Digital signature method and apparatus

Abstract

The present disclosure relates to a digital signature method and device, the method comprising: determining input signals of each gate circuit and a target Boolean circuit according to an encryption algorithm, a private key and a public key message of a preset signature algorithm; generating N random first mask information for each input signal of an AND gate in the target Boolean circuit, and generating N-1 random second mask information for each AND gate, and the XOR sum of the N mask information is the value of the preset mask information; for each AND gate, performing a calculation operation to complete a digital signature, comprising: determining first information using the first mask information of each input signal and each second mask information; determining second information using the first information, each second mask information, each input signal and the first mask information thereof; and completing the digital signature using the first information and the second information, which reduces redundant calculation, processes the target Boolean circuit calculation in parallel, improves signature efficiency, and reduces operation cost.

Description

Technical Field

[0001] This disclosure relates to the field of encryption technology, and in particular to a digital signature method and apparatus. Background Technology

[0002] Digital signatures are a technology that guarantees the integrity, authenticity, and non-repudiation of data. They are signed using a private key and verified by a corresponding public key, ensuring that the data has not been tampered with during transmission and that it comes from a legitimate sender.

[0003] In cryptography, various digital signature algorithms are widely used, including traditional algorithms such as RSA, ECDSA, and EdDSA. These algorithms, based on difficult problems such as large number factorization and elliptic curve discrete logarithm, provide high security under current computing conditions. However, with the development of quantum computing technology, these traditional signature algorithms are vulnerable to quantum computer attacks. Therefore, researching quantum-resistant signature algorithms has become an inevitable trend.

[0004] Although some algorithms (such as Picnic3) have shown significant advantages in quantum computing resistance, these encryption algorithms have long signature times due to redundant computation, which may affect performance in some application scenarios. Summary of the Invention

[0005] According to one aspect of this disclosure, a digital signature method is provided, the method comprising:

[0006] The target Boolean circuit is determined based on the encryption algorithm of the preset signature algorithm, the private key and the public key message, and the input signals of each gate circuit in the target Boolean circuit are obtained. The calculation task of the target Boolean circuit is assigned to N participants, where N is a positive integer.

[0007] For each AND gate input signal in the target Boolean circuit, N random first mask information is generated, and for each AND gate, N-1 random second mask information is generated, wherein the XOR sum of the N mask information is the value of the preset mask information;

[0008] For each AND gate, perform a computational operation to complete the digital signature, including:

[0009] The first information is determined using the first mask information and the second mask information of each input signal;

[0010] The second information is determined using the first information, each second mask information, each input signal and its first mask information;

[0011] The digital signature is completed using the first information and the second information.

[0012] In one possible implementation, the method further includes:

[0013] The target Boolean circuit is divided into multiple circuit modules, each of which is used to execute one round of encryption algorithm, wherein the circuit modules are configured to execute in parallel.

[0014] In one possible implementation, determining the first information using the first mask information and the second mask information of each input signal includes:

[0015] For each input port of each AND gate, perform an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to that input port to obtain the intermediate mask information of the corresponding input port.

[0016] Determine the XOR results of the round key mask information obtained in the previous round of operation and the intermediate mask information corresponding to each input port of the AND gate, and perform an inverse linear operation on each XOR result to obtain the first intermediate value;

[0017] The first information is obtained by multiplying the intermediate mask information of each input port of the AND gate, XORing the N-1 random second mask information corresponding to the AND gate, and XORing the first intermediate value of the AND gate.

[0018] In one possible implementation, determining the second information using the first information, each of the second mask information, each input signal, and their first mask information includes:

[0019] For any AND gate, the port mask value of the corresponding input port is obtained by XORing the intermediate mask information of each input port of the AND gate with the corresponding input signal.

[0020] The broadcast information of the first to N-1 participants is determined using the port mask values ​​corresponding to the first to N-1 participants, the first mask information, and the second mask information.

[0021] The broadcast information of the Nth participant is determined using the port mask value corresponding to the Nth participant, the first mask information, and the first information.

[0022] The second information includes broadcast information corresponding to the first to the Nth participants.

[0023] In one possible implementation, each AND gate includes a first input port and a second input port.

[0024] The broadcast information of the first to N-1 participants is determined using the port mask values ​​corresponding to the first to N-1 participants, the first mask information, and the second mask information, including:

[0025] For any one of the first to the (N-1)th participants, each participant obtains the broadcast information corresponding to that participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information.

[0026] In one possible implementation, each AND gate includes a first input port and a second input port.

[0027] For the Nth participant, the broadcast information of the Nth participant is determined using the port mask value corresponding to the Nth participant, the first mask information, and the first information, including:

[0028] The broadcast information corresponding to the participant is obtained by multiplying the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information.

[0029] In one possible implementation, the broadcast information corresponding to the participant is obtained based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information, including:

[0030] The result of the XOR operation of the first product, the second product, and the second mask information is used as the broadcast information corresponding to the participant.

[0031] In one possible implementation, the broadcast information corresponding to the participant is obtained based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information, including:

[0032] The result of the XOR operation of the first product, the second product, and the first information is used as the broadcast information corresponding to the participant.

[0033] In one possible implementation, completing a digital signature using the first information and the second information includes:

[0034] The first information and the second information are hashed respectively, and the hash results are used to complete the digital signature.

