one-time signature type value; and,

[0009] determining a first parameter and a second parameter for generating a private key respectively;

[0010] Generate a random number of a preset number of bytes, and use the random number as a secret seed;

[0011] generating a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter, and the secret seed;

[0012] grouping the plurality of first messages according to a parameter representing a parallel processing capability of a preset hash function;

[0013] For the first message in each group, using the preset hash function to determine in parallel the hash value corresponding to each first message in the group;

[0014] Obtaining a first secret pre-image array using a hash value corresponding to each of the first messages;

[0015] Generate a private key using the first secret preimage array.

[0016] In the quantum attack-resistant key generation method provided in an embodiment of the present application, a one-time signature type value is determined; and a first parameter and a second parameter for generating a private key are respectively determined to generate a random number of preset bytes, and the random number is used as a secret seed. Thus, multiple first messages can be further generated based on the one-time signature type value, the first parameter, the second parameter, and the secret seed. The multiple first messages are grouped according to a parameter representing the parallel processing capability of a preset hash function. For each first message in the group, the preset hash function is used to determine in parallel the hash values ​​corresponding to the respective first messages in the group, thereby improving the hash calculation efficiency. Then, a first secret pre-image array is obtained using the hash value corresponding to each first message. The private key is generated using the first secret pre-image array. Therefore, the method provided in the embodiment of the present application improves the efficiency of private key generation, thereby improving the efficiency of the quantum-resistant signature scheme based on the LM-OTS algorithm.

[0017] In some embodiments, the number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function;

[0018] The method further comprises:

[0019] When the number of the plurality of first messages is not divisible by T, for a last group, where the number of first messages in the last group is less than T, a hash value corresponding to each first message in the group is determined using the following first preset method:

[0020] Generate padded first messages using preset data so that the group includes T first messages;

[0021] Determine in parallel the hash value corresponding to each first message in the group using the preset hash function;

[0022] Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

[0023] It can be seen that for the last group, by filling in the first message, a preset hash function can be used to determine the hash value corresponding to each first message in the last group in parallel, thereby realizing parallel processing of the hash value corresponding to each first message in the last group, further improving the computing efficiency.

[0024] In some embodiments, the method further comprises:

[0025] Compare the number of first messages in the last group with 1 and T respectively;

[0026] When it is determined that the number of first messages in the last group is closer to T, the hash value corresponding to each first message in the last group is determined using the first preset method.

[0027] It can be seen that by comparing the number of first messages in the last group with 1 and T respectively, when the number of first messages in the last group is large (that is, closer to T), the first preset method can be used to determine the hash value corresponding to each first message in the last group, thereby realizing parallel processing of the hash value corresponding to each first message in the last group and improving computing efficiency.

[0028] In some embodiments, the method further comprises:

[0029] Based on the private key, generating a plurality of second messages;

[0030] The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to each second message in the group are determined in parallel using the preset hash function;

[0031] Obtaining a second secret pre-image array using a hash value corresponding to each of the second messages;

[0032] Determining intermediate parameters for generating a public key using the second secret preimage array;

[0033] A public key is generated using the intermediate parameter, the one-time signature type value, the first parameter, and the second parameter.

[0034] Therefore, the embodiments of the present application can improve the efficiency of generating public keys, thereby improving the efficiency of the quantum-resistant signature scheme based on the LM-OTS algorithm.

[0035] Another quantum attack-resistant key generation method provided in an embodiment of the present application includes:

[0036] Determine the private key;

[0037] Based on the private key, generating a plurality of second messages;

[0038] The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to each second message in the group are determined in parallel using the preset hash function;

[0039] Obtaining a second secret pre-image array using a hash value corresponding to each of the second messages;

[0040] Determining intermediate parameters for generating a public key using the second secret preimage array;

[0041] A public key is generated using the intermediate parameter, a one-time signature type value used to generate the private key, the first parameter, and the second parameter.

[0042] Therefore, similar to the above-mentioned improvement of the private key generation efficiency, the embodiment of the present application can also improve the generation efficiency of the public key alone.

[0043] This will improve the efficiency of the quantum-resistant signature scheme based on the LM-OTS algorithm.

[0044] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0045] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes:

[0046] For the multiple second messages, perform the following processing line by line:

[0047] The p second messages in the current row are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0048] It can be seen that the embodiment of the present application can calculate the hash value of the message line by line, thereby improving the calculation efficiency.

[0049] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0050] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes:

[0051] Determine a message sequence to be processed based on the second message in the jth row and the ith column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0052] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and for the second messages in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0053] It can be seen that the embodiment of the present application can arrange the messages to be hashed in a straight line, that is, arrange them row by row in sequence, to obtain a message sequence to be processed, thereby further improving the computing efficiency.

[0054] An embodiment of the present application provides a quantum attack-resistant key generation device, comprising:

[0055] A one-time signature type value unit, used to determine a one-time signature type value;

[0056] a private key parameter unit, configured to determine a first parameter and a second parameter for generating a private key;

[0057] A secret seed unit, configured to generate a random number of a preset number of bytes and use the random number as a secret seed;

[0058] A first message unit, configured to generate a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter, and the secret seed;

[0059] a first hash calculation unit, configured to group the plurality of first messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each first message in each group, using the preset hash function to determine, in parallel, a hash value corresponding to each first message in the group;

[0060] a first secret pre-image array unit, configured to obtain a first secret pre-image array using a hash value corresponding to each of the first messages;

[0061] A private key generation unit is used to generate a private key using the first secret pre-image array.

