Digital signature verification methods, devices, electronic devices and storage media

Abstract

This disclosure provides a digital signature verification method, apparatus, electronic device, and storage medium. The digital signature verification method includes: acquiring target data, a digital signature, a first point value, and a second point value; generating a first scalar value and a second scalar value based on the target data and the digital signature; pre-calculating the first point value to obtain a first pre-calculated result including multiple first pre-calculated point values; pre-calculating the second point value to obtain a second pre-calculated result including multiple second pre-calculated point values; performing coordinate transformation on the first pre-calculated point value to obtain a third pre-calculated point value with a Z-coordinate of 1, and performing coordinate transformation on the second pre-calculated point value to obtain a fourth pre-calculated point value with a Z-coordinate of 1; calculating a verification point value based on the third and fourth pre-calculated point values; and determining the validity of the digital signature based on the verification point value. This solution can improve the efficiency of digital signature verification.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a digital signature verification method, apparatus, electronic device, and storage medium. Background Technology

[0002] In elliptic curve cryptography, the dot product operation [k]P is a crucial operation that plays a decisive role in system efficiency. Multiple dot products [u]P + [v]Q are used in cryptographic protocols including elliptic curve digital signatures and key exchange.

[0003] Currently, when performing multi-point multiplication in the digital signature verification process, [u]P and [v]Q are calculated separately, and then [u]P and [v]Q are added together to obtain the result of the multi-point multiplication operation [u]P+[v]Q.

[0004] However, the method of calculating [u]P and [v]Q separately and then adding them together to obtain the result of the multiplication operation [u]P+[v]Q involves a large number of dot addition and dot multiplication operations during the multiplication operation, which leads to low efficiency of the multiplication operation and consequently low efficiency of digital signature verification. Summary of the Invention

[0005] In view of the above, embodiments of this disclosure provide a digital signature verification method, apparatus, electronic device, and storage medium to at least partially solve the above-mentioned problems.

[0006] According to a first aspect of the present disclosure, a digital signature verification method is provided, comprising: acquiring target data and a digital signature of the target data, and acquiring a first point value and a second point value, wherein the point corresponding to the first point value is a base point of an elliptic curve, the second point value is a public key, and the point corresponding to the second point value is a point on the elliptic curve different from the base point; generating a first scalar value and a second scalar value based on the target data and the digital signature; pre-computing the first point value to obtain a first pre-computing result, the first pre-computing result including multiple first pre-computing point values, wherein each first pre-computing point value is equal to the result of performing an integer number of addition operations along the elliptic curve on the first point value according to the encoding method of the first scalar value, and different first pre-computing point values ​​correspond to different integer number of addition operations; and pre-computing the second point value to obtain a second pre-computing result. The second pre-calculation result includes multiple second pre-calculation point values. Each second pre-calculation point value is equal to the result of performing an integer number of addition operations along the elliptic curve on the second point value according to the encoding method of the second scalar value. Different second pre-calculation point values ​​correspond to different integer number of addition operations. Coordinate transformations are performed on the first and second pre-calculation point values ​​respectively, so that the Z-coordinate of the third pre-calculation point value corresponding to the first pre-calculation point value after coordinate transformation is 1, and the Z-coordinate of the fourth pre-calculation point value corresponding to the second pre-calculation point value after coordinate transformation is also 1. Based on the third and fourth pre-calculation point values, the dot product of the first scalar value and the first point value is calculated, and the sum of this product and the dot product of the second scalar value and the second point value is obtained to obtain the verification point value. The validity of the digital signature is determined based on the verification point value.

[0007] In one possible implementation, the coordinate transformation of the first pre-calculated point value and the second pre-calculated point value includes: processing the first pre-calculation result using a coordinate transformation algorithm to obtain the third pre-calculated point value corresponding to each of the first pre-calculated point values ​​after coordinate transformation; processing the second pre-calculation result using the coordinate transformation algorithm to obtain the fourth pre-calculated point value corresponding to each of the second pre-calculated point values ​​after coordinate transformation; wherein, the coordinate transformation algorithm includes: determining that A1 is the Z-coordinate of the first pre-calculated point value in the pre-calculation result as Z1, and determining A i =(A i-1 ·Z i )mod p,Z i The Z-coordinate of the i-th pre-calculated point value in the pre-calculation result is defined, where i is an integer greater than 1 and less than or equal to n, n is the number of pre-calculated point values ​​in the pre-calculation result, mod represents the modulo operation, and p represents a preset prime number corresponding to the elliptic curve; determine B. n =(A n )-1 mod p, and determine B i = (B i+1 ·Z i+1 Let $i$ be an integer greater than 0 and less than $n$, mod $p$. Determine that $C1 = B1$, and determine $C$. i = (B i ·A i-1 ) mod p, where i is an integer greater than 1 and less than or equal to n; determine the point value corresponding to the i-th pre-calculated point value after coordinate transformation as (X′). i ,Y i ′,1),X′ i =(X i ·T i )mod p,Y i ′=(Y i ·T′ i )mod p,T i =(C i ·C i )mod p,T′ i =(T i ·C i )mod p.

[0008] In one possible implementation, the step of determining the sum of the dot product of the first scalar value and the first point value, and the dot product of the second scalar value and the second point value, to obtain a verification point value, based on the third pre-calculated point value and the fourth pre-calculated point value, includes: encoding the first scalar value to obtain a first encoding result, the first encoding result including multiple encoded values; encoding the second scalar value to obtain a second encoding result, the second encoding result including multiple encoded values; performing a doubling operation on the (i-1)th result value to obtain the i-th variable value, where i is an integer greater than 0 and less than or equal to m, m is the number of encoded values ​​included in the first encoding result, the number of encoded values ​​included in the first encoding result and the second encoding result are equal, and the 0th result value is equal to the infinity point of the elliptic curve; based on the i-th variable value and [u i ]P determines the i-th intermediate result value, wherein, in the process of calculating at least part of the i-th intermediate result value, the i-th variable value is calculated and [u i Whether P is equal, obtain a first judgment result and a first intermediate result, and in the first judgment result, indicate that the value of the i-th variable is equal to [u]. i When P is not equal, the first intermediate result is used to calculate the value of the i-th intermediate result; i [] represents the i-th encoded value in the first encoding result, [] represents the dot product operation, P represents the first dot value, [u iP is determined from the plurality of third pre-calculated point values; based on the i-th intermediate result value and [v i ]q determines the i-th result value, wherein, in the process of calculating at least part of the i-th result value, the i-th intermediate result value is calculated and [v i Whether Q is equal, obtain a second judgment result and a second intermediate result, where the second judgment result indicates that the i-th intermediate result value is equal to [v]. i When Q is not equal, the second intermediate result is used to calculate the i-th result value; v i Q represents the i-th encoded value in the second encoding result, and Q represents the second point value. i Q is determined from the plurality of fourth pre-calculated point values; the m-th result value is determined as the verification point value.

[0009] In one possible implementation, the statement is based on the value of the i-th variable and [u] i P determines the i-th intermediate result value, including: if u i =0, then the i-th intermediate result value is determined to be equal to the i-th variable value; if u i If ≠0, then the value of the i-th variable is used as the first input value of the equality judgment algorithm, and [u i ]P is used as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the value of the i-th variable and [u i Determine whether P is equal, obtain the first judgment result and the first intermediate result, and determine the value of the i-th intermediate result based on the first judgment result and the first intermediate result.

[0010] In one possible implementation, the step of basing the i-th intermediate result value on [v] i Q determines the i-th result value, including: if v i =0, then the i-th result value is determined to be equal to the i-th intermediate result value; if v i If ≠0, then the i-th intermediate result value is used as the first input value of the equality judgment algorithm, and [v i Q is used as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the i-th intermediate result value and [v] i Determine whether Q is equal, obtain the second judgment result and the second intermediate result, and determine the i-th result value based on the second judgment result and the second intermediate result.

[0011] In one possible implementation, determining the i-th intermediate result value based on the first judgment result and the first intermediate result includes: based on the first judgment result, if the i-th variable value is consistent with [u i If P is equal, then [u] iThe result of the doubling operation of P is determined as the i-th intermediate result value. If the i-th variable value is different from [u] i If P is not equal, then according to the value of the i-th variable, [u i ]P and the first intermediate result, calculate the value of the i-th intermediate result.

[0012] In one possible implementation, determining the i-th result value based on the second judgment result and the second intermediate result includes: based on the second judgment result, if the i-th intermediate result value is consistent with [v... i If Q is equal, then [v] i The result of the doubling operation of Q is determined as the i-th result value. If the i-th intermediate result value is different from [v... i If Q is not equal, then based on the i-th intermediate result value, [v i ]Q and the second intermediate result, calculate the i-th result value.

[0013] In one possible implementation, the equality judgment algorithm includes: if (EG) mod p = 0 and (FH) mod p = 0, then the first input value and the second input value are determined to be equal. The first input value of the equality judgment algorithm is (X1, Y1, Z1), and the second input value of the equality judgment algorithm is (X2, Y2, Z2). E = (X2·A) mod p, F = (Y2·B) mod p, G = (X1·C) mod p, H = (Y1·D) mod p, A = (Z1·Z1) mod p, B = (A·Z1) mod p, C = (Z2·Z2) mod p, D = (C·Z2) mod p. E, F, G, and H are intermediate results, and p represents a preset prime number corresponding to the elliptic curve.

[0014] In one possible implementation, the step of basing the value of the i-th variable, [u] i ]P and the first intermediate result, calculate the i-th intermediate result value, including: taking the i-th variable value as the first input of the target algorithm, and taking [u i P is used as the second input to the target algorithm, and the first intermediate result is used as the third input to the target algorithm. The target algorithm calculates the i-th intermediate result value; the i-th intermediate result value is then used as the input to the target algorithm. i ]Q and the second intermediate result, to calculate the i-th result value, including: using the i-th intermediate result value as the first input of the target algorithm, and using [v iQ is used as the second input of the target algorithm, and the second intermediate result is used as the third input of the target algorithm to calculate the i-th result value; wherein, the target algorithm includes: the output of the target algorithm is (X5,Y5,Z5), the first input of the target algorithm is (X3,Y3,Z3), the second input of the target algorithm is (X4,Y4,Z4), the third input of the target algorithm is (E,F,G,H), and X5=J 2 -(L+2M)mod p, Y5=J·(M-X5)-Nmodp, Z5=(Z3·Z4·I)mod p, I=(EG)mod p, J=(FH)mod p, K=I 2 mod p, L = (K·I)mod p, M = (K·G)mod p, N = (H·L)mod p, where p represents a preset prime number corresponding to the elliptic curve.