[0035] According to one aspect of this disclosure, a digital signature apparatus is provided, the apparatus comprising:

[0036] The first determining module is used to determine the target Boolean circuit based on the encryption algorithm of the preset signature algorithm, the private key and the public key message, and to obtain the input signals of each gate circuit in the target Boolean circuit. The calculation task of the target Boolean circuit is assigned to N participants, where N is a positive integer.

[0037] The mask generation module is used to generate N random first mask information for the input signal of each AND gate in the target Boolean circuit, and to generate N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information.

[0038] The computation module is used to: perform computation operations for each AND gate to complete the digital signature, including:

[0039] The second determining module is used to determine the first information using the first mask information and the second mask information of each input signal;

[0040] The third determining module is used to determine the second information using the first information, each second mask information, each input signal and its first mask information;

[0041] A digital signature module is used to complete a digital signature using the first information and the second information.

[0042] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to invoke the instructions stored in the memory to perform the method described above.

[0043] According to one aspect of this disclosure, a computer-readable storage medium is provided that stores computer program instructions thereon, which, when executed by a processor, implement the above-described method.

[0044] This embodiment of the present disclosure determines the target Boolean circuit based on the encryption algorithm of the preset signature algorithm, the private key, and the public key message, and obtains the input signals of each gate circuit in the target Boolean circuit. Then, through a sampling step, N random first mask information is generated for the input signal of each gate circuit, and N-1 random second mask information is generated for each gate circuit. Next, a calculation step uses the first mask information and the second mask information of each input signal to determine first information; the first information, the second mask information, each input signal, and its first mask information are used to determine second information; and the first information and the second information are used to complete the digital signature. The determination of the first and second information and the completion of the digital signature can be achieved through a single circuit execution. Compared with related technologies, this reduces redundant calculations, improves signature efficiency, and lowers computational costs.

[0045] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Other features and aspects of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the specification, serve to illustrate the technical solutions of this disclosure.

[0047] Figure 1 A flowchart of a digital signature method according to an embodiment of the present disclosure is shown.

[0048] Figure 2 A schematic diagram of a LowMC symmetric primitive circuit is shown;

[0049] Figure 3a A schematic diagram of a serial circuit module according to an embodiment of the present disclosure is shown;

[0050] Figure 3b A schematic diagram of a parallel circuit module according to an embodiment of the present disclosure is shown;

[0051] Figure 4 A schematic diagram illustrating the determination of broadcast information corresponding to each participant in the gate according to an embodiment of the present disclosure is shown.

[0052] Figure 5 A block diagram of a digital signature apparatus according to an embodiment of the present disclosure is shown;

[0053] Figure 6 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0054] Various exemplary embodiments, features, and aspects of this disclosure will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0055] In the description of this disclosure, it should be understood that the terms "length", "width", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing this disclosure and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this disclosure.

[0056] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this disclosure, "a plurality of" means two or more, unless otherwise expressly specified.

[0057] In this disclosure, unless otherwise expressly specified and limited, the terms "installation," "connection," "linking," "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this disclosure according to the specific circumstances.

[0058] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0059] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0060] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.

[0061] Picnic3 is a digital signature algorithm based on zero-knowledge proofs and secure multi-party computation, which is resistant to quantum computing attacks. The Picnic algorithm does not rely on number theory problems; its security depends on the security of the symmetric cryptographic primitives it uses, namely block ciphers and hash functions, thus resisting the security risks posed by quantum computing.

[0062] The core idea of ​​the Picnic3 algorithm is to use zero-knowledge proofs to prove that a message was signed with a legitimate private key, without revealing any information about the private key. Its implementation mainly includes the following steps:

[0063] • Making Commitments: The proving party generates a series of commitments, containing initial data generated using the private key and the message. This process involves a commitment generation mechanism based on zero-knowledge proofs to ensure the authenticity of information in subsequent steps.

[0064] • Challenge Generation: The verifier generates multiple challenges using a secure random number generator and sends these challenges to the prover. These challenges are used to test whether the signer is complying with the protocol. The generation of challenges is random, ensuring that the signing process cannot be predicted or forged.

[0065] • Responding: Based on the private key and the previously generated promise, the proving party calculates and returns a response to the challenge, sending this data to the validator. This response data serves to prove that the signer indeed possesses the corresponding private key and that the response is valid.

[0066] • Verify the response: Finally, the verifier uses the prover's public key to verify whether the response is correct, thereby confirming the validity of the message signature.

[0067] Although the Picnic3 algorithm is based on the KKW protocol and exhibits significant advantages in quantum-resistant computing, it also faces some challenges. Compared to other digital signature algorithms, Picnic3 has a longer signing time due to redundant computation, which may affect performance in certain application scenarios. For example, currently, Picnic3 executes the circuit twice during the commitment phase to obtain AUX error correction information and MSGS broadcast information. This redundant computation leads to both low digital signature efficiency and wasted computing resources.

[0068] Please see Figure 1 , Figure 1 A flowchart of a digital signature method according to an embodiment of the present disclosure is shown.

[0069] like Figure 1 As shown, the method includes:

[0070] Step S11: Determine the target Boolean circuit based on the encryption algorithm of the preset signature algorithm, the private key and the public key message, and obtain the input signals of each gate circuit in the target Boolean circuit. The calculation task of the target Boolean circuit is assigned to N participants, where N is a positive integer.

