Digital signature verification method and device, electronic equipment and storage medium

Abstract

Embodiments of the invention provide a digital signature verification method and apparatus, an electronic device and a storage medium. The digital signature verification method comprises the steps of obtaining target data, a digital signature, a first point value and a second point value; generating a first scalar value and a second scalar value according to the target data and the digital signature; pre-calculating the first point values to obtain a first pre-calculation result comprising a plurality of first pre-calculation point values; pre-calculating the second point values to obtain a second pre-calculation result comprising a plurality of second pre-calculation point values; performing coordinate conversion on the first pre-calculation point value to obtain a third pre-calculation point value of which the Z coordinate is 1, and performing coordinate conversion on the second pre-calculation point value to obtain a fourth pre-calculation point value of which the Z coordinate is 1; calculating a verification point value according to the third pre-calculation point value and the fourth pre-calculation point value; and determining the validity of the digital signature according to the verification point value. According to the scheme, the digital signature verification efficiency can be improved.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer technology, and in particular to a digital signature verification method, device, electronic device, and storage medium. Background Art

[0002] In cryptographic algorithms based on elliptic curves, the point multiplication operation [k]P is an important operation that plays a decisive role in the efficiency of the system. In cryptographic protocols such as digital signatures and key exchange based on elliptic curves, multiple point multiplication operations [u]P+[v]Q are used.

[0003] Currently, when performing a multi-point multiplication operation during a digital signature verification process, [u]P and [v]Q are first calculated separately, and then [u]P and [v]Q are added together to obtain a calculation result of the multi-point multiplication operation [u]P+[v]Q.

[0004] However, the method of calculating [u]P and [v]Q separately and then adding them to obtain the multi-point multiplication result [u]P+[v]Q includes a large number of point addition operations and point doubling operations in the multi-point multiplication process, resulting in low efficiency of the multi-point multiplication operation, and further resulting in low efficiency of digital signature verification. Summary of the invention

[0005] In view of this, the embodiments of the present disclosure provide a digital signature verification method, device, electronic device and storage medium to at least partially solve the above problems.

[0006] According to a first aspect of an embodiment of the present disclosure, a digital signature verification method is provided, comprising: obtaining target data and a digital signature of the target data, and obtaining a first point value and a second point value, wherein the point corresponding to the first point value is a base point of an elliptic curve, the second point value is a public key, and the point corresponding to the second point value is a point on the elliptic curve different from the base point; generating a first scalar value and a second scalar value according to the target data and the digital signature; pre-calculating the first point value to obtain a first pre-calculation result, wherein the first pre-calculation result comprises a plurality of first pre-calculated point values, the first pre-calculated point value being equal to the result of an integer number of addition operations along the elliptic curve according to an encoding method of the first scalar value, wherein different first pre-calculated point values ​​correspond to different integer numbers of addition operations; pre-calculating the second point value to obtain a second pre-calculation result The second pre-calculated result includes multiple second pre-calculated point values, the second pre-calculated point value is equal to the result of an integer number of addition operations performed on the second point value along the elliptic curve according to the encoding method of the second scalar value, and different second pre-calculated point values ​​correspond to different integer numbers of addition operations; the first pre-calculated point value and the second pre-calculated point value are respectively transformed in coordinates, so that the Z coordinate of the third pre-calculated point value corresponding to the coordinate transformation of the first pre-calculated point value is 1, and the Z coordinate of the fourth pre-calculated point value corresponding to the coordinate transformation of the second pre-calculated point value is 1; according to the third pre-calculated point value and the fourth pre-calculated point value, the dot product result of the first scalar value and the first point value is calculated, and the sum of the dot product result of the second scalar value and the second point value is calculated to obtain a verification point value; the validity of the digital signature is determined according to the verification point value.

[0007] In a possible implementation, the coordinate conversion of the first pre-calculated point value and the second pre-calculated point value respectively includes: processing the first pre-calculated result by a coordinate conversion algorithm to obtain the third pre-calculated point value corresponding to each of the first pre-calculated point values ​​after the coordinate conversion; processing the second pre-calculated result by the coordinate conversion algorithm to obtain the fourth pre-calculated point value corresponding to each of the second pre-calculated point values ​​after the coordinate conversion; wherein the coordinate conversion algorithm includes: determining A1 as the Z coordinate of the first pre-calculated point value in the pre-calculated result as Z1, and determining A i =(A i-1 ·Z i )mod p,Z i represents the Z coordinate of the i-th pre-calculated point value in the pre-calculated result, i is an integer greater than 1 and less than or equal to n, n is the number of pre-calculated point values ​​in the pre-calculated result, mod represents the remainder operation, and p represents the preset prime number corresponding to the elliptic curve; determine B n =(A n )-1 mod p, and determine B i =(B i+1 ·Z i+1 ) mod p, i is an integer greater than 0 and less than n; determine C1 = B1, and determine C i =(B i ·A i-1 ) mod p, i is an integer greater than 1 and less than or equal to n; determine that the point value corresponding to the i-th pre-calculated point value after coordinate transformation is (X′ i ,Y i ′,1),X′ i =(X i ·T i )mod p,Y i ′=(Y i ·T′ i )mod p,T i =(C i ·C i )mod p,T′ i =(T i ·C i )mod p.

[0008] In a possible implementation, the method of determining the sum of the dot product result of the first scalar value and the first point value and the dot product result of the second scalar value and the second point value according to the third pre-calculated point value and the fourth pre-calculated point value to obtain a verification point value includes: encoding the first scalar value to obtain a first encoding result, the first encoding result includes multiple encoding values; encoding the second scalar value to obtain a second encoding result, the second encoding result includes multiple encoding values; performing a doubling operation on the i-1th result value to obtain an i-th variable value, wherein i is an integer greater than 0 and less than or equal to m, m is the number of encoding values ​​included in the first encoding result, the number of encoding values ​​included in the first encoding result and the second encoding result is equal, and the 0th result value is equal to the infinity point of the elliptic curve; and calculating the verification point value according to the i-th variable value and [u i ]P determines the i-th intermediate result value, wherein, in the process of calculating at least part of the i-th intermediate result value, the i-th variable value and [u i ]P are equal, a first judgment result and a first intermediate result are obtained, and the first judgment result indicates that the i-th variable value is equal to [u i ]P are not equal, the first intermediate result is used to calculate the i-th intermediate result value; u i represents the i-th encoding value in the first encoding result, [] represents the point multiplication operation, P represents the first point value, [u i]P is determined from the plurality of third pre-calculated point values; according to the i-th intermediate result value and [v i ]q determines the i-th result value, wherein, in the process of calculating at least part of the i-th result value, the i-th intermediate result value and [v i ]Q are equal, obtain a second judgment result and a second intermediate result, and when the second judgment result indicates that the value of the i-th intermediate result is equal to [v i ] When Q is not equal, the second intermediate result is used to calculate the i-th result value; v i represents the i-th encoding value in the second encoding result, Q represents the second point value, [v i ]Q is determined from the multiple fourth pre-calculated point values; the mth result value is determined as the verification point value.

[0009] In a possible implementation, the method according to the i-th variable value and [u i ]P determines the i-th intermediate result value, including: if u i =0, then the i-th intermediate result value is determined to be equal to the i-th variable value; if u i ≠0, the i-th variable value is used as the first input value of the equality judgment algorithm, and [u i ]P as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the value of the i-th variable and [u i ]P are equal, obtain the first judgment result and the first intermediate result, and determine the i-th intermediate result value according to the first judgment result and the first intermediate result.

[0010] In a possible implementation, the method according to the i-th intermediate result value and [v i ]Q determines the i-th result value, including: if v i =0, then the i-th result value is determined to be equal to the i-th intermediate result value; if v i ≠0, the i-th intermediate result value is used as the first input value of the equality judgment algorithm, and [v i ]Q as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the i-th intermediate result value and [v i ]Q are equal, obtain the second judgment result and the second intermediate result, and determine the i-th result value according to the second judgment result and the second intermediate result.

[0011] In a possible implementation, determining the i-th intermediate result value according to the first judgment result and the first intermediate result includes: according to the first judgment result, if the i-th variable value is equal to [u i ]P are equal, then [u i]P times the point operation result is determined as the i-th intermediate result value, if the i-th variable value is equal to [u i ]P are not equal, then according to the i-th variable value, [u i ]P and the first intermediate result, calculate the i-th intermediate result value.

[0012] In a possible implementation, determining the i-th result value according to the second judgment result and the second intermediate result includes: according to the second judgment result, if the i-th intermediate result value is equal to [v i ]Q are equal, then [v i ]Q times the point operation result is determined as the i-th result value, if the i-th intermediate result value is equal to [v i ]Q are not equal, then according to the i-th intermediate result value, [v i ]Q and the second intermediate result, calculate the i-th result value.

[0013] In a possible implementation, the equality judgment algorithm includes: if (EG) mod p = 0 and (FH) mod p = 0, then determining that the first input value and the second input value are equal, the first input value of the equality judgment algorithm is (X1, Y1, Z1), the second input value of the equality judgment algorithm is (X2, Y2, Z2), E = (X2·A) mod p, F = (Y2·B) modp, G = (X1·C) mod p, H = (Y1·D) mod p, A = (Z1·Z1) mod p, B = (A·Z1) mod p, C = (Z2·Z2) mod p, D = (C·Z2) mod p, E, F, G and H are intermediate results, and p represents a preset prime number corresponding to the elliptic curve.

