Quantum attack-resistant key generation, signature method, device, system, and equipment

Abstract

The present application discloses a quantum attack-resistant key generation and signature method, apparatus, system, and device, which are used to improve key security and reduce the overall key leakage risk caused by the leakage of a key by a single party through the collaboration between the server and the terminal. The key generation method applied to the server side provided in the present application includes: determining a first seed random number for generating a key on the server side; generating first pseudo-random information based on the first seed random number, wherein the first pseudo-random information includes: a first component of the public key on the server side; determining a first intermediate variable for generating a second component of the public key for the first terminal based on the first pseudo-random information; sending the first component of the public key and the first intermediate variable to the first terminal, for the first terminal to generate and publish a public key based on the first component of the public key and the first intermediate variable.

Description

Technical Field

[0001] The present application relates to the field of digital signature technology, and in particular to quantum attack-resistant key generation, signature methods, devices, systems, and equipment. Background Art

[0002] ML-DSA is a digital signature algorithm standardized in the FIPS204 standard. This algorithm is a standardized version of Dilithium, the final algorithm selected for the post-quantum cryptography project.

[0003] To address the issue of key security, existing technologies typically deploy cryptographic algorithms in a secure environment to reduce the risk of private key leakage. However, despite deploying cryptographic algorithms in a secure environment, these technologies still pose the risk of single points of failure. For example, the advent of quantum computers significantly reduces the computational cost of cracking such keys, threatening the security of existing digital signature systems. Once a secure environment is breached or fails, the key may be leaked or damaged, compromising the security of the entire digital signature system. Summary of the Invention

[0004] The embodiments of the present application provide quantum-resistant key generation and signing methods, devices, systems, and equipment, which are used to improve key security through collaboration between the server and the terminal side, and reduce the overall key leakage risk caused by the leakage of the key by a single party.

[0005] An embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to a server side. The method includes:

[0006] Determining a first seed random number for generating a key on the server side;

[0007] Generate first pseudo-random information according to the first seed random number, wherein the first pseudo-random information includes: a first component of the public key of the server side;

[0008] Determining, based on the first pseudo-random information, a first intermediate variable for generating a second component of a public key by the first terminal;

[0009] The first component of the public key and the first intermediate variable are sent to a first terminal, so that the first terminal generates and publishes a public key based on the first component of the public key and the first intermediate variable.

[0010] In an embodiment of the present application, a key generation method is applied to a server side to determine a first seed random number for generating a key on the server side; first pseudo-random information is generated based on the first seed random number, wherein the first pseudo-random information includes: a first component of a public key on the server side; based on the first pseudo-random information, a first intermediate variable for generating a second component of a public key on a first terminal is determined; and the first component of the public key and the first intermediate variable can be sent to the first terminal, so that the first terminal generates and publishes a public key based on the first component of the public key and the first intermediate variable, thereby realizing collaborative key generation between the server and terminal sides, improving key security, and reducing the overall key leakage risk caused by a single party leaking a key.

[0011] Accordingly, an embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to a terminal side. The method includes:

[0012] Receiving a first component of a public key and a first intermediate variable sent by a server, where the first intermediate variable is used by the first terminal to generate a second component of the public key;

[0013] generating a public key matrix according to the first component of the public key;

[0014] Determining a second seed random number for generating a key on the first terminal side;

[0015] Generate second pseudo-random information according to the second seed random number, where the second pseudo-random information includes: private key seed information of the first terminal side;

[0016] generating a partial component of the private key on the first terminal side according to the private key seed information on the first terminal side;

[0017] generating a second intermediate variable according to the public key matrix and a partial component of the private key on the first terminal side;

[0018] determining a third intermediate variable based on the first intermediate variable and the second intermediate variable;

[0019] Determining a second component of the public key using the third intermediate variable;

[0020] A public key is generated and published using the first component and the second component of the public key.

[0021] It can be seen that, corresponding to the quantum attack-resistant key generation method on the server side provided in the above-mentioned embodiment of the present application, the embodiment of the present application also provides a quantum attack-resistant key generation method on the terminal side. The terminal side receives the first component and the first intermediate variable of the public key sent by the server, and generates and publishes the public key on the terminal side based on the first component and the first intermediate variable of the public key sent by the server, thereby realizing collaborative key generation between the server and the terminal side, improving key security, and reducing the overall key leakage risk caused by the leakage of the key by a single party.

[0022] Accordingly, an embodiment of the present application provides a signature method resistant to quantum attacks, which is applied to a terminal side. The method includes:

[0023] Generate a first signature random number for signing on the first terminal side;

[0024] Using the preset context information, the message to be signed is preprocessed to obtain a preprocessed message to be signed;

[0025] Determine a first portion of information using a partial component of the private key on the first terminal side, the first signature random number, and the preprocessed message to be signed, and send the first portion of information to the server;

[0026] receiving first feedback information sent by the server, which is determined based on the first partial information and a partial component of the private key on the server side;

[0027] Using the first feedback information, determining the second part of information and sending it to the server;

[0028] receiving second feedback information sent by the server, which is determined based on the second partial information and a partial component of the private key on the server side;

[0029] A signature result is generated for the message to be signed using the second feedback information and a partial component of the private key on the first terminal side.

[0030] It can be seen that corresponding to the collaborative key generation method between the server and terminal sides provided in the above-mentioned embodiment of the present application, the embodiment of the present application further provides a signature method on the terminal side that is resistant to quantum attacks, by sending the first part of information to the server side and receiving the corresponding first feedback information sent by the server side, and based on this, further sending the second part of information to the server side and receiving the corresponding second feedback information sent by the server side, finally, the second feedback information sent by the server side and the partial component of the private key on the terminal side can be used to complete the signature of the message to be signed, thereby further realizing the collaborative signature of the server and the terminal side on the basis of the collaborative key generation between the server and the terminal side, thereby improving the security of the digital signature.

[0031] Accordingly, an embodiment of the present application provides a signature method resistant to quantum attacks, which is applied to the server side. The method includes:

[0032] receiving a first portion of information sent by a first terminal;

[0033] generating, based on the first partial information and a partial component of the private key on the server side, and sending first feedback information to the first terminal, so that the first terminal generates second partial information based on the first feedback information;

[0034] receiving the second part of information sent by the terminal side;

[0035] Based on the second partial information and a partial component of the private key on the server side, second feedback information is generated and sent to the first terminal, so that the first terminal generates a signature result based on the second feedback information.

[0036] An embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a server side. The device includes:

[0037] A first seed random number unit, used to determine a first seed random number for generating a key on the server side;

[0038] A first pseudo-random information unit is configured to generate first pseudo-random information according to the first seed random number, wherein the first pseudo-random information includes: a first component of the public key of the server side;

[0039] a first intermediate variable unit, configured to determine, based on the first pseudo-random information, a first intermediate variable for generating a second component of a public key for the first terminal;

[0040] A sending unit is configured to send the first component of the public key and the first intermediate variable to a first terminal, so that the first terminal generates and publishes a public key based on the first component of the public key and the first intermediate variable.

[0041] It can be seen that corresponding to the terminal-side quantum attack-resistant signature method provided in the above-mentioned embodiment of the present application, the embodiment of the present application further provides a server-side quantum attack-resistant signature method, by receiving the first part of information sent by the terminal side, sending corresponding first feedback information to the terminal side, and further receiving the second part of information sent by the terminal side, and the corresponding second feedback information sent to the terminal side, so that the terminal side can use the second feedback information sent by the server side to complete the signature of the message to be signed, thereby further realizing the collaborative signature of the server and the terminal side on the basis of the collaborative key generation between the server and the terminal side, and improving the security of the digital signature.

[0042] An embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a terminal side. The device includes:

[0043] a receiving unit, configured to receive a first component of a public key and a first intermediate variable sent by a server, wherein the first intermediate variable is used by the first terminal to generate a second component of the public key;

[0044] a public key matrix unit, configured to generate a public key matrix according to the first component of the public key;

[0045] A second seed random number unit, configured to determine a second seed random number for generating a key on the first terminal side;

[0046] A second pseudo-random information unit is configured to generate second pseudo-random information according to the second seed random number, wherein the second pseudo-random information includes: private key seed information of the first terminal side;

[0047] a private key component unit, configured to generate a partial component of the private key on the first terminal side according to the private key seed information on the first terminal side;

[0048] A second intermediate variable unit, configured to generate a second intermediate variable according to the public key matrix and a partial component of the private key on the first terminal side;

[0049] a third intermediate variable unit, configured to determine a third intermediate variable based on the first intermediate variable and the second intermediate variable;

[0050] A second component unit, configured to determine a second component of the public key using the third intermediate variable;

[0051] The public key unit is used to generate and publish a public key using the first component and the second component of the public key.

[0052] An embodiment of the present application provides a quantum attack-resistant signature device, which is applied to a terminal. The device includes:

[0053] A first signature random number unit, used to generate a first signature random number for signing on the first terminal side;

[0054] A preprocessing unit, configured to preprocess the message to be signed using preset context information to obtain a preprocessed message to be signed;

[0055] a first part of information sending unit, configured to determine the first part of information by using a partial component of the private key on the first terminal side, the first signature random number, and the pre-processed message to be signed, and send the first part of information to the server;

[0056] a first feedback information receiving unit, configured to receive first feedback information sent by the server, determined based on the first partial information and a partial component of the private key on the server side;

[0057] A second part information sending unit, configured to determine the second part information by using the first feedback information and send the second part information to the server;

[0058] A second feedback information receiving unit is configured to receive second feedback information sent by the server, the second partial information being determined based on a partial component of the private key on the server side;

[0059] The signing unit is configured to generate a signature result for the message to be signed by using the second feedback information and a partial component of the private key on the first terminal side.

[0060] An embodiment of the present application provides a quantum attack-resistant signature device, which is applied to a server. The device includes:

[0061] A first part of information receiving unit, configured to receive the first part of information sent by the first terminal;

[0062] a first feedback information sending unit, configured to generate and send first feedback information to the first terminal based on the first partial information and a partial component of the private key on the server side, so that the first terminal generates second partial information based on the first feedback information;

[0063] A second part information receiving unit, configured to receive the second part information sent by the terminal side;

[0064] The second feedback information sending unit is configured to generate and send second feedback information to the first terminal based on the second partial information and a partial component of the private key on the server side, so that the first terminal generates a signature result based on the second feedback information.