[0071] Step S12: Generate N random first mask information for the input signal of each AND gate in the target Boolean circuit, and generate N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information.

[0072] Step S13: For each AND gate, perform a computation operation to complete the digital signature, including:

[0073] Step S131: Determine the first information using the first mask information and the second mask information of each input signal;

[0074] Step S132: Determine the second information using the first information, each second mask information, each input signal and its first mask information;

[0075] Step S133: Complete the digital signature using the first information and the second information.

[0076] This embodiment of the present disclosure determines the target Boolean circuit based on the encryption algorithm of the preset signature algorithm, the private key, and the public key message, and obtains the input signals of each gate circuit in the target Boolean circuit. Then, through a sampling step, N random first mask information is generated for each AND gate's input signal, and N-1 random second mask information is generated for each AND gate. Next, a calculation step uses the first mask information and the second mask information of each input signal to determine first information; the first information, the second mask information, each input signal, and its first mask information are used to determine second information; and the first information and the second information are used to complete the digital signature. The determination of the first and second information, and the completion of the digital signature, can be achieved through a single circuit execution. Compared to related technologies, this embodiment of the present disclosure, based on the parallel optimization of MPCitH digital signatures, reduces redundant calculations and processes the target Boolean circuit calculations in parallel, improving signature efficiency and reducing computational costs.

[0077] MPCitH is a zero-knowledge proof (ZKP) system built from the multi-party computation (MPC) protocol.

[0078] The method described in this disclosure can be executed by a terminal device, a server, or other processing device. The terminal device can be a user equipment (UE), mobile device, user terminal, terminal, handheld device, computing device, or in-vehicle device, etc. Examples of terminals include: mobile phones, tablets, laptops, PDAs, mobile internet devices (MIDs), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and wireless terminals in vehicle-to-everything (V2X) networks. For example, the server can be a local server or a cloud server.

[0079] In some possible implementations, the method can be implemented by a processing component invoking computer-readable instructions stored in memory. In one example, the processing component includes, but is not limited to, a single processor, discrete components, or a combination of processors and discrete components. The processor may include a controller in an electronic device with instruction execution capabilities. The processor may be implemented in any suitable manner, for example, by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components. Within the processor, the executable instructions may be executed by hardware circuitry such as logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. In one example, the memory may include a computer-readable storage medium, which may be a tangible device capable of holding and storing instructions used by an instruction execution device. The computer-readable storage medium may be, for example,—but is not limited to—an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), programmable read-only memory (PROM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media as used herein is not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0080] This disclosure embodiment is based on Secure Multi-party Computation (MPC) to calculate the first information and the second information. Of course, this disclosure embodiment does not limit the specific number of participating parties or the specific implementation method of each step. Those skilled in the art can set it according to the actual situation and needs, and adopt appropriate technical means to implement it.

[0081] This disclosure optimizes the "make commitment" step in the Picnic3 algorithm, allowing encryption by obtaining the first and second information in a single circuit execution. In contrast, related technologies require separate executions. Therefore, the method proposed in this disclosure offers higher execution efficiency and lower computational cost. It should be understood that the Picnic3 algorithm is based on the KKW protocol. This disclosure optimizes the "make commitment" step in the KKW protocol, reducing redundant computation and resource usage in the offline (random masks are random and do not require private keys) and online (private key required) stages of existing protocols. It also proposes a parallel optimization technique for the core underlying cryptographic primitives of the KKW protocol, modularizing the round functions of the underlying cryptographic primitives and executing all round functions in parallel, shortening signature time and improving signature efficiency. Software implementation efficiency is improved by 20%-40%. Of course, other steps for implementing digital signatures based on the Picnic3 algorithm can be found in existing KKW protocols. This disclosure does not limit or elaborate on the specific implementation of steps other than obtaining the first information (error correction information aux) and the second information (broadcast information msgs).

[0082] This disclosure does not limit the encryption algorithm of the preset signature algorithm. In the Picnic3 algorithm, the encryption algorithm of the preset signature algorithm can be a LowMC symmetric primitive. By inputting the private key K and the public key message (P, C) into the algorithm corresponding to the LowMC symmetric primitive circuit, i.e., C = LowMC(K, P) and executing it, it can be converted into a target Boolean circuit, and the input signals of each gate circuit in the target Boolean circuit can be obtained. This disclosure can be applied to M instances, each instance is run by N parties to jointly generate a target Boolean circuit, where N and M are determined by the parameters of Picnic3, and N and M are both positive integers. Of course, this disclosure does not limit the specific implementation method of obtaining the target Boolean circuit, and those skilled in the art can use relevant technologies to implement it according to the actual situation and needs.

[0083] The input signal of the AND gate refers to the intermediate state value encrypted with the private key in the target Boolean circuit. It is obtained by running the calculation in the LowMC circuit using the masked private key (i.e., normally through the XOR gate and the AND gate). Of course, the specific operation method of this embodiment is not limited. Those skilled in the art can set the encryption algorithm, such as the LowMC symmetric primitive, according to the actual situation and needs.

