Digital signature method and device

Abstract

The invention relates to a digital signature method and device. The method comprises the following steps: determining input signals of a target Boolean circuit and each gate circuit according to an encryption algorithm of a preset signature algorithm, a private key and a public key message; n pieces of random first mask information are generated for an input signal of each AND gate in the target Boolean circuit, N-1 pieces of random second mask information are generated for each AND gate, and the XOR sum of the N pieces of mask information is the value of preset mask information; for each AND gate, executing calculation operation to complete digital signature, which comprises the following steps: determining first information by utilizing the first mask information of each input signal and each piece of second mask information; determining second information by using the first information, each piece of second mask information, each input signal and the first mask information thereof; the digital signature is completed by using the first information and the second information at present, the redundancy calculation is reduced, the calculation of the target Boolean circuit is processed in parallel, the signature efficiency is improved, and the operation cost is reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of encryption technology, and in particular to a digital signature method and device. Background Art

[0002] Digital signature is a technology that ensures data integrity, authenticity and non-repudiation. It is signed with a private key and verified by the corresponding public key to ensure that the data has not been tampered with during transmission and comes from the legitimate sender.

[0003] In cryptography, a variety of digital signature algorithms have been widely used, including traditional algorithms such as RSA, ECDSA, and EdDSA. These algorithms are based on difficult problems such as large number factorization and elliptic curve discrete logarithm, and provide high security under current computing conditions. However, with the development of quantum computing technology, these traditional signature algorithms face the risk of quantum computer attacks. Therefore, it is an inevitable trend to study signature algorithms that are resistant to quantum computing.

[0004] Although some algorithms (such as Picnic3) have shown significant advantages in anti-quantum computing, these encryption algorithms have problems with redundant calculations, resulting in long signing times, which may affect performance in some application scenarios. Summary of the invention

[0005] According to one aspect of the present disclosure, a digital signature method is provided, the method comprising:

[0006] Determine a target Boolean circuit according to an encryption algorithm, a private key and a public key message of a preset signature algorithm, and obtain input signals of each gate circuit in the target Boolean circuit, wherein the calculation task of the target Boolean circuit is distributed to N participants, where N is a positive integer;

[0007] Generate N random first mask information for each input signal of each AND gate in the target Boolean circuit, and generate N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information;

[0008] For each AND gate, a computation operation is performed to complete the digital signature, including:

[0009] Determine the first information using the first mask information of each input signal and each second mask information;

[0010] Determine second information using the first information, each second mask information, each input signal and its first mask information;

[0011] The digital signature is completed using the first information and the second information.

[0012] In a possible implementation, the method further includes:

[0013] The target Boolean circuit is divided into a plurality of circuit modules, each circuit module is used to execute a round of encryption algorithm, wherein each circuit module is configured to execute in parallel.

[0014] In a possible implementation manner, determining the first information using the first mask information of each input signal and each second mask information includes:

[0015] For each input port of each AND gate, perform an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to the input port to obtain the intermediate mask information of the corresponding input port;

[0016] Determine each XOR result of the round key mask information obtained in the previous round of operation and the intermediate mask information corresponding to each input port of the AND gate, and perform an inverse linear operation on each XOR result to obtain a first intermediate value;

[0017] The first information is obtained by using the product of the intermediate mask information of each input port of the AND gate, the XOR sum of N-1 random second mask information corresponding to the AND gate, and the XOR result of the first intermediate value of the AND gate.

[0018] In a possible implementation manner, determining the second information by using the first information, each piece of second mask information, each input signal and its first mask information includes:

[0019] For any AND gate, the port mask value of the corresponding input port is obtained according to the intermediate mask information corresponding to each input port of the AND gate and the XOR operation result of the corresponding input signal;

[0020] Determine the broadcast information of the first to N-1th participants using the port mask values ​​corresponding to the first to N-1th participants, the first mask information, and the second mask information;

[0021] Determine the broadcast information of the Nth participant by using the port mask value corresponding to the Nth participant, the first mask information and the first information,

[0022] The second information includes broadcast information corresponding to the 1st to Nth participants.

[0023] In a possible implementation, each AND gate includes a first input port and a second input port.

[0024] Determining the broadcast information of the first to N-1th participants using the port mask values ​​corresponding to the first to N-1th participants, the first mask information, and the second mask information, including:

[0025] For any one of the 1st to N-1th participants, each participant obtains the broadcast information corresponding to the participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information.

[0026] In a possible implementation, each AND gate includes a first input port and a second input port.

[0027] For the Nth participant, determining the broadcast information of the Nth participant using the port mask value corresponding to the Nth participant, the first mask information, and the first information includes:

[0028] The broadcast information corresponding to the participant is obtained according to the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information.

[0029] In a possible implementation manner, obtaining the broadcast information corresponding to the participant according to a first product of a port mask value corresponding to the first input port and first mask information corresponding to the second input port, a second product of a port mask value corresponding to the second input port and first mask information corresponding to the first input port, and the second mask information includes:

[0030] The XOR operation result of the first product, the second product and the second mask information is used as the broadcast information corresponding to the participant.

[0031] In a possible implementation manner, obtaining the broadcast information corresponding to the participant according to a first product of a port mask value corresponding to the first input port and first mask information corresponding to the second input port, a second product of a port mask value corresponding to the second input port and first mask information corresponding to the first input port, and the first information includes:

[0032] The XOR operation result of the first product, the second product and the first information is used as the broadcast information corresponding to the participant.