[0014] In a possible implementation, the value of the i-th variable, [u i ]P and the first intermediate result, calculating the i-th intermediate result value, including: taking the i-th variable value as the first input of the target algorithm, i ]P as the second input of the target algorithm, the first intermediate result as the third input of the target algorithm, and the i-th intermediate result value is calculated by the target algorithm; the i-th intermediate result value, [v i ]Q and the second intermediate result, calculating the i-th result value, including: taking the i-th intermediate result value as the first input of the target algorithm, i]Q is used as the second input of the target algorithm, the second intermediate result is used as the third input of the target algorithm, and the i-th result value is calculated by the target algorithm; wherein the target algorithm includes: the output of the target algorithm is (X5, Y5, Z5), the first input of the target algorithm is (X3, Y3, Z3), the second input of the target algorithm is (X4, Y4, Z4), the third input of the target algorithm is (E, F, G, H), X5=J 2 -(L+2M)mod p, Y5=J·(M-X5)-Nmodp, Z5=(Z3·Z4·I)mod p, I=(EG)mod p, J=(FH)mod p, K=I 2 mod p, L = (K·I) mod p, M = (K·G) mod p, N = (H·L) mod p, p represents a preset prime number corresponding to the elliptic curve.

[0015] According to a second aspect of an embodiment of the present disclosure, a digital signature verification device is provided, comprising: an acquisition unit, configured to acquire target data and a digital signature of the target data, and to acquire a first point value and a second point value, wherein the point corresponding to the first point value is a base point of an elliptic curve, the second point value is a public key, and the point corresponding to the second point value is a point on the elliptic curve different from the base point; a generation unit, configured to generate a first scalar value and a second scalar value according to the target data and the digital signature; a first pre-calculation unit, configured to pre-calculate the first point value to obtain a first pre-calculation result, wherein the first pre-calculation result comprises a plurality of first pre-calculated point values, wherein the first pre-calculated point value is equal to a result of an integer number of addition operations performed on the first point value along the elliptic curve according to an encoding method of the first scalar value, and different first pre-calculated point values ​​correspond to different integer numbers of addition operations; a second pre-calculation unit, configured to pre-calculate the second point value to obtain a A second pre-calculation result is obtained, wherein the second pre-calculation result includes multiple second pre-calculation point values, wherein the second pre-calculation point value is equal to the result of an integer number of addition operations performed on the second point value along the elliptic curve according to the encoding method of the second scalar value, and different second pre-calculation point values ​​correspond to different integer numbers of addition operations; a conversion unit is used to perform coordinate conversion on the first pre-calculation point value and the second pre-calculation point value respectively, so that the Z coordinate of the third pre-calculation point value corresponding to the coordinate conversion of the first pre-calculation point value is 1, and the Z coordinate of the fourth pre-calculation point value corresponding to the coordinate conversion of the second pre-calculation point value is 1; a calculation unit is used to calculate the sum of the point product result of the first scalar value and the first point value and the point product result of the second scalar value and the second point value according to the third pre-calculation point value and the fourth pre-calculation point value, to obtain a verification point value; a verification unit is used to determine the validity of the digital signature according to the verification point value.

[0016] According to a third aspect of an embodiment of the present disclosure, a digital signature chip is provided, wherein the digital signature chip is used to execute the method described in the first aspect or any possible implementation of the first aspect.

[0017] According to a fourth aspect of an embodiment of the present disclosure, there is provided an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; the memory is used to store a computer program; and the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect by running the computer program stored in the memory.

[0018] According to a fifth aspect of an embodiment of the present disclosure, a computer storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method described in the first aspect or any possible implementation of the first aspect is implemented.

[0019] According to a sixth aspect of an embodiment of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method described in the first aspect or any possible implementation manner of the first aspect is implemented.

[0020] According to the scheme of the embodiment of the present disclosure, after precalculating the first point value to obtain a first precalculation result including multiple first precalculation point values, and precalculating the second point value to obtain a second precalculation result including multiple second precalculation point values, the first precalculation point value is converted into a third precalculation point value with a Z coordinate of 1, and the second precalculation point value is converted into a fourth precalculation point value with a Z coordinate of 1, and then after generating the first scalar value and the second scalar value according to the target data and the digital signature, the sum of the dot product result of the first scalar value and the first point value and the dot product result of the second scalar value and the second point value is calculated according to the third precalculation point value and the fourth precalculation point value to obtain a verification point value, and then the validity of the digital signature is determined according to the verification point value. By precalculating the first point value and the second point value, and performing coordinate conversion on the obtained first precalculation point value and the second precalculation point value, the third precalculation point value and the fourth precalculation point value are obtained, and when performing multiple dot multiplication operations, the dot multiplication operation results can be directly obtained from the third precalculation point value and the fourth precalculation point value, without repeating the same dot multiplication operation result multiple times, thereby improving the calculation efficiency. The third pre-calculated point value and the fourth pre-calculated point value are obtained through coordinate transformation. Since the Z coordinates of the third pre-calculated point value and the fourth pre-calculated point value are both equal to 1, the computational cost of point addition and doubling operations in subsequent multi-point multiplication operations is reduced, and the efficiency of multi-point multiplication operations is improved, thereby improving the efficiency of digital signature verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present disclosure. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0022] Figure 1 is a flow chart of a digital signature verification method according to an embodiment of the present disclosure;

[0023] Figure 2 is a flow chart of a verification point value calculation method according to an embodiment of the present disclosure;

[0024] Figure 3 is a schematic diagram of a digital signature verification device according to an embodiment of the present disclosure;

[0025] Figure 4 is a schematic diagram of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. All other embodiments obtained by ordinary technicians in the field based on the embodiments in the embodiments of the present disclosure should fall within the scope of protection of the embodiments of the present disclosure.

[0027] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0028] It should be understood that although the terms first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0029] In order to make the objectives, technical solutions and advantages of the present disclosure more clear, the embodiments of the present disclosure will be further described in detail below with reference to the accompanying drawings.

[0030] Digital Signature Verification Method

[0031] Figure 1 FIG. 1 is a flow chart of a digital signature verification method according to an embodiment of the present disclosure. Figure 1 As shown, the digital signature verification method includes the following steps:

[0032] Step 101: Obtain target data and a digital signature of the target data, and obtain a first point value and a second point value.

[0033] The target data and its digital signature are sent from the data sender to the data receiver. During the process of transmitting the target data from the data sender to the data receiver, the target data may be tampered with. Therefore, after receiving the target data and the digital signature, the data receiver verifies the validity of the digital signature to determine whether the target data has been tampered with. The digital signature is generated based on the private key of the data sender and the target data. The public key of the data sender is generated based on the private key of the data sender. The data sender will provide its public key to the data receiver so that the data receiver can verify the validity of the digital signature from the data sender based on the public key of the data sender. The disclosed embodiment does not limit the method for generating the digital signature, and the digital signature of the target data can be generated by any suitable digital signature method.

[0034] The point corresponding to the first point value is the base point of the elliptic curve, and the point corresponding to the second point value is a point on the elliptic curve different from the base point. The second point value is the public key of the data sender. The elliptic curve is used by the data sender to generate a digital signature and by the data receiver to verify the digital signature. Unless otherwise stated, the elliptic curves described in the various embodiments of the present disclosure refer to the same elliptic curve.

[0035] Step 102: Generate a first scalar value and a second scalar value according to the target data and the digital signature.

[0036] According to the target data and the digital signature, a first scalar value and a second scalar value for subsequent multi-point multiplication operation can be generated.

[0037] In one example, the digital signature includes two parts, r and s. By performing a hash operation on the target data m, z can be obtained. The formula u = (zs -1 ) mod n, the first scalar value u can be calculated, and the formula v = (rs -1 )mod n, the second scalar value v can be calculated, where mod represents the remainder operation and n is the order of the elliptic curve.

[0038] Step 103: pre-calculate the first point value to obtain a first pre-calculation result.

[0039] By precalculating the first point value, a first precalculated result including multiple first precalculated point values ​​can be obtained. The first precalculated point value is equal to the result of performing an integer number of addition operations on the first point value along the elliptic curve according to the encoding method of the first scalar value. Different first precalculated point values ​​correspond to different integer numbers of addition operations.

[0040] The first scalar value may be encoded by binary encoding, non-adjacent form (NAF) encoding, window encoding, or other encoding methods to resist side channel attacks and error injection attacks during the multi-point multiplication operation, thereby improving the security and computational efficiency of the multi-point multiplication operation. Depending on the encoding method of the first scalar value, the number and form of the first pre-calculated point values ​​included in the first pre-calculated result may be different. For example, when the first scalar value is encoded by NAF encoding, the first pre-processing result obtained by pre-processing the first point value P is {[1]P,[3]P,…,[2 w-1 -1]P}, [1]P is the result of adding the first point value P along the elliptic curve to the point at infinity, that is, [1]P=P, [3]P is the result of adding the first point value P twice along the elliptic curve, that is, [3]P=P+P+P, [2 w-1 -1]P is the result of performing w-1 addition operations on the first point value P along the elliptic curve. When other encoding methods are used to encode the first point value P, the first preprocessing result may also include [2]P, [4]P…, [2 w-1 ]One or more of P.

[0041] In an example, when the first scalar value is encoded by NAF encoding and the first pre-calculated point value is represented by Jacobian coordinates, the first point value P can be pre-calculated by the pre-calculation algorithm shown in the following pseudo code to obtain the first pre-calculation result {[1]P,[3]P,…,[2 w-1 -1]P}, where [1]P=P1, [3]P=P3, [2 w-1 -1]P=P2 w-1 -1 , w is the parameter of the NAF encoding algorithm, JacobianDouble() represents the doubling operation under Jacobian coordinates, and JacobianAdd() represents the point addition operation under Jacobian coordinates.