[0084] For example, the LowMC symmetric primitive circuit can be a low-level circuit based on 129 / 192 / 255 bits with r rounds, where r is a positive integer. The execution of a circuit once, as described in this embodiment, can refer to the execution of the LowMC symmetric primitive circuit once, in which case one execution includes r rounds of operations.

[0085] The digital signature method described in this disclosure may further include:

[0086] The target Boolean circuit is divided into multiple circuit modules, each of which is used to execute one round of encryption algorithm, wherein the circuit modules are configured to execute in parallel.

[0087] Thus, by using multiple parallel-executed circuit modules, the embodiments of this disclosure can further improve digital signature efficiency and reduce redundant calculations.

[0088] Please see Figure 2 , Figure 2 A schematic diagram of a LowMC symmetric primitive circuit is shown.

[0089] Figure 2 In this context, j is the round number, j≤r and is an integer. The circuit corresponding to each round of operation includes a linear layer, a nonlinear layer, and a key XOR layer, such as... Figure 2 As shown, X is the linear layer (used to perform linear operations, including XOR operations), A is the nonlinear layer (including AND gates), O is the key XOR layer (used to receive private key information), Input represents public key information (also known as input plaintext information), Output is output ciphertext information (ciphertext information refers to the ciphertext obtained by encrypting the public key information with the previous private key; this value is public and is also known as the public key), and state is the stored state value.

[0090] For example, if r is 4, then one execution of the LowMC symmetric primitive circuit requires 4 rounds of calculation. Related technologies require two circuit calculations to obtain error correction information AUX (first information) and broadcast information MSGS (second information), totaling 8 rounds. However, the embodiments of this disclosure only require the LowMC symmetric primitive circuit to execute once to obtain them.

[0091] In this embodiment of the disclosure, the number of circuit modules into which the target Boolean circuit is divided corresponds to the number of rounds r. For example, if the LowMC symmetric primitive circuit has 4 rounds, then the number of circuit modules is 4. Each circuit module may include one round of circuit execution, that is, each circuit module may include a corresponding linear layer, nonlinear layer, and key XOR layer. Of course, this embodiment of the disclosure does not limit the specific number of rounds or the specific number of circuit modules in the LowMC symmetric primitive circuit. Those skilled in the art can set it according to the actual situation and needs.

[0092] Please see Figure 3a , Figure 3a A schematic diagram of a serial circuit module according to an embodiment of the present disclosure is shown.

[0093] and Figure 2 The difference is that, Figure 3aThe LowMC symmetric primitive circuit shown has inverted inputs and outputs, performs operations from layer (j+1) to layer j, and the input to the key XOR layer is... Instead of the masked private key Z j .

[0094] It should be understood that the digital signature algorithm of the present disclosure embodiments can be applied to both of the above-mentioned different forms of LowMC symmetric primitive circuits.

[0095] Please see Figure 3b , Figure 3b A schematic diagram of a parallel circuit module according to an embodiment of the present disclosure is shown.

[0096] For example, such as Figure 3b As shown, a circuit module is used to perform one round of operation in a LowMC symmetric primitive circuit. It includes a corresponding linear layer, a nonlinear layer (the layer containing AND gates), and a key XOR layer. The linear layer and the key XOR layer are the layers containing XOR gates. Taking the gate circuit including XOR gates as an example, for any XOR gate, according to the intermediate mask information corresponding to each input port of the XOR gate ([λ... α ]、[λ β The result of the XOR operation of ]) yields the first intermediate value. Of course, during execution, the intermediate mask information ([λ) α ]、[λ β Input signal Z) α All of these values ​​are known, and can be calculated from them. in, (representing the masked input signal), and all are obtained through linear computation. Therefore, based on the computation data from the previous round (intermediate mask information ([λ)...)...) α ]、[λ β Input signal Z) α and round key mask information By performing inverse linear operations (or reverse linear operations) on the existing intermediate mask information, the required intermediate mask information and input signal can be obtained (i.e., the first intermediate value is obtained by performing inverse linear operations on the existing intermediate mask information), for example... Figure 3b In China, Performing inverse linear operations (or reverse linear operations) will yield the result. The calculations described here are explained in the relevant technical descriptions of LowMC symmetric primitive circuits and will not be repeated here. This disclosure does not limit the specific method of antilinear operation in the embodiments; those skilled in the art can set it according to actual conditions and needs. For example, antilinear operation can be implemented through XOR operations or matrix operations.

[0097] This disclosed embodiment, by using each circuit module independently, effectively shortens the signature generation time and optimizes the performance of Picnic3 in practical applications while ensuring security strength. This optimized design helps improve the practicality of post-quantum cryptography algorithms in various scenarios, especially in systems with strict requirements for signature speed and resource consumption.

[0098] This disclosure does not limit the specific implementation of generating the first mask information and the second mask information in step S12. Those skilled in the art can use relevant technologies to implement it according to actual conditions and needs. For example, N random first mask information and N-1 random second mask information can be generated according to the value of the preset mask information given in advance. As long as the XOR sum of the N random first mask information is equal to the value of the preset mask information, each second mask information can be arbitrarily random.

[0099] The calculation steps of step S13 are described below as an example.

[0100] In one possible implementation, step S131, which determines the first information using the first mask information and the second mask information of each input signal, may include:

[0101] For each input port of each AND gate, perform an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to that input port to obtain the intermediate mask information of the corresponding input port.