[0065] An embodiment of the present application provides a system including: a server and a first terminal;

[0066] The server is used to:

[0067] Determining a first seed random number for generating a key on the server side;

[0068] Generate first pseudo-random information according to the first seed random number, wherein the first pseudo-random information includes: a first component of the public key of the server side;

[0069] Determining, based on the first pseudo-random information, a first intermediate variable for generating a second component of a public key by the first terminal;

[0070] sending the first component of the public key and the first intermediate variable to a first terminal, so that the first terminal generates and publishes a public key based on the first component of the public key and the first intermediate variable;

[0071] The first terminal is configured to:

[0072] Receiving a first component of a public key and a first intermediate variable sent by a server, where the first intermediate variable is used by the first terminal to generate a second component of the public key;

[0073] generating a public key matrix according to the first component of the public key;

[0074] Determining a second seed random number for generating a key on the first terminal side;

[0075] Generate second pseudo-random information according to the second seed random number, where the second pseudo-random information includes: private key seed information of the first terminal side;

[0076] generating a partial component of the private key on the first terminal side according to the private key seed information on the first terminal side;

[0077] generating a second intermediate variable according to the public key matrix and a partial component of the private key on the first terminal side;

[0078] determining a third intermediate variable based on the first intermediate variable and the second intermediate variable;

[0079] Determining a second component of the public key using the third intermediate variable;

[0080] Generate and publish a public key using the first component and the second component of the public key;

[0081] and / or,

[0082] The first terminal is configured to:

[0083] Generate a first signature random number for signing on the first terminal side;

[0084] Using the preset context information, the message to be signed is preprocessed to obtain a preprocessed message to be signed;

[0085] Determine a first portion of information using a partial component of the private key on the first terminal side, the first signature random number, and the preprocessed message to be signed, and send the first portion of information to the server;

[0086] receiving first feedback information sent by the server, which is determined based on the first partial information and a partial component of the private key on the server side;

[0087] Using the first feedback information, determining the second part of information and sending it to the server;

[0088] receiving second feedback information sent by the server, which is determined based on the second partial information and a partial component of the private key on the server side;

[0089] Generate a signature result for the message to be signed using the second feedback information and a partial component of the private key on the first terminal side;

[0090] The server is used to:

[0091] receiving a first portion of information sent by a first terminal;

[0092] generating, based on the first partial information and a partial component of the private key on the server side, and sending first feedback information to the first terminal, so that the first terminal generates second partial information based on the first feedback information;

[0093] receiving the second part of information sent by the terminal side;

[0094] Based on the second partial information and a partial component of the private key on the server side, second feedback information is generated and sent to the first terminal, so that the first terminal generates a signature result based on the second feedback information.

[0095] Another embodiment of the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store program instructions, and the processor is used to call the program instructions stored in the memory and execute any of the above methods according to the obtained program.

[0096] Another embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute any of the above methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0098] Figures 1 to 3 A schematic diagram of a process for generating a key on a server side according to an embodiment of the present application;

[0099] Figure 4 、 Figure 5A schematic diagram of a flow chart of a key generation method applied to a first terminal side provided in an embodiment of the present application;

[0100] Figure 6 A schematic diagram of a flow chart of a signature method applied to a first terminal side provided in an embodiment of the present application;

[0101] Figure 7 A schematic diagram of a flow chart of a signature method applied to a server side provided in an embodiment of the present application;

[0102] Figure 8 A schematic diagram of a system architecture provided in an embodiment of the present application;

[0103] Figure 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0104] Figure 10 A schematic diagram of the structure of a quantum attack-resistant key generation device on the server side provided in an embodiment of the present application;

[0105] Figure 11 A schematic diagram of the structure of a quantum attack-resistant key generation device on the terminal side provided in an embodiment of the present application;

[0106] Figure 12 A schematic diagram of the structure of a quantum attack-resistant signature device on the terminal side provided in an embodiment of the present application;

[0107] Figure 13 A schematic diagram of the structure of a quantum attack-resistant signature device on the server side provided in an embodiment of the present application. DETAILED DESCRIPTION

[0108] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0109] The embodiments of the present application provide quantum-resistant key generation and signing methods, devices, systems, and equipment, which are used to improve key security through collaboration between the server and the terminal side, and reduce the overall key leakage risk caused by the leakage of the key by a single party.

[0110] Among them, the method and the device, the equipment, and the medium are based on the same application concept. Since the principles of solving problems by the method and the device and the medium are similar, the implementation of the device, the medium, and the method can refer to each other, and the repeated parts will not be repeated.

[0111] The terms "first", "second", etc. (if any) in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0112] The following examples and embodiments are to be understood as illustrative examples only. Although this specification may refer to "one," "an," or "some" examples or embodiments at several places, this does not mean that each such reference relates to the same example or embodiment, nor does it mean that the feature applies only to a single example or embodiment. Individual features of different embodiments may also be combined to provide further embodiments. Furthermore, terms such as "comprises" and "comprising" should be understood as not limiting the described embodiments to consisting only of those features already mentioned; such examples and embodiments may also include features, structures, units, modules, etc. that are not specifically mentioned.

[0113] The following describes in detail the various embodiments of the present application in conjunction with the accompanying drawings. It should be noted that the order in which the embodiments of the present application are presented only represents the order of the embodiments, and does not represent the advantages or disadvantages of the technical solutions provided by the embodiments.

[0114] Based on the ML-DSA algorithm, the embodiment of the present application further solves the potential risks in the management of signature private keys, especially the single point failure problem that may be caused by the loss of private keys. The embodiment of the present application proposes a digital signature scheme based on two-party collaboration, which aims to strengthen the private key protection mechanism of the ML-DSA algorithm through multi-party participation. The embodiment of the present application adopts key splitting and distributed computing methods. The two participants on the server side and the terminal side jointly generate the public key, and the private key is not concentrated on a single party, thereby avoiding the key failure problem at a single point (terminal side). Each participant only holds part of the key information and cannot independently restore the complete private key, thereby effectively improving the security and robustness of the system. The embodiment of the present application has efficient computing performance and scalability, and can adapt to different application scenarios.

[0115] In the embodiment of the present application, a public key is first generated through collaboration between the server and the terminal. Then, during the signing process, both parties must jointly participate in the signature operation, ensuring that even if the key of one party is leaked or lost, an attacker cannot easily obtain the complete key or forge the signature information.

[0116] The relevant symbols and parameters involved in the method provided in the embodiment of this application are introduced as follows:

[0117] q: represents a prime number, for example: 8380417=2 23 -2 13 +1.

[0118] The ring of integers.

[0119] R: a polynomial ring, for example:

[0120] R q :express Polynomial rings over , for example: R q For example, any element in

[0121]

[0122] ||f|| ∞ : represents the infinite norm of f, when f=f0+f1X+…+f n-1 X n-1 hour, Represents a byte, whose value is, for example, the set {0,1,…,255}.

[0123] T q :express The set of 256-dimensional vectors, that is, the set

[0124] H(*,len): The public hash function H generates a hash value of length len based on the input information.

[0125] H′: Public sponge hash function, consisting of three functions: initialization function H′.init(), absorption function H′.Absord(state,m), and squeeze function H′.Squeeze(state,l), where:

[0126] The initialization function H′.init() is used to initialize the internal state of the function H′;

[0127] The absorption function H′.Absord(state,m) is used to update the internal state state according to the message m;

[0128] The squeeze function H′.Squeeze(state,l) is used to generate a pseudo-random value output of l bytes based on the current internal state state.

[0129] Gen(S,seed): Generates random variables in space S in a deterministic way according to the seed seed.

[0130] Sample(S,seed,range): Generates a random variable with a range in space S by sampling from seed seed.

[0131] (k,l): the order of the public key matrix;

[0132] η: the parameter of the distribution of the private key component;

[0133] γ1: random vector y S ,y A The parameters of the distribution obeyed by etc.

[0134] d: Parameters used to decompose intermediate variables during the key generation phase;

[0135] γ2: Parameters used to decompose intermediate variables in the signature phase;

[0136] η′: the parameter of the distribution of the error vector introduced by the collaborative scheme, η′ takes values ​​such as 2 and 4;

[0137] β: coefficient control parameter;

[0138] τ: The upper limit of the Hamming weight of the verifier’s challenge information.

[0139] It should be noted that, in the embodiment of the present application, when the input information is a vector, the correlation algorithm means performing correlation operations on each component in the vector respectively.

[0140] The values ​​of the above-mentioned related parameters are shown in Table 1 below:

[0141]

[0142]

[0143] Table 1

[0144] The following are examples from different aspects.

[0145] See also Figure 1 The embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to the server side (the algorithm for collaborative key generation between the server and the first terminal is, for example, represented by DML-DSA.KeyGen). The method includes:

[0146] S101, determining a first seed random number for generating a key on the server side;

[0147] For example, generating a random seed number on the server side

[0148] S102: Generate first pseudo-random information according to the first seed random number, where the first pseudo-random information includes: a first component of the public key of the server side;

[0149] For example, based on the seed random number, the first pseudo-random information on the server side is derived in the following manner:

[0150]

[0151] Wherein, k and l are preset parameters, each occupying one byte, and their specific values ​​are shown in Table 1 above;

[0152] ρ represents the first component of the public key on the server side, and can also be used to represent the first component of the private key on the server side, that is, the first component of the public key on the server side is the same as the first component of the private key;

[0153] ρ′ S Indicates the private key seed information on the server side;

[0154] K S The second component of the server's private key.

[0155] S103. Determine, based on the first pseudo-random information, a first intermediate variable for generating a second component of a public key by the first terminal;

[0156] The second component used for the first terminal to generate a public key is, for example, represented as t1;

[0157] The first intermediate variable used by the first terminal to generate the second component of the public key is, for example, represented by t′.

[0158] In some embodiments, the first pseudo-random information further includes: the server-side private key seed information ρ′ S ;

[0159] Determining, based on the pseudo-random information, a first intermediate variable for generating a second component of a public key by the first terminal includes:

[0160] Step 1: Generate a public key matrix based on the first component of the public key;

[0161] For example, the public key matrix A is generated according to the first component ρ of the public key in the following manner:

[0162]

[0163] Among them, q is also a preset parameter, and its specific value is shown in Table 1 above;

[0164] Step 2: Generate components of the server-side private key based on the server-side private key seed information;

[0165] For example, based on the private key seed information on the server side, the fourth component s′1 and the fifth component s′2 of the private key on the server side are generated using the following formula:

[0166] (s′1,s′2)=Sample((R l ,R k ),ρ′ S ,[-η / 2,η / 2]);

[0167] Wherein, η is also a preset parameter, and its specific value is shown in Table 1 above;

[0168] Step 3: Determine a first intermediate variable for generating a second component of a public key by the first terminal based on the public key matrix and the components of the private key on the server side.

[0169] For example, based on the public key matrix, the fourth component and the fifth component of the private key on the server side, the first intermediate variable t′ used to generate the second component of the public key on the first terminal side is calculated using the following formula:

[0170] t′=As′1+s′2.

[0171] S104: Send the first component of the public key and the first intermediate variable to a first terminal, so that the first terminal generates and publishes a public key based on the first component of the public key and the first intermediate variable.

[0172] The public key published by the first terminal is, for example: pk=(ρ, t1).

[0173] The first component of the public key and the first intermediate variable used to generate the second component of the public key on the first terminal side, that is, ρ,t′.

