Threshold post-quantum signature method and system based on secure multi-party computation

Abstract

This invention provides a post-threshold quantum signature method and system based on secure multi-party computation, comprising: a key generation process, a signature generation process, and a signature verification process; entering the key generation process to obtain a public key and a private key; the public key is a public key, and the private key is a secret key; entering the signature generation process to send the signature to a recipient; the recipient receives the signature and enters the signature verification process; among the recipients, only the user holding the private key and performing the signature can pass the verification through the corresponding public key. This invention effectively improves the efficiency of multi-party collaborative signature generation by employing Shamir secret sharing combined with packet secret sharing and other technologies, reducing communication complexity by up to 25% when directly using Shamir secret sharing during distributed private key generation.

Description

Technical Field

[0001] This invention belongs to the field of computer and internet technology, specifically relating to a threshold-based post-quantum signature method and system based on secure multi-party computation. More specifically, it is a threshold-based post-quantum signature scheme based on secure multi-party computation. Background Technology

[0002] With the development of quantum computing, traditional encryption methods such as RSA and ECC may become vulnerable to the powerful computing capabilities of quantum computers. Therefore, post-quantum signature technology has become a hot research topic.

[0003] Threshold-based post-quantum signature schemes, utilizing secure multi-party computation (MPC), enhance the security and reliability of signatures through multi-node collaborative computation and threshold setting. However, existing technologies still present some specific difficulties and shortcomings. Firstly, secure multi-party computation is a general term for a class of cryptographic protocols, involving complex details that require further optimization and refinement. Secondly, while post-quantum signature technology shows potential in addressing quantum computing threats, it remains under development and may face unresolved issues in practical applications. For example, how to improve signature efficiency and performance while ensuring security; how to better adapt to different application scenarios and needs; and how to address potential new security threats. These issues require further research and exploration to promote the development and application of threshold-based post-quantum signature technology based on secure multi-party computation.

[0004] Patent document CN117240479A discloses a multi-party quantum signature method, apparatus, computer device, and storage medium. The scheme includes: obtaining the ID information of the signer and using this ID information as a public key; wherein the signer includes multiple signers, who, upon receiving initial information, verify the initial information by signing it to obtain signed information and send it to the next signer; obtaining a first private key and a second private key based on the public key; obtaining a first qubit sequence using each signer's signature information and the first private key; obtaining a second qubit sequence using each signer's signature information and the second private key; comparing the first qubit sequence and the second qubit sequence to obtain a comparison result; and obtaining a valid multi-party signature based on the comparison result. This scheme enables the signer to sign in an orderly manner while reducing the risk of information tampering.

[0005] However, this scheme lacks efficiency in generating signatures through multi-party collaboration and cannot guarantee the security of critical infrastructure and long-term authentication. This problem urgently needs to be addressed. Summary of the Invention

[0006] To address the shortcomings of existing technologies, the purpose of this invention is to provide a threshold-based post-quantum signature method and system based on secure multi-party computation.

[0007] A threshold-based quantum signature method based on secure multi-party computation provided by the present invention includes: a key generation process, a signature generation process, and a signature verification process;

[0008] The process begins with a key generation procedure to obtain a public key and a private key. The public key is publicly available, and the private key is kept secret. The process then proceeds to a signature generation procedure, where the signature is sent to the recipient. The recipient receives the signature and proceeds to a signature verification procedure. Among the recipients, only users who possess the private key and have performed the signature can pass the verification process using the corresponding public key.

[0009] Preferably, the key generation process includes:

[0010] Step A1: Have all signers randomly generate a signature matrix;

[0011] Step A2: Have all signers secretly share the signature matrix to obtain the shared secret;

[0012] Step A3: Grant all signatories a sub-secret corresponding to the shared secret;

[0013] Step A4: Based on the sub-secret, have all the signer calculate the shared secret to obtain the calculation result;

[0014] Step A5: Generate a key based on the calculated result;

[0015] Step A6: Based on the key, publicly disclose the public key for signing;

[0016] In step A1, the signature matrix is ​​A, and the matrix of the i-th signer is A_i; each element in the signature matrix is ​​randomly generated from a finite ring, i.e., R_q.