[0102] Determine the XOR results of the round key mask information obtained in the previous round of operation and the intermediate mask information corresponding to each input port of the AND gate, and perform an inverse linear operation on each XOR result to obtain the first intermediate value;

[0103] The first information is obtained by multiplying the intermediate mask information of each input port of the AND gate, XORing the N-1 random second mask information corresponding to the AND gate, and XORing the first intermediate value of the AND gate.

[0104] For example, the gate circuit may include an XOR gate, etc. According to the conventions of the LowMC symmetric primitive circuit algorithm, the input of the XOR gate can be obtained through the inverse operation of linear operations, for example... Figure 2 middle state j+1 The values ​​stored in the layer are subjected to inverse linear operations to obtain the values ​​of the statej-1 layer. The statej-1 layer serves as the input to the nonlinear layer Aj+1, that is, as the input to each AND gate of that layer.

[0105] For example, if the AND gate is a two-input AND gate, that is, it includes a first input port and a second input port, and the embodiments of this disclosure employ multi-party secure computation to implement the computation task, with the computation of each AND gate being assigned to N participants, then for the first input port, the first mask information corresponding to each participant is [λ]. α ]1…[λ α ] N For the second input port, the first mask information corresponding to each participant is [λ]. β ]1…[λ β ] N .

[0106] For example, by performing an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to the input port, the intermediate mask information of the corresponding input port can be obtained. Thus, the intermediate mask information of the first input port is:

[0107] For example, by performing an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to the input port, the intermediate mask information of the corresponding input port can be obtained, and the intermediate mask information of the second input port can be obtained as follows:

[0108] This disclosure does not limit the specific implementation of "determining the XOR results of the round key mask information obtained in the previous round of operation and the intermediate mask information corresponding to each input port of the AND gate, and performing an inverse linear operation on each XOR result to obtain the first intermediate value". For example, after obtaining each XOR result, the XOR results can be XORed to determine the corresponding first intermediate value λ. γ .

[0109] Among them, such as Figure 3b As shown, when the current round (middle block diagram) performs its calculations, it can obtain the round key mask information obtained from the previous round. And respectively, the corresponding round key mask information is compared with the intermediate mask information corresponding to each input port of the AND gate. Perform XOR operations separately After obtaining the corresponding XOR results, an inverse linear transformation is performed on each XOR result using an appropriate inverse linear operation method according to the actual situation and needs, to obtain the first intermediate value λ. γ .

[0110] For example, the first information is obtained by multiplying the intermediate mask information of each input port of the AND gate, XORing the N-1 random second mask information corresponding to the AND gate, and XORing the first intermediate value of the AND gate: in, λ represents the XOR sum of the N-1 random second mask information corresponding to the AND gate. α ·λ β λ represents the product of the intermediate mask information of each input port of the AND gate. γ This represents the first intermediate value.

[0111] For example, in this embodiment of the disclosure, the obtained first information aux can be used as the second mask information corresponding to the Nth participant ([λ α,β ] N =aux), thereby enabling error correction of the calculation results to improve accuracy.

[0112] After obtaining the first information, this embodiment of the disclosure can further obtain the broadcast information of each participant, i.e., the second information. For example, in one possible implementation, step S132, using the first information, each second mask information, each input signal and its first mask information to determine the second information, may include:

[0113] For any AND gate, the port mask value of the corresponding input port is obtained by XORing the intermediate mask information of each input port of the AND gate with the corresponding input signal.

[0114] The broadcast information of the first to N-1 participants is determined using the port mask values ​​corresponding to the first to N-1 participants, the first mask information, and the second mask information.

[0115] The broadcast information of the Nth participant is determined using the port mask value corresponding to the Nth participant, the first mask information, and the first information.

[0116] The second information includes broadcast information corresponding to the first to the Nth participants.

[0117] For example, for the first input port of the AND gate, based on "obtaining the port mask value of the corresponding input port according to the XOR operation result of the intermediate mask information corresponding to each input port of the AND gate and the corresponding input signal", the port mask value of the first input port can be obtained as follows: Among them, Z α This indicates the input signal of the first input port.

[0118] For example, for the second input port of the AND gate, based on "obtaining the port mask value of the corresponding input port according to the XOR operation result of the intermediate mask information corresponding to each input port of the AND gate and the corresponding input signal", the port mask value of the second input port can be obtained as follows: Among them, Z β This indicates the input signal of the second input port.

[0119] For example, the input signal Z of the first input port α The input signal Z at the second input port β It is obtained in step S11.

[0120] In one possible implementation, still taking a two-input AND gate as an example, each AND gate may include a first input port and a second input port.

[0121] The phrase "determining the broadcast information of the 1st to N-1th participants using the port mask values ​​corresponding to the 1st to N-1th participants, the first mask information, and the second mask information" can include:

[0122] For any one of the first to the (N-1)th participants, each participant obtains the broadcast information corresponding to that participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information.

[0123] In one possible implementation, obtaining the broadcast information corresponding to the participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information, may include:

[0124] The first product Second product and the second mask information ([λ α,β ] i The result of the XOR operation of () is used as the broadcast information ([s]) for that participant. i This relationship can be expressed by the following formula.

[0125] Please participate Figure 4 , Figure 4 A schematic diagram illustrating the determination of broadcast information corresponding to each participant in the gate according to an embodiment of the present disclosure is shown.