[0015] According to a second aspect of the present disclosure, a digital signature verification apparatus is provided, comprising: an acquisition unit, configured to acquire target data and a digital signature of the target data, and acquire a first point value and a second point value, wherein the point corresponding to the first point value is a base point of an elliptic curve, the second point value is a public key, and the point corresponding to the second point value is a point on the elliptic curve different from the base point; a generation unit, configured to generate a first scalar value and a second scalar value based on the target data and the digital signature; a first pre-computation unit, configured to pre-computation the first point value to obtain a first pre-computation result, wherein the first pre-computation result includes multiple first pre-computation point values, wherein each first pre-computation point value is equal to the result of performing an integer number of addition operations along the elliptic curve on the first point value according to the encoding method of the first scalar value, and different first pre-computation point values ​​correspond to different integer number of addition operations; and a second pre-computation unit, configured to pre-computation the second point value to obtain... A second pre-calculation result is obtained, which includes multiple second pre-calculation point values. Each second pre-calculation point value is equal to the result of performing an integer number of addition operations along the elliptic curve on the second point value according to the encoding method of the second scalar value. Different second pre-calculation point values ​​correspond to different integer number of addition operations. A conversion unit is used to perform coordinate transformation on the first pre-calculation point value and the second pre-calculation point value respectively, so that the Z coordinate of the third pre-calculation point value corresponding to the first pre-calculation point value after coordinate transformation is 1, and the Z coordinate of the fourth pre-calculation point value corresponding to the second pre-calculation point value after coordinate transformation is 1. A calculation unit is used to calculate the sum of the dot product result of the first scalar value and the first point value and the dot product result of the second scalar value and the second point value according to the third pre-calculation point value and the fourth pre-calculation point value to obtain a verification point value. A verification unit is used to determine the validity of the digital signature according to the verification point value.

[0016] According to a third aspect of the present disclosure, a digital signature chip is provided, the digital signature chip being used to perform the method as described in the first aspect or any possible implementation thereof.

[0017] According to a fourth aspect of the present disclosure, an electronic device is provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus; the memory is used to store a computer program; and the processor is used to execute the method described in the first aspect or any possible implementation thereof by running the computer program stored in the memory.

[0018] According to a fifth aspect of the present disclosure, a computer storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the method as described in the first aspect or any possible implementation thereof.

[0019] According to a sixth aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method as described in the first aspect or any possible implementation thereof.

[0020] According to the scheme of this embodiment, a first pre-calculation result including multiple first pre-calculated point values ​​is obtained by pre-calculating a first point value, and a second pre-calculation result including multiple second pre-calculated point values ​​is obtained by pre-calculating a second point value. Then, the first pre-calculated point value is converted into a third pre-calculated point value with a Z-coordinate of 1, and the second pre-calculated point value is converted into a fourth pre-calculated point value with a Z-coordinate of 1. After generating a first scalar value and a second scalar value based on the target data and the digital signature, the sum of the dot product of the first scalar value and the first point value and the dot product of the second scalar value and the second point value is calculated based on the third and fourth pre-calculated point values ​​to obtain a verification point value. The validity of the digital signature is then determined based on the verification point value. By pre-calculating the first and second point values ​​and performing coordinate transformation on them to obtain the third and fourth pre-calculated point values, the dot product result can be directly obtained from the third and fourth pre-calculated point values ​​during multi-dot product operations, eliminating the need to repeatedly perform the same dot product operation, thus improving computational efficiency. The third and fourth pre-calculated point values ​​are obtained through coordinate transformation. Since the Z coordinates of the third and fourth pre-calculated point values ​​are both equal to 1, the computational cost of point addition and doubling operations in subsequent multi-point multiplication operations is reduced, and the efficiency of multi-point multiplication operations is improved, thereby improving the efficiency of digital signature verification. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings.

[0022] Figure 1 This is a flowchart of a digital signature verification method according to an embodiment of this disclosure;

[0023] Figure 2 This is a flowchart of a verification point value calculation method according to an embodiment of this disclosure;

[0024] Figure 3 This is a schematic diagram of a digital signature verification device according to an embodiment of the present disclosure;

[0025] Figure 4 This is a schematic diagram of an electronic device according to an embodiment of the present disclosure. Detailed Implementation

[0026] To enable those skilled in the art to better understand the technical solutions in the embodiments of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art should fall within the protection scope of this disclosure.

[0027] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The singular forms “a,” “the,” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0028] It should be understood that although the terms first, second, third, etc., may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are used only to distinguish information of the same type from one another. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0029] To make the objectives, technical solutions, and advantages of this disclosure clearer, the embodiments of this disclosure will be described in further detail below with reference to the accompanying drawings.

[0030] Digital signature verification method

[0031] Figure 1 This is a flowchart of a digital signature verification method according to an embodiment of this disclosure. Figure 1 As shown, the digital signature verification method includes the following steps:

[0032] Step 101: Obtain the target data and its digital signature, and obtain the first point value and the second point value.

[0033] The target data and its digital signature are sent from the data sender to the data receiver. During the transmission of the target data from the data sender to the data receiver, the target data may be tampered with. Therefore, after receiving the target data and digital signature, the data receiver verifies the validity of the digital signature to determine whether the target data has been tampered with. The digital signature is generated based on the data sender's private key and the target data. The data sender's public key is generated based on the data sender's private key. The data sender provides its public key to the data receiver so that the data receiver can verify the validity of the digital signature from the data sender based on the data sender's public key. This disclosure does not limit the method of generating the digital signature; any suitable digital signature method can be used to generate the digital signature of the target data.

[0034] The point corresponding to the first value is the base point of the elliptic curve, and the point corresponding to the second value is a point on the elliptic curve that is different from the base point. The second value is the public key of the data sender. The elliptic curve is used by the data sender to generate a digital signature and by the data receiver to verify the digital signature. Unless otherwise stated, the elliptic curve described in the embodiments of this disclosure refers to the same elliptic curve.

[0035] Step 102: Generate the first scalar value and the second scalar value based on the target data and the digital signature.

[0036] Based on the target data and digital signature, a first scalar value and a second scalar value can be generated for subsequent multi-point multiplication operations.

[0037] In one example, the digital signature consists of two parts, r and s. z can be obtained by hashing the target data m, using the formula u = (zs). -1 The first scalar value u can be obtained by using the formula v = (rs mod n). -1 The modulo operation can be used to calculate the second scalar value v, where mod represents the modulo operation and n is the order of the elliptic curve.

[0038] Step 103: Perform a pre-calculation on the first point value to obtain the first pre-calculation result.

[0039] By pre-calculating the first point value, a first pre-calculation result including multiple first pre-calculated point values ​​can be obtained. The first pre-calculated point value is equal to the result of integer addition operations performed along the elliptic curve according to the encoding method of the first scalar value. Different first pre-calculated point values ​​correspond to different integer addition operations.

[0040] The first scalar value can be encoded using binary encoding, non-adjacent form (NAF) encoding, window encoding, etc., to resist side-channel attacks and error injection attacks during multi-point multiplication, thereby improving the security and computational efficiency of the multi-point multiplication process. Depending on the encoding method of the first scalar value, the number and form of the first pre-calculated point values ​​included in the first pre-calculated result can be different. For example, when encoding the first scalar value using NAF encoding, the first pre-processed result obtained by preprocessing the first point value P is {[1]P,[3]P,…,[2]P,[3]P,…,[3]P,[4]P,[5]P,[6]P,[7]P,[8]P,[9]P,

[10] P,

[11] P,

[12] P,

[13] P,

[14] P,

[15] P,

[16] P,

[17] P,

[18] P,[19 ... w-1 -1]P},[1]P is the result of adding the first point value P along the elliptic curve to the point at infinity, that is, [1]P=P,[3]P is the result of adding the first point value P along the elliptic curve twice, that is, [3]P=P+P+P,[2 w-1 -1]P is the result of w-1 addition operations performed along the elliptic curve on the first point value P. When encoding the first point value P using other encoding methods, the first preprocessing result may also include [2]P, [4]P…, [2]P. w-1 One or more of P.

[0041] In one example, when the first scalar value is encoded using NAF encoding and the first pre-computed point value is represented using Jacobian coordinates, the first point value P can be pre-computed using the pre-computation algorithm shown in the following pseudocode to obtain the first pre-computation result {[1]P,[3]P,…,[2]P,…,[3]P,…,[4]P,…,[5]P,…,[6]P,…,[7]P,…,[8]P,…,[9]P,…,

[10] P,…,

[11] P,…,

[20] P,…,

[12] P,…,[20 ... w-1 -1]P}, where, [1]P=P1, [3]P=P3, [2]P=P3, [3]P=P3, [4]P=P1, [5]P=P1, [6]P=P1, [7]P=P1, [8]P=P1, [9]P=P1,

[10] P=P1,

[11] P=P1,

[12] P=P1,

[13] P=P3, [14 w-1 -1]P=P2 w-1 -1 w is a parameter of the NAF encoding algorithm. JacobianDouble() represents the doubling operation in Jacobian coordinates, and JacobianAdd() represents the addition operation in Jacobian coordinates.