[0042] The pseudo code of the pre-calculation algorithm NafPointsPre() is as follows:

[0043] “

[0044] P1=P,P2=JacobianDouble(P)

[0045] for i=3to2 w-1 -1,step=2:

[0046] P i = JacobianAdd(P i-2 ,P2)

[0047] Return {P1,P3,…,P2 w-1 -1}

[0048] ”

[0049] In an example, the pseudo code of JacobianDouble() is as follows (P = (X1, Y1, Z1) is the input, [2] P = (X3, Y3, Z3) is the output):

[0050] “

[0051] A=Y1^2mod p

[0052] B=4*X1*A mod p

[0053] C=8*A^2mod p

[0054] D=3*X1^2+a*Z1^4mod p

[0055] E=2*B mod p

[0056] X3=D^2-E mod p

[0057] Y3=D*(B-X3)-C mod p

[0058] Z3=2*Y1*Z1 mod p

[0059] ”

[0060] In an example, the pseudo code of JacobianAdd() in Jacobian coordinates is as follows (P = (X1, Y1, Z1) and Q = (X2, Y2, Z2) are inputs, and P + Q = (X3, Y3, Z3) is the output):

[0061] “

[0062] A=Z1^2mod p

[0063] B=Z2^2mod p

[0064] C=Z1*A mod p

[0065] D=Z2*B mod p

[0066] E=X2*A mod p

[0067] F=Y2*C mod p

[0068] G=X1*B mod p

[0069] H=Y1*D mod p

[0070] I=EG mod p

[0071] J=FH mod p

[0072] K=I^2mod p

[0073] L=K*I mod p

[0074] M=K*G mod p

[0075] N=H*L mod p

[0076] X3=J^2-(L+2M)mod p

[0077] Y3=J*(M-X3)-N mod p

[0078] Z3=Z1*Z2*I mod p

[0079] ”

[0080] When subsequently calculating the dot product of the first scalar value and the first point value P, the dot product operation [u i ]P result, by pre-calculating the first point value, obtaining a first pre-calculation result including a plurality of first pre-calculated point values, the first pre-calculated point value being the point multiplication operation [u i ]P result, the subsequent calculation can directly take the corresponding first pre-calculated point value from the first pre-calculated result, without repeatedly calculating the same point multiplication operation [u i ]P, which improves the calculation efficiency.

[0081] Step 104: pre-calculate the second point value to obtain a second pre-calculation result.

[0082] By precalculating the second point value, a second precalculated result including multiple second precalculated point values ​​can be obtained. The second precalculated point value is equal to the result of an integer number of addition operations performed on the second point value along the elliptic curve according to the encoding method of the second scalar value. Different second precalculated point values ​​correspond to different integer numbers of addition operations.

[0083] The encoding method of the first scalar value and the second scalar value is the same. For the relevant content of precalculating the second point value, please refer to the description in the above step 103, which will not be repeated here.

[0084] When the dot product of the second scalar value and the second point value Q is calculated later, the dot product operation [v i ]Q result, by pre-calculating the second point value, obtaining a second pre-calculation result including a plurality of second pre-calculated point values, the second pre-calculated point value being the point multiplication operation [v i ]Q result, the subsequent calculation can directly take the corresponding second pre-calculated point value from the second pre-calculated result, without repeatedly calculating the same point multiplication operation [v i ]Q, which improves the computational efficiency.

[0085] Step 105, perform coordinate transformation on the first pre-calculated point value and the second pre-calculated point value respectively, so that the Z coordinate of the third pre-calculated point value corresponding to the coordinate transformation of the first pre-calculated point value is 1, and the Z coordinate of the fourth pre-calculated point value corresponding to the coordinate transformation of the second pre-calculated point value is 1.

[0086] The Z coordinate of each first pre-calculated point value included in the first pre-calculated result is not equal to 1, the Z coordinate of each second pre-calculated point value included in the second pre-calculated result is not equal to 1, the third pre-calculated point value can be obtained by coordinate transformation of the first pre-calculated point value, the fourth pre-calculated point value can be obtained by coordinate transformation of the second pre-calculated point value, and the Z coordinates of the third pre-calculated point value and the fourth pre-calculated point value are both equal to 1.

[0087] It should be noted that the first estimated point value and the second pre-calculated point value may be represented by Jacobian coordinates, Chudnovsky coordinates or other projective coordinates.

[0088] Step 106: Calculate the sum of the dot product result of the first scalar value and the first point value and the dot product result of the second scalar value and the second point value according to the third pre-calculated point value and the fourth pre-calculated point value to obtain the verification point value.

[0089] After obtaining the third pre-calculated point value and the fourth pre-calculated point value, the dot product [u]P of the first scalar value u and the first point value P can be calculated according to the third pre-calculated point value, and the dot product [v]Q of the second scalar value v and the second point value Q can be calculated according to the fourth pre-calculated point value, and then [u]P+[v]Q can be calculated to obtain the verification point value.

[0090] Step 107: Determine the validity of the digital signature based on the verification point value.

[0091] r′ can be calculated based on the verification point value. If r′ is the same as r included in the digital signature, it can be determined that the digital signature is valid, and then it can be determined that the target data has not been tampered with. If r′ is different from r included in the digital signature, it can be determined that the digital signature is invalid, and then it can be determined that the target data has been tampered with.

[0092] In one example, r′ can be calculated by the formula r′=x1mod n, where x1 is the X coordinate of the verification point value, mod represents the modulo operation, and n is the order of the elliptic curve.

[0093] In the embodiment of the present disclosure, after precalculating the first point value to obtain a first precalculation result including multiple first precalculation point values, and precalculating the second point value to obtain a second precalculation result including multiple second precalculation point values, the first precalculation point value is converted into a third precalculation point value with a Z coordinate of 1, and the second precalculation point value is converted into a fourth precalculation point value with a Z coordinate of 1, and then after generating the first scalar value and the second scalar value according to the target data and the digital signature, the sum of the dot product result of the first scalar value and the first point value and the dot product result of the second scalar value and the second point value is calculated according to the third precalculation point value and the fourth precalculation point value to obtain a verification point value, and then the validity of the digital signature is determined according to the verification point value. By precalculating the first point value and the second point value, and performing coordinate conversion on the obtained first precalculation point value and the second precalculation point value to obtain the third precalculation point value and the fourth precalculation point value, the dot product operation result can be directly obtained from the third precalculation point value and the fourth precalculation point value when performing multiple dot product operations, without repeating the same dot product operation result multiple times, thereby improving the calculation efficiency. The third pre-calculated point value and the fourth pre-calculated point value are obtained through coordinate transformation. Since the Z coordinates of the third pre-calculated point value and the fourth pre-calculated point value are both equal to 1, the computational cost of point addition and doubling operations in subsequent multi-point multiplication operations is reduced, and the efficiency of multi-point multiplication operations is improved, thereby improving the efficiency of digital signature verification.

[0094] In a possible implementation, when the first pre-calculated point value and the second pre-calculated point value are subjected to coordinate conversion, the first pre-calculated point value and the second pre-calculated point value may be processed respectively by a coordinate conversion algorithm to obtain a third pre-calculated point value corresponding to each first pre-calculated point value after the coordinate conversion, and a fourth pre-calculated point value corresponding to each second pre-calculated point value after the coordinate conversion. The coordinate conversion algorithm may include the following steps:

[0095] S11, determine A1 as the Z coordinate of the first pre-calculated point value in the pre-calculated result as Z1, and determine A i =(A i-1 ·Z i )mod p,Z irepresents the Z coordinate of the i-th pre-calculated point value in the pre-calculated result, i is an integer greater than 1 and less than or equal to n, n is the number of pre-calculated point values ​​in the pre-calculated result, mod represents the remainder operation, and p represents the preset prime number corresponding to the elliptic curve;

[0096] S12. Determine B n =(A n ) -1 mod p, and determine B i =(B i+1 ·Z i+1 ) mod p, i is an integer greater than 0 and less than n;

[0097] S13, determine C1 = B1, and determine C i =(B i ·A i-1 ) mod p, i is an integer greater than 1 and less than or equal to n;

[0098] S14, determine the point value corresponding to the i-th pre-calculated point value after coordinate transformation is (X′ i ,Y i ′,1),X′ i =(X i ·T i )mod p,Y i ′=(Y i ·T′ i )mod p,T i =(C i ·C i )mod p,T′ i =(T i ·C i )mod p.

[0099] When the coordinate transformation algorithm is used to transform the coordinates of the first pre-calculated point value, the input is {P1, P3, ..., P j}={(X1,Y1,Z1),(X2,Y2,Z2),…,(X j ,Y j ,Z j )}, j = 2 w-1 -1, the output is {P1',P3',…,P j '}={(X1',Y1',1),(X3',Y3',1),…,(X j ',Y j ',1)}.

[0100] When the coordinate transformation algorithm is used to transform the coordinates of the second pre-calculated point value, the input is {Q1, Q3, …, Q j}={(X1,Y1,Z1),(X3,Y3,Z3),…,(X j ,Y j ,Z j )}, j = 2 w-1 -1, the output is {Q1',Q3',…,Q j '}={(X1',Y1',1),(X3',Y3',1),…,(X j ',Y j ',1)}.

[0101] In an example, the pseudo code of the coordinate transformation algorithm PointsZ1New() is as follows:

[0102] “

[0103] {A1,A2,…,A j}={Z1,A1*Z2 mod p,…,A j-1 *Z j mod p}

[0104] Zinv=(A j ) -1 mod p

[0105] {B j ,B j-1 ,…,B1}={Zinv,B j *Z j mod p,…,B2*Z2 mod p}

[0106] {C1,C2,…,C j}={B1,B2*A1 mod p,…,B j *A j-1 mod p}

[0107] for i=1to j:

[0108] T i =C i *C i mod p,T i '=T i *C i mod p

[0109] X i '=X i *T i mod p,Y i '=Y i *T i 'mod p

[0110] Returns {(X1',Y1',1),(X2',Y2',1),…,(X j ',Y j ',1)}

[0111] ”

[0112] From the pseudo code of the above coordinate conversion algorithm, it can be seen that by using one modular inverse operation, the Z coordinates of all the first pre-calculated point values ​​or the second pre-calculated point values ​​are converted to 1. The computational overhead depends on j, which is approximately 1I+3*jM+4(j+1)M, where I represents the computational overhead of each modular inverse operation, and M represents the computational overhead of each modular multiplication operation.

[0113] In the embodiment of the present disclosure, the coordinate transformation of the first pre-calculated point value and the second pre-calculated point value is performed through a coordinate transformation algorithm, and the corresponding third pre-calculated point value is obtained after the coordinate transformation of the first pre-calculated point value, and the corresponding fourth pre-calculated point value is obtained after the coordinate transformation of the second pre-calculated point value, and the Z coordinate of the third pre-calculated point value and the fourth pre-calculated point value is 1, thereby reducing the computational cost of point addition operations and point multiplication operations based on the third pre-calculated point value and the fourth pre-calculated point value.