[0126] For example, such as Figure 4 As shown, for an AND gate, there are N participants (P1~P2). N-1 P N Since the participants P1 to P N-1 Since the second mask information is known, this embodiment of the disclosure can utilize the first to N-1 participants (P1 to P2). N-1The corresponding port mask value, the first mask information, and the second mask information determine the broadcast information of the 1st to the (N-1)th participants.

[0127] Specifically, in one example, according to the rule that "for any one of the first to the (N-1)th participants, each participant obtains the broadcast information corresponding to that participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information", the broadcast information for any participant Pi is... Where i is less than or equal to N-1 and is an integer, that is, Pi is any one of the participants from the 1st to the (N-1th)th participant.

[0128] For example, for the first participant P1, such as Figure 4 As shown, the broadcast information of the first participant P1 can be...

[0129] For example, for the (N-1)th participant P N-1 ,like Figure 4 As shown, the (N-1)th participant P N-1 The broadcast information can be

[0130] In one possible implementation, for the Nth participant, determining the broadcast information of the Nth participant using the port mask value corresponding to the Nth participant, the first mask information, and the first information may include:

[0131] The broadcast information corresponding to the participant is obtained by multiplying the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information.

[0132] Thus, in this embodiment of the disclosure, the aforementioned first information aux is used as the Nth participant P. N The second mask information can be used to correct the results, thereby improving the accuracy of multi-party computation.

[0133] In one possible implementation, obtaining the broadcast information corresponding to the participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information may include:

[0134] The first product Second product The result of the XOR operation of the first information (aux) is used as the broadcast information ([s]) corresponding to that participant. N This relationship can be expressed by the following formula.

[0135] For example, such as Figure 4 As shown, for an AND gate, there are N participants P1 to P2. N-1 P N Because of the participants P1 to P N-1 Since the second mask information is known, this embodiment of the disclosure can utilize the first to N-1 participants (P1 to P2). N-1 The corresponding port mask value, the first mask information, and the second mask information determine the broadcast information of the 1st to the (N-1th)th participants. This has been described previously and will not be repeated here.

[0136] For the Nth participant, this embodiment of the disclosure determines the broadcast information of the Nth participant by using the port mask value corresponding to the Nth participant, the first mask information, and the first information.

[0137] Specifically, in one example, the broadcast information corresponding to the participant is obtained according to "the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information". Figure 4 As shown, the Nth participant P N This is broadcast information. Where aux is [λ α,β ] N .

[0138] Thus, in this embodiment of the disclosure, the first information aux is used as the Nth participant P. N The second mask information is used to calculate its second information (i.e., broadcast information) to satisfy the accuracy condition λ of the AND gate of the Nth participant PN. α,β =λ α ·λ β .

[0139] In one possible implementation, completing a digital signature using the first information and the second information includes:

[0140] The first information and the second information are hashed respectively, and the hash results are used to complete the digital signature.

[0141] The embodiments disclosed herein do not limit the specific hash algorithm used for hash operations, and those skilled in the art can set it according to actual conditions and needs.

[0142] This disclosure does not limit the specific implementation method of completing the digital signature using the first and second information. After obtaining the first and second information, this disclosure can refer to the "making a commitment" description in the existing Picnic3 algorithm to complete the digital signature. The specific content included in the digital signature can be determined according to the actual situation and needs, and this disclosure does not limit it. For example, it may include the hash value of the first information and the second information, a random challenge value, a port mask value (secret information with a mask), and the corresponding response information, etc. For details, please refer to the protocol description of the existing Picnic3 algorithm.

[0143] It is understood that the various method embodiments mentioned above in this disclosure can be combined with each other to form combined embodiments without violating the principle and logic. Due to space limitations, this disclosure will not elaborate further. Those skilled in the art will understand that in the above methods of specific implementation, the specific execution order of each step should be determined by its function and possible internal logic.

[0144] Compared to the existing PICNIC3 digital signature technology based on MPCitH, the embodiments disclosed herein perform the same functions, but the present technology has a faster signing speed, higher throughput, and a signing efficiency improvement of 20%-40%.

[0145] The main difference compared to the existing PICNIC3 digital signature technology lies in the "commitment" step. The existing PICNIC's underlying circuitry executes serially, calculating auxiliary (auxiliary) and message (msgs) information separately in an offline and online phase. This information calculation requires two serial runs within the underlying circuitry, resulting in high computational costs.

[0146] In this embodiment, the introduction of masking technology enables a certain degree of independence in the input and output of the round functions of each participating party. This technology pre-calculates the state value port mask information of the secret circuit. This method enables parallel computation of the underlying cryptographic primitive round functions of each participant, which greatly improves the efficiency of signing.

[0147] Of course, the technical solutions of this disclosure are not limited to the PICNIC3 algorithm. They are universal for proof techniques using MPCitH. That is, as long as an algorithm needs to generate first information and second information for digital signature, this disclosure can be applied.

[0148] Please see Figure 5 , Figure 5A block diagram of a digital signature device according to an embodiment of the present disclosure is shown.

[0149] like Figure 5 As shown, the device includes:

[0150] The first determining module 10 is used to determine the target Boolean circuit according to the encryption algorithm of the preset signature algorithm, the private key and the public key message, and to obtain the input signals of each gate circuit in the target Boolean circuit. The calculation task of the target Boolean circuit is assigned to N participants, where N is a positive integer.