[0042] The pseudocode for the pre-computation algorithm NafPointsPre() is as follows:

[0043] “

[0044] P1 = P, P2 = Jacobian Double(P)

[0045] for i = 3 to 2 w-1 -1,step=2:

[0046] P i =JacobianAdd(P i-2 P2)

[0047] Return {P1,P3,…,P2} w-1 -1}

[0048] "

[0049] In one example, the pseudocode for the Jacobian Double() algorithm in Jacobian coordinates is as follows (P = (X1, Y1, Z1) is the input, [2] P = (X3, Y3, Z3) is the output):

[0050] “

[0051] A = Y1^2 mod p

[0052] B = 4 * x 1 * A mod p

[0053] C = 8 * A^2 mod p

[0054] D = 3 * X1^2 + a * Z1^4 mod p

[0055] E = 2 * B mod p

[0056] X3=D^2-E mod p

[0057] Y3=D*(B-X3)-C mod p

[0058] Z3 = 2 * Y1 * Z1 mod p

[0059] "

[0060] In one example, the pseudocode for the Jacobian coordinate point addition operation JacobianAdd() is as follows (P=(X1,Y1,Z1) and Q=(X2,Y2,Z2) are the inputs, and P+Q=(X3,Y3,Z3) is the output):

[0061] “

[0062] A = Z1^2 mod p

[0063] B = Z²^2 mod p

[0064] C = Z1 * A mod p

[0065] D = Z² * B mod p

[0066] E = X² * A mod p

[0067] F = Y² * C mod p

[0068] G = X1 * B mod p

[0069] H = Y1 * D mod p

[0070] I = EG mod p

[0071] J = FH mod p

[0072] K = I^2 mod p

[0073] L = K * I mod p

[0074] M = K * G mod p

[0075] N = H * L mod p

[0076] X3=J^2-(L+2M)mod p

[0077] Y3=J*(M-X3)-N mod p

[0078] Z3 = Z1 * Z2 * I mod p

[0079] "

[0080] The dot product operation will be used multiple times when calculating the dot product of the first scalar value and the first point value P. i The result of P is obtained by pre-calculating the first point value, resulting in a first pre-calculated result that includes multiple first pre-calculated point values. The first pre-calculated point value is the dot product operation. i The result of P can be directly used in subsequent calculations by retrieving the corresponding first pre-calculated point value from the first pre-calculated result, without having to repeatedly calculate the same dot product operation. i [P] improves computational efficiency.

[0081] Step 104: Perform a pre-calculation on the second point value to obtain the second pre-calculation result.

[0082] By pre-calculating the second point value, a second pre-calculation result including multiple second pre-calculated point values ​​can be obtained. The second pre-calculated point value is equal to the result of integer addition operations performed along the elliptic curve according to the encoding method of the second scalar value. Different second pre-calculated point values ​​correspond to different integer addition operations.

[0083] The encoding methods for the first and second scalar values ​​are the same. For details on the pre-calculation of the second point value, please refer to the description in step 103 above, which will not be repeated here.

[0084] The dot product operation will be used multiple times in subsequent calculations of the dot product of the second scalar value and the second point value Q. i The result of Q is obtained by pre-calculating the second point value to obtain a second pre-calculated result that includes multiple second pre-calculated point values. The second pre-calculated point values ​​are the dot product operation. i The result of Q can be directly used in subsequent calculations by retrieving the corresponding second pre-calculated point value from the second pre-calculated result, without having to repeatedly calculate the same dot product operation. i Q improves computational efficiency.

[0085] Step 105: Perform coordinate transformation on the first pre-calculated point value and the second pre-calculated point value respectively, so that the Z coordinate of the third pre-calculated point value corresponding to the first pre-calculated point value after coordinate transformation is 1, and the Z coordinate of the fourth pre-calculated point value corresponding to the second pre-calculated point value after coordinate transformation is 1.

[0086] The Z-coordinate of each first pre-calculated point value included in the first pre-calculated result is not equal to 1. The Z-coordinate of each second pre-calculated point value included in the second pre-calculated result is not equal to 1. The third pre-calculated point value can be obtained by performing coordinate transformation on the first pre-calculated point value. The fourth pre-calculated point value can be obtained by performing coordinate transformation on the second pre-calculated point value. The Z-coordinate of the third pre-calculated point value and the fourth pre-calculated point value are both equal to 1.

[0087] It should be noted that the first predicted point value and the second pre-calculated point value can be represented by Jacobian coordinates, Chudnovsky coordinates, or other projective coordinates.

[0088] Step 106: Based on the third and fourth pre-calculated point values, calculate the dot product of the first scalar value and the first point value, and sum the dot product of the second scalar value and the second point value to obtain the verification point value.

[0089] After obtaining the third and fourth pre-calculated point values, the first scalar value u and the first point value P can be multiplied by [u]P based on the third pre-calculated point value. The second scalar value v and the second point value Q can be multiplied by [v]Q based on the fourth pre-calculated point value. Then, [u]P + [v]Q is calculated to obtain the verification point value.

[0090] Step 107: Determine the validity of the digital signature based on the verification point value.

[0091] Based on the verification point value, r′ can be calculated. If r′ is the same as the r included in the digital signature, the digital signature is valid, and the target data has not been tampered with. If r′ is different from the r included in the digital signature, the digital signature is invalid, and the target data has been tampered with.

[0092] In one example, r′ can be calculated using the formula r′=x1mod n, where x1 is the X coordinate of the verification point, mod represents the modulo operation, and n is the order of the elliptic curve.

[0093] In this embodiment, a first pre-calculation result including multiple first pre-calculated point values ​​is obtained by pre-calculating the first point value, and a second pre-calculation result including multiple second pre-calculated point values ​​is obtained by pre-calculating the second point value. Then, the first pre-calculated point value is converted into a third pre-calculated point value with a Z-coordinate of 1, and the second pre-calculated point value is converted into a fourth pre-calculated point value with a Z-coordinate of 1. After generating a first scalar value and a second scalar value based on the target data and the digital signature, the sum of the dot product of the first scalar value and the first point value and the dot product of the second scalar value and the second point value is calculated based on the third and fourth pre-calculated point values ​​to obtain a verification point value. The validity of the digital signature is then determined based on the verification point value. By pre-calculating the first and second point values ​​and performing coordinate transformation on them to obtain the third and fourth pre-calculated point values, the dot product result can be directly obtained from the third and fourth pre-calculated point values ​​during multi-dot product operations, eliminating the need to repeatedly perform the same dot product operation, thus improving computational efficiency. The third and fourth pre-calculated point values ​​are obtained through coordinate transformation. Since the Z coordinates of the third and fourth pre-calculated point values ​​are both equal to 1, the computational cost of point addition and doubling operations in subsequent multi-point multiplication operations is reduced, and the efficiency of multi-point multiplication operations is improved, thereby improving the efficiency of digital signature verification.

[0094] In one possible implementation, when performing coordinate transformation on the first and second pre-calculated point values, a coordinate transformation algorithm can be used to process the first and second pre-calculated point values ​​respectively, to obtain a third pre-calculated point value corresponding to each first pre-calculated point value after coordinate transformation, and a fourth pre-calculated point value corresponding to each second pre-calculated point value after coordinate transformation. The coordinate transformation algorithm may include the following steps:

[0095] S11. Determine that A1 is the Z-coordinate of the first pre-calculated point value in the pre-calculation results, and determine A... i =(A i-1 ·Z i )mod p,Z iThe Z-coordinate of the i-th pre-calculated point value in the pre-calculation result is represented by i, which is an integer greater than 1 and less than or equal to n, n is the number of pre-calculated point values ​​in the pre-calculation result, mod represents the modulo operation, and p represents the preset prime number corresponding to the elliptic curve.

[0096] S12, Determine B n =(A n ) -1 mod p, and determine B i = (B i+1 ·Z i+1 ) mod p, where i is an integer greater than 0 and less than n;

[0097] S13. Determine C1 = B1, and determine C i = (B i ·A i-1 ) mod p, where i is an integer greater than 1 and less than or equal to n;

[0098] S14. Determine the point value corresponding to the i-th pre-calculated point value after coordinate transformation (X′). i ,Y i ′,1),X′ i =(X i ·T i )mod p,Y i ′=(Y i ·T′ i )mod p,T i =(C i ·C i )mod p,T′ i =(T i ·C i )mod p.

[0099] When performing coordinate transformation on the first pre-calculated point value using the above coordinate transformation algorithm, the input is {P1,P3,…,P…} j}={(X1,Y1,Z1),(X2,Y2,Z2),…,(X j ,Y j Z j )}, j=2 w-1 -1, the output is {P1',P3',…,P j '}={(X1',Y1',1),(X3',Y3',1),…,(X j ',Y j ',1)}.

[0100] When performing coordinate transformation on the second pre-calculated point value using the above coordinate transformation algorithm, the input is {Q1,Q3,…,Q}. j}={(X1,Y1,Z1),(X3,Y3,Z3),…,(X j ,Y j Z j )}, j=2 w-1 -1, the output is {Q1',Q3',…,Q j '}={(X1',Y1',1),(X3',Y3',1),…,(X j ',Y j ',1)}.

[0101] In one example, the pseudocode for the coordinate transformation algorithm PointsZ1New() is as follows:

[0102] “

[0103] {A1,A2,…,A j}={Z1,A1*Z2 mod p,…,A j-1 *Z j mod p}

[0104] Zinv = (A j ) -1 mod p

[0105] {B j B j-1 ,…,B1}={Zinv,B j *Z j mod p,…,B2*Z2 mod p}

[0106] {C1,C2,…,C j}={B1,B2*A1 mod p,…,B j *A j-1 mod p}

[0107] for i = 1 to j:

[0108] T i =C i *C i mod p,T i '=T i *C i mod p

[0109] X i =X i *T i mod p,Y i '=Y i *T i 'mod p

[0110] Returns {(X1',Y1',1),(X2',Y2',1),…,(X j ',Y j ',1)}

[0111] "

[0112] As can be seen from the pseudocode of the coordinate transformation algorithm above, by using a modular inverse operation, the Z coordinates of all the first pre-calculated point values ​​or the second pre-calculated point values ​​are converted to 1. The computational cost depends on j and is approximately 1I+3*jM+4(j+1)M, where I represents the computational cost of each modular inverse operation and M represents the computational cost of each modular multiplication operation.