[0033] In a possible implementation manner, using the first information and the second information to complete the digital signature includes:

[0034] Perform hash operations on the first information and the second information respectively, and use the hash operation results to complete the digital signature.

[0035] According to one aspect of the present disclosure, a digital signature device is provided, the device comprising:

[0036] A first determination module is used to determine a target Boolean circuit according to an encryption algorithm, a private key and a public key message of a preset signature algorithm, and obtain input signals of each gate circuit in the target Boolean circuit, wherein the calculation task of the target Boolean circuit is allocated to N participants, where N is a positive integer;

[0037] A mask generation module, used to generate N random first mask information for the input signal of each AND gate in the target Boolean circuit, and to generate N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information;

[0038] The calculation module is used to: perform calculation operations for each AND gate to complete the digital signature, including:

[0039] A second determination module, configured to determine first information using the first mask information of each input signal and each second mask information;

[0040] A third determination module, configured to determine second information using the first information, each piece of second mask information, each input signal and its first mask information;

[0041] A digital signature module is used to complete a digital signature using the first information and the second information.

[0042] According to one aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to call the instructions stored in the memory to execute the above method.

[0043] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0044] The disclosed embodiment determines the target Boolean circuit according to the encryption algorithm, private key and public key message of the preset signature algorithm, and obtains the input signal of each gate circuit in the target Boolean circuit. Then, the sampling step generates N random first mask information for the input signal of each gate circuit, and generates N-1 random second mask information for each gate circuit. Then, the calculation step determines the first information using the first mask information and the second mask information of each input signal; determines the second information using the first information, the second mask information, the input signal and its first mask information; and completes the digital signature using the first information and the second information. The determination of the first information and the second information and the digital signature can be completed through one circuit execution. Compared with the related art, redundant calculations are reduced, signature efficiency is improved, and operation costs are reduced.

[0045] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and do not limit the present disclosure. Other features and aspects of the present disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used to illustrate the technical solutions of the present disclosure together with the specification.

[0047] Figure 1 A flow chart of a digital signature method according to an embodiment of the present disclosure is shown.

[0048] Figure 2 A schematic diagram of a LowMC symmetric primitive circuit is shown;

[0049] Figure 3a A schematic diagram of a serial circuit module according to an embodiment of the present disclosure is shown;

[0050] Figure 3b A schematic diagram of a parallel circuit module according to an embodiment of the present disclosure is shown;

[0051] Figure 4 A schematic diagram showing determining broadcast information corresponding to each participant of a door according to an embodiment of the present disclosure;

[0052] Figure 5 A block diagram of a digital signature device according to an embodiment of the present disclosure is shown;

[0053] Figure 6 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0054] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0055] In the description of the present disclosure, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present disclosure and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present disclosure.

[0056] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present disclosure, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0057] In the present disclosure, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present disclosure can be understood according to specific circumstances.

[0058] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0059] The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can represent including any one or more elements selected from the set consisting of A, B, and C.

[0060] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0061] Picnic3 is a digital signature algorithm based on zero-knowledge proof and secure multi-party computation, which can resist quantum computing attacks. The Picnic algorithm does not rely on number theory problems, but its security depends on the security of the symmetric cryptographic primitives used, namely the block cipher and hash function, so that it can resist the security risks brought by quantum computing.

[0062] The core idea of ​​the Picnic3 algorithm is to use zero-knowledge proof technology to prove that the message is signed by a legitimate private key, but will not disclose any information about the private key. Its implementation mainly includes the following steps:

[0063] Making commitments: The prover generates a series of commitments, including initial data generated using a private key and a message. This process involves the commitment generation mechanism of zero-knowledge proofs, which is used to ensure the authenticity of the information in subsequent steps.

[0064] Generate challenges: The verifier generates multiple challenges through a secure random number generator and sends these challenge information to the prover. These challenges are used to test whether the signer complies with the protocol. The generation of challenges is random, ensuring that the signing process cannot be predicted or forged.

[0065] Make a response: The prover calculates and returns a response to the challenge based on the private key and the previously generated commitment, and sends this data to the verifier. This response data is used to prove that the signer does have the corresponding private key and that the response is legitimate.

[0066] Verify the response: Finally, the verifier uses the prover’s public key to verify that the response is correct, thereby confirming the validity of the signature on the message.

[0067] Although the Picnic3 algorithm is designed based on the KKW protocol and shows significant advantages in anti-quantum computing, it also faces some challenges. Compared with other digital signature algorithms, Picnic3 has a longer signing time due to redundant calculations, which may affect performance in some application scenarios. For example, at present, Picnic3 will execute the circuit twice in the commitment stage to obtain AUX error correction information and MSGS broadcast information. This redundant calculation leads to low efficiency of digital signatures on the one hand, and waste of computing resources on the other hand.

[0068] See also Figure 1 , Figure 1 A flow chart of a digital signature method according to an embodiment of the present disclosure is shown.

[0069] like Figure 1 As shown, the method includes:

[0070] Step S11, determining a target Boolean circuit according to an encryption algorithm, a private key and a public key message of a preset signature algorithm, and obtaining input signals of each gate circuit in the target Boolean circuit, wherein the calculation task of the target Boolean circuit is distributed to N participants, where N is a positive integer;

[0071] Step S12, generating N random first mask information for the input signal of each AND gate in the target Boolean circuit, and generating N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information;

[0072] Step S13, for each AND gate, perform a calculation operation to complete the digital signature, including:

[0073] Step S131, determining first information using first mask information of each input signal and each second mask information;

[0074] Step S132, determining second information using the first information, each second mask information, each input signal and its first mask information;

[0075] Step S133: Complete the digital signature using the first information and the second information.