[0151] The mask generation module 20 is used to generate N random first mask information for the input signal of each AND gate in the target Boolean circuit, and to generate N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information.

[0152] Calculation module 30 is used to: perform calculation operations for each AND gate to complete the digital signature, including:

[0153] The second determining module 310 is used to determine the first information using the first mask information and the second mask information of each input signal;

[0154] The third determining module 320 is used to determine the second information using the first information, each second mask information, each input signal and its first mask information;

[0155] The digital signature module 330 is used to complete a digital signature using the first information and the second information.

[0156] This embodiment of the present disclosure determines the target Boolean circuit based on the encryption algorithm of the preset signature algorithm, the private key, and the public key message, and obtains the input signals of each gate circuit in the target Boolean circuit. Then, through a sampling step, N random first mask information is generated for each AND gate's input signal, and N-1 random second mask information is generated for each AND gate. Next, a calculation step uses the first mask information and the second mask information of each input signal to determine first information; the first information, the second mask information, each input signal, and its first mask information are used to determine second information; and the first information and the second information are used to complete the digital signature. The determination of the first and second information, and the completion of the digital signature, can be achieved through a single circuit execution. Compared to related technologies, this embodiment of the present disclosure, based on the parallel optimization of MPCitH digital signatures, reduces redundant calculations, improves signature efficiency, and lowers computational costs.

[0157] In one possible implementation, the method further includes:

[0158] The target Boolean circuit is divided into multiple circuit modules, each of which is used to execute one round of encryption algorithm, wherein the circuit modules are configured to execute in parallel.

[0159] In one possible implementation, determining the first information using the first mask information and the second mask information of each input signal includes:

[0160] For each input port of each AND gate, perform an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to that input port to obtain the intermediate mask information of the corresponding input port.

[0161] Determine the XOR results of the round key mask information obtained in the previous round of operation and the intermediate mask information corresponding to each input port of the AND gate, and perform an inverse linear operation on each XOR result to obtain the first intermediate value;

[0162] The first information is obtained by multiplying the intermediate mask information of each input port of the AND gate, XORing the N-1 random second mask information corresponding to the AND gate, and XORing the first intermediate value of the AND gate.

[0163] In one possible implementation, determining the second information using the first information, each of the second mask information, each input signal, and their first mask information includes:

[0164] For any AND gate, the port mask value of the corresponding input port is obtained by XORing the intermediate mask information of each input port of the AND gate with the corresponding input signal.

[0165] The broadcast information of the first to N-1 participants is determined using the port mask values ​​corresponding to the first to N-1 participants, the first mask information, and the second mask information.

[0166] The broadcast information of the Nth participant is determined using the port mask value corresponding to the Nth participant, the first mask information, and the first information.

[0167] The second information includes broadcast information corresponding to the first to the Nth participants.

[0168] In one possible implementation, each AND gate includes a first input port and a second input port.

[0169] The broadcast information of the first to N-1 participants is determined using the port mask values ​​corresponding to the first to N-1 participants, the first mask information, and the second mask information, including:

[0170] For any one of the first to the (N-1)th participants, each participant obtains the broadcast information corresponding to that participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information.

[0171] In one possible implementation, each AND gate includes a first input port and a second input port.

[0172] For the Nth participant, the broadcast information of the Nth participant is determined using the port mask value corresponding to the Nth participant, the first mask information, and the first information, including:

[0173] The broadcast information corresponding to the participant is obtained by multiplying the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information.

[0174] In one possible implementation, the broadcast information corresponding to the participant is obtained based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information, including:

[0175] The result of the XOR operation of the first product, the second product, and the second mask information is used as the broadcast information corresponding to the participant.

[0176] In one possible implementation, the broadcast information corresponding to the participant is obtained based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information, including:

[0177] The result of the XOR operation of the first product, the second product, and the first information is used as the broadcast information corresponding to the participant.

[0178] In one possible implementation, completing a digital signature using the first information and the second information includes:

[0179] The first information and the second information are hashed respectively, and the hash results are used to complete the digital signature.

[0180] In one possible implementation, the gate circuit includes an XOR gate. For any XOR gate, a first intermediate value is obtained based on the XOR operation result of the intermediate mask information corresponding to each input port of the XOR gate, or...

[0181] The first intermediate value is obtained by performing an inverse linear operation on the existing intermediate mask information.

[0182] In some embodiments, the functions or modules of the apparatus provided in this disclosure can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0183] This disclosure also proposes a computer-readable storage medium storing computer program instructions that, when executed by a processor, implement the above-described method. The computer-readable storage medium may be a non-volatile computer-readable storage medium.

[0184] This disclosure also proposes an electronic device, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to invoke the instructions stored in the memory to execute the above-described method.

[0185] This disclosure also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in a processor of an electronic device, the processor in the electronic device performs the above-described method.

[0186] The certifying party, each participating party, and the corresponding verifying party in this disclosure embodiment can all be electronic devices, which can be provided as terminals, servers, or other forms of devices.