[0017] In step A2, the shared secret is [A];

[0018] The mathematical expression for the shared secret is:

[0019] Where n is the number of signing participants; [A_1] represents the sub-secret of the first signer; [A_n] represents the sub-secret of the nth signer; the sub-secret includes the first sub-secret and the second sub-secret;

[0020] In step A4, the mathematical expression for the calculation result is:

[0021] [t] = [A]*[s1] + [s2]

[0022] Where [t] represents the shared secret of the intermediate computation results during the signature generation process; the symbol * represents matrix and vector multiplication, where the multiplication is performed using the corresponding multiplication protocol of the secret sharing protocol; [s1] represents the first sub-secret, and [s2] represents the second sub-secret, where s1 is a vector of length l, s2 is a vector of length k, and l and k are both constants.

[0023] Preferably, step A6 includes:

[0024] Step A6.1: Have all signers generate a secret share of 0 on the ring, i.e., [0]; the degree of the secret share is n-1;

[0025] Step A6.2: Have all signers calculate the reconstruction result, and then generate the public key for the signature;

[0026] In step A6.1, 0 on the ring refers to the zero element in the polynomial ring in which the current calculation is performed;

[0027] In step A6.2, the mathematical expression for the reconstruction result is:

[0028] [t] = [t] + [0]

[0029] Where [t] represents the element t of the secret sharing, t represents a part of the public key, i.e. the reconstruction result; [0] represents the secret sharing of 0 on the ring, i.e. the 0 element of the secret sharing with a degree of n-1;

[0030] The mathematical expression for the public key is:

[0031] t = A*s1 + s2

[0032] Here, t represents a portion of the public key.

[0033] Preferably, the signature generation process includes:

[0034] Step B1: Randomly generate vector [y];

[0035] Step B2: Calculate the vector [y] using a secure multi-party computation protocol to obtain [w];

[0036] Step B3: Based on the aforementioned [w], calculate [c] using a secure multi-party computation protocol;

[0037] Step B4: Calculate [z] based on the vectors [y] and [c];

[0038] Step B5: Using a secure multi-party computation comparison protocol, determine whether the infinite norm of [z] is greater than or equal to gamma_2-beta. If the result is yes, then repeat step B1; if the result is no, then share and calculate z and c to obtain the calculation result; gamma_2-beta is a security parameter.

[0039] Step B6: Based on the calculation result, output the signature, which is sigma, sigma = (z, c);

[0040] In step B1, the length of vector [y] is 1;

[0041] In step B2, the mathematical expression for [w] is:

[0042] [w] = A[y]

[0043] Where [w] represents the state of secret sharing; [y] is the vector [y].

[0044] In step B3, the mathematical expression for [c] is:

[0045] [c]=H1(HighBits([w],2*gamma_2)||mu)

[0046] Where [c] represents the computation result of the Secure Multi-Party Computation Protocol (SMCP), c represents an element of another signature, H1 represents the hash function; mu represents the message; HighBits represents the function for extracting the high-order bits; gamma_2 represents the security parameters of the MSIS problem; and || represents the concatenation of two strings.

[0047] In step B4, the expression for [z] is:

[0048] [z] = [y] + [c][s_1]

[0049] Where [z] represents the intermediate result of the calculation, z represents an element of a signature; [s_1] represents the secret sharing of the private key.

[0050] Preferably, the signature verification process includes:

[0051] Step C1: Set the public key to pk, the message to mu, and the signature to sigma;

[0052] Step C2: Determine if the infinity norm of z is less than gamma_1-beta and c equals H1(HighBits(Az-ct,2*gamma_2)||mu); if the result is yes, the signature verification is successful; if the result is no, the signature is invalid; where gamma_1-beta represents another security parameter; A represents the signature matrix; z represents an element of one type of signature; c represents an element of another type of signature; t represents the intermediate calculation result in the signature generation process.

[0053] A threshold-post quantum signature system based on secure multi-party computation, provided by the present invention, includes:

[0054] Key generation module, signature generation module, and signature verification module;

[0055] The key generation module is used to generate a key; the signature generation module is used to generate a signature; the signature verification module is used to verify the signature.

[0056] The key generation module is triggered to obtain a public key and a private key; the public key is a public key, and the private key is a confidential key; the signature generation module is triggered to send the signature to the recipient; the recipient receives the signature and triggers the signature verification module; among the recipients, only the user who holds the private key and performs the signature can pass the verification of the corresponding public key.