[0062] Another quantum attack-resistant key generation device provided in an embodiment of the present application includes:

[0063] a private key determination unit, configured to determine a private key;

[0064] A second message unit, configured to generate a plurality of second messages based on the private key;

[0065] a second hash calculation unit, configured to group the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in each group, determine, in parallel, a hash value corresponding to each second message in the group using the preset hash function;

[0066] a second secret pre-image array unit, configured to obtain a second secret pre-image array using a hash value corresponding to each of the second messages;

[0067] an intermediate parameter unit, configured to determine an intermediate parameter for generating a public key using the second secret preimage array;

[0068] The public key unit is used to generate a public key using the intermediate parameter, a one-time signature type value used to generate the private key, the first parameter, and the second parameter.

[0069] Another embodiment of the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store program instructions, and the processor is used to call the program instructions stored in the memory and execute any of the above methods according to the obtained program.

[0070] Another embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute any of the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0072] Figure 1 A schematic diagram of a flow chart of a quantum attack-resistant key generation method provided in an embodiment of the present application;

[0073] Figure 2 A schematic diagram of grouping messages provided in an embodiment of the present application;

[0074] Figure 3 A schematic diagram of a flow chart of another quantum attack-resistant key generation method provided in an embodiment of the present application;

[0075] Figure 4 A schematic diagram of the key generation principle provided in an embodiment of the present application;

[0076] Figure 5 A schematic diagram of a flow chart of a third method for generating a key resistant to quantum attacks provided in an embodiment of the present application;

[0077] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0078] Figure 7 A schematic diagram of the structure of a quantum attack-resistant key generation device provided in an embodiment of the present application;

[0079] Figure 8 A schematic diagram of the structure of another quantum attack-resistant key generation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0080] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0081] The embodiments of the present application provide a quantum attack-resistant key generation method, apparatus, device, and medium to improve key generation efficiency and thereby improve digital signature efficiency.

[0082] Among them, the method and the device, equipment, and medium are based on the same application concept. Since the principles of solving problems by the method and the device, equipment, and medium are similar, the implementation of the device, equipment, medium, and method can refer to each other, and the repeated parts will not be repeated.

[0083] The terms "first", "second", etc. (if any) in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0084] The following examples and embodiments are to be understood as illustrative examples only. Although this specification may refer to "one," "an," or "some" examples or embodiments at several places, this does not mean that each such reference relates to the same example or embodiment, nor does it mean that the feature applies only to a single example or embodiment. Individual features of different embodiments may also be combined to provide further embodiments. Furthermore, terms such as "comprises" and "comprising" should be understood as not limiting the described embodiments to consisting only of those features already mentioned; such examples and embodiments may also include features, structures, units, modules, etc. that are not specifically mentioned.

[0085] The following describes in detail the various embodiments of the present application in conjunction with the accompanying drawings. It should be noted that the order in which the embodiments of the present application are presented only represents the order of the embodiments, and does not represent the advantages or disadvantages of the technical solutions provided by the embodiments.

[0086] The symbols, parameters, and marks involved in the embodiments of this application are described as follows:

[0087] ||: Data concatenation, X||Y means X is on the left and Y is on the right.

[0088] H(): The hash function used.

[0089] n: The number of bytes of the hash value output by the hash function used.

[0090] w: Winternitz parameter, for example, w=1, 2, 4, 8.

[0091] u: The hash function's output hash value consists of u w-bit strings, where u = 8n / w.

[0092] v: When signing a message m using the LM-OTS algorithm, a checksum of the hash value of m needs to be calculated. v is the number of w-bit strings in the checksum, which can be calculated as follows:

[0093]

[0094] in, represents the top function of x (take the smallest integer not less than x), Represents the base function of x (the largest integer not greater than x).

[0095] p: The number of n-byte sequences in the secret preimage array in the private key of the LM-OTS algorithm, where:

[0096] p=u+v;

[0097] γ: During the signature generation process, a checksum needs to be shifted left, so γ represents the number of bits shifted left. For example:

[0098] γ=16-vw.

[0099] The embodiments of the present application are intended to improve the efficiency of private key and public key generation, and thereby improve the efficiency of digital signatures based on, for example, the LM-OTS algorithm, thereby improving the efficiency of public and private key generation and digital signatures of schemes such as the Leighton-Micali signature system (LMS), the XMSS signature system, and their variants HSS and XMSSMT.

[0100] See also Figure 1 , an embodiment of the present application provides a quantum attack-resistant key generation method, comprising:

[0101] S101. Determine a one-time signature type (i.e., otstype) value;

[0102] For example, the otstype value is determined based on the hash function H() and the Winternitz parameter.

[0103] The otstype value is specified in, for example, a standard specification such as RFC 8554. In other words, the otstype value may be a preset value.

[0104] S102, respectively determining a first parameter and a second parameter for generating a private key;

[0105] Wherein, the first parameter, for example, I value;

[0106] The second parameter, such as q value;

[0107] If a valid 16-byte I value is input, the input I value is determined as the I value used to generate the private key;

[0108] Otherwise (for example, no I value is input), a 16-byte random number is generated as the I value.