[0187] Please see Figure 6 , Figure 6 A block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0188] For example, electronic device 1900 can be provided as a server. (See reference...) Figure 6 The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0189] Electronic device 1900 may also include a power supply component 1926 configured to perform power management of electronic device 1900, a wired or wireless network interface 1950 configured to connect electronic device 1900 to a network, and an input / output (I / O) interface 1958. Electronic device 1900 can operate on an operating system stored in memory 1932, such as Microsoft Server operating system (Windows Server). TM Apple's graphical user interface-based operating system (Mac OSX) TM ), a multi-user, multi-process computer operating system (Unix) TM Linux is a free and open-source Unix-like operating system. TM ), the open-source Unix-like operating system (FreeBSD) TM (or similar.)

[0190] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of an electronic device 1900 to perform the above-described method.

[0191] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0192] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, (but not limited to) electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0193] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0194] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0195] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0196] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0197] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0198] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0199] The computer program product can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0200] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A digital signature method, characterized in that, The method includes: The target Boolean circuit is determined based on the encryption algorithm of the preset signature algorithm, the private key and the public key message, and the input signals of each gate circuit in the target Boolean circuit are obtained. The calculation task of the target Boolean circuit is assigned to N participants, where N is a positive integer. For each AND gate input signal in the target Boolean circuit, N random first mask information is generated, and for each AND gate, N-1 random second mask information is generated, wherein the XOR sum of the N mask information is the value of the preset mask information; For each AND gate, perform a computational operation to complete the digital signature, including: The first information is determined using the first mask information and the second mask information of each input signal; The second information is determined using the first information, each second mask information, each input signal and its first mask information; The digital signature is completed using the first information and the second information.

2. The method according to claim 1, characterized in that, The method further includes: The target Boolean circuit is divided into multiple circuit modules, each of which is used to execute one round of encryption algorithm, wherein the circuit modules are configured to execute in parallel.

3. The method according to claim 1 or 2, characterized in that, The first information is determined using the first mask information and the second mask information of each input signal, including: For each input port of each AND gate, perform an XOR operation on the first mask information corresponding to the input signal of each participant corresponding to that input port to obtain the intermediate mask information of the corresponding input port. Determine the XOR results of the round key mask information obtained in the previous round of operation and the intermediate mask information corresponding to each input port of the AND gate, and perform an inverse linear operation on each XOR result to obtain the first intermediate value; The first information is obtained by multiplying the intermediate mask information of each input port of the AND gate, XORing the N-1 random second mask information corresponding to the AND gate, and XORing the first intermediate value of the AND gate.

4. The method according to claim 1 or 2, characterized in that, Determining the second information using the first information, each of the second mask information, each input signal, and their first mask information includes: For any AND gate, the port mask value of the corresponding input port is obtained by XORing the intermediate mask information of each input port of the AND gate with the corresponding input signal. The broadcast information of the first to N-1 participants is determined using the port mask values ​​corresponding to the first to N-1 participants, the first mask information, and the second mask information. The broadcast information of the Nth participant is determined using the port mask value corresponding to the Nth participant, the first mask information, and the first information. The second information includes broadcast information corresponding to the first to the Nth participants.

5. The method according to claim 1 or 2, characterized in that, Each AND gate includes a first input port and a second input port. The broadcast information of the first to N-1 participants is determined using the port mask values ​​corresponding to the first to N-1 participants, the first mask information, and the second mask information, including: For any one of the first to the (N-1)th participants, each participant obtains the broadcast information corresponding to that participant based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information.

6. The method according to claim 5, characterized in that, Each AND gate includes a first input port and a second input port. For the Nth participant, the broadcast information of the Nth participant is determined using the port mask value corresponding to the Nth participant, the first mask information, and the first information, including: The broadcast information corresponding to the participant is obtained by multiplying the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information.

7. The method according to claim 5, characterized in that, The broadcast information corresponding to the participant is obtained based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the second mask information. This includes: The result of the XOR operation of the first product, the second product, and the second mask information is used as the broadcast information corresponding to the participant.

8. The method according to claim 6, characterized in that, The broadcast information corresponding to the participant is obtained based on the first product of the port mask value corresponding to the first input port and the first mask information corresponding to the second input port, the second product of the port mask value corresponding to the second input port and the first mask information corresponding to the first input port, and the first information, including: The result of the XOR operation of the first product, the second product, and the first information is used as the broadcast information corresponding to the participant.

9. The method according to claim 1 or 2, characterized in that, Completing a digital signature using the first information and the second information includes: The first information and the second information are hashed respectively, and the hash results are used to complete the digital signature.

10. A digital signature device, characterized in that, The device includes: The first determining module is used to determine the target Boolean circuit based on the encryption algorithm of the preset signature algorithm, the private key and the public key message, and to obtain the input signals of each gate circuit in the target Boolean circuit. The calculation task of the target Boolean circuit is assigned to N participants, where N is a positive integer. The mask generation module is used to generate N random first mask information for the input signal of each AND gate in the target Boolean circuit, and to generate N-1 random second mask information for each AND gate, wherein the XOR sum of the N mask information is the value of the preset mask information. The computation module is used to: perform computation operations for each AND gate to complete the digital signature, including: The second determining module is used to determine the first information using the first mask information and the second mask information of each input signal; The third determining module is used to determine the second information using the first information, each second mask information, each input signal and its first mask information; A digital signature module is used to complete a digital signature using the first information and the second information.

Images