[0057] Preferably, the key generation module includes:

[0058] Module A1: Instruct all signers to randomly generate a signature matrix;

[0059] Module A2: Enables all signers to secretly share the signature matrix, thus obtaining the shared secret;

[0060] Module A3: Provides all signer parties with a sub-secret corresponding to the shared secret;

[0061] Module A4: Based on the sub-secret, have all the signer calculate the shared post-secret to obtain the calculation result;

[0062] Module A5: Generates a key based on the calculated result;

[0063] Module A6: Publicly discloses the signature public key based on the stated key;

[0064] In module A1, the signature matrix is ​​A, and the matrix of the i-th signer is A_i; each element in the signature matrix is ​​randomly generated from a finite ring, i.e., R_q.

[0065] In module A2, the shared secret is [A];

[0066] The mathematical expression for the shared secret is:

[0067] Where n is the number of signing participants; [A_1] represents the sub-secret of the first signer; [A_n] represents the sub-secret of the nth signer; the sub-secret includes the first sub-secret and the second sub-secret;

[0068] In module A4, the mathematical expression for the calculation result is:

[0069] [t] = [A]*[s1] + [s2]

[0070] Where [t] represents the shared secret of the intermediate computation results during the signature generation process; the symbol * represents matrix and vector multiplication, where the multiplication is performed using the corresponding multiplication protocol of the secret sharing protocol; [s1] represents the first sub-secret, and [s2] represents the second sub-secret, where s1 is a vector of length l, s2 is a vector of length k, and l and k are both constants.

[0071] Preferably, module A6 includes:

[0072] Module A6.1: Enable all signers to generate a secret share of 0 on the ring, i.e., [0]; the degree of the secret share is n-1;

[0073] Module A6.2: Instructs all signers to compute the reconstruction result and then generate the public key for the signature;

[0074] In module A6.1, 0 on the ring refers to the zero element in the polynomial ring where the current calculation is performed;

[0075] In module A6.2, the mathematical expression for the reconstruction result is:

[0076] [t] = [t] + [0]

[0077] Where [t] represents the element t of the secret sharing, t represents a part of the public key, i.e. the reconstruction result; [0] represents the secret sharing of 0 on the ring, i.e. the 0 element of the secret sharing with a degree of n-1;

[0078] The mathematical expression for the public key is:

[0079] t = A*s1 + s2

[0080] Here, t represents a portion of the public key.

[0081] Preferably, the signature generation module includes:

[0082] Module B1: Randomly generate vector [y];

[0083] Module B2: Calculates the vector [y] using a secure multi-party computation protocol to obtain [w];

[0084] Module B3: Based on the aforementioned [w], [c] is calculated using a secure multi-party computation protocol;

[0085] Module B4: Calculate [z] based on the vectors [y] and [c];

[0086] Module B5: Using a secure multi-party computation comparison protocol, determine whether the infinite norm of [z] is greater than or equal to gamma_2-beta. If the result is yes, then Module B1 is reactivated; if the result is no, then share and calculate z and c to obtain the calculation result. The gamma_2-beta is a security parameter.

[0087] Module B6: Based on the calculation result, output the signature, which is sigma, sigma = (z, c);

[0088] In module B1, the length of vector [y] is 1;

[0089] In module B2, the mathematical expression for [w] is:

[0090] [w] = A[y]

[0091] Where [w] represents the state of secret sharing; [y] is the vector [y].

[0092] In step B3, the mathematical expression for [c] is:

[0093] [c]=H1(HighBits([w],2*gamma_2)||mu)

[0094] Where [c] represents the computation result of the Secure Multi-Party Computation Protocol (SMCP), c represents an element of another signature, H1 represents the hash function; mu represents the message; HighBits represents the function for extracting the high-order bits; gamma_2 represents the security parameters of the MSIS problem; and || represents the concatenation of two strings.

[0095] In module B4, the expression for [z] is:

[0096] [z] = [y] + [c][s_1]

[0097] Where [z] represents the intermediate result of the calculation, z represents an element of a signature; [s_1] represents the secret sharing of the private key.

[0098] Preferably, the signature verification module includes:

[0099] Module C1: Set the public key to pk, the message to mu, and the signature to sigma;

[0100] Module C2: Determines whether the infinity norm of z is less than gamma_1-beta and c equals H1(HighBits(Az-ct,2*gamma_2)||mu); if the result is yes, the signature verification is successful; if the result is no, the signature is invalid; where gamma_1-beta represents another security parameter; A represents the signature matrix; z represents an element of one type of signature; c represents an element of another type of signature; t represents the intermediate calculation result during the signature generation process.