[0109] The q value is a preset value.

[0110] S103, generating a random number of a preset number of bytes (e.g., n bytes), and using the random number as a secret seed (e.g., represented as SEED);

[0111] It should be noted that the above three steps S101 to S103 can be executed in parallel without any limitation on the order.

[0112] For example, in the private key generation method for LM-OTS signature provided in the embodiment of the present application, the input and output contents are as follows:

[0113] enter:

[0114] H: Hash function, the length of the hash value output is n bytes. For example, if the hash function is the SM3 hash algorithm, then n is 32 bytes.

[0115] w: Winternitz parameter, with possible values ​​of 1, 2, 4, or 8. The Winternitz parameter (often denoted as w) defines the number of times a numeric value is encoded into a hash value. Specifically, it determines how many times the hash function must be repeated during the signing process to ensure the security of the signature. In LM-OTS, the Winternitz parameter is a key parameter that determines the size, security, and efficiency of the signature.

[0116] I: a first parameter of a preset number of bytes, for example, a 16-byte random value.

[0117] q: a second parameter of a preset number of bytes, for example, a 4-byte value, indicating the number of a node (for example, an OTS module).

[0118] Output:

[0119] Private key (otstype, I, q, x).

[0120] S104. Generate multiple first messages based on the one-time signature type value, the first parameter, the second parameter, and the secret seed;

[0121] The multiple first messages, such as plain text messages m1 to m p .

[0122] It should be noted that, in order to distinguish the description from the message in the process of generating the public key, in the embodiment of the present application, the message in the process of generating the private key is referred to as the first message, and the message in the process of generating the public key is referred to as the second message.

[0123] S105. Group the multiple first messages according to a parameter indicating a parallel processing capability of a preset hash function;

[0124] For example, if the parameter used to represent the parallel processing capability of the preset hash function is T, the messages m1 to m2 can be processed in a manner such that each group includes T first messages. p The messages are grouped in sequence. If the number of first messages is divisible by T, each group contains exactly T first messages. Otherwise, the number of first messages in the last group may be less than T.

[0125] S106. For each first message in each group, use the preset hash function to determine, in parallel, a hash value corresponding to each first message in the group;

[0126] That is, in order to improve the efficiency of key generation, the hash function fast execution method provided in the embodiment of the present application includes the above steps S105 and S106, which are used to quickly generate hash values ​​of multiple messages.

[0127] For example Figure 2 As shown, assuming that (m1,m2,…,m r ) There are r first messages in total, then the output after the above two steps is: (md1,md2,…,md r ); among them, md i =H(m i ),i=1,2,…,r.

[0128] In step S105, the r first messages are divided into groups according to a preset hash function parallel capability parameter T (the capability of executing multiple hash function operations simultaneously, i.e., the capability of obtaining multiple hash values ​​simultaneously). Every T messages are combined into one group. The last group may be a complete group (if r mod T = 0) or may not be a complete group (if r mod T ≠ 0).

[0129] For example, the SIMD (Single Instruction Multiple Data) instruction AVX512 can be used to perform hash calculations. The processing capability of one instruction is 512 bits, the hash function used is SM3, and the processing word length of SM3 is 32 bits. Then, the parameter T used to represent the parallel processing capability of the hash function is T = 512 / 32 = 16. If the number of first messages to be processed r = 100, then r mod T = 100 mod 16 = 4 ≠ 0, and the last group is an incomplete group containing 4 first messages. If the number of messages r = 256, then r mod T = 256 mod 16 = 0, and the last group is a complete group containing 16 first messages. SIMD is a single instruction multiple data stream technology that allows one instruction to operate on multiple data simultaneously, thereby improving computing efficiency.

[0130] Then, after the grouping is completed, in step S106, for each complete message in the group, it is recorded as:

[0131] (msg1,msg2,…,msg T );

[0132] SIMD parallel capability T, executes the hash function H (H based on SIMD instructions SIMD ), and calculate the hash values ​​of T first messages at the same time. For example, if SIMD is AVX512 and the hash function is SM3, the H SIMD SM3 algorithm implemented using AVX512 instructions AVX512 , it can process 16 hash tasks simultaneously (there is no interdependence between tasks), that is, for each group, it outputs the following results (hash values) at the same time:

[0133] (h1,h2,…,h 16 )=SM3 AVX512 (msg1,msg2,…,msg 16 );

[0134] That is, in the embodiments of the present application, multiple messages within each group can be processed in parallel, and the hash values ​​corresponding to the messages within the group can be obtained simultaneously. Different groups can perform hash calculations sequentially, or there can be no order requirement. That is, there may not be a need to perform hash calculations sequentially between groups. For example, the private key generation process involves 96 messages, which are divided into 6 groups. It does not matter which of the 6 groups performs hash calculations first or later. The specific order can be determined based on actual needs.

[0135] In some embodiments, the number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function;

[0136] The method further comprises:

[0137] When the number of the plurality of first messages is not divisible by T, for a last group, where the number of first messages in the last group is less than T, a hash value corresponding to each first message in the group is determined using the following first preset method:

[0138] Using preset data (which can be filled with any data, such as all-zero data), generate a padded first message so that the group includes T first messages;

[0139] Determine in parallel the hash value corresponding to each first message in the group using the preset hash function;

[0140] Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

[0141] In some embodiments, when the number of the plurality of first messages is not divisible by T, a second preset method may be used to determine the hash value corresponding to each first message in the last group. The second preset method is to calculate the hash value corresponding to each message in the last group one by one.