[0174] In some embodiments, see Figure 2 , the method further comprises:

[0175] S105. Receive a second intermediate variable (e.g., denoted as t″) sent by the first terminal; the second intermediate variable is determined by the first terminal using the first component of the public key sent by the server;

[0176] S106. Calculate a third intermediate variable based on the first intermediate variable and the second intermediate variable; for example: t=t′+t″;

[0177] S107. Determine a second component of the public key of the server based on the third intermediate variable.

[0178] For example, decomposing the third intermediate variable t, we get (t1, t0);

[0179] Among them, (t1, t0) satisfies t≡t12 d +t0 mod q, t0=t mod ± 2 d ;

[0180] t1 represents the second component of the public key, and t0 represents the sixth component of the server-side private key;

[0181] S108. Compare the public key of the server obtained by using the first component of the public key of the server and the second component of the public key of the server with the public key published by the first terminal;

[0182] For example, the public key pk=(ρ, t1) on the server side is compared with the public key pk=(ρ, t1) published by the first terminal.

[0183] S109: When the public key on the server side is different from the public key published by the first terminal, the key generation process is triggered to be re-executed, that is, the process returns to step S101.

[0184] In some embodiments, the first pseudo-random information further includes: private key seed information of the server side, and a second component of the private key of the server side;

[0185] See also Figure 3 , the method further comprises:

[0186] S110. Determine a third component of the private key of the server based on the public key of the server.

[0187] The third component of the server-side private key, for example: tr = H(pk, 64);

[0188] S111. Generate a fourth component and a fifth component of the server-side private key according to the server-side private key seed information;

[0189] For example, the fourth component s′1 and the fifth component s′2 of the server-side private key are generated using the following formula:

[0190] (s′1,s′2)=Sample((R l ,R k ),ρ′ S ,[-η / 2,η / 2]);

[0191] Wherein, η is also a preset parameter, and its specific value is shown in Table 1 above;

[0192] S112. Determine a sixth component of the server-side private key based on the third intermediate variable.

[0193] For example, decomposing the third intermediate variable t, we get (t1, t0);

[0194] Among them, (t1, t0) satisfies t≡t12 d +t0 mod q, t0=t mod ± 2 d ;

[0195] t1 represents the second component of the public key, and t0 represents the sixth component of the server-side private key;

[0196] S113. Obtain the private key of the server side by using the first component, the second component, the third component, the fourth component, the fifth component, and the sixth component of the private key of the server side.

[0197] The private key of the server side, for example: sk′=(ρ,K S ,tr,s′1,s′2,t0).

[0198] Among them, the two components tr and t0 are optional for the server side, that is, in the subsequent signing process, the server side may not use these two components.

[0199] Accordingly, see Figure 4 , an embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to a terminal side, and the method includes:

[0200] S201: Receive a first component of a public key and a first intermediate variable sent by a server, where the first intermediate variable is used by a first terminal to generate a second component of a public key;

[0201] The first component of the public key sent by the server and the first intermediate variable, such as ρ,t′

[0202] S202. Generate a public key matrix according to the first component of the public key;

[0203] For example, based on the first component ρ of the public key, generate the public key matrix:

[0204]

[0205] Among them, k, l, q are all preset parameters, and their specific values ​​are shown in Table 1 above;

[0206] S203: Determine a second seed random number for generating a key on the first terminal side;

[0207] For example, generate

[0208] S204: Generate second pseudo-random information based on the second seed random number, where the second pseudo-random information includes: private key seed information of the first terminal side;

[0209] For example, according to the seed random number ξ″, the second pseudo-random information on the first terminal side is derived:

[0210] Among them, k and l each occupy one byte;

[0211] Among them, ρ′ A Indicates the private key seed information of the first terminal side, K A a second component representing a private key on the first terminal side;

[0212] S205: Generate a partial component of the private key on the first terminal side according to the private key seed information on the first terminal side;

[0213] For example, according to the private key seed information ρ′ on the first terminal side A , generate the fourth and fifth components of the private key on the first terminal side:

[0214] (s″1,s″2)=Sample((R l ,R k ),ρ′ A ,[-η / 2,η / 2]);

[0215] S206. Generate a second intermediate variable according to the public key matrix and some components of the private key on the first terminal side;

[0216] For example, based on the public key matrix, the fourth component and the fifth component of the private key on the first terminal side, the second intermediate variable is calculated:

[0217] t″=As″1+s″2;

[0218] S207. Determine a third intermediate variable based on the first intermediate variable and the second intermediate variable;

[0219] For example, the third intermediate variable t is calculated using the following formula:

[0220] t=t′+t″;

[0221] S208. Determine the second component of the public key using the third intermediate variable;

[0222] For example, decomposing the third intermediate variable, we get (t1, t0);

[0223] Among them, (t1, t0) satisfies:

[0224] t≡t12 d +t0 mod q;

[0225] t0=t mod ± 2 d ;

[0226] Wherein, t1 represents the second component of the public key, and t0 represents the sixth component of the private key on the first terminal side;

[0227] S209: Generate and publish a public key using the first component and the second component of the public key;

[0228] Public key, for example: pk = (ρ, t1).

[0229] In some embodiments, the second pseudo-random information further includes: a second component of the private key of the first terminal side;

[0230] The partial components of the private key on the first terminal side include the fourth component and the fifth component of the private key on the first terminal side.

[0231] See also Figure 5 , the method further comprises:

[0232] S210: Determine the third component of the private key of the first terminal side using the public key;

[0233] For example, the third component of the private key on the first terminal side is calculated using the public key:

[0234] tr=H(pk,64);

[0235] Among them, tr also represents the hash value of the public key pk;

[0236] S211. Determine the sixth component of the private key of the first terminal side using the third intermediate variable;

[0237] For example, decomposing the third intermediate variable, we get (t1, t0);

[0238] Among them, (t1, t0) satisfies:

[0239] t≡t12 d +t0 mod q;

[0240] t0=t mod ± 2 d ;

[0241] Wherein, t1 represents the second component of the public key, and t0 represents the sixth component of the private key on the first terminal side;

[0242] S212. Use the first component of the public key as the first component of the private key on the first terminal side, and use the first component, second component, third component, fourth component, fifth component, and sixth component of the private key on the first terminal side to obtain the private key on the first terminal side.

[0243] The private key of the first terminal side, for example: sk″=(ρ,K A ,tr,s″1,s″2,t0).

[0244] In some embodiments, the method further comprises:

[0245] The second intermediate variable (eg, t″) is sent to the server, so that the server generates a second component of the public key of the server and a component of the private key of the server.

[0246] Accordingly, the following introduces the algorithm DML-DSA.Sign provided by the embodiment of the present application for the first terminal and the server to jointly sign the message.

[0247] See also Figure 6 , an embodiment of the present application provides a signature method for resisting quantum attacks applied to a terminal side, including:

[0248] S301: Generate a first signature random number for signing on the first terminal side;

[0249] In the embodiment of the present application, the message to be signed inputted on the first terminal side is represented as M, for example;

[0250] S302: Preprocess the message to be signed using the preset context information to obtain a preprocessed message to be signed;

[0251] The preset context information is represented as ctx, for example, and the ctx value during signature and signature verification is the same.

[0252] S303: Determine the first portion of information (e.g., μ, ρ″, respectively) using the partial components of the private key on the first terminal side, the first signature random number, and the pre-processed message to be signed. A ) and send it to the server;

[0253] S304: Receive first feedback information (e.g., represented as ρ″) determined based on the first partial information and a partial component of the private key on the server side, sent by the server. S , counter);

[0254] S305: Using the first feedback information, determine the second part of information (for example, respectively represented as counter, w A) and send it to the server;

[0255] S306, receiving the second feedback information (for example, respectively represented as );

[0256] S307: Generate a signature result for the message to be signed by using the second feedback information and a partial component of the private key on the first terminal side.

[0257] In some embodiments, determining the first portion of information using a partial component of the private key on the first terminal side and sending the first portion of information to the server includes:

[0258] Calculating a hash value (e.g., represented as μ) of the preprocessed message to be signed using the third component of the private key on the first terminal side;

[0259] Calculating a random seed on the first terminal side using the hash value, the second component of the private key on the first terminal side, and the first signature random number;

[0260] The hash value and the random seed of the first terminal side (for example, represented by ρ A ), which is sent to the server as the first part of the information.

[0261] In some embodiments, using the first feedback information to determine the second portion of information and sending it to the server includes:

[0262] Based on the random seed on the first terminal side and the second component (ie, counter) of the first feedback information, a random vector (eg, represented by y A );

[0263] Based on the random seed on the first terminal side, a first random error vector (e.g., represented as e) on the first terminal side is generated. A );

[0264] The original value of the commitment information on the first terminal side (for example, represented by w A ); wherein, in cryptography, the commitment information is an important key primitive of the commitment protocol, that is, the sender commits to a selected value (or statement) and keeps it hidden from the recipient, while the recipient can subsequently verify the value committed by the sender.

[0265] Updating the second component of the first feedback information (eg, counter=counter+1);

[0266] The updated second component of the first feedback information and the original value of the commitment information on the first terminal side are sent to the server as the second part of information.

[0267] In some embodiments, generating a signature result for the message to be signed using the second feedback information and a partial component of the private key on the first terminal side includes:

[0268] Using the second component of the second feedback information (for example, represented by c), the random vector (y A ), the fourth component (s″1) of the private key of the first terminal side, and determining the intermediate value of the second component used to calculate the signature value (for example, represented by z A );

[0269] Determine a second component (for example, represented as z) of the signature value on the first terminal side by using the intermediate value and the second feedback information;

[0270] Using the first component (ρ″) of the first feedback information S ), and a random seed on the first terminal side, to determine a random variable (for example, represented as Δ) shared between the server and the first terminal;

[0271] Using the random variable shared between the server and the first terminal, and the first random error vector on the first terminal side (for example, represented by e A ), determine the second random error vector on the first terminal side (for example, represented by e′ A );

[0272] Determine the intermediate variable on the first terminal side, and calculate the third component of the signature value on the first terminal side by using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side;

[0273] In some embodiments, determining the intermediate variable on the first terminal side, and calculating the third component of the signature value on the first terminal side using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side includes:

[0274] Calculating an intermediate variable on the first terminal side (e.g., represented as w″) based on the second component of the second feedback information, the fourth component of the second feedback information, the fifth component of the private key on the first terminal side, and the second random error vector on the first terminal side;

[0275] Decomposing the intermediate variable on the first terminal side to obtain a first decomposition result and a second decomposition result;

[0276] Determining whether it is necessary to trigger re-execution of the signing process based on the second component of the signature value and / or the first decomposition result and the second decomposition result of the intermediate variable on the first terminal side;

[0277] If yes, update the second component of the first feedback information again (for example, counter=counter+1), and send the updated count value to the server to trigger the server to re-execute the signing process;

[0278] Otherwise, calculating a third component (for example, represented as h) of the signature value on the first terminal side by using the second component (c) of the second feedback information, the sixth component (t0) of the private key on the first terminal side, and the intermediate variable on the first terminal side;

[0279] A signature result is determined based on the third component of the signature value on the first terminal side.