[0113] In this embodiment of the disclosure, the first pre-calculated point value and the second pre-calculated point value are transformed by a coordinate transformation algorithm. After the coordinate transformation, the first pre-calculated point value is obtained as the corresponding third pre-calculated point value, and the second pre-calculated point value is obtained as the corresponding fourth pre-calculated point value. The Z coordinates of the third pre-calculated point value and the fourth pre-calculated point value are 1, thereby reducing the computational cost of point addition and point multiplication operations based on the third pre-calculated point value and the fourth pre-calculated point value.

[0114] In one possible implementation, Figure 2 A flowchart of a verification point value calculation method according to an embodiment of this disclosure is shown, as follows: Figure 2 As shown, the method for calculating verification point values ​​includes the following steps:

[0115] Step 201: Encode the first scalar value to obtain the first encoding result, which includes multiple encoded values.

[0116] The first scalar value can be encoded using binary encoding, non-adjacent form (NAF) encoding, window encoding, and other encoding methods to resist side-channel attacks and error injection attacks during multi-point multiplication, thereby improving the security and computational efficiency of the multi-point multiplication process.

[0117] In one example, for input (k, w), the pseudocode for the NAF encoding algorithm NAF() is as follows:

[0118]

[0119] Encoding the first scalar value using the NAF algorithm shown in the pseudocode above yields the first encoded result {u l-1 ,u l-2 The first encoding result includes each encoded value in the range [-2...]. w-1 +1,2 w-1The range is [-1], and the number of non-zero encoded values ​​is approximately l / (w+1). The probability of non-zero encoding in the first encoding result is 1 / (w+1).

[0120] Step 202: Encode the second scalar value to obtain a second encoding result, which includes multiple encoded values.

[0121] The second scalar value can be encoded using binary encoding, non-adjacent form (NAF) encoding, window encoding, etc., and the first and second scalar values ​​are encoded using the same encoding method.

[0122] In one example, the second scalar value is encoded based on the NAF algorithm shown in the pseudocode in step 201, and the second encoded result is {v}. l-1 ,v l-2 The second encoding result includes each encoded value in the range [-2, ..., v1, v0}. w-1 +1,2 w-1 The range is [-1], and the number of non-zero encoded values ​​is approximately l / (w+1). The probability of non-zero encoding in the first encoding result is 1 / (w+1).

[0123] Step 203: Perform a doubling operation on the (i-1)th result value to obtain the i-th variable value.

[0124] i is an integer greater than 0 and less than or equal to m, where m is the number of encoded values ​​included in the first encoding result. The number of encoded values ​​included in the first encoding result and the second encoding result are equal. The 0th result value (initial result value) is equal to the infinity point of the elliptic curve.

[0125] In one example, when the third and fourth pre-calculated point values ​​are represented by Jacobian coordinates, the (i-1)th result value can be doubled using the pseudocode of JacobianDouble() shown in step 103 above.

[0126] Step 204: Based on the value of the i-th variable and [u i P determines the i-th intermediate result value.

[0127] u i Representing the i-th encoded value in the first encoded result, [] represents the dot product operation, P represents the first dot value, [u i P is determined from multiple third pre-calculated point values. For the first preprocessing result {P1, P3, ..., P...} j After performing coordinate transformation on the first pre-calculated point values, the set of the third pre-calculated point values ​​obtained is {P1', P3', ..., P}. j '},[u iP is Pu i The first encoding result is {u}. l-1 ,u l-2 The first encoded value in the first encoded result is u, ..., u1, u0}. l-1 The second encoded value in the first encoded result is u l-2 The (l-1)th encoded value in the first encoding result is u1, and the lth encoded value in the first encoding result is u0.

[0128] During the calculation of the i-th intermediate result value, the i-th variable value and [u] are calculated. i To determine if P is equal, obtain the first judgment result and the first intermediate result. The first judgment result can indicate whether the value of the i-th variable is equal to [u]. i Whether P is equal. The first judgment result indicates whether the value of the i-th variable is equal to [u]. i When P is not equal, the first intermediate result is used to calculate the value of the i-th intermediate result. The first judgment result indicates that the value of the i-th variable is equal to [u]. i When P is equal, it will be based on [u] i ]P calculates the i-th intermediate result value.

[0129] It should be noted that in this embodiment, the first intermediate result and the first intermediate result are different. For any i in the range (0, m], when calculating the value of the i-th variable and [u i Whether P is equal or not, the corresponding first judgment result and first intermediate result will be obtained.

[0130] Step 205: Based on the i-th intermediate result value and [v] i Q determines the i-th result value.

[0131] v i The i-th encoded value in the second encoding result is represented by Q, and the second point value is represented by [v]. i Q is determined from multiple fourth pre-calculated point values. For the second preprocessing result {Q1, Q3, ..., Q...} j After performing coordinate transformation on the second pre-calculated point values, the set of fourth pre-calculated point values ​​obtained is {Q1', Q3', ..., Q}. j '},[v i Q is Qv i The second encoding result is {v}. l-1 ,v l-2 The first encoded value in the second encoding result is v, ..., v1, v0}. l-1 The second encoded value in the second encoding result is v l-2 The (l-1)th encoded value in the second encoding result is v1, and the lth encoded value in the second encoding result is v0.

[0132] During the calculation of the i-th result value, the i-th intermediate result value and [v] are calculated. i Whether Q is equal, obtain the second judgment result and the second intermediate result. The second judgment result can indicate the i-th intermediate result value and [v] i Are Q and [v] equal? ​​The second judgment result indicates the i-th intermediate result value and [v] i When Q is not equal, the second intermediate result is used to calculate the i-th result value. The second judgment result indicates the i-th intermediate result value and [v] i When Q and ] are equal, it will be based on [v i Q determines the i-th result value.

[0133] It should be noted that the second intermediate result and the second intermediate result value are different in this embodiment. For any i in the range (0, m], when calculating the i-th intermediate result value and [v i Whether Q is equal or not, a corresponding second judgment result and a second intermediate result will be obtained.

[0134] When i is less than m, after obtaining the i-th result value, execute i = i + 1, and then calculate the next result value through steps 203 to 205 above, until the m-th result value is obtained.

[0135] Step 206: Determine the m-th result value as the verification point value.

[0136] In this embodiment of the disclosure, during the process of calculating at least a portion of the i-th intermediate result value, it is determined that the i-th variable value is related to [u]. i To determine whether P is equal, during the calculation of at least part of the i-th result value, compare the i-th intermediate result value with [v]. i Checking whether Q is equal helps avoid calculation errors by verifying the equality of point values. Because [u i P is determined from multiple third pre-calculated point values, [v i Q is determined from multiple fourth pre-computation point values, and the Z coordinates of the third and fourth pre-computation point values ​​are both equal to 1. Compared with directly calculating the verification point value based on the first and second pre-computation point values, this reduces the number of modular multiplication operations in the process of judging whether the point values ​​are equal. Each judgment on whether the point values ​​are equal can reduce 4 modular multiplication operations, thereby reducing the computational cost of calculating the verification point value and improving the efficiency of verifying digital signatures.

[0137] In one possible implementation, step 204 is based on the value of the i-th variable and [u i When determining the i-th intermediate result value, P can do so based on u i Whether it equals 0 is determined by a corresponding method to determine the i-th intermediate result value. Specifically, in u i When = 0, the value of the i-th variable can be directly determined as the i-th intermediate result value.i When ≠0, the value of the i-th variable is used as the first input value of the equality comparison algorithm, and [u i ]P is used as the second input value of the equality comparison algorithm. The equality comparison algorithm is used to calculate the value of the i-th variable and [u i If P is equal, obtain the corresponding first judgment result and first intermediate result, and then determine the value of the i-th intermediate result based on the first judgment result and the first intermediate result.

[0138] In this embodiment of the disclosure, u i When u = 0, i This doesn't actually affect multi-point multiplication, so directly determining the value of the i-th variable as the i-th intermediate result value reduces unnecessary calculations and improves the efficiency of calculating the verification point value. In u i When u ≠ 0, i It will have a practical effect on multiplication operations, depending on the value of the i-th variable and [u i To determine whether P is equal, the corresponding algorithm is used to calculate the i-th intermediate result value to ensure that the calculation result is not incorrect.

[0139] In one possible implementation, step 205 is based on the i-th intermediate result value and [v] i When determining the i-th result value, Q can be based on v. i Whether it equals 0 is determined by a corresponding method to determine the i-th result value. Specifically, in v i When = 0, the i-th intermediate result value can be directly determined as the i-th result value, in v i When ≠0, the i-th intermediate result value is used as the first input value of the equality comparison algorithm, and [v i Q is used as the second input value of the equality comparison algorithm. The algorithm calculates the i-th intermediate result value and [v] i If Q is equal, obtain the corresponding second judgment result and second intermediate result, and then determine the i-th result value based on the second judgment result and the second intermediate result.

[0140] In this embodiment of the disclosure, v i When v = 0, i This doesn't actually affect multi-point multiplication, so directly determining the i-th intermediate result value as the i-th result value reduces unnecessary calculations and improves the efficiency of calculating verification point values. In v i When ≠0, v i This will have a practical effect on multiplication operations, based on the i-th intermediate result value and [v i To determine if Q is equal, the i-th result value is calculated using the corresponding algorithm to ensure that the calculation result is correct.

[0141] In one possible implementation, when determining the value of the i-th intermediate result based on the first judgment result and the first intermediate result, if the first judgment result indicates that the value of the i-th variable is consistent with [u... i If P is equal, then [u] i The result of the doubling operation of P is determined as the i-th intermediate result value. If the first judgment result indicates that the (i-1)-th result value is the same as [u], then... i If P is not equal, then according to the value of the i-th variable, [u i ] P and the first intermediate result, calculate the value of the i-th intermediate result.

[0142] In one example, in the case of [u] i When performing a doubling operation on [u], the pseudocode for the doubling operation JacobianDouble() shown in step 103 above can be used to perform the doubling operation on the [u]th ... i ]P performs a doubling operation.