[0114] In one possible implementation, Figure 2 A flowchart of a verification point value calculation method according to an embodiment of the present disclosure is shown. Figure 2 As shown, the verification point value calculation method includes the following steps:

[0115] Step 201: Encode a first scalar value to obtain a first encoding result, where the first encoding result includes multiple encoding values.

[0116] The first scalar value can be encoded by binary encoding, non-adjacent form (NAF) encoding, window encoding, etc. to resist side channel attacks and error injection attacks in the multi-point multiplication process, thereby improving the security and computational efficiency of the multi-point multiplication process.

[0117] In an example, for input (k, w), the pseudo code of the NAF encoding algorithm NAF() is as follows:

[0118]

[0119] The first scalar value is encoded based on the NAF algorithm shown in the above pseudo code, and the first encoding result obtained is {u l-1 ,u l-2 ,…,u1,u0}, each encoding value included in the first encoding result is in [-2 w-1 +1,2 w-1-1], and the number of non-zero coding values ​​is approximately l / (w+1), and the probability of non-zero coding in the first coding result is 1 / (w+1).

[0120] Step 202: Encode the second scalar value to obtain a second encoding result, where the second encoding result includes multiple encoding values.

[0121] The second scalar value may be encoded by binary encoding, non-adjacent form (NAF) encoding, window encoding or the like, and the first scalar value and the second scalar value may be encoded by the same encoding method.

[0122] In one example, the second scalar value is encoded based on the NAF algorithm shown in the pseudo code in step 201, and the second encoding result obtained is {v l-1 ,v l-2 ,…,v1,v0}, each encoding value included in the second encoding result is in the range [-2 w-1 +1,2 w-1 -1], and the number of non-zero coding values ​​is approximately l / (w+1), and the probability of non-zero coding in the first coding result is 1 / (w+1).

[0123] Step 203: perform a doubling operation on the i-1th result value to obtain the i-th variable value.

[0124] i is an integer greater than 0 and less than or equal to m, m is the number of coded values ​​included in the first coding result, and the number of coded values ​​included in the first coding result and the second coding result is equal. The 0th result value (initial result value) is equal to the infinity point of the elliptic curve.

[0125] In one example, when the third pre-calculated point value and the fourth pre-calculated point value are represented by Jacobian coordinates, the point doubling operation JacobianDouble() pseudo code shown in step 103 may be used to perform a point doubling operation on the i-1th result value.

[0126] Step 204: According to the value of the i-th variable and [u i ]P determines the i-th intermediate result value.

[0127] u i represents the i-th encoding value in the first encoding result, [] represents the point multiplication operation, P represents the first point value, [u i ]P is determined from a plurality of third pre-calculated point values. The first pre-processing result {P1, P3, ..., P j After the coordinate transformation of the first pre-calculated point values ​​included in}, the set of third pre-calculated point values ​​obtained is {P1', P3', ..., P j '},[u i]P is Pu i '. The first encoding result is {u l-1 ,u l-2 ,…,u1,u0}, the first encoding value in the first encoding result is u l-1 , the second encoding value in the first encoding result is u l-2 , the l-1th encoding value in the first encoding result is u1, and the lth encoding value in the first encoding result is u0.

[0128] In the process of calculating the intermediate result value of the part i, the i-th variable value and [u i ]P are equal, a first judgment result and a first intermediate result are obtained, and the first judgment result can indicate whether the value of the i-th variable is equal to [u i ]P are equal. In the first judgment result, the i-th variable value is equal to [u i ]P are not equal, the first intermediate result is used to calculate the i-th intermediate result value, and the first judgment result indicates that the i-th variable value is equal to [u i ]P are equal, based on [u i ]P calculates the i-th intermediate result value.

[0129] It should be noted that, in the embodiment of the present disclosure, the first intermediate result and the second intermediate result have different values. For any i in the range of (0, m), when calculating the value of the i-th variable and [u i ]When the two values ​​are equal, the corresponding first judgment result and first intermediate result will be obtained.

[0130] Step 205: According to the value of the ith intermediate result and [v i ]Q determines the i-th result value.

[0131] v i represents the i-th encoding value in the second encoding result, Q represents the second point value, [v i ]Q is determined from a plurality of fourth pre-calculated point values. The second pre-processing result {Q1, Q3, ..., Q j After the coordinate transformation of the second pre-calculated point values ​​included in}, the set of fourth pre-calculated point values ​​obtained is {Q1', Q3', ..., Q j '},[v i ]Q is Qv i '. The second encoding result is {v l-1 ,v l-2 ,…,v1,v0}, the first encoding value in the second encoding result is v l-1 , the second encoding value in the second encoding result is v l-2 , the l-1th encoding value in the second encoding result is v1, and the lth encoding value in the second encoding result is v0.

[0132] In the process of calculating the i-th result value of the part, the i-th intermediate result value and [v i ]Q are equal, a second judgment result and a second intermediate result are obtained, and the second judgment result can indicate the value of the ith intermediate result and [v i ]Q are equal. In the second judgment result, the i-th intermediate result value and [v i ]Q are not equal, the second intermediate result is used to calculate the i-th result value, and the second judgment result indicates that the i-th intermediate result value and [v i ]Q are equal, based on [v i ]Q determines the i-th result value.

[0133] It should be noted that the second intermediate result in the embodiment of the present disclosure is different from the second intermediate result value. For any i in the range of (0, m), when calculating the value of the i-th intermediate result and [v i ]Q are equal, the corresponding second judgment result and second intermediate result will be obtained.

[0134] When i is less than m, after obtaining the i-th result value, after executing i=i+1, the next result value is calculated through the above steps 203 to 205 until the m-th result value is obtained.

[0135] Step 206: Determine the mth result value as the verification point value.

[0136] In the embodiment of the present disclosure, during the process of calculating at least part of the i-th intermediate result value, it is determined whether the i-th variable value is equal to [u i ]P are equal, in the process of calculating at least part of the i-th result value, determine whether the i-th intermediate result value is equal to [v i ]Q are equal, by judging whether the point values ​​are equal, calculation errors can be avoided. i ]P is determined from a plurality of third pre-calculated point values, [v i ]Q is determined from multiple fourth pre-calculated point values, and the Z coordinates of the third pre-calculated point value and the fourth pre-calculated point value are both equal to 1. The verification point value is calculated relatively directly based on the first pre-calculated point value and the second pre-calculated point value, which reduces the number of modular multiplication operations in the process of determining whether the point values ​​are equal. Each time the point values ​​are determined to be equal, 4 modular multiplication operations can be reduced, thereby reducing the computational cost of calculating the verification point value and improving the efficiency of verifying the digital signature.

[0137] In a possible implementation, step 204 is based on the value of the i-th variable and [u i ]P can determine the value of the i-th intermediate result according to u i Is it equal to 0? The i-th intermediate result value is determined by a corresponding method. i = 0, the i-th variable value can be directly determined as the i-th intermediate result value.i ≠0, the value of the i-th variable is used as the first input value of the equality judgment algorithm, and [u i ]P is used as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the value of the i-th variable and [u i ]P are equal, obtain the corresponding first judgment result and first intermediate result, and then determine the i-th intermediate result value according to the first judgment result and the first intermediate result.

[0138] In the disclosed embodiment, u i = 0, u i It will not have any actual effect on the multi-point multiplication operation, so the i-th variable value is directly determined as the i-th intermediate result value, which reduces unnecessary operations and improves the efficiency of calculating the verification point value. i ≠0, u i It will have a practical effect on the multi-point multiplication operation, according to the value of the i-th variable and [u i ]P are equal, and the corresponding algorithm is used to calculate the i-th intermediate result value to ensure that the calculation result will not be wrong.

[0139] In a possible implementation, step 205 is based on the i-th intermediate result value and [v i ]Q determines the i-th result value, you can use v i Is it equal to 0? The i-th result value is determined by the corresponding method. Specifically, in v i = 0, the ith intermediate result value can be directly determined as the ith result value. i ≠0, the i-th intermediate result value is used as the first input value of the equality judgment algorithm, and [v i ]Q is used as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the i-th intermediate result value and [v i ]Q are equal, obtain the corresponding second judgment result and second intermediate result, and then determine the i-th result value according to the second judgment result and the second intermediate result.

[0140] In the disclosed embodiment, v i =0, v i It does not have any actual effect on the multi-point multiplication operation, so the i-th intermediate result value is directly determined as the i-th result value, which reduces unnecessary operations and improves the efficiency of calculating the verification point value. i When v i It will have a practical effect on the multi-point multiplication operation, according to the value of the intermediate result of the ith i ]Q are equal, and the corresponding algorithm is used to calculate the i-th result value to ensure that the calculation result will not be wrong.

[0141] In a possible implementation, when determining the i-th intermediate result value according to the first judgment result and the first intermediate result, if the first judgment result indicates that the i-th variable value is equal to [u i ]P are equal, then [u i ]P is determined as the i-th intermediate result value. If the first judgment result indicates that the i-1th result value is equal to [u i ]P are not equal, then according to the value of the i-th variable, [u i ]P and the first intermediate result, calculate the i-th intermediate result value.

[0142] In one example, in [u i When performing a doubling operation, the pseudo code of the doubling operation JacobianDouble() shown in step 103 above can be used to perform a doubling operation on the first [u i ]P performs doubling operations.

[0143] In the embodiment of the present disclosure, if the value of the i-th variable is equal to [u i ]P are equal, directly [u i ]P is determined as the i-th intermediate result value. If the i-th variable value is equal to [u i ]P are not equal, then according to the value of the i-th variable, [u i ]P and the first intermediate result, and calculate the value of the ith intermediate result by the dot addition formula. i ]P are equal, the first intermediate result will be obtained, and the first intermediate result will be temporarily stored before the value of the i-th variable and [u i ]When P is not equal, the first intermediate result is reused to calculate the i-th intermediate result value, thereby reducing the computational overhead of calculating the i-th intermediate result value.