[0101] Compared with the prior art, the present invention has the following beneficial effects:

[0102] 1. This invention effectively improves the efficiency of multi-party collaborative signature generation by employing Shamir secret sharing combined with packaged secret sharing techniques. When generating distributed private keys, the communication complexity can be reduced to as low as 25% of that achieved by directly using Shami secret sharing. Specifically, the value depends on the specific values ​​of parameter t and the number of packaged secrets k while ensuring security. Therefore, this invention realizes a secure multi-party post-quantum signature scheme resistant to quantum computing attacks.

[0103] 2. This invention combines the quantum attack resistance of the Aigis-Sig signature algorithm with the characteristics of multi-party secure computation to realize a decentralized trust mechanism, which solves the risk of single point of failure in traditional certificate authentication. With a parameter setting of t for the n-party signature threshold, it can resist the failure of up to t nodes or being compromised by attackers, thus enhancing the resilience and reliability of the certificate authentication system.

[0104] 3. The present invention adopts a method of generating post-quantum signatures through multi-party collaboration, which not only inherits the quantum computing resistance characteristics of post-quantum signatures, but also disperses the attack target through multi-party collaboration. Previously, an attacker only needed to break through one central node, but now he needs to break through t+1 nodes to achieve the attack effect, which improves the robustness against quantum threats and ensures the security of critical infrastructure and long-term authentication.

[0105] 4. The multi-party post-quantum signature scheme of the present invention enhances the trust level of critical systems, namely financial systems and military systems, through its distributed and quantum attack resistant characteristics, and meets the stringent certificate authentication requirements of these high-security fields.

[0106] 5. This invention employs Shamir secret sharing technology and packaged secret sharing technology to realize a quantum attack-resistant multi-party post-quantum signature, which has high security and a decentralized trust mechanism. Attached Figure Description

[0107] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0108] Figure 1 This is a schematic diagram of the key generation process provided by the present invention;

[0109] Figure 2 This is a schematic diagram of the signature generation process provided by the present invention;

[0110] Figure 3 This is a schematic diagram of the signature process provided by the present invention. Detailed Implementation

[0111] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0112] A threshold-post quantum signature method based on secure multi-party computation provided by the present invention includes: a key generation step, a signature generation step, and a signature verification step;

[0113] First, key generation is performed, producing a public key and a private key. The private key is kept secret, while the public key can be made public. All individuals holding the private key jointly sign the file to be signed. After the file and signature are sent to the recipient, the recipient can use the public key and the file to verify the signature calculation. Only signatures made by those holding the private key can be verified using the corresponding public key.

[0114] The key generation step includes:

[0115] Step A1: Have all signers randomly generate a signature matrix;

[0116] Step A2: Have all the signers secretly share the signature matrix to obtain the shared secret;

[0117] Step A3: Grant the participating parties a sub-secret corresponding to the shared secret;

[0118] Step A4: Have all the signer parties calculate the shared secret to obtain the calculation result;

[0119] Step A5: Generate a key based on the calculation result;

[0120] Step A6: Based on the key, publicly disclose the public key for signing.

[0121] In step A1, the signature matrix is ​​A, and the matrix of the i-th signer is A_i; each element in the signature matrix is ​​randomly generated from a finite ring, i.e., R_q.

[0122] In step A2, the shared secret is [A];

[0123] The mathematical expression for [A] is:

[0124] [A] = [A_1] + ... + [A_n]

[0125] Where n is the number of signing participants; [A_1] represents the sub-secret of the first signer; [A_n] represents the sub-secret of the nth signer.

[0126] In step A3, the sub-secret includes: sub-secret [s1] and sub-secret [s2]; where s1 is a vector of length l and s2 is a vector of length k;

[0127] In step A3, the participants are all the signatories;

[0128] In step A4, the mathematical expression for the calculation result is:

[0129] [t] = [A]*[s1] + [s2]

[0130] Where [t] represents the shared secret of the intermediate computation results during the signature generation process; the symbol * represents matrix and vector multiplication, where the multiplication is performed using the corresponding multiplication protocol of the secret sharing protocol.

[0131] Step A6 includes:

[0132] Step A6.1: Have all signers generate a secret share of 0 on the ring, i.e., [0]; the degree of the secret share is n-1.

[0133] Step A6.2: Have all signers calculate [t] to obtain the reconstruction result;

[0134] Step A6.3: Based on the reconstruction result, generate the public key for the signature;

[0135] In step A6.1, 0 on the ring refers to the zero element in the polynomial ring in which the current calculation takes place. The zero element on the ring is defined as any element multiplied by it equal to itself.