[0143] In this embodiment of the disclosure, if the value of the i-th variable is the same as [u i If P is equal, then directly add [u] i The result of the doubling operation of P is determined as the i-th intermediate result value. If the i-th variable value is different from [u] i If P is not equal, then according to the value of the i-th variable, [u i ]P and the first intermediate result are used to calculate the value of the i-th intermediate result using a point-addition formula. Then, the value of the i-th variable is calculated using an equality comparison algorithm and compared with [u]. i In the process of determining whether P is equal, a first intermediate result is obtained. By temporarily storing the first intermediate result, the value of the i-th variable is compared with [u]. i When P is not equal, the first intermediate result is reused to calculate the i-th intermediate result value, which reduces the computational cost of calculating the i-th intermediate result value.

[0144] In one possible implementation, when determining the i-th result value based on the second judgment result and the second intermediate result, if the second judgment result indicates that the i-th intermediate result value is consistent with [v...] i If Q is equal, then [v] i The result of the doubling operation of Q is determined as the i-th result value. If the second judgment result indicates that the i-th intermediate result value is the same as [v], then... i If Q is not equal, then based on the i-th intermediate result value, [v i Q and the second intermediate result, calculate the i-th result value.

[0145] In one example, in the context of [Q] i When performing doubling operations on [v], the pseudocode for the doubling operation JacobianDouble() shown in step 103 above can be used to perform the doubling operation on the [v]th ... i Q is used for doubling operations.

[0146] In this embodiment of the disclosure, if the i-th intermediate result value is the same as [v i If Q is equal, then directly add [v] i The result of the doubling operation of Q is determined as the i-th result value. If the i-th intermediate result value is different from [v], then... i If Q is not equal, then based on the i-th intermediate result value, [v i Q and the second intermediate result are used to calculate the i-th result value using a point-addition formula. The i-th intermediate result value is then calculated using an equality comparison algorithm and compared with [v]. i During the process of checking if Q is equal, a second intermediate result is obtained. By temporarily storing the second intermediate result, the value of the i-th intermediate result is compared with [v]. i When Q is not equal, the second intermediate result is reused to calculate the i-th result value, which reduces the computational cost of calculating the i-th result value.

[0147] In one possible implementation, the equality judgment algorithm for determining whether two point values ​​are equal includes:

[0148] If (EG) mod p = 0 and (FH) mod p = 0, then the first and second input values ​​are determined to be equal. The first input value of the equality judgment algorithm is (X1, Y1, Z1), and the second input value of the equality judgment algorithm is (X2, Y2, Z2). E = (X2·A) mod p, F = (Y2·B) mod p, G = (X1·C) mod p, H = (Y1·D) mod p, A = (Z1·Z1) mod p, B = (A·Z1) mod p, C = (Z2·Z2) mod p, D = (C·Z2) mod p. E, F, G, and H are intermediate results, and p represents the preset prime number corresponding to the elliptic curve.

[0149] The input to the equality comparison algorithm is point values ​​P1 and P2, where P1 = (X1, Y1, Z1) and P2 = (X2, Y2, Z2). The output of the equality comparison algorithm is {True / False, (E, F, G, H)}, where True / False is the comparison result, True indicates that P1 and P2 are equal, False indicates that P1 and P2 are not equal, and (E, F, G, H) is an intermediate result.

[0150] In one example, the pseudocode for the equality comparison algorithm PointsEqualNew(P1,P2) is as follows:

[0151] “

[0152] A = Z1 * Z1 mod p,

[0153] B = A * Z1 mod p,

[0154] C = Z² * Z² mod p,

[0155] D = C * Z² mod p,

[0156] E = X² * A mod p,

[0157] F = Y² * B mod p,

[0158] G = X1 * C mod p,

[0159] H = Y1 * D mod p,

[0160] If (E–G)mod p==0 and (F–H)mod p==0,

[0161] Returns True, (E, F, G, H)

[0162] Else:

[0163] Returns False, (E, F, G, H)

[0164] "

[0165] The equality comparison algorithm PointsEqualNew(P1,P2) is used to calculate the value of the i-th variable and [u i When P and P are equal, P1 is the value of the i-th variable, and P2 is [u i ]P. If the value of the i-th variable is the same as [u i If the values ​​of the i-th variable and [u] are equal, then the first judgment result is True, and the first intermediate result is (E, F, G, H). i If P are not equal, the first judgment result is False, and the first intermediate result is (E,F,G,H).

[0166] The i-th intermediate result value is calculated using the equality comparison algorithm PointsEqualNew(P1,P2) and [v i When Q is equal, P1 is the i-th intermediate result value, and P2 is [v i Q. If the i-th intermediate result value is the same as [v] i If [v] is equal to Q, then the second judgment result is True, and the second intermediate result is (E, F, G, H). If the i-th intermediate result value is equal to [v], then the second judgment result is True, and the second intermediate result is (E, F, G, H). i If Q are not equal, the second judgment result is False, and the second intermediate result is (E,F,G,H).

[0167] In this embodiment of the disclosure, by using the above-described equality judgment algorithm, while judging whether two point values ​​are equal, an intermediate result can be obtained. The intermediate result can be reused to calculate the i-th intermediate result value or the i-th result value, thereby saving the computational overhead of calculating the i-th intermediate result value and the i-th result value, and improving the verification efficiency of digital signature.

[0168] In one possible implementation, based on the value of the i-th variable, [u i When calculating the i-th intermediate result value using P and the first intermediate result, the i-th variable value can be used as the first input to the target algorithm, and [u] i P is used as the second input to the target algorithm, and the first intermediate result is used as the third input to the target algorithm. The target algorithm then calculates the i-th intermediate result value. Based on the i-th intermediate result value, [v i When calculating the i-th result value using Q and the second intermediate result, the i-th intermediate result value can be used as the first input to the target algorithm, and [v] i Q is used as the second input to the target algorithm, and the second intermediate result is used as the third input to the target algorithm. The target algorithm is then used to calculate the i-th result value.

[0169] The output of the target algorithm is (X5, Y5, Z5), the first input of the target algorithm is (X3, Y3, Z3), the second input of the target algorithm is (X4, Y4, Z4), and the third input of the target algorithm is (E, F, G, H). X5 = J 2 -(L+2M)mod p, Y5=J·(M-X5)-Nmod p, Z5=(Z3·Z4·I)mod p, I=(EG)mod p, J=(FH)mod p, K=I 2 mod p, L = (K·I)mod p, M = (K·G)mod p, N = (H·L)mod p, where p represents the predefined prime number corresponding to the elliptic curve.

[0170] The target algorithm can be a point addition operation in Jacobian coordinates, and it can reuse the intermediate results of the equality comparison algorithm. In one example, the inputs to the target algorithm are P = (X1, Y1, Z1), Q = (X2, Y2, Z2), and (E, F, G, H), where (E, F, G, H) are the intermediate results of the equality comparison algorithm. The output of the target algorithm is (X3, Y3, Z3). The pseudocode for the target algorithm JacobianAddNew(P, Q, (E, F, G, H)) is as follows:

[0171] “

[0172] I = (EG) mod p

[0173] J = (FH) mod p

[0174] K = I^2 mod p

[0175] L = K * I mod p

[0176] M = K * G mod p

[0177] N = H * L mod p

[0178] X3=J^2-(L+2M)mod p

[0179] Y3=J*(M-X3)-N mod p

[0180] Z3 = Z1 * Z2 * I mod p

[0181] "

[0182] When calculating the i-th intermediate result value using the target algorithm JacobianAddNew(P,Q,(E,F,G,H)), P is the i-th variable value, and Q is [u i P, (E,F,G,H) is the first intermediate result. At this time, the output (X3,Y3,Z3) of the target algorithm JacobianAddNew(P,Q,(E,F,G,H)) is the i-th intermediate result value.

[0183] When calculating the i-th result value using the target algorithm JacobianAddNew(P,Q,(E,F,G,H)), P is the i-th intermediate result value, and Q is [v i Q, (E,F,G,H) are the second intermediate results. At this time, the output (X3,Y3,Z3) of the target algorithm JacobianAddNew(P,Q,(E,F,G,H)) is the i-th result value.

[0184] In this embodiment of the disclosure, during the process of calculating whether two point values ​​are equal, the intermediate results (E, F, G, H) are retained by the equality judgment algorithm. When the target algorithm calculates the i-th intermediate result value or the i-th result value, the target algorithm can reuse the intermediate results (E, F, G, H), which reduces the modular multiplication operation in the process of calculating the i-th intermediate result value and the i-th result value, thereby reducing the calculation cost of the i-th intermediate result value and the i-th result value and improving the verification efficiency of digital signature.

[0185] In one possible implementation, combining the foregoing embodiments, and assuming that the first and second scalar values ​​are NAF encoded and each point value is represented by Jacobian coordinates, the pseudocode for the multi-point multiplication algorithm for calculating the verification point value after obtaining the target data, the digital signature of the target data, and the first and second point values ​​is as follows. For ease of subsequent comparison and explanation, this multi-point multiplication operation is defined as the first multi-point multiplication operation. The inputs to the first multi-point multiplication operation are u, v, P, Q, and w, where u is the first scalar value, v is the second scalar value, P is the first point value, Q is the second point value, and w is a preset parameter. The output of the first multi-point multiplication operation is [u]P + [v]Q, that is, the verification point value is [u]P + [v]Q.

[0186] The pseudocode for the first multi-dot multiplication operation is as follows:

[0187]

[0188] In the pseudocode for the first multi-point multiplication operation described above, NAF() is the NAF encoding algorithm in the aforementioned embodiment, NafPointsPre() is the pre-computation algorithm in the aforementioned embodiment, PointsZ1New() is the coordinate transformation algorithm in the aforementioned embodiment, JacobianDouble() is the doubling point operation algorithm in the aforementioned embodiment, PointsEqualNew() is the equality judgment algorithm in the aforementioned embodiment, JacobianAddNew() is the target algorithm (point addition operation) in the aforementioned embodiment, and the finally returned R is the verification point value.

[0189] In this embodiment, NAF encoding is used to encode the first and second scalar values, which is less vulnerable to side-channel attacks and reduces the number of point addition operations, improving the performance of multi-point multiplication. The coordinate transformation algorithm PointsZ1New() is used to transform the coordinates of the first and second pre-calculated point values, making the Z-coordinates of the obtained third and fourth pre-calculated point values ​​1. This reduces the computational cost of point addition and doubling operations and decreases the number of modular multiplication operations in the equality comparison algorithm PointsEqualNew(). The target algorithm JacobianAddNew() reuses the intermediate results of the equality comparison algorithm PointsEqualNew(), further reducing the computational overhead of point addition operations.