[0144] In a possible implementation, when determining the i-th result value according to the second judgment result and the second intermediate result, if the second judgment result indicates that the i-th intermediate result value is equal to [v i ]Q are equal, then [v i ]Q times the point operation result is determined as the i-th result value, if the second judgment result indicates that the i-th intermediate result value is equal to [v i ]Q are not equal, then according to the i-th intermediate result value, [v i ]Q and the second intermediate result, calculate the i-th result value.

[0145] In one example, in [Q i When performing doubling operation, the pseudo code of JacobianDouble() shown in step 103 can be used to perform doubling operation on the first [v i ]Q performs doubling operation.

[0146] In the embodiment of the present disclosure, if the i-th intermediate result value is equal to [v i ]Q is equal, directly change [v i ]Q double point operation result is determined as the i-th result value. If the i-th intermediate result value is equal to [v i ]Q are not equal, then according to the i-th intermediate result value, [v i ]Q and the second intermediate result, and calculate the i-th result value by the dot addition formula. After the i-th intermediate result value is calculated by the equality judgment algorithm and [v i ]Q are equal, the second intermediate result will be obtained, and the second intermediate result will be temporarily stored. i ]When Q are not equal, the second intermediate result is reused to calculate the i-th result value, reducing the computational overhead of calculating the i-th result value.

[0147] In one possible implementation, the equality determination algorithm for determining whether two point values ​​are equal includes:

[0148] If (EG) mod p = 0 and (FH) mod p = 0, then the first input value and the second input value are determined to be equal, the first input value of the equality judgment algorithm is (X1, Y1, Z1), the second input value of the equality judgment algorithm is (X2, Y2, Z2), E = (X2·A) mod p, F = (Y2·B) mod p, G = (X1·C) mod p, H = (Y1·D) mod p, A = (Z1·Z1) modp, B = (A·Z1) mod p, C = (Z2·Z2) mod p, D = (C·Z2) mod p, E, F, G and H are intermediate results, and p represents a preset prime number corresponding to the elliptic curve.

[0149] The input of the equality judgment algorithm is the point values ​​P1 and P2, P1 = (X1, Y1, Z1), P2 = (X2, Y2, Z2). The output of the equality judgment algorithm is {True / False, (E, F, G, H)}, True / False is the judgment result, True means P1 and P2 are equal, False means P1 and P2 are not equal, (E, F, G, H) is the intermediate result.

[0150] In an example, the pseudo code of the equality judgment algorithm PointsEqualNew(P1,P2) is as follows:

[0151] “

[0152] A=Z1*Z1 mod p,

[0153] B=A*Z1 mod p,

[0154] C=Z2*Z2 mod p,

[0155] D=C*Z2 mod p,

[0156] E=X2*A mod p,

[0157] F=Y2*B mod p,

[0158] G=X1*C mod p,

[0159] H=Y1*D mod p,

[0160] If (E–G)mod p==0 and (F–H)mod p==0,

[0161] Return True, (E, F, G, H)

[0162] Else:

[0163] Returns False, (E, F, G, H)

[0164] ”

[0165] By using the equality judgment algorithm PointsEqualNew(P1,P2) to calculate the value of the i-th variable and [u i ]P are equal, P1 is the value of the i-th variable, P2 is [u i ]P. If the value of the i-th variable is equal to [u i ]P are equal, the first judgment result is True, and the first intermediate result is (E, F, G, H). i ]P are not equal, the first judgment result is False, and the first intermediate result is (E, F, G, H).

[0166] When the equal judgment algorithm PointsEqualNew(P1,P2) is used to calculate the value of the i-th intermediate result and [v i ]Q are equal, P1 is the i-th intermediate result value, P2 is [v i ]Q. If the i-th intermediate result value is equal to [v i ]Q are equal, the second judgment result is True, and the second intermediate result is (E, F, G, H). If the value of the ith intermediate result is equal to [v i ]Q are not equal, the second judgment result is False, and the second intermediate result is (E, F, G, H).

[0167] In the embodiment of the present disclosure, through the above-mentioned equality judgment algorithm, while judging whether two point values ​​are equal, an intermediate result can be obtained, and the intermediate result can be reused to calculate the i-th intermediate result value or the i-th result value, thereby saving the computational overhead of calculating the i-th intermediate result value and the i-th result value, and improving the verification efficiency of the digital signature.

[0168] In a possible implementation, according to the value of the i-th variable, [u i ]P and the first intermediate result to calculate the i-th intermediate result value, the i-th variable value can be used as the first input of the target algorithm, and [u i ]P as the second input of the target algorithm, and the first intermediate result as the third input of the target algorithm, and the target algorithm is used to calculate the i-th intermediate result value. i ]Q and the second intermediate result calculate the i-th result value, the i-th intermediate result value can be used as the first input of the target algorithm, and [v i ]Q is used as the second input of the target algorithm, the second intermediate result is used as the third input of the target algorithm, and the i-th result value is calculated through the target algorithm.

[0169] The output of the target algorithm is (X5, Y5, Z5), the first input of the target algorithm is (X3, Y3, Z3), the second input of the target algorithm is (X4, Y4, Z4), the third input of the target algorithm is (E, F, G, H), X5 = J 2 -(L+2M)mod p, Y5=J·(M-X5)-Nmod p, Z5=(Z3·Z4·I)mod p, I=(EG)mod p, J=(FH)mod p, K=I 2 mod p, L = (K·I) mod p, M = (K·G) mod p, N = (H·L) mod p, p represents a preset prime number corresponding to the elliptic curve.

[0170] The target algorithm can be a point addition operation under Jacobian coordinates, and the target algorithm can reuse the intermediate results of the equality judgment algorithm. In an example, the input of the target algorithm is P = (X1, Y1, Z1), Q = (X2, Y2, Z2) and (E, F, G, H), where (E, F, G, H) is the intermediate result of the equality judgment algorithm. The output of the target algorithm is (X3, Y3, Z3). The pseudo code of the target algorithm JacobianAddNew (P, Q, (E, F, G, H)) is as follows:

[0171] “

[0172] I=(EG)mod p

[0173] J=(FH)mod p

[0174] K=I^2mod p

[0175] L=K*I mod p

[0176] M=K*G mod p

[0177] N=H*L mod p

[0178] X3=J^2-(L+2M)mod p

[0179] Y3=J*(M-X3)-N mod p

[0180] Z3=Z1*Z2*I mod p

[0181] ”

[0182] When the target algorithm JacobianAddNew(P,Q,(E,F,G,H)) is used to calculate the i-th intermediate result value, P is the i-th variable value, Q is [u i ]P, (E, F, G, H) is the first intermediate result. At this time, the output (X3, Y3, Z3) of the target algorithm JacobianAddNew(P, Q, (E, F, G, H)) is the i-th intermediate result value.

[0183] When the i-th result value is calculated by the target algorithm JacobianAddNew(P,Q,(E,F,G,H)), P is the i-th intermediate result value, Q is [v i ]Q, (E,F,G,H) is the second intermediate result. At this time, the output (X3,Y3,Z3) of the target algorithm JacobianAddNew(P,Q,(E,F,G,H)) is the i-th result value.

[0184] In the disclosed embodiment, during the process of calculating whether two point values ​​are equal by the equality judgment algorithm, the intermediate results (E, F, G, H) will be retained. When the i-th intermediate result value or the i-th result value is calculated by the target algorithm, the target algorithm can reuse the intermediate results (E, F, G, H), thereby reducing the modular multiplication operations in the process of calculating the i-th intermediate result value and the i-th result value, thereby reducing the calculation costs of the i-th intermediate result value and the i-th result value and improving the verification efficiency of the digital signature.

[0185] In a possible implementation, in combination with the aforementioned embodiments, under the premise that the first scalar value and the second scalar value are NAF-encoded and each point value is represented by Jacobian coordinates, after obtaining the target data, the digital signature of the target data, and the first point value and the second point value, the pseudo code of the multi-point multiplication algorithm for calculating the verification point value is as follows. For the convenience of subsequent comparison and explanation, the multi-point multiplication operation is defined as the first multi-point multiplication operation. The input of the first multi-point multiplication operation is u, v, P, Q, and w, where u is the first scalar value, v is the second scalar value, P is the first point value, Q is the second point value, and w is a preset parameter. The output of the first multi-point multiplication operation is [u]P+[v]Q, that is, the verification point value is [u]P+[v]Q.

[0186] The pseudo code for the first multi-point multiplication operation is as follows:

[0187]

[0188] In the pseudocode of the above-mentioned first multi-point multiplication operation, NAF() is the NAF encoding algorithm in the aforementioned embodiment, NafPointsPre() is the pre-calculation algorithm in the aforementioned embodiment, PointsZ1New() is the coordinate conversion algorithm in the aforementioned embodiment, JacobianDouble() is the doubling point operation algorithm in the aforementioned embodiment, PointsEqualNew() is the equality judgment algorithm in the aforementioned embodiment, JacobianAddNew() is the target algorithm (point addition operation) in the aforementioned embodiment, and the finally returned R is the verification point value.

[0189] In the disclosed embodiment, the first scalar value and the second scalar value are encoded by NAF encoding, which can reduce the side channel attack, reduce the number of point addition operations, and improve the performance of multi-point multiplication operations. The first pre-calculated point value and the second pre-calculated point value are converted by the coordinate conversion algorithm PointsZ1New(), so that the Z coordinates of the third pre-calculated point value and the fourth pre-calculated point value are 1, which reduces the computational cost of point addition and point multiplication operations, and can reduce the number of modular multiplication operations in the equality judgment algorithm PointsEqualNew(). The target algorithm JacobianAddNew() reuses the intermediate results of the equality judgment algorithm PointsEqualNew(), reducing the computational overhead of the point addition operation.