[0136] In step A6.2, the expression for [t] is:

[0137] [t] = [t] + [0]

[0138] Where [t] represents the element t in the secret sharing, and t represents a part of the public key; [0] represents the vector of 0 elements in the secret sharing with degree n-1, and 0 represents the zero element on the ring.

[0139] The reconstruction result is t.

[0140] In step A6.3, the public key for the signature is (A,t); the mathematical expression for (A,t) is:

[0141] t = A*s1 + s2

[0142] Here, t represents a part of the public key, which can be combined with another part of the public key to form a public key, i.e., (A,t).

[0143] The signature generation step includes:

[0144] Step B1: Randomly generate vector [y];

[0145] Step B2: Calculate the vector [y] using a secure multi-party computation protocol to obtain [w];

[0146] Step B3: Based on the aforementioned [w], calculate [c] using a secure multi-party computation protocol;

[0147] Step B4: Calculate [z] based on the vectors [y] and [c];

[0148] Step B5: Using a secure multi-party computation comparison protocol, determine whether the infinite norm of [z] is greater than or equal to gamma_2-beta. If the result is yes, then repeat step B1; if the result is no, then share and calculate z and c to obtain the calculation result.

[0149] Step B6: Based on the calculation result, output the signature, which is sigma, sigma = (z, c).

[0150] In step B1, the length of vector [y] is l;

[0151] Each element of the vector [y] is randomly generated from a finite ring R_q and is infinitely less than gamma_1-1; gamma_1-1 is the value of the safety parameter gamma1 minus 1.

[0152] In step B2, the mathematical expression for [w] is:

[0153] [w] = A[y]

[0154] Where [w] represents the state of secret sharing;

[0155] In step B3, the expression for [c] is:

[0156] [c]=H1(HighBits([w],2*gamma_2)||mu)

[0157] Where H1 represents the hash function; mu represents the message; HighBits represents the function for extracting the high-order bits; gamma_2 represents the security parameter for the MSIS problem; * represents the multiplication sign; and || represents the concatenation of two strings.

[0158] In step B4, the expression for [z] is:

[0159] [z] = [y] + [c][s_1]

[0160] Where [z] represents the intermediate result of the calculation; [s_1] represents the secret sharing of the private key;

[0161] In step B5, gamma_2-beta is a safety parameter, specifically representing the conditions that need to be met to ensure safety;

[0162] Specifically, in gamma_2-beta, gamma_2 and beta are both safety parameters. Among them, beta is the safety parameter for solving the LWE SIS problem, and gamma_2 is the safety parameter for the MSIS problem.

[0163] The signature verification step includes:

[0164] Step C1: Assume the public key is pk, the message is mu, and the signature is sigma; specifically, pk = (A, t), and the signature sigma = (z, c):

[0165] Step C2: Determine if the infinity norm of z is less than gamma_1-beta and c equals H1(HighBits(Az-ct,2*gamma_2)||mu); if the result is yes, the signature verification is successful; if the result is no, the signature is invalid; where gamma_1-beta represents another security parameter; A represents the signature matrix; z represents an element of one type of signature; c represents an element of another type of signature; t represents the intermediate calculation result in the signature generation process.

[0166] Specifically, c is the plaintext corresponding to the secret sharing [c], and H1(HighBits(Az-ct,2gamma_2)||mu) is the method to directly calculate the plaintext.

[0167] The key generation algorithm, i.e. the key generation steps.

[0168] The key generation step includes:

[0169] Step 1: All signers randomly generate a matrix A with length k and width w, where each element is randomly generated from a finite ring R_q. The matrix generated by signer i is denoted as A_i.

[0170] Step two: All signers share the matrix generated in step one with the remaining participants using Shamir secret sharing and packaged secret sharing techniques. Assuming the parameter for packaged secret sharing is t, the total number of signers is n, and the number of packages in packaged secret sharing is k, then all signers use a packaged secret sharing polynomial of degree t+k-1 to package the corresponding coefficients of k elements in matrix A at once. Specifically, the coefficients of the ring elements are expressed as polynomials representing the corresponding positions.

[0171] Step 3: Use square brackets to denote the shared secret after packaging. Each participant will receive the corresponding sub-secret. In the above operation, after each signer i generates A_i, it shares it with the other participants through Shamir secret sharing and packaged secret sharing. The other signers will receive the sub-secret [A_i] of A_i.