[0190] In one possible implementation, assuming the first and second scalar values ​​are binary encoded and each point value is represented using Jacobian coordinates, the pseudocode for the multi-point multiplication algorithm after obtaining the target data, its digital signature, and the first and second point values ​​is as follows. For ease of subsequent comparison, this multi-point multiplication operation is defined as the second multi-point multiplication operation. The input to the second multi-point multiplication operation is u = {u...} l-1 ,ul-2 ,…,u1,u0}2、v={v l-1 ,v l-2 ,…,v1,v0}2、P and Q, where u is the first scalar value, {u l-1 ,u l-2 {v, ..., u1, u0}2 represents the first scalar value after binary encoding, v represents the second scalar value, and {v} l-1 ,v l-2 ,…,v1,v0}2 is the second scalar value after binary encoding, P is the first point value, P=(X1,Y1,Z1), Q is the second point value, Q=(X2,Y2,Z2), and Z1 and Z2 are not equal to 1. The output of the second multi-point multiplication operation is [u]P+[v]Q, that is, the verification point value is [u]P+[v]Q.

[0191] The pseudocode for the second multi-dot multiplication operation is as follows:

[0192]

[0193]

[0194] In the pseudocode for the second multi-dot multiplication operation mentioned above, the inputs to the dot addition operation JacobianAdd() are P = (X1, Y1, Z1) and Q = (X2, Y2, Z2), and the output is P + Q = (X3, Y3, Z3), where p is a prime number. The pseudocode for the dot addition operation JacobianAdd() is as follows:

[0195] “

[0196] A = Z1^2 mod p

[0197] B = Z²^2 mod p

[0198] C = Z1 * A mod p

[0199] D = Z² * B mod p

[0200] E = X² * A mod p

[0201] F = Y² * C mod p

[0202] G = X1 * B mod p

[0203] H = Y1 * D mod p

[0204] I = EG mod p

[0205] J = FH mod p

[0206] K = I^2 mod p

[0207] L = K * I mod p

[0208] M = K * G mod p

[0209] N = H * L mod p

[0210] X3=J^2-(L+2M)mod p

[0211] Y3=J*(M-X3)-N mod p

[0212] Z3 = Z1 * Z2 * I mod p

[0213] "

[0214] In the pseudocode for the second multi-dot operation mentioned above, the input of the doubling operation JacobianDouble() is P = (X1, Y1, Z1), and the output is [2] P = (X3, Y3, Z3). The pseudocode for the doubling operation JacobianDouble() is as follows:

[0215] “

[0216] A = Y1^2 mod p

[0217] B = 4 * x 1 * A mod p

[0218] C = 8 * A^2 mod p

[0219] D = 3 * X1^2 + a * Z1^4 mod p

[0220] E = 2 * B mod p

[0221] X3=D^2-E mod p

[0222] Y3=D*(B-X3)-C mod p

[0223] Z3 = 2 * Y1 * Z1 mod p

[0224] "

[0225] In the pseudocode for the second multi-dot multiplication operation described above, the equality comparison algorithm PointsEqual() takes P1 = (X1, Y1, Z1) and P2 = (X2, Y2, Z2) as input and outputs True or False. The pseudocode for PointsEqual() is as follows:

[0226] “

[0227] A = Z1 * Z1 mod p,

[0228] B = A * Z1 mod p,

[0229] C = Z² * Z² mod p,

[0230] D = C * Z² mod p,

[0231] E = X² * A mod p,

[0232] F = Y² * B mod p,

[0233] G = X1 * C mod p,

[0234] H = Y1 * D mod p,

[0235] If(EG)mod p==0 and (FH)mod p==0,

[0236] Return True

[0237] Else:

[0238] Return False

[0239] "

[0240] In one possible implementation, assuming the first and second scalar values ​​are NAF encoded and each point value is represented using Jacobian coordinates, the pseudocode for another multi-point multiplication algorithm to calculate the verification point value after obtaining the target data, the digital signature of the target data, and the first and second point values ​​is as follows. For ease of subsequent comparison and explanation, this multi-point multiplication operation is defined as the third multi-point multiplication operation. The inputs to the third multi-point multiplication operation are u, v, P, Q, and w, where u is the first scalar value, v is the second scalar value, P is the first point value, Q is the second point value, and w is a preset parameter. The output of the third multi-point multiplication operation is [u]P + [v]Q, that is, the verification point value is [u]P + [v]Q.

[0241] The pseudocode for the third multi-dot multiplication operation is as follows:

[0242]

[0243]

[0244] In the pseudocode for the third multi-dot multiplication operation described above, NAF() is the NAF encoding algorithm in the aforementioned embodiment, NafPointsPre() is the pre-computation algorithm in the aforementioned embodiment, JacobianDouble() is the doubling-dot operation algorithm in the aforementioned embodiment, PointsEqual() is the equality judgment algorithm PointsEqual() in the aforementioned embodiment, and JacobianAdd() is the dot addition operation JacobianAdd() in the aforementioned embodiment.

[0245] The following section analyzes the performance of the first, second, and third multi-point multiplication operations using pseudocode, with the example that the Z coordinates of the first point value P and the second point value Q are both not equal to 1.

[0246] Table 3 below shows a performance comparison of the first, second, and third multi-point multiplication operations. As can be seen from Table 3, the pre-computation algorithm in the first multi-point multiplication operation performs worse than the second and third multi-point multiplication operations. Furthermore, the larger the value of w, the worse the performance of the pre-computation algorithm in the first multi-point multiplication operation. However, in terms of equality comparison algorithms and dot addition operations, the first multi-point multiplication operation performs better than the second and third multi-point multiplication operations. Moreover, as the value of w increases, the performance of the first multi-point multiplication operation improves, and this improvement can compensate for the performance loss in the pre-computation algorithm.

[0247] Table 3

[0248]

[0249] In Table 3 above, I represents the computational cost of each modular inverse operation, M represents the computational cost of each modular multiplication operation, and A represents the computational cost of each modular addition operation.

[0250] Assuming a modular inverse operation is equivalent to 384 modular multiplication operations, taking l=256 as an example, Table 4 below lists the performance of the first, second, and third multi-point multiplication operations under different w values, where only the number of modular multiplication operations is counted. Table 4 also summarizes the number of modular multiplications and the storage space for pre-computed points (excluding points P and Q) required for multi-point multiplication operations on a 256-bit elliptic curve under different w values.

[0251] Table 4

[0252]

[0253]

[0254] As shown in Table 4 above, in terms of storage space, the first multi-point multiplication operation requires the same amount of storage resources as the third multi-point multiplication operation. Regarding performance, the performance of the first multi-point multiplication operation improves with increasing w value. However, when w = 4 / 5 / 6, the performance difference of the first multi-point multiplication operation is relatively small. In embedded systems, considering storage resource limitations, a smaller w value requires less storage resources. In summary, for 256-bit elliptic curves, when w = 4, the first multi-point multiplication operation offers a significant performance improvement while consuming less storage resources.

[0255] It should be noted that the pseudocode provided in the embodiments of this disclosure is only an example and is not intended to limit the embodiments of this disclosure in any way.

[0256] In one possible implementation, the equality judgment algorithm PointsEqualNew() and the target algorithm JacobianAddNew() in the aforementioned embodiments can be used not only for multi-point multiplication based on NAF encoding (encoding the first and second scalar values ​​using NAF encoding), but also for multi-point multiplication based on binary encoding (encoding the first and second scalar values ​​using binary encoding), thereby improving the performance of multi-point multiplication based on binary encoding.

[0257] In one possible implementation, the coordinate transformation algorithm PointsZ1New(), the equality judgment algorithm PointsEqualNew(), and the target algorithm JacobianAddNew() in the aforementioned embodiments can be used not only for multi-point multiplication operations based on NAF encoding (encoding the first and second scalar values ​​using NAF encoding), but also for multi-point multiplication operations based on Window encoding (encoding the first and second scalar values ​​using Window encoding), thereby improving the performance of multi-point multiplication operations based on Window encoding.

[0258] It should be noted that point values ​​can be represented using Jacobian coordinates, Chudnovsky coordinates, or other projective coordinates. The Jacobian coordinates of a point value are represented as (X, Y, Z), where X = x * Z^2, Y = y * Z^3, and Z is an auxiliary parameter. The coordinate transformation algorithm PointsZ1New(), the equality comparison algorithm PointsEqualNew(), and the target algorithm JacobianAddNew() are applicable not only to Jacobian coordinates but also to other projective coordinates. The other projective coordinates of a point are represented as (X, Y, Z), where X = x * Z^c, Y = y * Z^d, and Z is an auxiliary parameter. Jacobian coordinates are a type of projective coordinate, specifically when c = 2 and d = 3. The coordinate transformation algorithm PointsZ1New(), the equality judgment algorithm PointsEqualNew(), and the target algorithm JacobianAddNew() are also applicable to Chudnovsky coordinates. The Chudnovsky coordinates of a point value are represented as X, Y, Z, Z^2, Z^3, where X = x * Z^2, Y = y * Z^2, and Z is an auxiliary parameter. Chudnovsky coordinates are an extension of Jacobian coordinates.

[0259] Digital signature verification device

[0260] Figure 3 A schematic diagram of a digital signature verification apparatus according to an embodiment of this disclosure is shown. Figure 3 As shown, the digital signature verification device 300 includes:

[0261] The acquisition unit 301 is used to acquire target data and the digital signature of the target data, and to acquire a first point value and a second point value. The point corresponding to the first point value is the base point of the elliptic curve, and the second point value is the public key. The point corresponding to the second point value is a point on the elliptic curve that is different from the base point.