[0190] In a possible implementation, under the premise that the first scalar value and the second scalar value are binary coded and each point value is represented by Jacobian coordinates, after obtaining the target data, the digital signature of the target data, and the first point value and the second point value, the pseudo code of the multi-point multiplication algorithm for calculating the verification point value is as follows. For the convenience of subsequent comparison, the multi-point multiplication operation is defined as the second multi-point multiplication operation. The input of the second multi-point multiplication operation is u={u l-1 ,ul-2 ,…,u1,u0}2、v={v l-1 ,v l-2 ,…,v1,v0}2, P and Q, where u is the first scalar value, {u l-1 ,u l-2 ,…,u1,u0}2 is the first scalar value after binary encoding, v is the second scalar value, {v l-1 ,v l-2 ,…,v1,v0}2 is the second scalar value after binary encoding, P is the first point value, P = (X1, Y1, Z1), Q is the second point value, Q = (X2, Y2, Z2), and Z1 and Z2 are not equal to 1. The output of the second multi-point multiplication operation is [u]P+[v]Q, that is, the verification point value is [u]P+[v]Q.

[0191] The pseudo code for the second multi-point multiplication operation is as follows:

[0192]

[0193]

[0194] In the pseudo code of the second multi-point multiplication operation, the input of the JacobianAdd() operation is P=(X1, Y1, Z1) and Q=(X2, Y2, Z2), and the output is P+Q=(X3, Y3, Z3), where p is a prime number. The pseudo code of the JacobianAdd() operation is as follows:

[0195] “

[0196] A=Z1^2mod p

[0197] B=Z2^2mod p

[0198] C=Z1*A mod p

[0199] D=Z2*B mod p

[0200] E=X2*A mod p

[0201] F=Y2*C mod p

[0202] G=X1*B mod p

[0203] H=Y1*D mod p

[0204] I=EG mod p

[0205] J=FH mod p

[0206] K=I^2mod p

[0207] L=K*I mod p

[0208] M=K*G mod p

[0209] N=H*L mod p

[0210] X3=J^2-(L+2M)mod p

[0211] Y3=J*(M-X3)-N mod p

[0212] Z3=Z1*Z2*I mod p

[0213] ”

[0214] In the pseudo code of the second multi-point multiplication operation, the input of the doubling JacobianDouble() is P = (X1, Y1, Z1), and the output is [2] P = (X3, Y3, Z3). The pseudo code of the doubling JacobianDouble() is as follows:

[0215] “

[0216] A=Y1^2mod p

[0217] B=4*X1*A mod p

[0218] C=8*A^2mod p

[0219] D=3*X1^2+a*Z1^4mod p

[0220] E=2*B mod p

[0221] X3=D^2-E mod p

[0222] Y3=D*(B-X3)-C mod p

[0223] Z3=2*Y1*Z1 mod p

[0224] ”

[0225] In the pseudo code of the second multi-point multiplication operation, the input of the equality judgment algorithm PointsEqual() is P1 = (X1, Y1, Z1) and P2 = (X2, Y2, Z2), and the output is True or False. The pseudo code of the equality judgment algorithm PointsEqual() is as follows:

[0226] “

[0227] A=Z1*Z1 mod p,

[0228] B=A*Z1 mod p,

[0229] C=Z2*Z2 mod p,

[0230] D=C*Z2 mod p,

[0231] E=X2*A mod p,

[0232] F=Y2*B mod p,

[0233] G=X1*C mod p,

[0234] H=Y1*D mod p,

[0235] If(EG)mod p==0 and (FH)mod p==0,

[0236] Return True

[0237] Else:

[0238] Return False

[0239] ”

[0240] In a possible implementation, under the premise that the first scalar value and the second scalar value are NAF-encoded and each point value is represented by Jacobian coordinates, after obtaining the target data, the digital signature of the target data, and the first point value and the second point value, the pseudo code of another multi-point multiplication algorithm for calculating the verification point value is as follows. For the convenience of subsequent comparison and explanation, the multi-point multiplication operation is defined as the third multi-point multiplication operation. The input of the third multi-point multiplication operation is u, v, P, Q, and w, where u is the first scalar value, v is the second scalar value, P is the first point value, Q is the second point value, and w is a preset parameter. The output of the third multi-point multiplication operation is [u]P+[v]Q, that is, the verification point value is [u]P+[v]Q.

[0241] The pseudo code for the third multi-point multiplication operation is as follows:

[0242]

[0243]

[0244] In the pseudocode of the above-mentioned third multi-point multiplication operation, NAF() is the NAF encoding algorithm in the aforementioned embodiment, NafPointsPre() is the pre-calculation algorithm in the aforementioned embodiment, JacobianDouble() is the point doubling operation algorithm in the aforementioned embodiment, PointsEqual() is the equality judgment algorithm PointsEqual() in the aforementioned embodiment, and JacobianAdd() is the point addition operation JacobianAdd() in the aforementioned embodiment.

[0245] The following combines the pseudocodes of the first multi-point multiplication operation, the second multi-point multiplication operation, and the third multi-point multiplication operation, and takes the example that the Z coordinates of the first point value P and the second point value Q are not equal to 1 to perform performance analysis on the first multi-point multiplication operation, the second multi-point multiplication operation, and the third multi-point multiplication operation.

[0246] Table 3 below shows the performance comparison of the first multi-point multiplication operation, the second multi-point multiplication operation, and the third multi-point multiplication operation. As can be seen from Table 3, the performance of the pre-calculation algorithm in the first multi-point multiplication operation is inferior to that of the second multi-point multiplication operation and the third multi-point multiplication operation, and the larger the w value, the worse the performance of the first multi-point multiplication operation in the pre-calculation algorithm, but in terms of the equality judgment algorithm and point addition operation, the first multi-point multiplication operation is better than the second multi-point multiplication operation and the third multi-point multiplication operation, and as the w value increases, the performance of the first multi-point multiplication operation is better, and it can make up for the performance loss of the first multi-point multiplication operation in the pre-calculation algorithm.

[0247] Table 3

[0248]

[0249] In the above Table 3, I represents the computational overhead of each modular inverse operation, M represents the computational overhead of each modular multiplication operation, and A represents the computational overhead of each modular addition operation.

[0250] Assuming that one modular inverse operation is equivalent to 384 modular multiplication operations, taking l=256 as an example, the following Table 4 lists the performance of the first multi-point multiplication operation, the second multi-point multiplication operation, and the third multi-point multiplication operation under different w values, where only the number of modular multiplication operations is counted. Under different w values, Table 4 counts the number of modular multiplications and the storage space of pre-calculated points (excluding points P and Q) required for calculating multi-point multiplication operations on a 256-bit elliptic curve.

[0251] Table 4

[0252]

[0253]

[0254] As can be seen from Table 4 above, in terms of storage space, the storage resources required for the first multi-point multiplication operation are the same as those for the third multi-point multiplication operation. In terms of performance, as the value of w increases, the performance of the first multi-point multiplication operation is better. However, when w=4 / 5 / 6, the performance difference of the first multi-point multiplication operation is small. In embedded systems, if the limitation of storage resources is taken into account, the smaller the value of w, the less storage resources are required. In summary, for a 256-bit elliptic curve, when w=4, the first multi-point multiplication operation has a better performance improvement and consumes less storage resources.

[0255] It should be noted that the pseudo codes provided in the embodiments of the present disclosure are only examples and are not limitations of the embodiments of the present disclosure.

[0256] In one possible implementation, the equality judgment algorithm PointsEqualNew() and the target algorithm JacobianAddNew() in the aforementioned embodiment can be used for multi-point multiplication operations based on NAF coding (encoding the first scalar value and the second scalar value using NAF coding), as well as multi-point multiplication operations based on binary coding (encoding the first scalar value and the second scalar value using binary coding), thereby improving the performance of multi-point multiplication operations based on binary coding.

[0257] In a possible implementation, the coordinate transformation algorithm PointsZ1New(), the equality judgment algorithm PointsEqualNew() and the target algorithm JacobianAddNew() in the aforementioned embodiments can be used for multi-point multiplication operations based on NAF coding (encoding the first scalar value and the second scalar value using NAF coding), and can also be used for multi-point multiplication operations based on Window coding (encoding the first scalar value and the second scalar value using Window coding), so that the performance of multi-point multiplication operations based on Window coding is improved.

[0258] It should be noted that the point value can be represented by Jacobian coordinates, Chudnovsky coordinates or other projective coordinates. The Jacobian coordinates of the point value are expressed as (X, Y, Z), where X = x*Z^2, Y = y*Z^3, and Z is an auxiliary parameter. In addition to being applicable to Jacobian coordinates, the coordinate conversion algorithm PointsZ1New(), the equality judgment algorithm PointsEqualNew(), and the target algorithm JacobianAddNew() are also applicable to other projective coordinates. The other projective coordinates of the point are expressed as (X, Y, Z), where X = x*Z^c, Y = y*Z^d, and Z is an auxiliary parameter. Jacobian coordinates are a type of projective coordinates, that is, when c = 2 and d = 3. The coordinate conversion algorithm PointsZ1New(), the equality judgment algorithm PointsEqualNew() and the target algorithm JacobianAddNew() are also applicable to Chudnovsky coordinates. The Chudnovsky coordinates of the point value are expressed as X, Y, Z, Z^2, Z^3), where X=x*Z^2, Y=y*Z^2, Z is an auxiliary parameter, and the Chudnovsky coordinates are an extension of the Jacobian coordinates.