[0142] In some embodiments, the method further comprises:

[0143] Compare the number of first messages in the last group with 1 and T respectively;

[0144] When it is determined that the number of first messages in the last group is closer to T, the hash value corresponding to each first message in the last group is determined using the first preset method.

[0145] That is, if the number of messages in the last incomplete group is close to the parallel capacity T, the first preset method is preferentially adopted; if the number of messages in the last incomplete group is close to 1, the second preset method is preferentially adopted.

[0146] For example, if the last group is incomplete, with only three messages requiring hash calculation, and the parallelism parameter T = 4, then the group is padded to a complete group by adding a data block, ensuring that it is the same length as the first three messages, to create four messages to be hashed. The pre-set hash function is then used to calculate the hash values ​​of this complete group of T = 4 messages in parallel. Finally, the hash values ​​corresponding to the padded messages (i.e., the fourth hash value) are discarded, and only the hash values ​​of the non-padded messages (i.e., the first through third hash values) are retained.

[0147] If the last group is incomplete, only one message needs to be hashed, and the parallel capability parameter is T=4, 1 is not close to 4, so it is more appropriate to select the second preset method mentioned above and perform normal hash calculation, that is, only the hash value of one data block needs to be calculated.

[0148] In summary, when step S106 is executed, the hash values ​​of all first messages are output:

[0149] (md1,md2,…,md r ).

[0150] S107. Obtain a first secret pre-image array using the hash value corresponding to each of the first messages;

[0151] S108: Generate a private key using the first secret pre-image array.

[0152] For example, if the input of step S105 includes the following message:

[0153] m1=I||u8str(q)||u16str(0)||0xFF||SEED,

[0154] m2=I||u8str(q)||u16str(1)||0xFF||SEED,

[0155] …

[0156] m p =I||u8str(q)||u16str(p-1)||0xFF||SEED.

[0157] The output of step S106 includes the following hash values ​​corresponding to each message:

[0158] x[0]=H(m1),

[0159] x[1]=H(m2),

[0160] …

[0161] x[p-1]=H(m p ).

[0162] Then, the secret pre-image array of LM-OTS generated in step S107 is as follows:

[0163] x=(x[0],x[1],…,x[p-1]);

[0164] in:

[0165] x[j]=H(I||u8str(q)||u16str(j)||0xFF||SEED), j=0,1,…,p-1.

[0166] For example, if the Winternitz parameter w in the embodiment of the present application is 8, then the hash value output by the hash function SM3 includes u = 8n / w = 32 w = 8-bit strings, and the number of w = 8-bit strings in the check value is v = 2. Therefore, in the LM-OTS private key, the number of n = 32 byte sequences in the secret preimage array is p = u + v = 34.

[0167] Finally, step S108 uses the secret pre-image array to generate and output the LM-OTS private key:

[0168] (otstype,I,q,x).

[0169] In some embodiments, see Figure 3 , the method further comprises:

[0170] S109. Generate multiple second messages based on the private key;

[0171] See also Figure 4 For example, in the private key (otstype, I, q, x), x=(x[0], x[1], ..., x[p-1]), then based on the private key, the multiple second messages generated include: m 0,0 ~m2 w -1,p-1 , that is, a total of 2 w Multiply by p second messages.

[0172] That is to say, if Figure 4 As shown, the second message for generating the public key includes the second message of row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret preimage arrays corresponding to the private key, and w is a preset value, namely the Winternitz parameter, which can be 1, 2, 4, or 8, for example;

[0173] S110: Group the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in each group, use the preset hash function to determine, in parallel, a hash value corresponding to each second message in the group;

[0174] That is to say, similar to steps S105 and S106 in the above-mentioned process of generating a private key, in the process of generating a public key, the embodiment of the present application can also first group the input messages, and use a preset hash function to determine the hash values ​​corresponding to the messages in each group in parallel.

[0175] S111. Obtain a second secret pre-image array using a hash value corresponding to each of the second messages;

[0176] The second secret pre-image array, for example, y=(y[0], y[1], ..., y[p-1]).

[0177] S112. Determine intermediate parameters for generating a public key using the second secret pre-image array;

[0178] The intermediate parameter, that is, the K value required to calculate the public key, is, for example:

[0179] K=H(I||u32str(q)||0x8080||y[0]||y[1]||…||y[p-1]);

[0180] Among them, I and q use the relevant values ​​of the private key, that is, the first parameter and the second parameter respectively.

[0181] S113. Generate a public key using the intermediate parameter, the one-time signature type value, the first parameter, and the second parameter.

[0182] For example, generate and output the public key of LM-OTS:

[0183] (otstype,I,q,K);

[0184] Among them, otstype, I, and q use the relevant values ​​of the private key.

[0185] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0186] The step S110 includes:

[0187] For the multiple second messages, perform the following processing line by line:

[0188] The p second messages in the current row are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0189] That is, in one embodiment, the hash value may be calculated row by row, for example, see Figure 4 , complete the hash calculation in the first row of dotted boxes, then do the hash calculation in the second row of dotted boxes, and so on. Iteration 2 is required w -1 hash calculation (i.e. numbering from 0 to 2 w -2, total 2 w -1 hash calculation), each hash calculation is the hash value of a line of messages (p messages per line).