[0262] The generation unit 302 is used to generate a first scalar value and a second scalar value based on the target data and the digital signature;

[0263] The first pre-calculation unit 303 is used to pre-calculate the first point value and obtain the first pre-calculation result. The first pre-calculation result includes multiple first pre-calculation point values. The first pre-calculation point value is equal to the result of performing an integer number of addition operations along the elliptic curve on the first point value according to the encoding method of the first scalar value. Different first pre-calculation point values ​​correspond to different integer number of addition operations.

[0264] The second pre-calculation unit 304 is used to pre-calculate the second point value and obtain the second pre-calculation result. The second pre-calculation result includes multiple second pre-calculation point values. The second pre-calculation point value is equal to the result of performing an integer number of addition operations along the elliptic curve according to the encoding method of the second scalar value. Different second pre-calculation point values ​​correspond to different integer number of addition operations.

[0265] The transformation unit 305 is used to perform coordinate transformation on the first pre-calculated point value and the second pre-calculated point value respectively, so that the Z coordinate of the third pre-calculated point value corresponding to the first pre-calculated point value after coordinate transformation is 1, and the Z coordinate of the fourth pre-calculated point value corresponding to the second pre-calculated point value after coordinate transformation is 1.

[0266] The calculation unit 306 is used to calculate the dot product of the first scalar value and the first point value based on the third pre-calculated point value and the fourth pre-calculated point value, and to sum the dot product of the second scalar value and the second point value to obtain the verification point value;

[0267] Verification unit 307 is used to determine the validity of a digital signature based on the verification point value.

[0268] In this embodiment of the disclosure, after the acquisition unit 301 acquires the target data, digital signature, first point value, and second point value, the generation unit 302 generates a first scalar value and a second scalar value based on the target data and digital signature. The first pre-calculation unit 303 pre-calculates the first point value to obtain a first pre-calculation result including multiple first pre-calculated point values. The second pre-calculation unit 304 pre-calculates the second point value to obtain a second pre-calculation result including multiple second pre-calculated point values. The conversion unit 305 converts the first pre-calculated point value into a third pre-calculated point value with a Z-coordinate of 1 and converts the second pre-calculated point value into a fourth pre-calculated point value with a Z-coordinate of 1. Then, the calculation unit 306 calculates the sum of the dot product of the first scalar value and the first point value and the dot product of the second scalar value and the second point value based on the third and fourth pre-calculated point values ​​to obtain the verification point value. Then, the verification unit 307 determines the validity of the digital signature based on the verification point value. By pre-calculating the first and second point values ​​and then performing coordinate transformation on these pre-calculated point values, third and fourth pre-calculated point values ​​are obtained. During multi-point multiplication operations, the result can be directly obtained from these third and fourth pre-calculated point values, eliminating the need to repeatedly perform the same multiplication operation, thus improving computational efficiency. Furthermore, obtaining the third and fourth pre-calculated point values ​​through coordinate transformation, since their Z-coordinates are both equal to 1, reduces the computational cost of point addition and doubling operations in subsequent multi-point multiplication operations, thereby improving the efficiency of multi-point multiplication operations and ultimately enhancing the efficiency of digital signature verification.

[0269] In an embedded system, the digital signature verification device 300 in this embodiment of the present disclosure can be deployed in a coprocessor, and the central processing unit (CPU) schedules the coprocessor to enable the digital signature verification device 300 to complete digital signature verification.

[0270] It should be noted that the digital signature verification device 300 provided in this disclosure is based on the same inventive concept as the digital signature verification method provided in the foregoing embodiments, corresponds to the corresponding digital signature verification method in the foregoing multiple method embodiments, and has the beneficial effects of the corresponding digital signature verification method embodiments. Therefore, it will not be described again here. In addition, the implementation of each unit in the digital signature verification device 300 provided in this disclosure can refer to the description of the corresponding part in the foregoing digital signature verification method embodiments, and it will not be described again here.

[0271] Digital signature chip

[0272] This disclosure provides a digital signature chip that can be used to perform the digital signature verification method in any of the above embodiments.

[0273] electronic devices

[0274] Figure 4 This is a schematic block diagram of an electronic device provided in an embodiment of this disclosure. Specific embodiments of this disclosure do not limit the specific implementation of the electronic device. Figure 4 As shown, the electronic device may include: a processor 402, a communications interface 404, a memory 406, and a communication bus 408. Wherein:

[0275] The processor 402, communication interface 404, and memory 406 communicate with each other via communication bus 408.

[0276] Communication interface 404 is used to communicate with other electronic devices or servers.

[0277] The processor 402 is used to execute program 410, which can specifically execute the relevant steps in any of the aforementioned digital signature verification method embodiments.

[0278] Specifically, program 410 may include program code that includes computer operation instructions.

[0279] Processor 402 may be a CPU, an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement embodiments of this disclosure. The smart device may include one or more processors of the same type, such as one or more CPUs; or it may include processors of different types, such as one or more CPUs and one or more ASICs.

[0280] RISC-V is an open-source instruction set architecture based on the Reduced Instruction Set Computing (RISC) principle. It can be applied to various aspects of microcontrollers and FPGA chips, specifically in areas such as IoT security, industrial control, mobile phones, and personal computers. Because its design considers small size, speed, and low power consumption, it is particularly suitable for modern computing devices such as warehouse-scale cloud computers, high-end mobile phones, and tiny embedded systems. With the rise of AIoT (Artificial Intelligence of Things), the RISC-V instruction set architecture is receiving increasing attention and support and is expected to become the next generation of widely used CPU architecture.

[0281] The computer operation instructions in this embodiment can be computer operation instructions based on the RISC-V instruction set architecture. Correspondingly, the processor 402 can be designed based on the RISC-V instruction set. Specifically, the processor chip in the electronic device provided in this embodiment can be a chip designed using the RISC-V instruction set. This chip can execute executable code based on the configured instructions, thereby implementing the digital signature verification method in the above embodiments.

[0282] Memory 406 is used to store program 410. Memory 406 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0283] Specifically, program 410 can be used to cause processor 402 to execute the digital signature verification method in any of the foregoing embodiments.

[0284] The specific implementation of each step in procedure 410 can be found in the corresponding steps and modules described in any of the aforementioned digital signature verification method embodiments, and will not be repeated here. Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the devices and modules described above can be referred to the corresponding process descriptions in the aforementioned method embodiments, and will not be repeated here.

[0285] The electronic device of this disclosure pre-calculates a first point value to obtain a first pre-calculation result including multiple first pre-calculated point values, and pre-calculates a second point value to obtain a second pre-calculation result including multiple second pre-calculated point values. Then, the first pre-calculated point value is converted into a third pre-calculated point value with a Z-coordinate of 1, and the second pre-calculated point value is converted into a fourth pre-calculated point value with a Z-coordinate of 1. After generating a first scalar value and a second scalar value based on the target data and the digital signature, the sum of the dot product of the first scalar value and the first point value and the dot product of the second scalar value and the second point value is calculated based on the third and fourth pre-calculated point values ​​to obtain a verification point value. The validity of the digital signature is then determined based on the verification point value. By pre-calculating the first and second point values ​​and performing coordinate transformation on them to obtain the third and fourth pre-calculated point values, the dot product result can be directly obtained from the third and fourth pre-calculated point values ​​during multi-dot product operations, eliminating the need to repeatedly perform the same dot product operation, thus improving computational efficiency. The third and fourth pre-calculated point values ​​are obtained through coordinate transformation. Since the Z coordinates of the third and fourth pre-calculated point values ​​are both equal to 1, the computational cost of point addition and doubling operations in subsequent multi-point multiplication operations is reduced, and the efficiency of multi-point multiplication operations is improved, thereby improving the efficiency of digital signature verification.

[0286] Computer storage media

[0287] This disclosure also provides a computer-readable storage medium storing instructions for causing a machine to perform the digital signature verification method as described herein. Specifically, a system or apparatus equipped with a storage medium storing software program code that implements the functions of any of the embodiments described above, and enabling the computer (or CPU or MPU) of the system or apparatus to read and execute the program code stored in the storage medium.

[0288] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute a part of this disclosure.

[0289] Examples of storage media used to provide program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0290] Computer program products

[0291] This disclosure also provides a computer program product, including computer instructions that instruct a computing device to perform any corresponding operation in the above-described plurality of method embodiments.

[0292] It should be noted that, depending on the implementation needs, the various components / steps described in the embodiments of this disclosure can be broken down into more components / steps, or two or more components / steps or parts of the operation of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of this disclosure.

[0293] The methods described above according to embodiments of this disclosure can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code originally stored on a remote recording medium or a non-transitory machine-readable medium and subsequently stored on a local recording medium, downloaded over a network. Thus, the methods described herein can be processed by software stored on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA). It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) capable of storing or receiving software or computer code that, when accessed and executed by the computer, processor, or hardware, implements the methods described herein. Furthermore, when a general-purpose computer accesses code used to implement the methods shown herein, the execution of the code transforms the general-purpose computer into a dedicated computer for executing the methods shown herein.

[0294] It should be noted that the user-related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to sample data used for training the model, data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0295] Those skilled in the art will recognize that the units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for specific applications, but such implementations should not be considered beyond the scope of the embodiments disclosed herein.

[0296] The above embodiments are only used to illustrate the embodiments of this disclosure, and are not intended to limit the embodiments of this disclosure. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the embodiments of this disclosure. Therefore, all equivalent technical solutions also fall within the scope of the embodiments of this disclosure, and the patent protection scope of the embodiments of this disclosure should be defined by the claims.