[0076] After the target Boolean circuit is determined according to the encryption algorithm, private key and public key message of the preset signature algorithm, and the input signal of each gate circuit in the target Boolean circuit is obtained, the embodiment of the present disclosure generates N random first mask information for the input signal of each AND gate through a sampling step, and generates N-1 random second mask information for each AND gate, and then determines the first information using the first mask information and the second mask information of each input signal in a calculation step; determines the second information using the first information, the second mask information, the input signal and its first mask information; completes the digital signature using the first information and the second information, and completes the determination of the first information and the second information and the digital signature through a single circuit execution. Compared with the related art, the embodiment of the present disclosure is based on the parallel optimization of the MPCitH digital signature, reduces redundant calculations, and processes the target Boolean circuit calculations in parallel, improves signature efficiency, and reduces computing costs.

[0077] Among them, MPCitH is a zero-knowledge proof (ZKP) system built from a multi-party computation (MPC) protocol.

[0078] The execution subject of the method of the embodiment of the present disclosure can be executed by a terminal device or a server or other processing device. Among them, the terminal device can be a user equipment (User Equipment, UE), a mobile device, a user terminal, a terminal, a handheld device, a computing device or a vehicle-mounted device, etc., and exemplary examples of some terminals are: mobile phones (Mobile Phone), tablet computers, laptops, PDAs, mobile Internet devices (Mobile Internet device, MID), wearable devices, virtual reality (Virtual Reality, VR) devices, augmented reality (Augmented reality, AR) devices, wireless terminals in industrial control (Industrial Control), wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids (Smart Grid), wireless terminals in transportation safety (Transportation Safety), wireless terminals in smart cities (Smart City), wireless terminals in smart homes (Smart Home), wireless terminals in Internet of Vehicles, etc. For example, the server can be a local server or a cloud server.

[0079] In some possible implementations, the method can be implemented by a processing component calling a computer-readable instruction stored in a memory. In one example, the processing component includes but is not limited to a separate processor, or a discrete component, or a combination of a processor and a discrete component. The processor may include a controller having an instruction execution function in an electronic device, and the processor may be implemented in any appropriate manner, for example, by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components. Inside the processor, the executable instructions may be executed by hardware circuits such as logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. In one example, the memory may include a computer-readable storage medium, which may be a tangible device that can hold and store instructions used by an instruction execution device. The computer-readable storage medium may be, for example, - but not limited to - an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), programmable read-only memory (PROM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, such as punch cards or raised structures in grooves with instructions stored thereon, and any suitable combination of the above. Computer-readable storage media as used herein are not to be interpreted as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0080] The disclosed embodiment implements the calculation of the first information and the second information based on secure multi-party computing (MPC). Of course, the disclosed embodiment does not limit the specific number of participants, and does not limit the specific implementation method of each step. Those skilled in the art can set it according to actual conditions and needs, and adopt appropriate technical means to achieve it.

[0081] The disclosed embodiment can optimize the "making a commitment" step in the Picnic3 algorithm. The first information and the second information can be obtained by executing the circuit once to achieve encryption, while the related technology needs to be executed once respectively. Therefore, the method proposed in the disclosed embodiment has high execution efficiency and low computing cost. It should be understood that the Picnic3 algorithm is designed based on the KKW protocol. The disclosed embodiment optimizes the "making a commitment" in the KKW protocol, reduces the redundant calculation and computing resource usage in the offline stage (the random mask is random and does not require the participation of the private key) and the online stage (the stage that requires the participation of the private key) in the existing protocol; proposes a parallel optimization technology for the core underlying encryption primitive of the KKW protocol, that is, modularizing the round function of the underlying encryption primitive, executing all round functions in parallel, shortening the signing time, improving the signing efficiency, and improving the software implementation efficiency by 20%-40%. Of course, please refer to the existing KKW protocol for other steps of implementing digital signatures based on the Picnic3 algorithm. The disclosed embodiment does not limit the specific implementation of the steps other than obtaining the first information (error correction information aux) and the second information (broadcast information msgs), and does not repeat them.

[0082] The embodiments of the present disclosure do not limit the encryption algorithm of the preset signature algorithm. In the Picnic3 algorithm, the encryption algorithm of the preset signature algorithm can be a LowMC symmetric primitive. By inputting the private key K and the public key message (P, C) into the algorithm corresponding to the LowMC symmetric primitive circuit, that is, C = LowMC (K, P) and executing it, it can be converted into a target Boolean circuit, and the input signal of each gate circuit in the target Boolean circuit can be obtained. The embodiments of the present disclosure can be applied to M instances, each instance is run by N parties to jointly generate a target Boolean circuit, N and M are determined by the parameters of Picnic3, where N and M are both positive integers. Of course, the embodiments of the present disclosure do not limit the specific implementation method of obtaining the target Boolean circuit, and those skilled in the art can adopt relevant technologies to implement it according to actual conditions and needs.

[0083] Among them, the input signal of the AND gate refers to the intermediate state value encrypted by the private key in the target Boolean circuit, which is obtained by running calculations in the LowMC circuit using the masked private key (that is, normally through the XOR gate and the AND gate). Of course, the embodiment of the present disclosure does not limit its specific calculation method. Those skilled in the art can set the encryption algorithm that can refer to the preset signature algorithm according to actual conditions and needs, such as the LowMC symmetric primitive.