[0259] Digital signature verification device

[0260] Figure 3 A schematic diagram of a digital signature verification device according to an embodiment of the present disclosure is shown. Figure 3 As shown, the digital signature verification device 300 includes:

[0261] An acquisition unit 301 is used to acquire target data and a digital signature of the target data, and acquire a first point value and a second point value, wherein the point corresponding to the first point value is a base point of the elliptic curve, the second point value is a public key, and the point corresponding to the second point value is a point on the elliptic curve different from the base point;

[0262] A generating unit 302, configured to generate a first scalar value and a second scalar value according to the target data and the digital signature;

[0263] A first pre-calculation unit 303 is used to pre-calculate the first point value to obtain a first pre-calculation result, where the first pre-calculation result includes multiple first pre-calculation point values, where the first pre-calculation point value is equal to a result of performing an integer number of addition operations on the first point value along the elliptic curve according to an encoding method of the first scalar value, and different first pre-calculation point values ​​correspond to different integer numbers of addition operations;

[0264] A second pre-calculation unit 304 is used to pre-calculate the second point value to obtain a second pre-calculation result, where the second pre-calculation result includes multiple second pre-calculation point values, where the second pre-calculation point value is equal to the result of performing an integer number of addition operations on the second point value along the elliptic curve according to the encoding method of the second scalar value, and different second pre-calculation point values ​​correspond to different integer numbers of addition operations;

[0265] A conversion unit 305, configured to perform coordinate conversion on the first pre-calculated point value and the second pre-calculated point value respectively, so that the Z coordinate of the third pre-calculated point value corresponding to the coordinate conversion of the first pre-calculated point value is 1, and the Z coordinate of the fourth pre-calculated point value corresponding to the coordinate conversion of the second pre-calculated point value is 1;

[0266] A calculation unit 306, configured to calculate a sum of a dot product result of the first scalar value and the first point value and a dot product result of the second scalar value and the second point value according to the third pre-calculated point value and the fourth pre-calculated point value, to obtain a verification point value;

[0267] The verification unit 307 is used to determine the validity of the digital signature according to the verification point value.

[0268] In the embodiment of the present disclosure, after the acquisition unit 301 acquires the target data, the digital signature, the first point value and the second point value, the generation unit 302 generates the first scalar value and the second scalar value according to the target data and the digital signature, the first pre-calculation unit 303 pre-calculates the first point value to obtain a first pre-calculation result including multiple first pre-calculated point values, the second pre-calculation unit 304 pre-calculates the second point value to obtain a second pre-calculation result including multiple second pre-calculated point values, the conversion unit 305 converts the first pre-calculated point value into a third pre-calculated point value with a Z coordinate of 1, and converts the second pre-calculated point value into a fourth pre-calculated point value with a Z coordinate of 1, and then the calculation unit 306 calculates the sum of the dot product result of the first scalar value and the first point value and the dot product result of the second scalar value and the second point value according to the third pre-calculated point value and the fourth pre-calculated point value to obtain a verification point value, and then the verification unit 307 determines the validity of the digital signature according to the verification point value. By precalculating the first point value and the second point value, and performing coordinate conversion on the obtained first precalculated point value and the second precalculated point value, the third precalculated point value and the fourth precalculated point value are obtained. When performing multi-point multiplication operations, the point multiplication operation result can be directly obtained from the third precalculated point value and the fourth precalculated point value, without repeating the same point multiplication operation result multiple times, thereby improving the calculation efficiency. The third precalculated point value and the fourth precalculated point value are obtained by coordinate conversion. Since the Z coordinates of the third precalculated point value and the fourth precalculated point value are both equal to 1, the calculation cost of the point addition operation and the doubling operation in the subsequent multi-point multiplication operation is reduced, and the efficiency of the multi-point multiplication operation is improved, thereby improving the efficiency of digital signature verification.

[0269] In an embedded system, the digital signature verification device 300 in the embodiment of the present disclosure may be deployed in a coprocessor, and the central processing unit (CPU) schedules the coprocessor to enable the digital signature verification device 300 to complete digital signature verification.

[0270] It should be noted that the digital signature verification device 300 provided in the embodiment of the present disclosure is based on the same inventive concept as the digital signature verification method provided in the aforementioned embodiment, corresponds to the corresponding digital signature verification method in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding digital signature verification method embodiments, so it will not be repeated here. In addition, the implementation of each unit in the digital signature verification device 300 provided in the embodiment of the present disclosure can refer to the description of the corresponding parts in the aforementioned digital signature verification method embodiments, and it will not be repeated here.

[0271] Digital signature chip

[0272] The embodiments of the present disclosure provide a digital signature chip, which can be used to execute the digital signature verification method in any of the above embodiments.

[0273] Electronic devices

[0274] Figure 4 is a schematic block diagram of an electronic device provided by an embodiment of the present disclosure, and the specific embodiment of the present disclosure does not limit the specific implementation of the electronic device. Figure 4 As shown, the electronic device may include: a processor (processor) 402, a communication interface (Communications Interface) 404, a memory (memory) 406, and a communication bus 408. Among them:

[0275] The processor 402 , the communication interface 404 , and the memory 406 communicate with each other via a communication bus 408 .

[0276] The communication interface 404 is used to communicate with other electronic devices or servers.

[0277] The processor 402 is used to execute the program 410, and specifically can execute the relevant steps in any of the aforementioned digital signature verification method embodiments.

[0278] Specifically, the program 410 may include program codes, which include computer operation instructions.

[0279] The processor 402 may be a CPU, or an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present disclosure. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0280] RISC-V is an open source instruction set architecture based on the Reduced Instruction Set (RISC) principle. It can be applied to various aspects such as single-chip microcomputers and FPGA chips. Specifically, it can be applied to the fields of IoT security, industrial control, mobile phones, personal computers, etc., and because it is designed with small, fast, and low-power realities in mind, it is particularly suitable for modern computing devices such as warehouse-scale cloud computers, high-end mobile phones, and tiny embedded systems. With the rise of artificial intelligence Internet of Things (AIoT), the RISC-V instruction set architecture has also received more and more attention and support, and is expected to become the next generation of widely used CPU architecture.

[0281] The computer operation instructions in the embodiments of the present disclosure may be computer operation instructions based on the RISC-V instruction set architecture, and correspondingly, the processor 402 may be designed based on the RISC-V instruction set. Specifically, the processor chip in the electronic device provided in the embodiments of the present disclosure may be a chip designed using the RISC-V instruction set, and the chip may execute executable code based on the configured instructions, thereby implementing the digital signature verification method in the above embodiments.

[0282] The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0283] The program 410 may be specifically configured to enable the processor 402 to execute the digital signature verification method in any of the aforementioned embodiments.

[0284] The specific implementation of each step in program 410 can refer to the corresponding steps in any of the above digital signature verification method embodiments and the corresponding description in the module, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described devices and modules can refer to the corresponding process description in the above method embodiments, which will not be repeated here.

[0285] Through the electronic device of the embodiment of the present disclosure, after precalculating the first point value to obtain a first precalculation result including multiple first precalculation point values, and precalculating the second point value to obtain a second precalculation result including multiple second precalculation point values, the first precalculation point value is converted into a third precalculation point value with a Z coordinate of 1, and the second precalculation point value is converted into a fourth precalculation point value with a Z coordinate of 1, and then after generating the first scalar value and the second scalar value according to the target data and the digital signature, the sum of the dot product result of the first scalar value and the first point value and the dot product result of the second scalar value and the second point value is calculated according to the third precalculation point value and the fourth precalculation point value to obtain a verification point value, and then the validity of the digital signature is determined according to the verification point value. By precalculating the first point value and the second point value, and performing coordinate conversion on the obtained first precalculation point value and the second precalculation point value, the third precalculation point value and the fourth precalculation point value are obtained, and when performing multiple point multiplication operations, the point multiplication operation results can be directly obtained from the third precalculation point value and the fourth precalculation point value, without repeating the same point multiplication operation result multiple times, thereby improving the calculation efficiency. The third pre-calculated point value and the fourth pre-calculated point value are obtained through coordinate transformation. Since the Z coordinates of the third pre-calculated point value and the fourth pre-calculated point value are both equal to 1, the computational cost of point addition and doubling operations in subsequent multi-point multiplication operations is reduced, and the efficiency of multi-point multiplication operations is improved, thereby improving the efficiency of digital signature verification.

[0286] Computer storage media

[0287] The present disclosure also provides a computer-readable storage medium storing instructions for causing a machine to execute the digital signature verification method as described herein. Specifically, a system or device equipped with a storage medium may be provided, on which a software program code implementing the functions of any of the above embodiments is stored, and a computer (or CPU or MPU) of the system or device is enabled to read and execute the program code stored in the storage medium.

[0288] In this case, the program code itself read from the storage medium can realize the function of any one of the above embodiments, and thus the program code and the storage medium storing the program code constitute part of the present disclosure.

[0289] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0290] Computer program product

[0291] The embodiments of the present disclosure also provide a computer program product, including computer instructions, which instruct a computing device to execute any corresponding operation in the above-mentioned multiple method embodiments.

[0292] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present disclosure can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present disclosure.

[0293] The above-mentioned method according to the embodiment of the present disclosure may be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a special-purpose processor or programmable or special-purpose hardware (such as an ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the method shown herein, the execution of the code converts the general-purpose computer into a special-purpose computer for executing the method shown herein.

[0294] It should be noted that the user-related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to sample data used to train the model, data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0295] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for specific applications, but such implementation should not be considered to be beyond the scope of the embodiments of the present disclosure.

[0296] The above implementation methods are only used to illustrate the embodiments of the present disclosure, and are not limitations of the embodiments of the present disclosure. Ordinary technicians in the relevant technical field may make various changes and modifications without departing from the spirit and scope of the embodiments of the present disclosure. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present disclosure. The scope of patent protection of the embodiments of the present disclosure should be defined by the claims.