[0172] Step four, all signer calculates [A];

[0173] The mathematical expression for [A] is:

[0174] [A] = [A_1] + ... + [A_n]

[0175] Where n is the number of participants who signed.

[0176] Step 5: All signers send their respective [A] to the other signers, who then calculate matrix A using the secret sharing reconstruction technique.

[0177] Step 6: All signers use Shamir secret sharing and packaged secret sharing techniques to jointly generate a private key s1 and a private key s2 for signing, where s1 is a vector of length l and s2 is a vector of length k.

[0178] Each signer receives a sub-secret [s1] and a sub-secret [s2] from vectors s1 and s2. Each element in vectors s1 and s2 is selected from a ring R_q with an infinity norm less than or equal to η.

[0179] Step 6: All signers, following the method in Step 3, locally pack the k elements corresponding to the coefficients of the polynomial local package matrix A with a local degree of k-1. Then, according to the multiplication rule of ring elements, that is, the multiplication of polynomials, calculate [t] = [A] * [s_1] + [s_2].

[0180] Step 7: All signers jointly generate a secret share [0] on the ring with a degree of n-1.

[0181] Step 8: All signers jointly calculate [t] = [t] + [0] and then disclose [t] to the other participants. All signers calculate t through secret sharing reconstruction technology.

[0182] Step nine: (A,t) is published as the public key for signing.

[0183] The signature generation algorithm, i.e. the signature generation steps.

[0184] The signature generation step includes: assuming that message mu is to be signed:

[0185] Step 1: All signers jointly generate a vector [y] of length l. Each element of vector [y] is randomly generated from a finite ring R_q and satisfies an infinite norm less than gamma_1-1; where the symbol - represents subtraction and gamma_1 is a security parameter.

[0186] Step two, all participants jointly pass the secure multi-party computation protocol [w] = A[y].

[0187] Step 3: All participants jointly calculate [c] = H1(HighBits([w],2*gamma_2)||mu) using a secure multi-party computation protocol. gamma_2 is the security parameter for the MSIS problem, and HighBits is the function for extracting the high-order bits. ([w],2*gamma_2) means extracting the first gamma_2 bits from the high-order bits of the coefficients of each polynomial (ring elements can be considered as polynomials) in vector w. Since [w] is a secretly shared state, the coefficient vector of [w] is first bit-factored using the secure multi-party computation protocol, allowing extraction from the high-order bits. H1 is the specified hash function.

[0188] Step four, all participants calculate [z] = [y] + [c][s_1]

[0189] Step 5: All participants use a secure multi-party computation comparison protocol to determine whether the infinite norm of [z] is greater than or equal to gamma_1-beta and whether LowBits(A[y]-[c][s_2],2gamma_2) is greater than or equal to gamma_2-beta. If either of these conditions is met, the process restarts from step 1. Otherwise, all participants distribute [z] and [c] to other participants, and all participants compute z and c using a secret-sharing reconstruction technique.

[0190] Step 6: All participants output their signature sigma = (z, c).

[0191] The signature verification algorithm, i.e. the signature verification steps.

[0192] The signature verification step includes:

[0193] Assuming a given public key pk = (A, t), a message mu, and a signature sigma = (z, c):

[0194] Step 1: The signature verifier calculates whether the infinity norm of z is less than gamma_1-beta and whether c is equal to H1(HighBits(Az-ct,2gamma_2)||mu). If both equations are true, the signature verification is successful. Otherwise, the signature is considered invalid.

[0195] The present invention also provides a thresholded post-quantum signature system based on secure multi-party computation. The thresholded post-quantum signature system based on secure multi-party computation can be implemented by executing the process steps of the thresholded post-quantum signature method based on secure multi-party computation. That is, those skilled in the art can understand the thresholded post-quantum signature method based on secure multi-party computation as a preferred embodiment of the thresholded post-quantum signature system based on secure multi-party computation.