[0280] In some embodiments, determining a signature result based on the third component of the signature value on the first terminal side includes:

[0281] Determining whether it is necessary to trigger re-execution of the signing process based on the third component of the signature value on the first terminal side and / or the second component of the second feedback information and the sixth component of the private key on the first terminal side;

[0282] If yes, update the second component of the first feedback information again (for example, counter=counter+1), and send the updated count value to the server to trigger the server to re-execute the signing process;

[0283] Otherwise, the first component, the second component, and the third component of the signature value on the first terminal side are used to obtain the signature result (for example ), wherein the first component of the signature value on the first terminal side (ie ) is the first component in the second feedback information.

[0284] Accordingly, see Figure 7 , an embodiment of the present application provides a quantum attack-resistant signature method applied to a server side, including:

[0285] S401, receiving a first portion of information sent by a first terminal;

[0286] S402: Generate and send first feedback information to the first terminal based on the first partial information and a partial component of the private key on the server side, so that the first terminal generates second partial information based on the first feedback information;

[0287] S403, receiving the second part of information sent by the terminal side;

[0288] S404: Generate and send second feedback information to the first terminal based on the second partial information and a partial component of the private key on the server side, so that the first terminal generates a signature result based on the second feedback information.

[0289] In some embodiments, generating and sending first feedback information to the first terminal based on the first partial information and a partial component of the server-side private key includes:

[0290] Generate a second random number for signature on the server side (for example, represented as r S );

[0291] Based on the first component of the first part of the information and the second signature random number used for signing on the server side, the random seed (ρ″) on the server side is calculated. S ), and sending the random seed on the server side as the first component of the first feedback information to the first terminal;

[0292] Setting the initial values ​​of some components of the signature value (for example, represented by z and h, respectively) to terminators; or, upon receiving a message from the first terminal triggering re-execution of the signing process, setting some components of the signature value to terminators;

[0293] Generate a random vector on the server side using the random seed on the server side and the current count value;

[0294] generating a first random error vector on the server side by using the random seed on the server side;

[0295] Determining the original value of the commitment information on the server side using a public key matrix, a random vector on the server side, and a first random error vector on the server side, wherein the public key matrix is ​​a public key matrix (A) generated based on the first component (ρ) of the private key on the server side;

[0296] The counter value is updated (for example, counter=counter+1), and the updated counter value is sent to the first terminal as the second component of the first feedback information.

[0297] In some embodiments, generating and sending second feedback information to the first terminal based on the second partial information and a partial component of the server-side private key includes:

[0298] According to the second component of the second part of the information and the original value of the commitment information on the server side (ie, w S), calculate the original value of the signature commitment information; wherein the second component of the second part of the information is the original value of the commitment information on the first terminal side (ie w A );

[0299] Determine whether the original value of the signature commitment information does not meet the preset requirements; for example, determine whether the following conditions are met:

[0300]

[0301] If yes (i.e. the original value w of the signature commitment information is invalid), then update the counter value counter = counter + 1 and re-execute the signing process (i.e. re-use the random seed on the server side and the current count value to generate the random vector on the server side and execute the subsequent process);

[0302] Otherwise (i.e., the original value w of the signature commitment information is valid), decompose the original value of the signature commitment information to obtain the signature commitment information;

[0303] determining a plurality of components of second feedback information based on the signature commitment information and a partial component of the private key of the server side;

[0304] Sending multiple components of the second feedback information to the first terminal.

[0305] In some embodiments, determining multiple components of the second feedback information based on the signature commitment information and partial components of the server-side private key includes:

[0306] Calculate the hash value of the signature commitment information (for example, expressed as ), and used as the first component of the second feedback information;

[0307] Calculate the verifier's challenge information (e.g., denoted as c) based on the hash value of the signature commitment information, and use it as the second component of the second feedback information;

[0308] Using the random vector on the server side (for example, represented by y S ), the challenge information of the signature verifier (c), the fourth component of the private key of the server side (s′1), and the third component of the second feedback information (e.g., z S =y S +cs′1);

[0309] Based on the first random error vector on the server side and the random variable shared between the server and the first terminal, the second random error vector on the server side (e.g., e′ S =e S -Δ);

[0310] Based on the original value (w) of the signature commitment information, the challenge information (c) of the verifier, the fifth component (s′2) of the private key on the server side, the second random error vector (e′ S ), and obtain the fourth component of the second feedback information (e.g., w′=w-cs′2-e′ S );

[0311] The first component, the second component, the third component, and the fourth component of the second feedback information are sent to the first terminal (i.e., c, z S ,w′, where the second component c can also be not sent, and the terminal side can generate the first component based on Obtain the second component c).

[0312] A specific embodiment is given below to illustrate the entire process of the first terminal and the server jointly executing the signature.

[0313] The collaborative signature process provided in the embodiment of the present application includes five sub-processes, among which the first, third and fifth sub-processes are sub-processes executed on the first terminal side, and the second and fourth sub-processes are sub-processes executed on the server side.

[0314] The following are examples of each sub-process.

[0315] The first sub-process on the first terminal side (for generating and sending the first part of information to the server based on the private key of the first terminal, the message to be signed, and the preset context information):

[0316] Start the signing process:

[0317] A1: Generate a first signature random number for signing on the first terminal side:

[0318] A2: Use the preset context information ctx to preprocess the message to be signed to obtain a preprocessed message to be signed:

[0319] M′=0|||ctx|||ctx||M;

[0320] Among them, 0 and |ctx| each occupy one byte;

[0321] A3: Generate a public key matrix based on the first component ρ of the private key on the first terminal side:

[0322]

[0323] A is needed in the subsequent step A10.

[0324] A4: Using the third component of the private key on the first terminal side, calculate the hash value of the pre-processed message M′ to be signed:

[0325] μ=H(tr||M′,64)

[0326] A5: Using the hash value μ, the second component K of the private key on the first terminal side A , the first signature random number r A , calculate the random seed on the first terminal side:

[0327] ρ″ A =H(K A ||r A ||μ,64)

[0328] A6: The hash value of the pre-processed message M′ to be signed and the random seed on the first terminal side are used as the first part of information, i.e. μ, ρ″ A , sent to the server.

[0329] Among them, μ is also the first component of the first part of the information, ρ″ A It also serves as the second component of the first part of the information.

[0330] Second sub-process on the server side (for generating and sending first feedback information to the first terminal based on the first part of information sent by the first terminal):

[0331] S1: Generate the second signature random number for signing on the server side

[0332] S2: Generate the public key matrix based on the first component ρ of the server-side private key:

[0333]

[0334] S3: Based on the first component μ of the first part of the information and the second signature random number r used for signing on the server side S , calculate the random seed on the server side:

[0335] ρ″ S =H(K S ||r S ||μ,64);

[0336] S4: Set the random seed ρ″ on the server side S Sending to the first terminal;

[0337] The random seed ρ″ on the server side S , which is also used as the first component of the first feedback information sent to the first terminal.

[0338] S5: Calculate the random variable Δ shared between the server and the first terminal = Gen(R k ,(ρ″ A ,ρ″ S ));

[0339] The subsequent step S17 requires Δ;

[0340] S6: Set the count value of the counter to 0;

[0341] The counter is used to count the number of times the signature process is executed.

[0342] S7: When the count value counter=0, the initial value of some components of the signature value is set to the terminator; or, when a message is received from the first terminal triggering the re-execution of the signing process (which carries the count value counter updated by the first terminal), some components of the signature value are set to the terminator.

[0343] For example, the signature value ultimately used by the first terminal for signing includes three components, namely, the first component, the second component, and the third component of the signature value;

[0344] When the second and third components of the signature value subsequently determined by the first terminal do not meet the conditions, the server side will be triggered to re-execute the signing process. Therefore, when the server receives the message from the first terminal triggering the re-execution of the signing process, it will set some components of the signature value (for example, including the second and third components of the signature value) as terminators.

[0345] Specifically, for example, the initial value of z,h is set to the terminator ⊥;

[0346] Wherein, z represents the second component of the signature value, and h represents the third component of the signature value;

[0347] When it is determined that the value of (z, h) is a terminator (i.e., an initial value), it is determined to proceed to step S8. In other words, when the value of (z, h) is a terminator, it indicates that the signature result does not meet the requirements, and the signature algorithm is run again from this step, and step S8 is continued.

[0348] Since the signature algorithm runs randomly, for example, the following y S ,e S Parameters such as , are generated independently and randomly each time. Therefore, the signature result is different each time. If the value of (z, h) in a signature result is not a terminator, the signature meets the requirements.

[0349] S8: Using the random seed ρ″ on the server side S, and the current count value counter (initial value 0, or the latest count value counter sent by the first terminal, or the count value counter updated by the server), generate a random vector on the server side:

[0350]

[0351] S9: Using the random seed ρ″ on the server side S , generate the first random error vector on the server side:

[0352] e S =Sample(R k ,ρ″ S ,[-η′ / 2,η′ / 2])

[0353] S10: Using the public key matrix A and the random vector y on the server side S , the first random error vector e on the server side S , calculate the original value of the commitment information on the server side:

[0354] w S =A·y S +e S ;

[0355] S11: Update the count value of the counter, ie, set counter=counter+1, and send the updated count value counter to the first terminal.

[0356] The counter may be sent by the first terminal at A12 and A18, or may be the value updated by the server at S14.

[0357] The updated count value counter is also used as the second component of the first feedback information sent to the first terminal.

[0358] It should be noted that the first component and the second component of the first feedback information may be sent to the first terminal simultaneously, or may be sent to the first terminal separately.

[0359] The counter is used to generate y S Part of the seed information, ensure that the y is regenerated after the update S different.

[0360] The third sub-process on the first terminal side (for generating and sending the second part of information to the server based on the first feedback information sent by the server):

[0361] A7: First component ρ″ based on first feedback information S and the random seed ρ″ on the first terminal side A, calculate the random variable shared between the server and the first terminal:

[0362] Δ=Gen(R k ,(ρ″ A ,ρ″ S )).

[0363] The subsequent step A15 requires Δ.

[0364] The value of Δ in step A7 is the same as that of Δ in step S5.

[0365] A8: Based on the random seed ρ″ on the first terminal side A , and the second component counter of the first feedback information, generate a random vector on the first terminal side:

[0366]

[0367] A9: Based on the random seed ρ″ on the first terminal side A , generate the first random error vector on the first terminal side:

[0368] e A =Sample((R k ),ρ″ A ,[-η′ / 2,η′ / 2]);

[0369] A10: Calculate the original value of the commitment information on the first terminal side using the public key matrix, the random vector on the first terminal side, and the first random error vector on the first terminal side:

[0370] w A =A·y A -e A ;

[0371] A11: Update the second component of the first feedback information, that is, set counter=counter+1;

[0372] A12: The second component of the updated first feedback information and the original value of the commitment information on the first terminal side, i.e., counter,w A , sent to the server as the second part of the information.