Claims

1. A digital signature verification method, characterized in that: include: Obtain target data and a digital signature of the target data, and obtain a first point value and a second point value, wherein the point corresponding to the first point value is a base point of an elliptic curve, the second point value is a public key, and the point corresponding to the second point value is a point on the elliptic curve different from the base point; generating a first scalar value and a second scalar value according to the target data and the digital signature; Precalculating the first point value to obtain a first precalculation result, the first precalculation result including a plurality of first precalculation point values, the first precalculation point value being equal to a result of performing an integer number of addition operations on the first point value along the elliptic curve according to an encoding method of the first scalar value, and different first precalculation point values ​​corresponding to different integer numbers of addition operations; Precalculating the second point value to obtain a second precalculation result, where the second precalculation result includes a plurality of second precalculation point values, where the second precalculation point value is equal to a result of performing an integer number of addition operations on the second point value along the elliptic curve according to an encoding method of the second scalar value, and different second precalculation point values ​​correspond to different integer numbers of addition operations; Performing coordinate transformation on the first pre-calculated point value and the second pre-calculated point value respectively, so that the Z coordinate of a third pre-calculated point value corresponding to the coordinate transformation of the first pre-calculated point value is 1, and the Z coordinate of a fourth pre-calculated point value corresponding to the coordinate transformation of the second pre-calculated point value is 1; According to the third pre-calculated point value and the fourth pre-calculated point value, calculate the sum of the dot product result of the first scalar value and the first point value and the dot product result of the second scalar value and the second point value to obtain a verification point value; The validity of the digital signature is determined based on the verification point value.

2. The method according to claim 1, characterized in that The performing coordinate conversion on the first pre-calculated point value and the second pre-calculated point value respectively includes: Processing the first pre-calculated result by a coordinate conversion algorithm to obtain the third pre-calculated point value corresponding to each first pre-calculated point value after coordinate conversion; Processing the second pre-calculated result by the coordinate conversion algorithm to obtain the fourth pre-calculated point value corresponding to each second pre-calculated point value after coordinate conversion; Wherein, the coordinate conversion algorithm includes: Determine A1 as the Z coordinate of the first pre-calculated point value in the pre-calculated result is Z1, and determine A i =(A i-1 ·Z i )mod p,Z i represents the Z coordinate of the i-th pre-calculated point value in the pre-calculated result, i is an integer greater than 1 and less than or equal to n, n is the number of pre-calculated point values ​​in the pre-calculated result, mod represents a remainder operation, and p represents a preset prime number corresponding to the elliptic curve; Determine B n =(A n ) -1 mod p, and determine B i =(B i+1 ·Z i+1 ) mod p, i is an integer greater than 0 and less than n; Determine C1 = B1, and determine C i =(B i ·A i-1 ) mod p, i is an integer greater than 1 and less than or equal to n; Determine that the corresponding point value after the coordinate transformation of the i-th pre-calculated point value is (X′ i ,Y i ′, 1), X′ i =(X i ·T u )mod p,Y i ′=(Y i ·T′ i )mod p,T i =(C i ·C i )mod p,T′ i =(T i ·C i )mod p.

3. The method according to claim 1, characterized in that The step of determining, according to the third pre-calculated point value and the fourth pre-calculated point value, a sum of a dot product result of the first scalar value and the first point value and a dot product result of the second scalar value and the second point value to obtain a verification point value comprises: Encoding the first scalar value to obtain a first encoding result, where the first encoding result includes a plurality of encoding values; Encoding the second scalar value to obtain a second encoding result, where the second encoding result includes a plurality of encoding values; Perform a doubling operation on the i-1th result value to obtain an i-th variable value, where i is an integer greater than 0 and less than or equal to m, m is the number of code values ​​included in the first coding result, the number of code values ​​included in the first coding result and the second coding result is equal, and the 0th result value is equal to the infinity point of the elliptic curve; According to the value of the i-th variable and [u i ]P determines the i-th intermediate result value, wherein, in the process of calculating at least part of the i-th intermediate result value, the i-th variable value and [u i ]P are equal, a first judgment result and a first intermediate result are obtained, and the first judgment result indicates that the value of the i-th variable is equal to [u i ]P are not equal, the first intermediate result is used to calculate the i-th intermediate result value; u i represents the i-th encoding value in the first encoding result, [] represents the point multiplication operation, P represents the first point value, [u i ]P is determined from said plurality of third pre-calculated point values; According to the value of the ith intermediate result and [v i ]Q determines the i-th result value, wherein, in the process of calculating at least part of the i-th result value, the i-th intermediate result value and [v i ]Q are equal, obtain a second judgment result and a second intermediate result, and when the second judgment result indicates that the value of the i-th intermediate result is equal to [v i ] When Q is not equal, the second intermediate result is used to calculate the i-th result value; v i represents the i-th encoding value in the second encoding result, Q represents the second point value, [v i ]Q is determined from said plurality of fourth pre-calculated point values; The mth result value is determined as the verification point value.

4. The method according to claim 3, characterized in that According to the i-th variable value and [u i ]P determines the i-th intermediate result value, including: If u i =0, then the i-th intermediate result value is determined to be equal to the i-th variable value; If u i ≠0, the i-th variable value is used as the first input value of the equality judgment algorithm, and [u i ]P as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the difference between the i-th variable value and [u i ]P are equal, obtain the first judgment result and the first intermediate result, and determine the i-th intermediate result value according to the first judgment result and the first intermediate result.

5. The method according to claim 4, characterized in that According to the i-th intermediate result value and [v i ]Q determines the i-th result value, including: If v i =0, it is determined that the i-th result value is equal to the i-th intermediate result value; If v i ≠0, the i-th intermediate result value is used as the first input value of the equality judgment algorithm, and [v i ]Q is used as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the i-th intermediate result value and [v i ]Q are equal, obtain the second judgment result and the second intermediate result, and determine the i-th result value according to the second judgment result and the second intermediate result.

6. The method according to claim 5, characterized in that The determining the i-th intermediate result value according to the first judgment result and the first intermediate result includes: According to the first judgment result, if the i-th variable value is equal to [u i ]P are equal, then [u i ]P times the point operation result is determined as the i-th intermediate result value, if the i-th variable value is equal to [u i ]P are not equal, then according to the i-th variable value, [u i ]P and the first intermediate result, calculate the i-th intermediate result value.

7. The method according to claim 6, characterized in that The determining the i-th result value according to the second judgment result and the second intermediate result includes: According to the second judgment result, if the i-th intermediate result value is equal to [v i ]Q are equal, then [v i ]Q times the point operation result is determined as the i-th result value, if the i-th intermediate result value is equal to [v i ]Q are not equal, then according to the i-th intermediate result value, [v i ]Q and the second intermediate result, calculate the i-th result value.

8. The method according to claim 6 or 7, characterized in that: The equality judgment algorithm includes: If (EG) mod p = 0 and (FH) mod p = 0, it is determined that the first input value and the second input value are equal, the first input value of the equality judgment algorithm is (X1, Y1, Z1), the second input value of the equality judgment algorithm is (X2, Y2, Z2), E = (X2·A) mod p, F = (Y2·B) mod p, G = (X1·C) mod p, H = (Y1·D) mod p, A = (Z1·Z1) modp, B = (A·Z1) mod p, C = (Z2·Z2) mod p, D = (C·Z2) mod p, E, F, G and H are intermediate results, and p represents a preset prime number corresponding to the elliptic curve.

9. The method according to claim 7, characterized in that: According to the i-th variable value, [u i ]P and the first intermediate result, calculating the i-th intermediate result value, including: taking the i-th variable value as the first input of the target algorithm, i ]P as the second input of the target algorithm, the first intermediate result as the third input of the target algorithm, and the i-th intermediate result value is calculated by the target algorithm; According to the i-th intermediate result value, [v i ]Q and the second intermediate result, calculating the i-th result value, including: taking the i-th intermediate result value as the first input of the target algorithm, i ]Q as the second input of the target algorithm, the second intermediate result as the third input of the target algorithm, and the i-th result value is calculated by the target algorithm; Wherein, the target algorithm includes: The output of the target algorithm is (X5, Y5, Z5), the first input of the target algorithm is (X3, Y3, Z3), the second input of the target algorithm is (X4, Y4, Z4), the third input of the target algorithm is (E, F, G, H), X5 = J 2 -(L+2M)mod p, Y5=J·(M-X5)-N mod p, Z5=(Z3·Z4·I)mod p, I=(EG)mod p, J=(FH)mod p, K=I 2 mod p, L = (K·I) mod p, M = (K·G) mod p, N = (H·L) mod p, p represents a preset prime number corresponding to the elliptic curve.

10. A digital signature verification device, characterized in that: include: an acquisition unit, configured to acquire target data and a digital signature of the target data, and acquire a first point value and a second point value, wherein the point corresponding to the first point value is a base point of an elliptic curve, the second point value is a public key, and the point corresponding to the second point value is a point on the elliptic curve different from the base point; a generating unit, configured to generate a first scalar value and a second scalar value according to the target data and the digital signature; a first pre-calculation unit, configured to pre-calculate the first point value to obtain a first pre-calculation result, wherein the first pre-calculation result includes a plurality of first pre-calculated point values, wherein the first pre-calculated point value is equal to a result of performing an integer number of addition operations on the first point value along the elliptic curve according to an encoding method of the first scalar value, and different first pre-calculated point values ​​correspond to different integer numbers of addition operations; a second pre-calculation unit, configured to pre-calculate the second point value to obtain a second pre-calculation result, wherein the second pre-calculation result includes a plurality of second pre-calculation point values, the second pre-calculation point value being equal to a result of performing an integer number of addition operations on the second point value along the elliptic curve according to an encoding method of the second scalar value, and different second pre-calculation point values ​​correspond to different integer numbers of addition operations; a conversion unit, configured to perform coordinate conversion on the first pre-calculated point value and the second pre-calculated point value, respectively, so that a Z coordinate of a third pre-calculated point value corresponding to the coordinate conversion of the first pre-calculated point value is 1, and a Z coordinate of a fourth pre-calculated point value corresponding to the coordinate conversion of the second pre-calculated point value is 1; a calculation unit, configured to calculate, according to the third pre-calculated point value and the fourth pre-calculated point value, a sum of a dot product result of the first scalar value and the first point value and a dot product result of the second scalar value and the second point value, to obtain a verification point value; A verification unit is used to determine the validity of the digital signature according to the verification point value.

11. A digital signature chip, characterized in that: The digital signature chip is used to execute the method according to any one of claims 1-9.

12. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 9 by running the computer program stored in the memory.

13. A computer storage medium, characterized in that: The computer storage medium stores a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 9.

14. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 9.

Images