[0190] Among them, for any row (identified by j), the p plaintext messages (m j,0 ,m j,1 ,…,m j,p-1 ), the current j (0<=j<2 w -1) lines of p second messages (m j,0 ,m j,1 ,…,m j,p-1 ) for grouping; for the second messages in each group, a preset hash function is used to determine in parallel the hash values ​​corresponding to the second messages in the group.

[0191] Among them, any plaintext m j,i =I||u32str(q)||u16str(i)||u8str(j)||tj,i , where 0 <= i <p;

[0192] The HASH value of the p plaintext messages in any j rows is:

[0193] (t j+1,0 ,t j+1,1 ,…,t j+1,p-1 )=(H(m j,0 ),H(m j,1 ),…,H(m j,p-1 )).

[0194] Calculate the hash value of the message in each row one by one, and finally get the hash value of all messages in all rows.

[0195] Then, let Where i = 0, 1, …, p-1, and the second secret pre-image array is obtained, that is, y = (y[0], y[1], …, y[p-1]).

[0196] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0197] The step S110 includes:

[0198] Determine a message sequence to be processed based on the second message in the jth row and the ith column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0199] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and for the second messages in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0200] That is, see for example Figure 4 In some embodiments, Figure 4 Arrange the messages to be hashed in the sequence row by row to obtain the message sequence to be processed. This breaks the restriction of having to complete one row before moving on to the next, and the execution efficiency is higher.

[0201] Among them, m j,i =I||u32str(q)||u16str(i)||u8str(j)||t j,i ,0<=i <p,0<=j<2 w -1, so the message sequence to be processed includes (2 w-1) p second messages.

[0202] For the said (2 w -1) p second messages, group them according to the parameter T used to represent the parallel processing ability of the preset hash function, and for each second message within each group, use the preset hash function to parallelly determine the hash value corresponding to each second message within the group, that is, calculate and obtain (2 w -1) p HASH values:

[0203]

[0204] Let 0 <= i < p, and finally obtain the second secret preimage array, that is, y = (y[0], y[1],..., y[p - 1]).

[0205] Refer to Figure 5 , another key generation method against quantum attacks provided by the embodiments of the present application includes:

[0206] S201. Determine the private key;

[0207] The determined private key can be the completely stored (otstype, I, q, x).

[0208] Alternatively, the compressed-stored private key (otstype, I, q, SEED) can also be obtained. Then, further, the hash function fast execution method provided by the embodiments of the present application can be used to generate the secret preimage array of LM-OTS by using the n-byte randomly generated secret seed SEED:

[0209] x = (x[0], x[1],..., x[p - 1]);

[0210] Where:

[0211] x[j] = H(I || u8str(q) || u16str(j) || 0xFF || SEED), j = 0, 1,..., p - 1.

[0212] For example, as Figure 4 shown, the input and output contents of the public key generation scheme of the LM-OTS signature provided by the embodiments of the present application are as follows:

[0213] Input:

[0214] H: Hash function, with the output hash length of n bytes;

[0215] w: Winternitz parameter, and the value can be 1, 2, 4, 8.

[0216] Private key (otstype,I,q,x) or (otstype,I,q,SEED)

[0217] Output:

[0218] Public key (otstype, I, q, K).

[0219] That is to say, the private key determined in this step can be a private key determined using the method provided in the above-mentioned embodiment of the present application, or a pre-stored private key.

[0220] S202. Generate multiple second messages based on the private key;

[0221] S203: Group the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in each group, use the preset hash function to determine, in parallel, a hash value corresponding to each second message in the group;

[0222] For example, if the SIMD instruction used is AVX512, the processing capability of one instruction is 512 bits, and for the preset hash function SM3, the processing word length of SM3 is 32 bits, then the parallel capability parameter T=512 / 32=16.

[0223] S204. Obtain a second secret pre-image array using the hash value corresponding to each of the second messages;

[0224] S205. Determine intermediate parameters for generating a public key using the second secret pre-image array;

[0225] S206: Generate a public key using the intermediate parameter, the one-time signature type value used to generate the private key, the first parameter, and the second parameter.

[0226] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0227] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes:

[0228] For the multiple second messages, perform the following processing line by line:

[0229] The p second messages in the current row are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0230] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0231] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes:

[0232] Determine a message sequence to be processed based on the second message in the jth row and the ith column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0233] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and for the second messages in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0234] In summary, the technical solution provided by the embodiment of the present application can improve the efficiency of LM-OTS private key generation. Originally, generating LM-OTS private key required performing p hash calculations. However, if the embodiment of the present application uses the SIMD optimization implementation of AVX512 instructions, only p hash calculations are required. hash calculations, the performance is improved by nearly 16 times; if the SIMD optimization implementation of AVX2 instructions is used, only Second hashing, performance improved by nearly 8 times;

[0235] Similarly, the technical solution provided by the embodiment of the present application can also improve the efficiency of LM-OTS public key generation. Originally, generating LM-OTS public key required executing (2 w -1)p small packet hash calculations and 1 large packet hash calculation (i.e., calculation K). If the embodiment of the present application uses the SIMD optimization implementation of AVX512 instructions, only The performance improvement is close to 16 times if the SIMD optimization implementation scheme of AVX2 instructions is used in the embodiment of the present application. The performance improvement is close to 8 times with two small packet hash calculations and one large packet hash calculation.