[0084] Exemplarily, the LowMC symmetric primitive circuit may be an r-round bottom-layer circuit based on 129 / 192 / 255 bits, where r is a positive integer. The circuit that executes once in the embodiment of the present disclosure may be a LowMC symmetric primitive circuit that executes once, and one execution includes r rounds of operations.

[0085] The digital signature method of the embodiment of the present disclosure may also include:

[0086] The target Boolean circuit is divided into a plurality of circuit modules, each circuit module is used to execute a round of encryption algorithm, wherein each circuit module is configured to execute in parallel.

[0087] In this way, the disclosed embodiment can further improve the efficiency of digital signatures and reduce redundant calculations through multiple circuit modules executed in parallel.

[0088] See also Figure 2 , Figure 2 A schematic diagram of a LowMC symmetric primitive circuit is shown.

[0089] Figure 2 In the equation, j is the round number, j≤r and is an integer. The circuit corresponding to each round of operation includes a linear layer, a nonlinear layer, and a key XOR layer, such as Figure 2 As shown in the figure, X is a linear layer (used to perform linear operations, including XOR operations), A is a nonlinear layer (including AND gates), O is a key XOR layer (used to receive private key information), Input represents public key information (also called input plaintext information), Output is output ciphertext information (ciphertext information refers to the ciphertext obtained by encrypting the public key information with the previous private key. This value is public and is also called the public key), and state is the stored state value.

[0090] For example, if r is 4, that is, one execution of the LowMC symmetric primitive circuit requires four rounds of operations. If the related technology wants to obtain the error correction information AUX (first information) and the broadcast information MSGS (second information), it is necessary to perform two circuit calculations, a total of eight rounds. However, the embodiment of the present disclosure only requires the LowMC symmetric primitive circuit to be executed once to obtain the result.

[0091] In the disclosed embodiment, the number of circuit modules into which the target Boolean circuit is divided corresponds to the number of rounds r. For example, if the LowMC symmetric primitive circuit has 4 rounds, the number of circuit modules is 4, and each circuit module may include one round of circuit execution, that is, each circuit module may include a corresponding linear layer, a nonlinear layer, and a key XOR layer. Of course, the disclosed embodiment does not limit the specific number of rounds of the LowMC symmetric primitive circuit and the specific number of circuit modules, and those skilled in the art may set them according to actual conditions and needs.

[0092] See also Figure 3a , Figure 3a A schematic diagram of a serial circuit module according to an embodiment of the present disclosure is shown.

[0093] and Figure 2 The difference is, Figure 3aThe input and output of the LowMC symmetric primitive circuit shown are reversed, and it performs operations from the j+1th layer to the jth layer, and the input to the key XOR layer is Instead of the masked private key Z j .

[0094] It should be understood that the digital signature algorithm of the embodiment of the present disclosure can be applied to the above two different forms of LowMC symmetric primitive circuits.

[0095] See also Figure 3b , Figure 3b A schematic diagram of a parallel circuit module according to an embodiment of the present disclosure is shown.

[0096] For example, Figure 3b As shown, a circuit module is used to perform a round of operations in the LowMC symmetric primitive circuit, which includes a corresponding linear layer, a nonlinear layer (a layer where the AND gate is located), and a key XOR layer, wherein the linear layer and the key XOR layer are layers where the XOR gate is located. Taking the gate circuit including the XOR gate as an example, for any XOR gate, according to the intermediate mask information ([λ α ]、[λ β ]) is the first intermediate value. Of course, since during execution, the intermediate mask information ([λ α ]、[λ β ]), input signal Z α are all known, and these values ​​can be calculated to in, represents the input signal with mask), and they are all obtained by linear operation. Therefore, according to the previous round of operation data (intermediate mask information ([λ α ]、[λ β ]), input signal Z α And round key mask information The currently required intermediate mask information and input signal can be obtained by performing an inverse linear operation (or inverse linear operation) on the existing intermediate mask information (i.e., the first intermediate value is obtained by performing an inverse linear operation on the existing intermediate mask information), for example Figure 3b In, yes Performing an inverse linear operation (or inverse linear operation) yields For the operation here, please refer to the introduction of the LowMC symmetric primitive circuit in the related art, which will not be described in detail here. The specific method of the inverse linear operation is not limited in the embodiment of the present disclosure, and those skilled in the art can set it according to the actual situation and needs. For example, the inverse linear operation can be implemented by XOR operation and matrix operation.

[0097] The disclosed embodiment uses each circuit module independently, and under the premise of ensuring security strength, the solution effectively shortens the signature generation time and optimizes the performance of Picnic3 in practical applications. This optimized design helps to improve the practicality of post-quantum cryptography algorithms in various scenarios, especially in systems with strict requirements on signature speed and resource consumption.

[0098] The embodiment of the present disclosure does not limit the specific implementation method of generating the first mask information and the second mask information in step S12. Those skilled in the art may adopt relevant technologies to implement it according to actual conditions and needs. For example, N random first mask information and N-1 random second mask information may be generated according to the value of preset mask information given in advance. As long as the XOR sum of the N random first mask information is the value of the preset mask information, each second mask information may be in any random manner.

[0099] The calculation steps of step S13 are exemplarily introduced below.