[0373] It should be noted that counter,w A They are also used as the first component and the second component of the second part of information respectively. These two components can be sent to the server at the same time or separately.

[0374] The fourth sub-process on the server side (for generating and sending second feedback information to the first terminal based on the second part of information sent by the first terminal):

[0375] S12: Original value w based on the commitment information on the first terminal side A , and the original value of the commitment information on the server side w S , calculate the original value of the signature commitment information:

[0376] w=w S +w A ;

[0377] S13: Determine whether the original value w of the signature commitment information meets the preset requirements. If yes, execute step S14; otherwise, return to step S8;

[0378] For example, determine whether the following conditions are met:

[0379] If it is satisfied, it means that the original value w of the signature commitment information does not meet the preset requirements, then counter=counter+1 is updated, and then return to step S8. That is, this step is used to check the validity of the original value w of the signature commitment information. If it does not meet the requirements, the signing process needs to be triggered again.

[0380] If the above conditions are not met, it means that the original value w of the signature commitment information meets the preset requirements, and the subsequent step S14 is continued.

[0381] S14: Decompose the original value w of the signature commitment information to obtain a first decomposition result and a second decomposition result (w1, w0) of w; wherein the first decomposition result w1 is used as the signature commitment information.

[0382] For example, the decomposed (w1, w0) satisfies the following conditions:

[0383] w≡w1(2γ2)+w0 mod q;

[0384] S15: Calculate the hash value of the signature commitment information w1:

[0385]

[0386]

[0387] Also represents the first component of the signature value;

[0388] Also serves as the first component of second feedback information that needs to be sent to the first terminal later;

[0389] S16: hash value based on signature commitment information Calculate the challenge information of the signature verifier:

[0390]

[0391] c is also used as the second component of the second feedback information that needs to be sent to the first terminal later;

[0392] S17: Using the server-side random vector y S , the verifier's challenge information c, the fourth component s′1 of the server's private key, and the partial information on the server side used to calculate the second component of the signature value:

[0393] z S =y S +cs′1;

[0394] z S Also serves as the third component of the second feedback information that needs to be sent to the first terminal later;

[0395] S18: Calculate the second random error vector on the server side:

[0396] e′ S =e S -Δ;

[0397] S19: Based on the original value w of the signature commitment information, the challenge information c of the verifier, the fifth component s′2 of the private key on the server side, and the second random error vector e′ on the server side S , calculate the intermediate variables on the server side:

[0398] w′=w-cs′2-e′ S ;

[0399] w ′ Also serves as the fourth component of the second feedback information that needs to be sent to the first terminal later;

[0400] S20: The first component, the second component, the third component, and the fourth component of the second feedback information are z S ,w′ is sent to the first terminal.

[0401] It should be noted that in this step, the server can only send The terminal side can be Calculate c; or the server sends and c, the terminal side does not need to be Calculate c.

[0402] The fifth sub-process on the first terminal side (used to finally complete the signature based on the second feedback information sent by the server and the private key on the first terminal side):

[0403] A13: Using the second component c of the second feedback information and the random vector y on the first terminal side A, the fourth component s″1 of the private key on the first terminal side, determining the intermediate value of the second component used to calculate the signature value:

[0404] z A =y A +cs″1;

[0405] A14: Calculate the second component of the signature value on the first terminal side:

[0406] z=z S +z A ;

[0407] A15: Using the random variable shared between the server and the first terminal, and the first random error vector e on the first terminal side A , calculate the second random error vector on the first terminal side:

[0408] e′ A =e A -Δ;

[0409] A16: Based on the fourth component w′ of the second feedback information, the second component c of the second feedback information, the fifth component s″2 of the private key on the first terminal side, and the second random error vector e′ on the first terminal side A , calculate the intermediate variable on the first terminal side:

[0410] w″=w′-cs″2+e′ A ;

[0411] A17: Decompose the intermediate variable w″ on the first terminal side to obtain a first decomposition result and a second decomposition result (r1, r0) of w″;

[0412] Among them, (r1, r0) satisfies the following conditions:

[0413] w″≡r1(2γ2)+r0 mod q;

[0414] A18: Based on the second component z of the signature value and / or the decomposition result of the intermediate variable w″ on the first terminal side, determine whether it is necessary to trigger re-execution of the signing process;

[0415] If yes, update the count value counter=counter+1, and send the updated count value counter to the server, thereby triggering the server to re-execute step S8;

[0416] Otherwise, go to step A19.

[0417] For example, if ||z|| ∞ ≥γ1-β or ||r0|| ∞≥γ2-β, then update the count value counter=counter+1, send the updated count value counter to the server, and trigger the server to re-execute step S8;

[0418] A19: Calculate the third component of the signature value on the first terminal side using the second component c of the second feedback information, the sixth component t0 of the private key on the first terminal side, and the intermediate variable w″ on the first terminal side:

[0419] h=MakeHint(-ct0,w″+ct0);

[0420] Among them, h also represents carry hint information;

[0421] A20: Based on the third component h of the signature value, and / or the second component c of the second feedback information, and the sixth component t0 of the private key on the first terminal side, determine whether it is necessary to trigger re-execution of the signing process;

[0422] If yes, update the count value counter=counter+1, and send the updated count value counter to the server, thereby triggering the server to re-execute step S7;

[0423] Otherwise, go to step A21.

[0424] For example, if ||ct0|| ∞ ≥γ2, or the number of 1s in h exceeds ω, then update the count value counter = counter + 1, send the updated count value counter to the server, and trigger the server to re-execute step S8;

[0425] A21: Calculate the signature result using the first, second, and third components of the signature value:

[0426]

[0427] Among them, the first component of the signature value The server carries it in the second feedback information.

[0428] A22: Output signature σ, which is the public signature result.

[0429] It should be noted that:

[0430] The function MakeHint(x,y) is used to calculate whether the high bit of r is changed when x is added to r. The specific calculation process is as follows:

[0431] enter:

[0432] Output: 0 or 1;

[0433] Decompose x to get (x1,x0), where x≡x1(2γ2)+x0 mod q

[0434] Decomposing z=x+y yields (z1,z0), where z≡z1(2γ2)+z0 mod q

[0435] If x1≠z1, output 1, otherwise output 0.

[0436] The function SampleInBall(seed) is used to generate a polynomial f in the ring R whose coefficients belong to the set {-1, 0, 1} according to the seed seed, and the number of nonzero coefficients τ in the polynomial f does not exceed 64. The specific calculation process is as follows:

[0437] Input: Seed

[0438] Output: Polynomial f = f0 + f1X + ... + f 255 X 255 ∈R;

[0439] Let f = 0;

[0440] Let the initial state of the sponge hash function state = H′.Init();

[0441] Use seed seed to update the internal state of the sponge hash function state = H′.Absord(state,seed);

[0442] Generate an 8-byte (64-bit) pseudo-random output s and update the internal state (state, s) = H′.Squeeze(state, 8);

[0443] Update f0,f1,…,f 255 :For i from 256-τ to 255, calculate:

[0444] Generate a pseudo-random number j between 0 and 255 and update the internal state:

[0445] (state,j)=H.squeeze(state,1)

[0446] While j>i, do(state,j)=H.squeeze(state,1);

[0447] That is, by repeatedly executing H.squeeze, j≤i;

[0448] Update f i ,f j Value: f i =f j ,fj =(-1) s[i+τ-256] .

[0449] Correspondingly, on the second terminal (the second terminal also represents the signature verifier), the message M and its signature are verified using pk=(ρ, t1). The specific process of the signature verification algorithm ML-DSA.Verify includes the following steps:

[0450] B0: Input message M, context information ctx, and signature

[0451] B1: Preprocess the message to obtain M′=0|||ctx|||ctx||M;

[0452] B2: Extract the public key component information from the public key: (ρ, t1) = pk;

[0453] B3: Extract the signature value component information from the signature value:

[0454] B4: If the third component h of the signature value = ⊥, the signature verification fails;

[0455] B5: Generate the public key matrix based on the first component ρ of the public key:

[0456] B6: Calculate the hash value of the public key: tr = H(pk,64);

[0457] B7: Calculate the hash value of the preprocessed message: μ = H(tr||M′, 64);

[0458] B8: Computational Challenge Information:

[0459] B9: Calculate the approximate value of the intermediate variable: w′ Approx =Az-c·(t1·2 d );

[0460] B10: According to the carry hint information h, restore the commitment information: w′1=UseHint(h,w′ Approx );

[0461] B11: Calculate the hash value of the commitment information:

[0462] B12: If The signature verification is determined to have failed;

[0463] B13: If ||z|| ∞ ≥γ1-β, the signature verification fails;

[0464] B14: Output the message that the signature verification passed.

[0465] In summary, in this embodiment, from the collaborative key generation algorithm DML-DSA.KeyGen, it can be seen that t=A·(s′1+s″1)+s′2+s″2, where s1=s′1+s″1, s2=s′2+s″2.

[0466] From the collaborative signature algorithm DML-DSA.Sign steps S5 and S19, we can see that e S -e′ S =Δ.

[0467] From the collaborative signature algorithm DML-DSA.Sign steps A7 and A15, we can know that e A -e′ A =Δ.

[0468] From the collaborative signature algorithm DML-DSA.Sign steps S11, A10, and S13, we can see that:

[0469] w=w S +w A =A(y A +y S )-e A +e S .

[0470] From step S14 of the collaborative signature algorithm DML-DSA.Sign, we can see that:

[0471] because

[0472] Therefore, HighBits(w)=HighBits(A(y A +y S )).

[0473] From the collaborative signature algorithm DML-DSA.Sign steps S20 and A16, we can see that:

[0474] w″=w′-cs′2+e′ A =w-cs″2-e′ S -cs′2+e′ A =A(y A +y S )-e A +e S -cs″2-e′ S -cs′2+e′ A =A(y A +y S )-cs2.

[0475] From the collaborative signature algorithm DML-DSA.Sign steps S18, A13, and A14, we can see that:

[0476] z=z S +z A =(y A +y S )+cs1.

[0477] From the collaborative signature algorithm DML-DSA.Sign step A19, we can know that:

[0478] h=MakeHint(-ct0,w″+ct0)=MakeHint(-ct0,A(y A +y S )-cs2+ct0).

[0479] From step B9 of the ML-DSA.Verify signature verification algorithm, we can see that:

[0480] w′ Approx =Az-c·(t1·2 d )=A((y A +y S )+cs1)-c(t-t0)=A((y A +y S )+cs1)-c(A·s1+s2-t0)=w″+ct0.

[0481] Therefore, w′1 calculated in the signature verification step B10 is the same as w1 calculated in step S14 during the signing process, so the signature verification is correct.