[0236] Furthermore, the embodiments of the present application can further improve the implementation efficiency of the signature scheme based on LM-OTS by improving the key generation efficiency, for example, improving the efficiency of public and private key generation of the Leighton-Micali signature system (LMS), the XMSS signature system, and their variants HSS and XMSSMT.

[0237] The following is an introduction to the equipment or device provided in the embodiments of the present application, in which the explanations or examples of technical features that are the same as or corresponding to those described in the above method are not repeated hereafter.

[0238] An electronic device provided in an embodiment of the present application, see Figure 6 , for example:

[0239] The processor 600 is configured to read the program in the memory 620 and execute the following process:

[0240] Determine the one-time signature type value; and,

[0241] determining a first parameter and a second parameter for generating a private key respectively;

[0242] Generate a random number of a preset number of bytes, and use the random number as a secret seed;

[0243] generating a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter, and the secret seed;

[0244] grouping the plurality of first messages according to a parameter representing a parallel processing capability of a preset hash function;

[0245] For the first message in each group, using the preset hash function to determine in parallel the hash value corresponding to each first message in the group;

[0246] Obtaining a first secret pre-image array using a hash value corresponding to each of the first messages;

[0247] Generate a private key using the first secret preimage array.

[0248] In some embodiments, the number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function;

[0249] The processor 600 is further configured to read the program in the memory 620 and execute the following process:

[0250] When the number of the plurality of first messages is not divisible by T, for a last group, where the number of first messages in the last group is less than T, a hash value corresponding to each first message in the group is determined using the following first preset method:

[0251] Generate padded first messages using preset data so that the group includes T first messages;

[0252] Determine in parallel the hash value corresponding to each first message in the group using the preset hash function;

[0253] Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

[0254] In some embodiments, the processor 600 is further configured to read a program in the memory 620 and execute the following process:

[0255] Compare the number of first messages in the last group with 1 and T respectively;

[0256] When it is determined that the number of first messages in the last group is closer to T, the hash value corresponding to each first message in the last group is determined using the first preset method.

[0257] In some embodiments, the processor 600 is further configured to read a program in the memory 620 and execute the following process:

[0258] Based on the private key, generating a plurality of second messages;

[0259] The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to each second message in the group are determined in parallel using the preset hash function;

[0260] Obtaining a second secret pre-image array using a hash value corresponding to each of the second messages;

[0261] Determining intermediate parameters for generating a public key using the second secret preimage array;

[0262] A public key is generated using the intermediate parameter, the one-time signature type value, the first parameter, and the second parameter.

[0263] In some embodiments, the processor 600 is configured to read a program in the memory 620 and execute the following process:

[0264] Determine the private key;

[0265] Based on the private key, generating a plurality of second messages;

[0266] The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to each second message in the group are determined in parallel using the preset hash function;

[0267] Obtaining a second secret pre-image array using a hash value corresponding to each of the second messages;

[0268] Determining intermediate parameters for generating a public key using the second secret preimage array;

[0269] A public key is generated using the intermediate parameter, a one-time signature type value used to generate the private key, the first parameter, and the second parameter.

[0270] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0271] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes:

[0272] For the multiple second messages, perform the following processing line by line:

[0273] The p second messages in the current row are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0274] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0275] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes:

[0276] Determine a message sequence to be processed based on the second message in the jth row and the ith column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0277] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and for the second messages in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0278] The transceiver 610 is configured to receive and send data under the control of the processor 600 .

[0279] Among them, Figure 6 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 600 and memory represented by memory 620. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 610 may be a plurality of components, i.e., a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, such as a wireless channel, a wired channel, an optical cable, and the like. For different user devices, the user interface 630 may also be an interface capable of connecting external or internal devices as required, and the connected devices include but are not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

[0280] The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 can store data used by the processor 600 when performing operations.

[0281] In some embodiments, the processor 600 may be a CPU (central processing unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a CPLD (Complex Programmable Logic Device), and the processor may also adopt a multi-core architecture.

[0282] The processor calls the computer program stored in the memory to execute any of the methods provided in the embodiments of the present application according to the obtained executable instructions. The processor and the memory can also be arranged physically separately.

[0283] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0284] See also Figure 7 , an embodiment of the present application provides a quantum attack-resistant key generation device, comprising:

[0285] A one-time signature type value unit 11 is used to determine a one-time signature type value;

[0286] a private key parameter unit 12, configured to determine a first parameter and a second parameter for generating a private key;

[0287] A secret seed unit 13 is used to generate a random number of a preset number of bytes and use the random number as a secret seed;

[0288] A first message unit 14 is configured to generate a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter, and the secret seed;

[0289] a first hash calculation unit 15 configured to group the plurality of first messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each first message in each group, determine, in parallel, a hash value corresponding to each first message in the group using the preset hash function;

[0290] A first secret pre-image array unit 16 is configured to obtain a first secret pre-image array using a hash value corresponding to each of the first messages;

[0291] The private key generation unit 17 is configured to generate a private key using the first secret pre-image array.