[0100] In a possible implementation manner, step S131 determines the first information using the first mask information of each input signal and each second mask information, which may include:

[0101] For each input port of each AND gate, perform an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to the input port to obtain the intermediate mask information of the corresponding input port;

[0102] Determine each XOR result of the round key mask information obtained in the previous round of operation and the intermediate mask information corresponding to each input port of the AND gate, and perform an inverse linear operation on each XOR result to obtain a first intermediate value;

[0103] The first information is obtained by using the product of the intermediate mask information of each input port of the AND gate, the XOR sum of N-1 random second mask information corresponding to the AND gate, and the XOR result of the first intermediate value of the AND gate.

[0104] Exemplarily, the gate circuit may include an XOR gate, etc. According to the convention of the LowMC symmetric primitive circuit algorithm, the input of the XOR gate can be obtained by the inverse operation of the linear operation, for example Figure 2 Medium state j+1 The values ​​stored in the layer are inversely linearly calculated to obtain the values ​​of the statej-1 layer, and the statej-1 layer serves as the input of the nonlinear layer Aj+1, that is, as the input of each AND gate of this layer.

[0105] For example, if the AND gate is a two-input AND gate, that is, includes a first input port and a second input port, the embodiment of the present disclosure uses multi-party secure computing to implement the computing task, and the computing of each AND gate is assigned to N participants. Then, for the first input port, the first mask information corresponding to each participant is [λ α ] 1 …[λ α ] N ; For the second input port, the first mask information corresponding to each participant is [λ β ] 1 …[λ β ] N .

[0106] Exemplarily, by performing an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to the input port, the intermediate mask information of the corresponding input port is obtained, and the intermediate mask information of the first input port can be obtained as follows:

[0107] Exemplarily, by performing an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to the input port to obtain the intermediate mask information of the corresponding input port, the intermediate mask information of the second input port can be obtained as follows:

[0108] The embodiment of the present disclosure does not limit the specific implementation method of "determining each XOR result of the round key mask information obtained by the previous round operation and the intermediate mask information corresponding to each input port of the AND gate, and performing an inverse linear operation on each XOR result to obtain a first intermediate value". For example, after obtaining each XOR result, each XOR result can be XORed to determine the corresponding first intermediate value λ γ .

[0109] Among them, Figure 3b As shown, when the current round (middle frame) is operating, the round key mask information obtained by the previous round of operation can be obtained. And respectively combine the corresponding round key mask information with the intermediate mask information corresponding to each input port of the AND gate Perform XOR operation on each Obtain the corresponding XOR result, and then use a suitable inverse linear operation method to perform inverse linear transformation on each XOR result according to the actual situation and needs to obtain the first intermediate value λ γ .

[0110] Exemplarily, the first information is obtained by using the product of the intermediate mask information of each input port of the AND gate, the XOR sum of N-1 random second mask information corresponding to the AND gate, and the XOR result of the first intermediate value of the AND gate: in, represents the XOR sum of the N-1 random second mask information corresponding to the AND gate, λ α ·λ β represents the product of the intermediate mask information of each input port of the AND gate, λ γ Indicates the first intermediate value.

[0111] Exemplarily, the embodiment of the present disclosure may use the obtained first information aux as the second mask information corresponding to the Nth participant ([λ α,β ] N =aux), thereby realizing error correction of the operation results to improve the accuracy of the information.

[0112] After obtaining the first information, the embodiment of the present disclosure can further obtain the broadcast information of each participant, that is, the second information. Exemplarily, in a possible implementation, step S132 determines the second information using the first information, each second mask information, each input signal and its first mask information, which may include:

[0113] For any AND gate, the port mask value of the corresponding input port is obtained according to the intermediate mask information corresponding to each input port of the AND gate and the XOR operation result of the corresponding input signal;

[0114] Determine the broadcast information of the first to N-1th participants using the port mask values ​​corresponding to the first to N-1th participants, the first mask information, and the second mask information;

[0115] Determine the broadcast information of the Nth participant by using the port mask value corresponding to the Nth participant, the first mask information and the first information,

[0116] The second information includes broadcast information corresponding to the 1st to Nth participants.

[0117] Exemplarily, for the first input port of the AND gate, based on “obtaining the port mask value of the corresponding input port according to the intermediate mask information corresponding to each input port of the AND gate and the XOR operation result of the corresponding input signal”, it can be obtained that the port mask value of the first input port is: Among them, Z α Represents the input signal of the first input port.

[0118] Exemplarily, for the second input port of the AND gate, based on “obtaining the port mask value of the corresponding input port according to the intermediate mask information corresponding to each input port of the AND gate and the XOR operation result of the corresponding input signal”, it can be obtained that the port mask value of the second input port is: Among them, Z β Indicates the input signal of the second input port.

[0119] Exemplarily, the input signal Z of the first input port α , the input signal Z of the second input port β Obtained in step S11.

[0120] In a possible implementation, still taking a two-input AND gate as an example, each AND gate may include a first input port and a second input port.

[0121] The “determining the broadcast information of the 1st to N-1th participants using the port mask values ​​corresponding to the 1st to N-1th participants, the first mask information, and the second mask information” may include:

[0122] For any one of the 1st to N-1th participants, each participant obtains the broadcast information corresponding to the participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information.

[0123] In a possible implementation manner, obtaining the broadcast information corresponding to the participant according to a first product of a port mask value corresponding to the first input port and first mask information corresponding to the second input port, a second product of a port mask value corresponding to the second input port and first mask information corresponding to the first input port, and the second mask information may include:

[0124] Multiply the first product The second product And the second mask information ([λ α,β ] i ) is used as the broadcast information corresponding to the participant ([s] i ), the relationship can be expressed by the following formula

[0125] Please participate Figure 4 , Figure 4 A schematic diagram of determining broadcast information corresponding to each participant of a door according to an embodiment of the present disclosure is shown.