[0482] It should be noted that the efficiency of signature verification can be improved by adjusting the values ​​of the parameters in the above algorithm according to actual needs.

[0483] In the embodiment of the present application, the first terminal and the server collaborate to complete key generation and signature, avoiding the single point failure problem when the first terminal independently controls the private key. In addition, the first terminal and the server cannot derive the other party's partial private key, that is, neither party has the complete private key, and only the two parties collaborate to complete the signature operation. Therefore, the two-party collaboration method realizes the protection of the private key. The attacker can only recover the complete private key by obtaining the private keys of the server and the first terminal at the same time. In addition, the embodiment of the present application can also resist quantum attacks, because the security of the ML-DSA algorithm itself and the private keys of the server and the user in this collaborative scheme are based on the security of the MLWE problem, and therefore can resist quantum computing attacks.

[0484] The following introduces the system, equipment or device provided in the embodiments of the present application, in which the explanations or examples of technical features that are the same as or corresponding to those described in the above method are not repeated hereafter.

[0485] See also Figure 8 , an embodiment of the present application provides a system, including a server 70 and at least one first terminal 71;

[0486] The server 70 is used to:

[0487] Determining a first seed random number for generating a key on the server side;

[0488] Generate first pseudo-random information according to the first seed random number, wherein the first pseudo-random information includes: a first component of the public key of the server side;

[0489] Determining, based on the first pseudo-random information, a first intermediate variable for generating a second component of a public key by the first terminal;

[0490] sending the first component of the public key and the first intermediate variable to a first terminal, so that the first terminal generates and publishes a public key based on the first component of the public key and the first intermediate variable;

[0491] The first terminal 71 is configured to:

[0492] Receiving a first component of a public key and a first intermediate variable sent by a server, where the first intermediate variable is used by the first terminal to generate a second component of the public key;

[0493] generating a public key matrix according to the first component of the public key;

[0494] Determining a second seed random number for generating a key on the first terminal side;

[0495] Generate second pseudo-random information according to the second seed random number, where the second pseudo-random information includes: private key seed information of the first terminal side;

[0496] generating a partial component of the private key on the first terminal side according to the private key seed information on the first terminal side;

[0497] generating a second intermediate variable according to the public key matrix and a partial component of the private key on the first terminal side;

[0498] determining a third intermediate variable based on the first intermediate variable and the second intermediate variable;

[0499] Determining a second component of the public key using the third intermediate variable;

[0500] Generate and publish a public key using the first component and the second component of the public key;

[0501] and / or,

[0502] The first terminal 71 is configured to:

[0503] Generate a first signature random number for signing on the first terminal side;

[0504] Using the preset context information, the message to be signed is preprocessed to obtain a preprocessed message to be signed;

[0505] Determine a first portion of information using a partial component of the private key on the first terminal side, the first signature random number, and the preprocessed message to be signed, and send the first portion of information to the server;

[0506] receiving first feedback information sent by the server, which is determined based on the first partial information and a partial component of the private key on the server side;

[0507] Using the first feedback information, determining the second part of information and sending it to the server;

[0508] receiving second feedback information sent by the server, which is determined based on the second partial information and a partial component of the private key on the server side;

[0509] Generate a signature result for the message to be signed using the second feedback information and a partial component of the private key on the first terminal side;

[0510] The server 70 is used to:

[0511] receiving a first portion of information sent by a first terminal;

[0512] generating, based on the first partial information and a partial component of the private key on the server side, and sending first feedback information to the first terminal, so that the first terminal generates second partial information based on the first feedback information;

[0513] receiving the second part of information sent by the terminal side;

[0514] Based on the second partial information and a partial component of the private key on the server side, second feedback information is generated and sent to the first terminal, so that the first terminal generates a signature result based on the second feedback information.

[0515] Of course, in some embodiments, the system may further include at least one second terminal for signature verification, the specific functions of which are as described in the above-mentioned signature verification method ML-DSA.Verify on the second terminal side, and will not be described in detail.

[0516] An electronic device provided in an embodiment of the present application, see Figure 9 , for example:

[0517] The processor 600 is used to read the program in the memory 620 and execute any one of the method processes described above on the server side and the first terminal side (details will not be repeated here).

[0518] The transceiver 610 is configured to receive and send data under the control of the processor 600 .

[0519] Among them, Figure 9 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 600 and memory represented by memory 620. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 610 may be a plurality of components, i.e., a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, such as a wireless channel, a wired channel, an optical cable, and the like. For different user devices, the user interface 630 may also be an interface capable of connecting external or internal devices as required, and the connected devices include but are not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

[0520] The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 can store data used by the processor 600 when performing operations.

[0521] In some embodiments, the processor 600 may be a CPU (central processing unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a CPLD (Complex Programmable Logic Device), and the processor may also adopt a multi-core architecture.

[0522] See also Figure 10 A quantum attack-resistant key generation device, applied to a server, comprising:

[0523] A first seed random number unit 11 is used to determine a first seed random number for generating a key on the server side;

[0524] A first pseudo-random information unit 12 is configured to generate first pseudo-random information according to the first seed random number, wherein the first pseudo-random information includes: a first component of the public key of the server side;

[0525] A first intermediate variable unit 13 is configured to determine, based on the first pseudo-random information, a first intermediate variable for generating a second component of a public key for the first terminal;

[0526] The sending unit 14 is configured to send the first component of the public key and the first intermediate variable to a first terminal, so that the first terminal generates and publishes a public key based on the first component of the public key and the first intermediate variable.

[0527] In some embodiments, the first pseudo-random information further includes: private key seed information of the server side;

[0528] Determining, based on the pseudo-random information, a first intermediate variable for generating a second component of a public key by the first terminal includes:

[0529] generating a public key matrix according to the first component of the public key;

[0530] Generating components of the server-side private key according to the server-side private key seed information;

[0531] A first intermediate variable for generating a second component of a public key by a first terminal is determined according to the public key matrix and the components of the private key on the server side.

[0532] In some embodiments, the apparatus further comprises:

[0533] a second intermediate variable unit, configured to receive a second intermediate variable sent by the first terminal; the second intermediate variable is determined by the first terminal using the first component of the public key sent by the server;

[0534] a third intermediate variable unit, configured to calculate a third intermediate variable based on the first intermediate variable and the second intermediate variable;

[0535] A second component unit, configured to determine a second component of the public key of the server side based on the third intermediate variable;

[0536] a comparing unit, configured to compare a public key of the server side obtained by using the first component of the public key of the server side and the second component of the public key of the server side with the public key published by the first terminal;

[0537] The triggering unit is used to trigger the re-execution of the key generation process when the public key on the server side is different from the public key published by the first terminal.

[0538] In some embodiments, the first pseudo-random information further includes: private key seed information of the server side, and a second component of the private key of the server side;

[0539] The device further comprises:

[0540] A third component unit, configured to determine a third component of the private key of the server side based on the public key of the server side;

[0541] a fourth component and a fifth component unit, configured to generate a fourth component and a fifth component of the private key of the server side according to the private key seed information of the server side;

[0542] a sixth component unit, configured to determine a sixth component of the private key of the server side based on the third intermediate variable;

[0543] The private key unit is used to obtain the private key of the server side by using the first component, the second component, the third component, the fourth component, the fifth component, and the sixth component of the private key of the server side.

[0544] See also Figure 11 , an embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a terminal side, and the device includes:

[0545] A receiving unit 21 is configured to receive a first component of a public key and a first intermediate variable sent by a server, where the first intermediate variable is used by the first terminal to generate a second component of the public key;

[0546] A public key matrix unit 22, configured to generate a public key matrix according to the first component of the public key;

[0547] A second seed random number unit 23, configured to determine a second seed random number for generating a key on the first terminal side;

[0548] A second pseudo-random information unit 24 is configured to generate second pseudo-random information according to the second seed random number, wherein the second pseudo-random information includes: private key seed information of the first terminal side;

[0549] a private key component unit 25, configured to generate a partial component of the private key on the first terminal side according to the private key seed information on the first terminal side;

[0550] A second intermediate variable unit 26 is configured to generate a second intermediate variable according to the public key matrix and a partial component of the private key on the first terminal side;

[0551] A third intermediate variable unit 27, configured to determine a third intermediate variable based on the first intermediate variable and the second intermediate variable;

[0552] A second component unit 28 is configured to determine a second component of the public key using the third intermediate variable;

[0553] The public key unit 29 is configured to generate and publish a public key using the first component and the second component of the public key.

[0554] In some embodiments, the second pseudo-random information further includes: a second component of the private key of the first terminal side;

[0555] The partial components of the private key on the first terminal side include the fourth component and the fifth component of the private key on the first terminal side;

[0556] The device further comprises:

[0557] A third component unit, configured to determine a third component of the private key of the first terminal side using the public key;

[0558] a sixth component unit, configured to determine a sixth component of the private key of the first terminal side using the third intermediate variable;

[0559] A private key unit is used to use the first component of the public key as the first component of the private key on the first terminal side, and use the first component, second component, third component, fourth component, fifth component, and sixth component of the private key on the first terminal side to obtain the private key on the first terminal side.

[0560] In some embodiments, the apparatus further comprises:

[0561] A sending unit is configured to send the second intermediate variable to the server, so that the server generates a second component of the public key of the server and a component of the private key of the server.

[0562] See also Figure 12 , an embodiment of the present application provides a signature device that is resistant to quantum attacks, applied to a terminal side, and the device includes:

[0563] A first signature random number unit 31 is used to generate a first signature random number for signing on the first terminal side;

[0564] A preprocessing unit 32 is configured to preprocess the message to be signed using preset context information to obtain a preprocessed message to be signed;

[0565] A first part of information sending unit 33 is configured to determine a first part of information by using a partial component of the private key on the first terminal side, the first signature random number, and the pre-processed message to be signed, and send the first part of information to the server;

[0566] A first feedback information receiving unit 34 is configured to receive first feedback information sent by the server and determined based on the first partial information and a partial component of the private key on the server side;

[0567] A second part information sending unit 35 is used to determine the second part of information by using the first feedback information and send it to the server;

[0568] A second feedback information receiving unit 36 ​​is configured to receive second feedback information sent by the server and determined based on the second partial information and a partial component of the private key on the server side;

[0569] The signing unit 37 is configured to generate a signature result for the message to be signed by using the second feedback information and a partial component of the private key on the first terminal side.

[0570] In some embodiments, determining the first portion of information using a partial component of the private key on the first terminal side and sending the first portion of information to the server includes:

[0571] Calculating a hash value of the preprocessed message to be signed using the third component of the private key on the first terminal side;

[0572] Calculating a random seed on the first terminal side using the hash value, the second component of the private key on the first terminal side, and the first signature random number;

[0573] The hash value and the random seed on the first terminal side are sent to the server as a first part of information.