[0292] In some embodiments, the number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function;

[0293] The first hash calculation unit 15 is further configured to:

[0294] When the number of the plurality of first messages is not divisible by T, for a last group, where the number of first messages in the last group is less than T, a hash value corresponding to each first message in the group is determined using the following first preset method:

[0295] Generate padded first messages using preset data so that the group includes T first messages;

[0296] Determine in parallel the hash value corresponding to each first message in the group using the preset hash function;

[0297] Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

[0298] In some embodiments, the first hash calculation unit 15 is further configured to:

[0299] Compare the number of first messages in the last group with 1 and T respectively;

[0300] When it is determined that the number of first messages in the last group is closer to T, the hash value corresponding to each first message in the last group is determined using the first preset method.

[0301] In some embodiments, see Figure 8 , the device further comprises:

[0302] A private key determining unit 21 is configured to determine a private key, for example, by obtaining the private key generated by the private key generating unit 17;

[0303] A second message unit 22, configured to generate a plurality of second messages based on the private key;

[0304] a second hash calculation unit 23 configured to group the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in each group, determine, in parallel, a hash value corresponding to each second message in the group using the preset hash function;

[0305] A second secret pre-image array unit 24 is configured to obtain a second secret pre-image array using a hash value corresponding to each of the second messages;

[0306] an intermediate parameter unit 25 for determining intermediate parameters for generating a public key using the second secret preimage array;

[0307] The public key unit 26 is configured to generate a public key using the intermediate parameter, the one-time signature type value used to generate the private key, the first parameter, and the second parameter.

[0308] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0309] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes:

[0310] For the multiple second messages, perform the following processing line by line:

[0311] The p second messages in the current row are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0312] In some embodiments, the plurality of second messages include a second message in row j and column i, where 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value;

[0313] The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes:

[0314] Determine a message sequence to be processed based on the second message in the jth row and the ith column, wherein the second messages in the message sequence to be processed are arranged in order of rows;

[0315] The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and for the second messages in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

[0316] It should be noted that the division of units in the embodiments of the present application is schematic and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0317] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0318] Any of the devices or apparatuses provided in the embodiments of the present application may specifically be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), etc. They may include a central processing unit (CPU), a memory, input / output devices, etc. Input devices may include a keyboard, a mouse, a touch screen, etc. Output devices may include a display device, such as a liquid crystal display (LCD) or a cathode ray tube (CRT).

[0319] The memory may include a read-only memory (ROM) and a random access memory (RAM), and provides program instructions and data stored in the memory to the processor. In an embodiment of the present application, the memory may be used to store the program of any of the methods provided in the embodiments of the present application.

[0320] The processor calls the program instructions stored in the memory, and the processor is used to execute any of the methods provided in the embodiments of the present application according to the obtained program instructions.

[0321] The present application embodiment also provides a computer program product or computer program, which includes computer instructions, which are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions so that the computer device performs any of the methods described in the above embodiments. The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0322] The present invention provides a computer-readable storage medium for storing computer program instructions used by the apparatus provided in the above embodiments of the present invention, which includes a program for executing any of the methods provided in the above embodiments of the present invention. The computer-readable storage medium may be a non-transitory computer-readable medium.

[0323] The computer-readable storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (such as ROMs, EPROMs, EEPROMs, non-volatile memories (NANDFLASH), solid-state drives (SSDs)), etc.

[0324] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) that contain computer-usable program code.

[0325] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0326] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0327] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0328] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A quantum attack-resistant key generation method, characterized in that: The method comprises: Determine the one-time signature type value; and, determining a first parameter and a second parameter for generating a private key respectively; Generate a random number of a preset number of bytes, and use the random number as a secret seed; generating a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter, and the secret seed; Grouping the plurality of first messages according to a parameter representing a parallel processing capability of a preset hash function; wherein the parameter representing the parallel processing capability of the preset hash function represents a number of hash function operations to be executed simultaneously; For the first message in each group, using the preset hash function to determine in parallel the hash value corresponding to each first message in the group; Obtaining a first secret pre-image array using a hash value corresponding to each of the first messages; Generate a private key using the first secret preimage array.

2. The method according to claim 1, characterized in that The number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function; The method further comprises: When the number of the plurality of first messages is not divisible by T, for a last group, where the number of first messages in the last group is less than T, a hash value corresponding to each first message in the group is determined using the following first preset method: Generate padded first messages using preset data so that the group includes T first messages; Determine in parallel the hash value corresponding to each first message in the group using the preset hash function; Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

3. The method according to claim 2, characterized in that The method further comprises: Compare the number of first messages in the last group with 1 and T respectively; When it is determined that the number of first messages in the last group is closer to T, the hash value corresponding to each first message in the last group is determined using the first preset method.

4. The method according to claim 1, wherein The method further comprises: Based on the private key, generating a plurality of second messages; The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to each second message in the group are determined in parallel using the preset hash function; Obtaining a second secret pre-image array using a hash value corresponding to each of the second messages; Determining intermediate parameters for generating a public key using the second secret preimage array; A public key is generated using the intermediate parameter, the one-time signature type value, the first parameter, and the second parameter.