[0196] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0197] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A threshold-post quantum signature method based on secure multi-party computation, characterized in that, include: Key generation process, signature generation process, and signature verification process; Enter the key generation process to obtain the public and private keys; The public key is a publicly available key, and the private key is a private key; The signature generation process begins, and the signature is sent to the recipient. The recipient receives the signature and then proceeds to the signature verification process. Among the recipients, only the user who holds the private key and performs the signing can be verified through the corresponding public key; The signature generation process includes: Step B1: Randomly generate vector [y]; Step B2: Calculate the vector [y] using a secure multi-party computation protocol to obtain [w]; Step B3: Based on the aforementioned [w], calculate [c] using a secure multi-party computation protocol; Step B4: Calculate [z] based on the vectors [y] and [c]; Step B5: Using a secure multi-party computation comparison protocol, determine whether the infinite norm of [z] is greater than or equal to gamma_2-beta. If the result is yes, then repeat step B1; if the result is no, then share and calculate z and c to obtain the calculation result; gamma_2-beta is a security parameter. Step B6: Based on the calculation result, output the signature, which is sigma, sigma=(z,c); In step B1, the length of vector [y] is 1; In step B2, the mathematical expression for [w] is: [w] = A[y] Where [w] represents the state of secret sharing; [y] is the vector [y]; A represents the signature matrix; In step B3, the mathematical expression for [c] is: Where [c] represents the computation result of the Secure Multi-Party Computation Protocol (SMCP), c represents an element of another signature, H1 represents the hash function; mu represents the message; HighBits represents the function for extracting the high-order bits; gamma_2 represents the security parameters of the MSIS problem; and || represents the concatenation of two strings. In step B4, the expression for [z] is: [z]=[y]+[c][s_1] Where [z] represents the intermediate result of the calculation, z represents an element of a signature; [s_1] represents the secret sharing of the private key.

2. The threshold-post quantum signature method based on secure multi-party computation according to claim 1, characterized in that, The key generation process includes: Step A1: Have all signers randomly generate a signature matrix; Step A2: Have all signers secretly share the signature matrix to obtain the shared secret; Step A3: Grant all signatories a sub-secret corresponding to the shared secret; Step A4: Based on the sub-secret, have all the signer parties calculate the shared secret to obtain the calculation result; Step A5: Generate a key based on the calculated result; Step A6: Based on the key, publicly disclose the public key for signing; In step A1, the signature matrix is ​​A, and the matrix of the i-th signer is A_i; each element in the signature matrix is ​​randomly generated from a finite ring, i.e., R_q. In step A2, the shared secret is [A]; The mathematical expression for the shared secret is: Where n is the number of signing participants; [A_1] represents the sub-secret of the first signer; [A_n] represents the sub-secret of the nth signer; the sub-secret includes the first sub-secret and the second sub-secret; In step A4, the mathematical expression for the calculation result is: [t]=[A] [s1]+[s2] Where [t] represents the shared secret of the intermediate computation results during the signature generation process; symbol The expression represents matrix and vector multiplication, where the multiplication is performed using the corresponding multiplication protocol of the secret sharing protocol; [s1] represents the first sub-secret, and [s2] represents the second sub-secret, where s1 is a vector of length l and s2 is a vector of length k, where l and k are both constants.

3. The threshold-based post-quantum signature method based on secure multi-party computation according to claim 2, characterized in that, Step A6 includes: Step A6.1: Have all signers generate a secret share of 0 on the ring, i.e., [0]; the degree of the secret share is n-1; Step A6.2: Have all signers calculate the reconstruction result, and then generate the public key for the signature; In step A6.1, 0 on the ring refers to the zero element in the polynomial ring in which the current calculation is performed; In step A6.2, the mathematical expression for the reconstruction result is: [t] = [t] + [0] Where [t] represents the element t of the secret sharing, t represents a part of the public key, i.e. the reconstruction result; [0] represents the secret sharing of 0 on the ring, i.e. the 0 element of the secret sharing with a degree of n-1; The mathematical expression for the public key is: t = A s1+s2 Here, t represents a portion of the public key.

4. The threshold-based post-quantum signature method based on secure multi-party computation according to claim 1, characterized in that, The signature verification process includes: Step C1: Set the public key to pk, the message to mu, and the signature to sigma; Step C2: Determine if the infinity norm of z is less than gamma_1-beta and c equals H1(HighBits(Az-ct,2)). If the result of gamma_2)||mu) is yes, the signature verification is successful; if the result is no, the signature is invalid; where gamma_1-beta represents another security parameter; A represents the signature matrix; z represents an element of one type of signature; c represents an element of another type of signature; t represents the intermediate calculation result in the signature generation process.