[0126] For example, Figure 4 As shown, for an AND gate, there are N participants (P 1 ~P N-1 , P N ), because the participant P 1 ~P N-1 The second mask information of is known, therefore, the embodiment of the present disclosure can use the 1st to N-1th participants (P 1 ~P N-1) The corresponding port mask value, the first mask information and the second mask information determine the broadcast information of the 1st to N-1th participants.

[0127] Specifically, in one example, according to "for any one of the 1st to N-1th participants, each participant obtains the broadcast information corresponding to the participant according to the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information", any participant Pi is the broadcast information Among them, i is less than or equal to N-1 and is an integer, that is, Pi is any one of the 1st to N-1th participants.

[0128] For example, for the first participant P 1 ,like Figure 4 As shown, the first participant P 1 The broadcast information can be

[0129] For example, for the N-1th participant P N-1 ,like Figure 4 As shown, the N-1th participant P N-1 The broadcast information can be

[0130] In a possible implementation manner, for the Nth participant, determining the broadcast information of the Nth participant using the port mask value corresponding to the Nth participant, the first mask information, and the first information may include:

[0131] The broadcast information corresponding to the participant is obtained according to the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information.

[0132] In this way, the embodiment of the present disclosure uses the first information aux obtained above as the Nth participant P N The second mask information can be used to correct the results, thereby improving the accuracy of multi-party calculations.

[0133] In a possible implementation manner, obtaining the broadcast information corresponding to the participant according to a first product of a port mask value corresponding to the first input port and first mask information corresponding to the second input port, a second product of a port mask value corresponding to the second input port and first mask information corresponding to the first input port, and the first information may include:

[0134] Multiply the first product The second product and the XOR operation result of the first information (aux) as the corresponding broadcast information of the participant ([s] N ), the relationship can be expressed by the following formula

[0135] For example, Figure 4 As shown, for an AND gate, there are N participants P 1 ~P N-1 , P N , since the participant P 1 ~P N-1 The second mask information of is known, therefore, the embodiment of the present disclosure can use the 1st to N-1th participants (P 1 ~P N-1 ) The port mask value corresponding to the first mask information and the second mask information determine the broadcast information of the 1st to N-1th participants. The introduction is as described above and will not be repeated here.

[0136] For the Nth participant, the embodiment of the present disclosure determines the broadcast information of the Nth participant according to the Nth participant, using the port mask value corresponding to the Nth participant, the first mask information and the first information.

[0137] Specifically, in one example, according to "according to the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information, the broadcast information corresponding to the participant is obtained", such as Figure 4 As shown, the Nth participant P N For broadcast information Among them, aux is [λ α,β ] N .

[0138] In this way, the embodiment of the present disclosure uses the first information aux as the Nth participant P N The second mask information of the Nth participant PN is used to calculate the second information (i.e., broadcast information), which can satisfy the accuracy condition λ of the AND gate of the Nth participant PN. α,β =λ α ·λ β .

[0139] In a possible implementation manner, using the first information and the second information to complete the digital signature includes:

[0140] Perform hash operations on the first information and the second information respectively, and use the hash operation results to complete the digital signature.

[0141] The embodiments of the present disclosure do not limit the specific hash algorithm used for hash operations, and those skilled in the art can set it according to actual conditions and needs.

[0142] The disclosed embodiment does not limit the specific implementation method of completing the digital signature using the first information and the second information. After obtaining the first information and the second information, the disclosed embodiment can refer to the introduction of "making a commitment" in the existing Picnic3 algorithm to complete the digital signature. The specific content included in the digital signature can be determined according to actual conditions and needs, and the disclosed embodiment does not limit it. For example, it may include the hash value of the first information and the second information, the random challenge value, the port mask value (masked secret information) and the corresponding response information, etc. For details, please refer to the protocol introduction of the existing Picnic3 algorithm.

[0143] It can be understood that the above-mentioned various method embodiments mentioned in the present disclosure can be combined with each other to form a combined embodiment without violating the principle logic. Due to space limitations, the present disclosure will not repeat them. It can be understood by those skilled in the art that in the above-mentioned method of the specific implementation method, the specific execution order of each step should be determined according to its function and possible internal logic.

[0144] Compared with the existing MPCitH-based PICNIC3 digital signature technology, the functions completed by the disclosed embodiment are the same, but the signing speed of the technology is faster, the throughput is greater, and the signing efficiency is improved by 20%-40%.

[0145] Compared with the existing PICNIC3 digital signature technology, the main difference lies in the step of "making a commitment". The existing PICNIC's underlying circuit is executed serially, and auxiliary (aux) information and message (msgs) information are calculated in the offline stage and the online stage respectively. The calculation of information needs to be run twice in series in the underlying circuit, which has a high computational cost.

[0146] In the disclosed embodiment, the introduction of masking technology makes the input and output of the round function of each participant have a certain degree of independence. This technology pre-calculates the state value port mask information of the secret circuit. This method realizes parallel calculation of the underlying encryption primitive round functions of each participant, which greatly improves the efficiency of signature.

[0147] Of course, the technical solution of the embodiment of the present disclosure is not limited to the PICNIC3 algorithm, and is universal to the proof technology using MPCitH, that is, as long as an algorithm is required to generate the first information and the second information for digital signature, the embodiment of the present disclosure can be applied.