Claims

1. A digital signature verification method, characterized in that, include: Obtain target data and its digital signature, and obtain a first point value and a second point value. The point corresponding to the first point value is the base point of the elliptic curve, the second point value is the public key, and the point corresponding to the second point value is a point on the elliptic curve that is different from the base point. Based on the target data and the digital signature, generate a first scalar value and a second scalar value; The first point value is pre-calculated to obtain a first pre-calculation result. The first pre-calculation result includes multiple first pre-calculated point values. Each first pre-calculated point value is equal to the result of performing an integer number of addition operations along the elliptic curve on the first point value according to the encoding method of the first scalar value. Different first pre-calculated point values ​​correspond to different integer number of addition operations. The second point value is pre-calculated to obtain a second pre-calculation result. The second pre-calculation result includes multiple second pre-calculated point values. The second pre-calculated point value is equal to the result of performing an integer number of addition operations along the elliptic curve on the second point value according to the encoding method of the second scalar value. Different second pre-calculated point values ​​correspond to different integer number of addition operations. The first pre-calculated point value and the second pre-calculated point value are respectively subjected to coordinate transformation, so that the Z coordinate of the third pre-calculated point value corresponding to the first pre-calculated point value after coordinate transformation is 1, and the Z coordinate of the fourth pre-calculated point value corresponding to the second pre-calculated point value after coordinate transformation is 1; Based on the third pre-calculated point value and the fourth pre-calculated point value, calculate the dot product of the first scalar value and the first point value, and sum the dot product of the second scalar value and the second point value to obtain the verification point value; The validity of the digital signature is determined based on the verification point value.

2. The method according to claim 1, characterized in that, The coordinate transformation of the first pre-calculated point value and the second pre-calculated point value includes: The first pre-calculation result is processed by a coordinate transformation algorithm to obtain the third pre-calculation point value corresponding to each first pre-calculation point value after coordinate transformation; The second pre-calculation result is processed by the coordinate transformation algorithm to obtain the fourth pre-calculation point value corresponding to each second pre-calculation point value after coordinate transformation; The coordinate transformation algorithm includes: Determine A1 as the Z-coordinate of the first pre-calculated point value in the pre-calculation results, and determine A. i =(A i-1 ·Z i )mod p,Z i The Z-coordinate of the i-th pre-calculated point value in the pre-calculation result is represented by i, which is an integer greater than 1 and less than or equal to n, n is the number of pre-calculated point values ​​in the pre-calculation result, mod represents the modulo operation, and p represents the preset prime number corresponding to the elliptic curve. Determine B n =(A n ) -1 mod p, and determine B i = (B i+1 ·Z i+1 ) mod p, where i is an integer greater than 0 and less than n; Determine C1 = B1, and determine C i = (B i ·A i-1 ) mod p, where i is an integer greater than 1 and less than or equal to n; The point value corresponding to the i-th pre-calculated point value after coordinate transformation is (X′). i ,Y i ′,1),X′ i =(X i ·T u )mod p,Y i ′=(Y i ·T′ i )mod p,T i =(C i ·C i )mod p,T′ i =(T i ·C i )mod p.

3. The method according to claim 1, characterized in that, The step of determining the sum of the dot product of the first scalar value and the first point value and the dot product of the second scalar value and the second point value based on the third pre-calculated point value and the fourth pre-calculated point value to obtain the verification point value includes: Encode the first scalar value to obtain a first encoding result, the first encoding result including multiple encoded values; The second scalar value is encoded to obtain a second encoding result, which includes multiple encoded values. Perform a doubling operation on the (i-1)th result value to obtain the i-th variable value, where i is an integer greater than 0 and less than or equal to m, m is the number of encoded values ​​included in the first encoding result, the number of encoded values ​​included in the first encoding result and the second encoding result are equal, and the 0th result value is equal to the infinity point of the elliptic curve. Based on the value of the i-th variable and [u i ]P determines the i-th intermediate result value, wherein, in the process of calculating at least part of the i-th intermediate result value, the i-th variable value is calculated and [u i Whether P is equal, obtain a first judgment result and a first intermediate result, and in the first judgment result, indicate that the value of the i-th variable is equal to [u]. i When P is not equal, the first intermediate result is used to calculate the value of the i-th intermediate result; i [] represents the i-th encoded value in the first encoding result, [] represents the dot product operation, P represents the first dot value, [u i P is determined from multiple third pre-calculated point values; Based on the i-th intermediate result value and [v i Q determines the i-th result value, wherein, in the process of calculating at least part of the i-th result value, the i-th intermediate result value is calculated and [v i Whether Q is equal, obtain a second judgment result and a second intermediate result, where the second judgment result indicates that the i-th intermediate result value is equal to [v]. i When Q is not equal, the second intermediate result is used to calculate the i-th result value; v i Q represents the i-th encoded value in the second encoding result, and Q represents the second point value. i Q is determined from multiple fourth pre-calculated point values; The m-th result value is determined as the verification point value.

4. The method according to claim 3, characterized in that, The statement based on the value of the i-th variable and [u] i P determines the i-th intermediate result value, including: If u i If the value is 0, then the intermediate result value of the i-th variable is determined to be equal to the value of the i-th variable. If u i If ≠0, then the value of the i-th variable is used as the first input value of the equality judgment algorithm, and [u i ]P is used as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the value of the i-th variable and [u i Determine whether P is equal, obtain the first judgment result and the first intermediate result, and determine the value of the i-th intermediate result based on the first judgment result and the first intermediate result.

5. The method according to claim 4, characterized in that, The value based on the i-th intermediate result and [v] i Q determines the i-th result value, including: If v i If = 0, then the i-th result value is equal to the i-th intermediate result value; If v i If ≠0, then the i-th intermediate result value is used as the first input value of the equality judgment algorithm, and [v i Q is used as the second input value of the equality judgment algorithm, and the equality judgment algorithm is used to calculate the i-th intermediate result value and [v] i Determine whether Q is equal, obtain the second judgment result and the second intermediate result, and determine the i-th result value based on the second judgment result and the second intermediate result.

6. The method according to claim 5, characterized in that, Determining the value of the i-th intermediate result based on the first judgment result and the first intermediate result includes: Based on the first judgment result, if the value of the i-th variable is consistent with [u i If P is equal, then [u] i The result of the doubling operation of P is determined as the i-th intermediate result value. If the i-th variable value is different from [u] i If P is not equal, then according to the value of the i-th variable, [u i ]P and the first intermediate result, calculate the value of the i-th intermediate result.

7. The method according to claim 6, characterized in that, The step of determining the i-th result value based on the second judgment result and the second intermediate result includes: Based on the second judgment result, if the i-th intermediate result value is consistent with [v] i If Q is equal, then [v] i The result of the doubling operation of Q is determined as the i-th result value. If the i-th intermediate result value is different from [v... i If Q is not equal, then based on the i-th intermediate result value, [v i ]Q and the second intermediate result, calculate the i-th result value.

8. The method according to claim 6 or 7, characterized in that, The equality comparison algorithm includes: If (EG) mod p = 0 and (FH) mod p = 0, then the first input value and the second input value are determined to be equal. The first input value of the equality judgment algorithm is (X1, Y1, Z1), and the second input value of the equality judgment algorithm is (X2, Y2, Z2). E = (X2·A) mod p, F = (Y2·B) mod p, G = (X1·C) mod p, H = (Y1·D) mod p, A = (Z1·Z1) mod p, B = (A·Z1) mod p, C = (Z2·Z2) mod p, D = (C·Z2) mod p. E, F, G and H are intermediate results, and p represents the preset prime number corresponding to the elliptic curve.

9. The method according to claim 7, characterized in that, The value of the i-th variable, [u] i ]P and the first intermediate result, calculate the i-th intermediate result value, including: taking the i-th variable value as the first input of the target algorithm, and taking [u i P is used as the second input of the target algorithm, and the first intermediate result is used as the third input of the target algorithm to calculate the i-th intermediate result value. The value based on the i-th intermediate result, [v] i ]Q and the second intermediate result, to calculate the i-th result value, including: using the i-th intermediate result value as the first input of the target algorithm, and using [v i Q is used as the second input to the target algorithm, and the second intermediate result is used as the third input to the target algorithm to calculate the i-th result value. The target algorithm includes: The output of the target algorithm is (X5, Y5, Z5), the first input of the target algorithm is (X3, Y3, Z3), the second input of the target algorithm is (X4, Y4, Z4), and the third input of the target algorithm is (E, F, G, H), where X5 = J. 2 -(L+2M)mod p, Y5=J·(M-X5)-N mod p, Z5=(Z3·Z4·I)mod p, I=(EG)mod p, J=(FH)mod p, K=I 2 mod p, L = (K·I)mod p, M = (K·G)mod p, N = (H·L)mod p, where p represents a preset prime number corresponding to the elliptic curve.

10. A digital signature verification device, characterized in that, include: The acquisition unit is used to acquire target data and the digital signature of the target data, and to acquire a first point value and a second point value, wherein the point corresponding to the first point value is the base point of the elliptic curve, the second point value is the public key, and the point corresponding to the second point value is a point on the elliptic curve that is different from the base point. The generation unit is configured to generate a first scalar value and a second scalar value based on the target data and the digital signature. The first pre-calculation unit is used to pre-calculate the first point value to obtain a first pre-calculation result. The first pre-calculation result includes multiple first pre-calculation point values. Each first pre-calculation point value is equal to the result of performing an integer number of addition operations along the elliptic curve on the first point value according to the encoding method of the first scalar value. Different first pre-calculation point values ​​correspond to different integer number of addition operations. The second pre-calculation unit is used to pre-calculate the second point value to obtain a second pre-calculation result. The second pre-calculation result includes multiple second pre-calculation point values. The second pre-calculation point value is equal to the result of performing an integer number of addition operations along the elliptic curve on the second point value according to the encoding method of the second scalar value. Different second pre-calculation point values ​​correspond to different integer number of addition operations. The transformation unit is used to perform coordinate transformation on the first pre-calculated point value and the second pre-calculated point value respectively, so that the Z coordinate of the third pre-calculated point value corresponding to the first pre-calculated point value after coordinate transformation is 1, and the Z coordinate of the fourth pre-calculated point value corresponding to the second pre-calculated point value after coordinate transformation is 1; The calculation unit is used to calculate the sum of the dot product of the first scalar value and the first point value and the dot product of the second scalar value and the second point value based on the third pre-calculated point value and the fourth pre-calculated point value, to obtain the verification point value; A verification unit is used to determine the validity of the digital signature based on the verification point value.

11. A digital signature chip, characterized in that, The digital signature chip is used to perform the method as described in any one of claims 1-9.

12. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is configured to perform the method of any one of claims 1-9 by running the computer program stored in the memory.

13. A computer storage medium, characterized in that, The computer storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1-9.

14. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method as described in any one of claims 1-9.

Images