[0574] In some embodiments, using the first feedback information to determine the second portion of information and sending it to the server includes:

[0575] generating a random vector on the first terminal side based on a random seed on the first terminal side and a second component of the first feedback information;

[0576] generating a first random error vector on the first terminal side based on a random seed on the first terminal side;

[0577] Calculating an original value of the commitment information on the first terminal side using a public key matrix, a random vector on the first terminal side, and a random error vector on the first terminal side;

[0578] updating the second component of the first feedback information;

[0579] The updated second component of the first feedback information and the original value of the commitment information on the first terminal side are sent to the server as the second part of information.

[0580] In some embodiments, generating a signature result for the message to be signed using the second feedback information and a partial component of the private key on the first terminal side includes:

[0581] Determine an intermediate value of the second component used to calculate the signature value by using the second component of the second feedback information, the random vector on the first terminal side, and the fourth component of the private key on the first terminal side;

[0582] Determine a second component of the signature value on the first terminal side by using the intermediate value and the second feedback information;

[0583] Determine a random variable shared between the server and the first terminal using the first component of the first feedback information and a random seed on the first terminal side;

[0584] Determine a second random error vector on the first terminal side by using a random variable shared between the server and the first terminal and a first random error vector on the first terminal side;

[0585] Determine the intermediate variable on the first terminal side, and calculate the third component of the signature value on the first terminal side by using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side;

[0586] A signature result is determined based on the third component of the signature value on the first terminal side.

[0587] In some embodiments, determining the intermediate variable on the first terminal side, and calculating the third component of the signature value on the first terminal side using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side includes:

[0588] Calculating an intermediate variable on the first terminal side based on the second component of the second feedback information, the fourth component of the second feedback information, the fifth component of the private key on the first terminal side, and the second random error vector on the first terminal side;

[0589] Decomposing the intermediate variable on the first terminal side to obtain a first decomposition result and a second decomposition result;

[0590] Determining whether it is necessary to trigger re-execution of the signing process based on the second component of the signature value and / or the first decomposition result and the second decomposition result of the intermediate variable on the first terminal side;

[0591] If yes, updating the second component of the first feedback information again, and sending the updated count value to the server to trigger the server to re-execute the signing process;

[0592] Otherwise, the third component of the signature value on the first terminal side is calculated using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side.

[0593] In some embodiments, determining a signature result based on the third component of the signature value on the first terminal side includes:

[0594] Determining whether it is necessary to trigger re-execution of the signing process based on the third component of the signature value on the first terminal side and / or the second component of the second feedback information and the sixth component of the private key on the first terminal side;

[0595] If yes, updating the second component of the first feedback information again, and sending the updated count value to the server to trigger the server to re-execute the signing process;

[0596] Otherwise, the signature result is obtained using the first component, the second component, and the third component of the signature value on the first terminal side, wherein the first component of the signature value on the first terminal side is the first component in the second feedback information.

[0597] See also Figure 13 The embodiment of the present application provides a signature device that is resistant to quantum attacks and is applied to a server. The device includes:

[0598] A first part information receiving unit 41 is configured to receive the first part of information sent by the first terminal;

[0599] a first feedback information sending unit 42, configured to generate and send first feedback information to the first terminal based on the first partial information and a partial component of the server-side private key, so that the first terminal generates second partial information based on the first feedback information;

[0600] A second part information receiving unit 43 is configured to receive the second part information sent by the terminal side;

[0601] The second feedback information sending unit 44 is configured to generate and send second feedback information to the first terminal based on the second partial information and a partial component of the server-side private key, so that the first terminal generates a signature result based on the second feedback information.

[0602] In some embodiments, generating and sending first feedback information to the first terminal based on the first partial information and a partial component of the server-side private key includes:

[0603] Generate a second signature random number for signing on the server side;

[0604] Calculating a random seed on the server side based on the first component of the first partial information and a second signature random number used for signing on the server side, and sending the random seed on the server side as the first component of first feedback information to the first terminal;

[0605] Setting the initial value of some components of the signature value to a terminator; or, when receiving a message from the first terminal triggering re-execution of the signing process, setting some components of the signature value to a terminator;

[0606] Generate a random vector on the server side using the random seed on the server side and the current count value;

[0607] generating a first random error vector on the server side by using the random seed on the server side;

[0608] Determining the original value of the commitment information on the server side using a public key matrix, a random vector on the server side, and a first random error vector on the server side, wherein the public key matrix is ​​a public key matrix generated based on the first component of the private key on the server side;

[0609] The count value is updated, and the updated count value is sent to the first terminal as the second component of the first feedback information.

[0610] In some embodiments, generating and sending second feedback information to the first terminal based on the second partial information and a partial component of the server-side private key includes:

[0611] Calculating the original value of the signed commitment information based on the second component of the second partial information and the original value of the commitment information on the server side; wherein the second component of the second partial information is the original value of the commitment information on the first terminal side;

[0612] Determine whether the original value of the signature commitment information does not meet the preset requirements; if so, update the count value and re-execute the signing process;

[0613] Otherwise, decompose the original value of the signature commitment information to obtain the signature commitment information;

[0614] determining a plurality of components of second feedback information based on the signature commitment information and a partial component of the private key of the server side;

[0615] Sending multiple components of the second feedback information to the first terminal.

[0616] In some embodiments, determining multiple components of the second feedback information based on the signature commitment information and partial components of the server-side private key includes:

[0617] Calculating a hash value of the signature commitment information and using the hash value as a first component of the second feedback information;

[0618] Calculate the verifier's challenge information based on the hash value of the signature commitment information and use it as the second component of the second feedback information;

[0619] Obtaining a third component of the second feedback information using the random vector on the server side, the challenge information of the signature verifier, and the fourth component of the private key on the server side;

[0620] Calculating a second random error vector on the server side based on the first random error vector on the server side and a random variable shared between the server and the first terminal;

[0621] Obtaining a fourth component of the second feedback information based on the original value of the signature commitment information, the challenge information of the signature verifier, the fifth component of the private key on the server side, and the second random error vector on the server side;

[0622] The first component, the second component, the third component, and the fourth component of the second feedback information are sent to the first terminal.

[0623] The present invention provides a computer-readable storage medium for storing computer program instructions used by the apparatus provided in the above embodiments of the present invention, which includes a program for executing any of the methods provided in the above embodiments of the present invention. The computer-readable storage medium may be a non-transitory computer-readable medium.

Claims

1. A signature method resistant to quantum attacks, characterized in that: Applied to the terminal side, the method includes: Generate a first signature random number for signing on the first terminal side; Using the preset context information, the message to be signed is preprocessed to obtain a preprocessed message to be signed; Determine a first portion of information using a partial component of the private key on the first terminal side, the first signature random number, and the preprocessed message to be signed, and send the first portion of information to the server; receiving first feedback information sent by the server, which is determined based on the first partial information and a partial component of the private key on the server side; Using the first feedback information, determining the second part of information and sending it to the server; receiving second feedback information sent by the server, which is determined based on the second partial information and a partial component of the private key on the server side; A signature result is generated for the message to be signed using the second feedback information and a partial component of the private key on the first terminal side.

2. The method according to claim 1, characterized in that Determining the first portion of information using a partial component of the private key on the first terminal side and sending the first portion of information to the server includes: Calculating a hash value of the preprocessed message to be signed using the third component of the private key on the first terminal side; Calculating a random seed on the first terminal side using the hash value, the second component of the private key on the first terminal side, and the first signature random number; The hash value and the random seed on the first terminal side are sent to the server as a first part of information.

3. The method according to claim 2, characterized in that Determining the second part of information by using the first feedback information and sending the second part of information to the server includes: generating a random vector on the first terminal side based on a random seed on the first terminal side and a second component of the first feedback information; generating a first random error vector on the first terminal side based on a random seed on the first terminal side; Calculating an original value of the commitment information on the first terminal side using a public key matrix, a random vector on the first terminal side, and a random error vector on the first terminal side; updating the second component of the first feedback information; The updated second component of the first feedback information and the original value of the commitment information on the first terminal side are sent to the server as the second part of information.

4. The method according to claim 1, wherein Generating a signature result for the message to be signed using the second feedback information and a partial component of the private key on the first terminal side, including: Determine an intermediate value of the second component used to calculate the signature value by using the second component of the second feedback information, the random vector on the first terminal side, and the fourth component of the private key on the first terminal side; Determine a second component of the signature value on the first terminal side by using the intermediate value and the second feedback information; Determine a random variable shared between the server and the first terminal using the first component of the first feedback information and a random seed on the first terminal side; Determine a second random error vector on the first terminal side by using a random variable shared between the server and the first terminal and a first random error vector on the first terminal side; Determine the intermediate variable on the first terminal side, and calculate the third component of the signature value on the first terminal side by using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side; A signature result is determined based on the third component of the signature value on the first terminal side.

5. The method according to claim 4, characterized in that Determining an intermediate variable on the first terminal side, and calculating a third component of the signature value on the first terminal side by using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side, including: Calculating an intermediate variable on the first terminal side based on the second component of the second feedback information, the fourth component of the second feedback information, the fifth component of the private key on the first terminal side, and the second random error vector on the first terminal side; Decomposing the intermediate variable on the first terminal side to obtain a first decomposition result and a second decomposition result; Determining whether it is necessary to trigger re-execution of the signing process based on the second component of the signature value and / or the first decomposition result and the second decomposition result of the intermediate variable on the first terminal side; If yes, updating the second component of the first feedback information again, and sending the updated count value to the server to trigger the server to re-execute the signing process; Otherwise, the third component of the signature value on the first terminal side is calculated using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side.

6. The method according to claim 4, characterized in that Determining a signature result based on the third component of the signature value on the first terminal side includes: Determining whether it is necessary to trigger re-execution of the signing process based on the third component of the signature value on the first terminal side and / or the second component of the second feedback information and the sixth component of the private key on the first terminal side; If yes, updating the second component of the first feedback information again, and sending the updated count value to the server to trigger the server to re-execute the signing process; Otherwise, the signature result is obtained using the first component, the second component, and the third component of the signature value on the first terminal side, wherein the first component of the signature value on the first terminal side is the first component in the second feedback information.

7. A signature method resistant to quantum attacks, characterized in that: Applied to the server side, the method includes: receiving a first portion of information sent by a first terminal; generating, based on the first partial information and a partial component of the private key on the server side, and sending first feedback information to the first terminal, so that the first terminal generates second partial information based on the first feedback information; receiving the second part of information sent by the first terminal; Based on the second partial information and a partial component of the private key on the server side, generating and sending second feedback information to the first terminal, so that the first terminal generates a signature result based on the second feedback information; The first part of information is determined by the first terminal in the following manner: Generate a first signature random number for signing on the first terminal side; Using the preset context information, the message to be signed is preprocessed to obtain a preprocessed message to be signed; The first portion of information is determined using a partial component of the private key on the first terminal side, the first signature random number, and the preprocessed message to be signed.