5. A quantum attack-resistant key generation method, characterized in that: The method comprises: Determine the private key; Based on the private key, generating a plurality of second messages; The plurality of second messages are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to each second message in the group are determined in parallel using the preset hash function; wherein the parameter representing the parallel processing capability of the preset hash function represents the number of hash function operations to be executed simultaneously; Obtaining a second secret pre-image array using a hash value corresponding to each of the second messages; Determining intermediate parameters for generating a public key using the second secret preimage array; A public key is generated using the intermediate parameter, the one-time signature type value used to generate the private key, the first parameter, and the second parameter.

6. The method according to claim 5, characterized in that The plurality of second messages include a second message in row j and column i, wherein 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value; The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes: For the multiple second messages, perform the following processing line by line: The p second messages in the current row are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

7. The method according to claim 5, characterized in that The plurality of second messages include a second message in row j and column i, wherein 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value; The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes: Determine a message sequence to be processed based on the second message in the jth row and the ith column, wherein the second messages in the message sequence to be processed are arranged in order of rows; The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and for the second messages in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

8. A quantum attack-resistant key generation device, characterized in that: The device comprises: A one-time signature type value unit, used to determine a one-time signature type value; a private key parameter unit, configured to determine a first parameter and a second parameter for generating a private key; A secret seed unit, configured to generate a random number of a preset number of bytes and use the random number as a secret seed; A first message unit, configured to generate a plurality of first messages based on the one-time signature type value, the first parameter, the second parameter, and the secret seed; a first hash calculation unit, configured to group the plurality of first messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each first message in each group, using the preset hash function to determine, in parallel, a hash value corresponding to each first message in the group; wherein the parameter representing the parallel processing capability of the preset hash function represents a number of hash function operations to be performed simultaneously; a first secret pre-image array unit, configured to obtain a first secret pre-image array using a hash value corresponding to each of the first messages; A private key generation unit is used to generate a private key using the first secret pre-image array.

9. The device according to claim 8, characterized in that The number of first messages included in each group is the same as the parameter value T used to represent the parallel processing capability of the preset hash function; The first hash calculation unit is further configured to: When the number of the plurality of first messages is not divisible by T, for a last group, where the number of first messages in the last group is less than T, a hash value corresponding to each first message in the group is determined using the following first preset method: Generate padded first messages using preset data so that the group includes T first messages; Determine in parallel the hash value corresponding to each first message in the group using the preset hash function; Among the hash values ​​corresponding to the first messages in the group, the hash value corresponding to the padded first message is deleted.

10. The device according to claim 9, characterized in that The first hash calculation unit is further configured to: Compare the number of first messages in the last group with 1 and T respectively; When it is determined that the number of first messages in the last group is closer to T, the hash value corresponding to each first message in the last group is determined using the first preset method.

11. The device according to claim 8, characterized in that The device further comprises: A second message unit, configured to generate a plurality of second messages based on the private key; a second hash calculation unit, configured to group the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in each group, determine, in parallel, a hash value corresponding to each second message in the group using the preset hash function; a second secret pre-image array unit, configured to obtain a second secret pre-image array using a hash value corresponding to each of the second messages; an intermediate parameter unit, configured to determine an intermediate parameter for generating a public key using the second secret preimage array; The public key unit is used to generate a public key using the intermediate parameter, the one-time signature type value, the first parameter and the second parameter.

12. A quantum attack-resistant key generation device, characterized in that: The device comprises: a private key determination unit, configured to determine a private key; A second message unit, configured to generate a plurality of second messages based on the private key; a second hash calculation unit, configured to group the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function; and, for each second message in each group, determine, in parallel, a hash value corresponding to each second message in the group using the preset hash function; wherein the parameter representing the parallel processing capability of the preset hash function represents a number of hash function operations to be executed simultaneously; a second secret pre-image array unit, configured to obtain a second secret pre-image array using a hash value corresponding to each of the second messages; an intermediate parameter unit, configured to determine an intermediate parameter for generating a public key using the second secret preimage array; The public key unit is used to generate a public key using the intermediate parameter, a one-time signature type value used to generate the private key, the first parameter, and the second parameter.

13. The device according to claim 12, characterized in that The plurality of second messages include a second message in row j and column i, wherein 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value; The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes: For the multiple second messages, perform the following processing line by line: The p second messages in the current row are grouped according to a parameter representing a parallel processing capability of a preset hash function; and for each second message in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

14. The device according to claim 12, characterized in that The plurality of second messages include a second message in row j and column i, wherein 0<=i <p,0<=j<2 w -1; p represents the number of secret pre-image arrays corresponding to the private key, and w is a preset value; The step of grouping the plurality of second messages according to a parameter representing a parallel processing capability of a preset hash function, and determining, for each second message in each group, a hash value corresponding to each second message in the group using the preset hash function in parallel, includes: Determine a message sequence to be processed based on the second message in the jth row and the ith column, wherein the second messages in the message sequence to be processed are arranged in order of rows; The second messages in the sequence of messages to be processed are grouped according to a parameter representing a parallel processing capability of a preset hash function, and for the second messages in each group, hash values ​​corresponding to the respective second messages in the group are determined in parallel using the preset hash function.

15. An electronic device, characterized in that: include: a memory for storing program instructions; A processor, configured to call the program instructions stored in the memory and execute the method according to any one of claims 1 to 7 according to the obtained program.

16. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the method according to any one of claims 1 to 7.

Images