[0148] See also Figure 5 , Figure 5 A block diagram of a digital signature device according to an embodiment of the present disclosure is shown.

[0149] like Figure 5 As shown, the device comprises:

[0150] The first determination module 10 is used to determine the target Boolean circuit according to the encryption algorithm, private key and public key message of the preset signature algorithm, and obtain the input signal of each gate circuit in the target Boolean circuit, and the calculation task of the target Boolean circuit is allocated to N participants, where N is a positive integer;

[0151] The mask generation module 20 is used to generate N random first mask information for the input signal of each AND gate in the target Boolean circuit, and to generate N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information;

[0152] The calculation module 30 is used to perform a calculation operation for each AND gate to complete the digital signature, including:

[0153] A second determination module 310, configured to determine first information using the first mask information of each input signal and each second mask information;

[0154] A third determination module 320, configured to determine second information using the first information, each second mask information, each input signal and its first mask information;

[0155] The digital signature module 330 is used to complete a digital signature using the first information and the second information.

[0156] After determining the target Boolean circuit according to the encryption algorithm, private key and public key message of the preset signature algorithm and obtaining the input signals of each gate circuit in the target Boolean circuit, the embodiment of the present disclosure generates N random first mask information for the input signal of each AND gate through a sampling step, and generates N-1 random second mask information for each AND gate, and then determines the first information using the first mask information and the second mask information of each input signal in a calculation step; determines the second information using the first information, the second mask information, the input signal and its first mask information; and completes the digital signature using the first information and the second information. The determination of the first information and the second information and the digital signature can be completed through a single circuit execution. Compared with the related art, the embodiment of the present disclosure is based on the parallel optimization of the MPCitH digital signature, which reduces redundant calculations, improves signature efficiency, and reduces computing costs.

[0157] In a possible implementation, the method further includes:

[0158] The target Boolean circuit is divided into a plurality of circuit modules, each circuit module is used to execute a round of encryption algorithm, wherein each circuit module is configured to execute in parallel.

[0159] In a possible implementation manner, determining the first information using the first mask information of each input signal and each second mask information includes:

[0160] For each input port of each AND gate, perform an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to the input port to obtain the intermediate mask information of the corresponding input port;

[0161] Determine each XOR result of the round key mask information obtained in the previous round of operation and the intermediate mask information corresponding to each input port of the AND gate, and perform an inverse linear operation on each XOR result to obtain a first intermediate value;

[0162] The first information is obtained by using the product of the intermediate mask information of each input port of the AND gate, the XOR sum of N-1 random second mask information corresponding to the AND gate, and the XOR result of the first intermediate value of the AND gate.

[0163] In a possible implementation manner, determining the second information by using the first information, each piece of second mask information, each input signal and its first mask information includes:

[0164] For any AND gate, the port mask value of the corresponding input port is obtained according to the intermediate mask information corresponding to each input port of the AND gate and the XOR operation result of the corresponding input signal;

[0165] Determine the broadcast information of the first to N-1th participants using the port mask values ​​corresponding to the first to N-1th participants, the first mask information, and the second mask information;

[0166] Determine the broadcast information of the Nth participant by using the port mask value corresponding to the Nth participant, the first mask information and the first information,

[0167] The second information includes broadcast information corresponding to the 1st to Nth participants.

[0168] In a possible implementation, each AND gate includes a first input port and a second input port.

[0169] Determining the broadcast information of the first to N-1th participants using the port mask values ​​corresponding to the first to N-1th participants, the first mask information, and the second mask information, including:

[0170] For any one of the 1st to N-1th participants, each participant obtains the broadcast information corresponding to the participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information.

[0171] In a possible implementation, each AND gate includes a first input port and a second input port.

[0172] For the Nth participant, determining the broadcast information of the Nth participant using the port mask value corresponding to the Nth participant, the first mask information, and the first information includes:

[0173] The broadcast information corresponding to the participant is obtained according to the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information.

[0174] In a possible implementation manner, obtaining the broadcast information corresponding to the participant according to a first product of a port mask value corresponding to the first input port and first mask information corresponding to the second input port, a second product of a port mask value corresponding to the second input port and first mask information corresponding to the first input port, and the second mask information includes:

[0175] The XOR operation result of the first product, the second product and the second mask information is used as the broadcast information corresponding to the participant.

[0176] In a possible implementation manner, obtaining the broadcast information corresponding to the participant according to a first product of a port mask value corresponding to the first input port and first mask information corresponding to the second input port, a second product of a port mask value corresponding to the second input port and first mask information corresponding to the first input port, and the first information includes:

[0177] The XOR operation result of the first product, the second product and the first information is used as the broadcast information corresponding to the participant.

[0178] In a possible implementation manner, using the first information and the second information to complete the digital signature includes:

[0179] Perform hash operations on the first information and the second information respectively, and use the hash operation results to complete the digital signature.

[0180] In a possible implementation, the gate circuit includes an XOR gate, and for any XOR gate, the first intermediate value is obtained according to the XOR operation result of the intermediate mask information corresponding to each input port of the XOR gate, or

[0181] The first intermediate value is obtained by performing an inverse linear operation on the existing intermediate mask information.

[0182] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0183] The embodiment of the present disclosure also provides a computer-readable storage medium, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the above method is implemented. The computer-readable storage medium may be a non-volatile computer-readable storage medium.

[0184] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to call the instructions stored in the memory to execute the above method.