5. A threshold-post quantum signature system based on secure multi-party computation, characterized in that, include: Key generation module, signature generation module, and signature verification module; The key generation module is used to generate keys; The signature generation module is used to generate signatures; The signature verification module is used to verify signatures; The key generation module is triggered to obtain a public key and a private key; the public key is a public key, and the private key is a confidential key; the signature generation module is triggered to send the signature to the recipient; the recipient receives the signature and triggers the signature verification module. Among the recipients, only the user who holds the private key and performs the signing can be verified through the corresponding public key; The signature generation module includes: Module B1: Randomly generate vector [y]; Module B2: Calculates the vector [y] using a secure multi-party computation protocol to obtain [w]; Module B3: Based on the aforementioned [w], [c] is calculated using a secure multi-party computation protocol; Module B4: Calculate [z] based on the vectors [y] and [c]; Module B5: Using a secure multi-party computation comparison protocol, determine whether the infinite norm of [z] is greater than or equal to gamma_2-beta. If the result is yes, then Module B1 is reactivated; if the result is no, then share and calculate z and c to obtain the calculation result. The gamma_2-beta is a security parameter. Module B6: Based on the calculation result, output the signature, which is sigma, sigma=(z,c); In module B1, the length of vector [y] is 1; In module B2, the mathematical expression for [w] is: [w] = A[y] Where [w] represents the state of secret sharing; [y] is the vector [y]; A represents the signature matrix; In module B3, the mathematical expression for [c] is: Where [c] represents the computation result of the Secure Multi-Party Computation Protocol (SMCP), c represents an element of another signature, H1 represents the hash function; mu represents the message; HighBits represents the function for extracting the high-order bits; gamma_2 represents the security parameters of the MSIS problem; and || represents the concatenation of two strings. In module B4, the expression for [z] is: [z]=[y]+[c][s_1] Where [z] represents the intermediate result of the calculation, z represents an element of a signature; [s_1] represents the secret sharing of the private key.

6. The threshold-post quantum signature system based on secure multi-party computation according to claim 5, characterized in that, The key generation module includes: Module A1: Instruct all signers to randomly generate a signature matrix; Module A2: Enables all signers to secretly share the signature matrix, thus obtaining the shared secret; Module A3: Provides all signers with a sub-secret corresponding to the shared secret; Module A4: Based on the sub-secret, have all the signer parties calculate the shared secret to obtain the calculation result; Module A5: Generates a key based on the calculated result; Module A6: Publicly discloses the signature public key based on the stated key; In module A1, the signature matrix is ​​A, and the matrix of the i-th signer is A_i; each element in the signature matrix is ​​randomly generated from a finite ring, i.e., R_q. In module A2, the shared secret is [A]; The mathematical expression for the shared secret is: Where n is the number of signing participants; [A_1] represents the sub-secret of the first signer; [A_n] represents the sub-secret of the nth signer; the sub-secret includes the first sub-secret and the second sub-secret; In module A4, the mathematical expression for the calculation result is: [t]=[A] [s1]+[s2] Where [t] represents the shared secret of the intermediate computation results during the signature generation process; symbol The expression represents matrix and vector multiplication, where the multiplication is performed using the corresponding multiplication protocol of the secret sharing protocol; [s1] represents the first sub-secret, and [s2] represents the second sub-secret, where s1 is a vector of length l and s2 is a vector of length k, where l and k are both constants.

7. The threshold-post quantum signature system based on secure multi-party computation according to claim 6, characterized in that, Module A6 includes: Module A6.1: Enable all signers to generate a secret share of 0 on the ring, i.e., [0]; the degree of the secret share is n-1; Module A6.2: Instructs all signers to compute the reconstruction result and then generate the public key for the signature; In module A6.1, 0 on the ring refers to the zero element in the polynomial ring where the current calculation is performed; In module A6.2, the mathematical expression for the reconstruction result is: [t] = [t] + [0] Where [t] represents the element t of the secret sharing, t represents a part of the public key, i.e. the reconstruction result; [0] represents the secret sharing of 0 on the ring, i.e. the 0 element of the secret sharing with a degree of n-1; The mathematical expression for the public key is: Here, t represents a portion of the public key.

8. The threshold-post quantum signature system based on secure multi-party computation according to claim 5, characterized in that, The signature verification module includes: Module C1: Set the public key to pk, the message to mu, and the signature to sigma; Module C2: Determines whether the infinity norm of z is less than gamma_1-beta and whether c equals H1(HighBits(Az-ct,2)). If the result of gamma_2)||mu) is yes, the signature verification is successful; if the result is no, the signature is invalid; where gamma_1-beta represents another security parameter; A represents the signature matrix; z represents an element of one type of signature; c represents an element of another type of signature; t represents the intermediate calculation result in the signature generation process.

Images