8. The method according to claim 7, characterized in that Generating and sending first feedback information to the first terminal based on the first partial information and a partial component of the private key on the server side includes: Generate a second signature random number for signing on the server side; Calculating a random seed on the server side based on the first component of the first partial information and a second signature random number used for signing on the server side, and sending the random seed on the server side as the first component of first feedback information to the first terminal; Setting the initial value of some components of the signature value to a terminator; or, when receiving a message from the first terminal triggering re-execution of the signing process, setting some components of the signature value to a terminator; Generate a random vector on the server side using the random seed on the server side and the current count value; generating a first random error vector on the server side by using the random seed on the server side; Determining the original value of the commitment information on the server side using a public key matrix, a random vector on the server side, and a first random error vector on the server side, wherein the public key matrix is ​​a public key matrix generated based on the first component of the private key on the server side; The count value is updated, and the updated count value is sent to the first terminal as the second component of the first feedback information.

9. The method according to claim 7, characterized in that Generating and sending second feedback information to the first terminal based on the second partial information and a partial component of the private key on the server side includes: Calculating the original value of the signed commitment information based on the second component of the second partial information and the original value of the commitment information on the server side; wherein the second component of the second partial information is the original value of the commitment information on the first terminal side; Determine whether the original value of the signature commitment information does not meet the preset requirements; if so, update the count value and re-execute the signing process; Otherwise, decompose the original value of the signature commitment information to obtain the signature commitment information; determining a plurality of components of second feedback information based on the signature commitment information and a partial component of the private key of the server side; Sending multiple components of the second feedback information to the first terminal.

10. The method according to claim 9, characterized in that Determining multiple components of second feedback information based on the signature commitment information and partial components of the server-side private key includes: Calculating a hash value of the signature commitment information and using the hash value as a first component of the second feedback information; Calculate the verifier's challenge information based on the hash value of the signature commitment information and use it as the second component of the second feedback information; Obtaining a third component of the second feedback information using the random vector on the server side, the challenge information of the signature verifier, and the fourth component of the private key on the server side; Calculating a second random error vector on the server side based on the first random error vector on the server side and a random variable shared between the server and the first terminal; The fourth component of the second feedback information is obtained based on the original value of the signature commitment information, the challenge information of the signature verifier, the fifth component of the private key on the server side, and the second random error vector on the server side.

11. A signature device resistant to quantum attacks, characterized in that: Applied to the terminal side, the device includes: A first signature random number unit, used to generate a first signature random number for signing on the first terminal side; A preprocessing unit, configured to preprocess the message to be signed using preset context information to obtain a preprocessed message to be signed; a first part of information sending unit, configured to determine the first part of information by using a partial component of the private key on the first terminal side, the first signature random number, and the pre-processed message to be signed, and send the first part of information to the server; a first feedback information receiving unit, configured to receive first feedback information sent by the server, the first feedback information being determined based on the first partial information and a partial component of the private key on the server side; A second part information sending unit, configured to determine the second part information by using the first feedback information and send the second part information to the server; A second feedback information receiving unit is configured to receive second feedback information sent by the server, the second partial information being determined based on a partial component of the private key on the server side; The signing unit is configured to generate a signature result for the message to be signed by using the second feedback information and a partial component of the private key on the first terminal side.

12. The device according to claim 11, characterized in that Determining the first portion of information using a partial component of the private key on the first terminal side and sending the first portion of information to the server includes: Calculating a hash value of the preprocessed message to be signed using the third component of the private key on the first terminal side; Calculating a random seed on the first terminal side using the hash value, the second component of the private key on the first terminal side, and the first signature random number; The hash value and the random seed on the first terminal side are sent to the server as a first part of information.

13. The device according to claim 12, characterized in that Determining the second part of information by using the first feedback information and sending the second part of information to the server includes: generating a random vector on the first terminal side based on a random seed on the first terminal side and a second component of the first feedback information; generating a first random error vector on the first terminal side based on a random seed on the first terminal side; Calculating an original value of the commitment information on the first terminal side using a public key matrix, a random vector on the first terminal side, and a random error vector on the first terminal side; updating the second component of the first feedback information; The updated second component of the first feedback information and the original value of the commitment information on the first terminal side are sent to the server as the second part of information.

14. The device according to claim 11, characterized in that Generating a signature result for the message to be signed using the second feedback information and a partial component of the private key on the first terminal side, including: Determine an intermediate value of the second component used to calculate the signature value by using the second component of the second feedback information, the random vector on the first terminal side, and the fourth component of the private key on the first terminal side; Determine a second component of the signature value on the first terminal side by using the intermediate value and the second feedback information; Determine a random variable shared between the server and the first terminal using the first component of the first feedback information and a random seed on the first terminal side; Determine a second random error vector on the first terminal side by using a random variable shared between the server and the first terminal and a first random error vector on the first terminal side; Determine the intermediate variable on the first terminal side, and calculate the third component of the signature value on the first terminal side by using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side; A signature result is determined based on the third component of the signature value on the first terminal side.

15. The device according to claim 14, characterized in that Determining an intermediate variable on the first terminal side, and calculating a third component of the signature value on the first terminal side by using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side, including: Calculating an intermediate variable on the first terminal side based on the second component of the second feedback information, the fourth component of the second feedback information, the fifth component of the private key on the first terminal side, and the second random error vector on the first terminal side; Decomposing the intermediate variable on the first terminal side to obtain a first decomposition result and a second decomposition result; Determining whether it is necessary to trigger re-execution of the signing process based on the second component of the signature value and / or the first decomposition result and the second decomposition result of the intermediate variable on the first terminal side; If yes, updating the second component of the first feedback information again, and sending the updated count value to the server to trigger the server to re-execute the signing process; Otherwise, the third component of the signature value on the first terminal side is calculated using the second component of the second feedback information, the sixth component of the private key on the first terminal side, and the intermediate variable on the first terminal side.

16. The device according to claim 14, characterized in that Determining a signature result based on the third component of the signature value on the first terminal side includes: Determining whether it is necessary to trigger re-execution of the signing process based on the third component of the signature value on the first terminal side and / or the second component of the second feedback information and the sixth component of the private key on the first terminal side; If yes, updating the second component of the first feedback information again, and sending the updated count value to the server to trigger the server to re-execute the signing process; Otherwise, the signature result is obtained using the first component, the second component, and the third component of the signature value on the first terminal side, wherein the first component of the signature value on the first terminal side is the first component in the second feedback information.

17. A signature device resistant to quantum attacks, characterized in that: Applied to the server side, the device includes: A first part of information receiving unit, configured to receive the first part of information sent by the first terminal; a first feedback information sending unit, configured to generate and send first feedback information to the first terminal based on the first partial information and a partial component of the private key on the server side, so that the first terminal generates second partial information based on the first feedback information; A second part information receiving unit, configured to receive the second part information sent by the first terminal; a second feedback information sending unit, configured to generate and send second feedback information to the first terminal based on the second partial information and a partial component of the private key of the server side, so that the first terminal generates a signature result based on the second feedback information; The first part of information is determined by the first terminal in the following manner: Generate a first signature random number for signing on the first terminal side; Using the preset context information, the message to be signed is preprocessed to obtain a preprocessed message to be signed; The first portion of information is determined using a partial component of the private key on the first terminal side, the first signature random number, and the preprocessed message to be signed.

18. The device according to claim 17, characterized in that Generating and sending first feedback information to the first terminal based on the first partial information and a partial component of the private key on the server side includes: Generate a second signature random number for signing on the server side; Calculating a random seed on the server side based on the first component of the first partial information and a second signature random number used for signing on the server side, and sending the random seed on the server side as the first component of first feedback information to the first terminal; Setting the initial value of some components of the signature value to a terminator; or, when receiving a message from the first terminal triggering re-execution of the signing process, setting some components of the signature value to a terminator; Generate a random vector on the server side using the random seed on the server side and the current count value; generating a first random error vector on the server side by using the random seed on the server side; Determining the original value of the commitment information on the server side using a public key matrix, a random vector on the server side, and a first random error vector on the server side, wherein the public key matrix is ​​a public key matrix generated based on the first component of the private key on the server side; The count value is updated, and the updated count value is sent to the first terminal as the second component of the first feedback information.

19. The device according to claim 17, characterized in that Generating and sending second feedback information to the first terminal based on the second partial information and a partial component of the private key on the server side includes: Calculating the original value of the signed commitment information based on the second component of the second partial information and the original value of the commitment information on the server side; wherein the second component of the second partial information is the original value of the commitment information on the first terminal side; Determine whether the original value of the signature commitment information does not meet the preset requirements; if so, update the count value and re-execute the signing process; Otherwise, decompose the original value of the signature commitment information to obtain the signature commitment information; determining a plurality of components of second feedback information based on the signature commitment information and a partial component of the private key of the server side; Sending multiple components of the second feedback information to the first terminal.

20. The device according to claim 19, characterized in that Determining multiple components of second feedback information based on the signature commitment information and partial components of the server-side private key includes: Calculating a hash value of the signature commitment information and using the hash value as a first component of the second feedback information; Calculate the verifier's challenge information based on the hash value of the signature commitment information and use it as the second component of the second feedback information; Obtaining a third component of the second feedback information using the random vector on the server side, the challenge information of the signature verifier, and the fourth component of the private key on the server side; Calculating a second random error vector on the server side based on the first random error vector on the server side and a random variable shared between the server and the first terminal; Obtaining a fourth component of the second feedback information based on the original value of the signature commitment information, the challenge information of the signature verifier, the fifth component of the private key on the server side, and the second random error vector on the server side; The first component, the second component, the third component, and the fourth component of the second feedback information are sent to the first terminal.

21. A digital signature system, characterized in that: include: A server and a first terminal; wherein, The first terminal is configured to: Generate a first signature random number for signing on the first terminal side; Using the preset context information, the message to be signed is preprocessed to obtain a preprocessed message to be signed; Determine a first portion of information using a partial component of the private key on the first terminal side, the first signature random number, and the preprocessed message to be signed, and send the first portion of information to the server; receiving first feedback information sent by the server, which is determined based on the first partial information and a partial component of the private key on the server side; Using the first feedback information, determining the second part of information and sending it to the server; receiving second feedback information sent by the server, which is determined based on the second partial information and a partial component of the private key on the server side; Generate a signature result for the message to be signed using the second feedback information and a partial component of the private key on the first terminal side; The server is used to: receiving a first portion of information sent by a first terminal; generating, based on the first partial information and a partial component of the private key on the server side, and sending first feedback information to the first terminal, so that the first terminal generates second partial information based on the first feedback information; receiving the second part of information sent by the first terminal; Based on the second partial information and a partial component of the private key on the server side, second feedback information is generated and sent to the first terminal, so that the first terminal generates a signature result based on the second feedback information.

22. An electronic device, characterized in that: include: a memory for storing program instructions; A processor, configured to call the program instructions stored in the memory and execute the method according to any one of claims 1 to 10 according to the obtained program.

Images