[0185] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0186] The proving party, each participating party and the corresponding verifying party in the embodiment of the present disclosure may all be electronic devices, and the electronic devices may be provided as terminals, servers or other forms of devices.

[0187] See also Figure 6 , Figure 6 A block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0188] For example, the electronic device 1900 may be provided as a server. Figure 6 , the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0189] The electronic device 1900 may also include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output (I / O) interface 1958. The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as a Microsoft Server operating system (Windows Server 2003). TM ), a graphical user interface operating system launched by Apple (Mac OSX TM ), a multi-user, multi-process computer operating system (Unix TM ), a free and open source Unix-like operating system (Linux TM ), an open source Unix-like operating system (FreeBSD TM ) or similar.

[0190] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0191] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0192] Computer readable storage medium can be a tangible device that can hold and store instructions used by an instruction execution device. Computer readable storage medium can be, for example, (but not limited to) an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, for example, a punch card or a convex structure in a groove on which instructions are stored, and any suitable combination thereof. The computer readable storage medium used here is not interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (for example, a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0193] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0194] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0195] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0196] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0197] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0198] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0199] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK) and the like.

[0200] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A digital signature method, characterized in that: The method comprises: Determine the target Boolean circuit according to the encryption algorithm, private key and public key message of the preset signature algorithm, and obtain the input signal of each gate circuit in the target Boolean circuit. The calculation task of the target Boolean circuit is assigned to N participants, where N is a positive integer; Generate N random first mask information for each input signal of each AND gate in the target Boolean circuit, and generate N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information; For each AND gate, a computation operation is performed to complete the digital signature, including: Determine the first information using the first mask information of each input signal and each second mask information; Determine second information using the first information, each second mask information, each input signal and its first mask information; The digital signature is completed using the first information and the second information.

2. The method according to claim 1, characterized in that: The method further comprises: The target Boolean circuit is divided into a plurality of circuit modules, each circuit module is used to execute a round of encryption algorithm, wherein each circuit module is configured to execute in parallel.

3. The method according to claim 1 or 2, characterized in that: Determining first information using first mask information of each input signal and each second mask information includes: For each input port of each AND gate, perform an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to the input port to obtain the intermediate mask information of the corresponding input port; Determine each XOR result of the round key mask information obtained in the previous round of operation and the intermediate mask information corresponding to each input port of the AND gate, and perform an inverse linear operation on each XOR result to obtain a first intermediate value; The first information is obtained by using the product of the intermediate mask information of each input port of the AND gate, the XOR sum of N-1 random second mask information corresponding to the AND gate, and the XOR result of the first intermediate value of the AND gate.

4. The method according to claim 1 or 2, characterized in that: Determining second information using the first information, each second mask information, each input signal and its first mask information includes: For any AND gate, the port mask value of the corresponding input port is obtained according to the intermediate mask information corresponding to each input port of the AND gate and the XOR operation result of the corresponding input signal; Determine the broadcast information of the first to N-1th participants using the port mask values ​​corresponding to the first to N-1th participants, the first mask information, and the second mask information; Determine the broadcast information of the Nth participant by using the port mask value corresponding to the Nth participant, the first mask information and the first information, The second information includes broadcast information corresponding to the 1st to Nth participants.

5. The method according to claim 1 or 2, characterized in that: Each AND gate includes a first input port and a second input port, Determining the broadcast information of the first to N-1th participants using the port mask values ​​corresponding to the first to N-1th participants, the first mask information, and the second mask information, including: For any one of the 1st to N-1th participants, each participant obtains the broadcast information corresponding to the participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information.

6. The method according to claim 5, characterized in that Each AND gate includes a first input port and a second input port, For the Nth participant, determining the broadcast information of the Nth participant using the port mask value corresponding to the Nth participant, the first mask information, and the first information includes: The broadcast information corresponding to the participant is obtained according to the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information.

7. The method according to claim 5, characterized in that Obtaining broadcast information corresponding to the participant according to a first product of a port mask value corresponding to the first input port and first mask information corresponding to the second input port, a second product of a port mask value corresponding to the second input port and first mask information corresponding to the first input port, and the second mask information, including: The XOR operation result of the first product, the second product and the second mask information is used as the broadcast information corresponding to the participant.

8. The method according to claim 6, characterized in that Obtaining broadcast information corresponding to the participant according to a first product of a port mask value corresponding to the first input port and first mask information corresponding to the second input port, a second product of a port mask value corresponding to the second input port and first mask information corresponding to the first input port, and the first information, including: The XOR operation result of the first product, the second product and the first information is used as the broadcast information corresponding to the participant.

9. The method according to claim 1 or 2, characterized in that: Using the first information and the second information to complete the digital signature includes: Perform hash operations on the first information and the second information respectively, and use the hash operation results to complete the digital signature.

10. A digital signature device, characterized in that: The device comprises: A first determination module is used to determine a target Boolean circuit according to an encryption algorithm, a private key and a public key message of a preset signature algorithm, and obtain input signals of each gate circuit in the target Boolean circuit, wherein the calculation task of the target Boolean circuit is allocated to N participants, where N is a positive integer; A mask generation module, used to generate N random first mask information for each input signal of each AND gate in the target Boolean circuit, and to generate N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information; The calculation module is used to: perform calculation operations for each AND gate to complete the digital signature, including: A second determination module, configured to determine first information using the first mask information of each input signal and each second mask information; A third determination module, configured to determine second information using the first information, each piece of second mask information, each input signal and its first mask information; A digital signature module is used to complete a digital signature using the first information and the second information.

Images