A method, system, and electronic device for key generation between two terminals.

Abstract

This invention relates to the field of quantum computer technology, specifically to a key generation method, system, and electronic device for two terminals. This application effectively ensures the confidentiality and security of the negotiated public key and private key determined by the public random seed and the intermediate public key, as well as the private key, by using a public random seed and an XOR operation based on the random seeds provided by both terminals and an XOR operation based on the public keys shared by both parties. Compared to conventional data encryption, transmission, and decryption operations, this reduces the number of data transmissions and improves the security of the signature.

Description

Technical Field

[0001] This invention relates to the field of quantum cryptography, and in particular to a key generation method, system, and electronic device for two terminals. Background Technology

[0002] Digital signatures are a crucial component of public-key cryptography, ensuring the authenticity, integrity, and non-repudiation of digital information. They are widely used in e-commerce, software distribution, email, and other fields requiring information security. With the increasing prevalence of mobile and remote work, the demand for secure digital signatures on mobile devices is constantly growing. However, mobile devices such as smartphones and tablets typically lack dedicated hardware cryptographic modules to store users' private keys and other confidential information. This allows attackers to easily obtain the signing private key stored locally, compromising the security of signatures made on mobile devices.

[0003] With the development of quantum computing technology, traditional cryptographic algorithms face unprecedented security threats. Traditional public-key encryption algorithms, such as RSA and ECC (Elliptic Curve Cryptography), rely on the computational complexity of mathematical problems like large integer factorization and discrete logarithms. However, Shor's quantum algorithm can efficiently solve these difficult problems in polynomial time, thus posing a serious challenge to the security of existing public-key encryption systems. Current technologies use a trusted device as a third party to achieve secure communication between two terminals. However, this technology involves multiple rounds of communication between the three parties to verify each other's identities and encrypt information transmission, resulting in low information signing efficiency. Furthermore, the complexity of the three-party communication increases the risk of information tampering or theft. Summary of the Invention

[0004] This invention provides a key generation method, system, and electronic device for two terminals, which solves the problems of low information signing efficiency and high risk of information tampering or theft caused by the large number of data transmissions in the prior art.

[0005] This specification provides an embodiment of a key generation method for two terminals, applicable to either terminal, the method comprising:

[0006] Each terminal obtains a common random seed based on the XOR operation of the random seeds provided by the two terminals through mutual interaction;

[0007] A public polynomial is obtained by performing hash compression operations based on a public random seed, and a secret polynomial is obtained by performing hash compression operations based on random seeds provided by each terminal.

[0008] Each terminal determines its public key based on a public polynomial and a secret polynomial within the corresponding terminal. Each terminal obtains an intermediate public key by performing an XOR operation on the public keys of the two terminals shared through mutual interaction.

[0009] A compressed public key is obtained by hashing based on a public random seed and an intermediate public key.

[0010] The public random seed and the intermediate public key are determined to be the negotiation public key for any terminal; the public random seed, the compressed public key, the random number parameters provided by each terminal, the secret polynomial corresponding to each terminal, and the public key corresponding to another terminal are determined to be the private key for any terminal.

[0011] Optionally, each terminal obtains a common random seed based on an XOR operation of random seeds provided by the two terminals through mutual interaction, including:

[0012] Verify the reliability of the random seeds provided by each terminal.

[0013] Optionally, verifying the trustworthiness of the random seeds provided by each terminal includes:

[0014] One of the two terminals is selected as the target terminal, and the other terminal is the cooperating terminal;

[0015] Within the target terminal, a hash commitment operation is performed on the random seed provided by the target terminal to obtain the target commitment value; and the random seed and target commitment value of the target terminal are sent to the cooperating terminal.

[0016] The comparison commitment value is obtained by performing a hash commitment operation on the random seed provided by the target terminal within the cooperating terminal;

[0017] If the target commitment value matches the comparison target commitment value, then the random seed provided by the target terminal is reliable.

[0018] Optionally, verifying the trustworthiness of the random seeds provided by each terminal further includes:

[0019] One of the two terminals is selected as the target terminal, and the other terminal is the cooperating terminal;

[0020] Within the cooperating terminal, a hash commitment operation is performed on the random seed provided by the target terminal to obtain the target commitment value; and the random seed and target commitment value of the cooperating terminal are sent to the target terminal.

[0021] Within the target terminal, a hash commitment operation is performed on the random seed provided by the terminal to obtain a comparison commitment value;

[0022] If the target commitment value matches the comparison target commitment value, then the random seed provided by the terminal is reliable.

[0023] Optionally, each terminal obtains an intermediate public key based on an XOR operation of the public keys of the two terminals shared through mutual interaction, including:

[0024] Verify the trustworthiness of the public keys provided by each terminal.

[0025] Optionally, verifying the trustworthiness of the public keys provided by each terminal includes:

[0026] One of the two terminals is selected as the target terminal, and the other terminal is the cooperating terminal;

[0027] Within the target terminal, perform a hash commitment operation on the public key provided by the target terminal to obtain the target commitment value; and send the public key of the target terminal and the target commitment value to the cooperating terminal;

[0028] The comparison commitment value is obtained by performing a hash commitment operation on the public key provided by the target terminal within the cooperating terminal;

[0029] If the target commitment value matches the comparison commitment value, then the public key provided by the target terminal is trustworthy.

[0030] Optionally, verifying the trustworthiness of the public keys provided by each terminal further includes:

[0031] One of the two terminals is selected as the target terminal, and the other terminal is the cooperating terminal;

[0032] Within the cooperating terminal, a hash commitment operation is performed on the public key provided by the cooperating terminal to obtain the target commitment value; and the public key of the cooperating terminal and the target commitment value are sent to the target terminal.

[0033] Within the target terminal, a hash commitment operation is performed on the public key provided by the target terminal to obtain a comparison commitment value;

[0034] If the target commitment value matches the comparison target commitment value, then the public key provided by the terminal is trusted.

[0035] This specification provides an embodiment of a key generation system for two terminals, characterized in that it includes a target terminal and a cooperating terminal, and the system includes:

[0036] The target terminal and the cooperating terminal obtain a common random seed based on the XOR operation of the random seeds provided by the two terminals through mutual interaction;

[0037] The target terminal and cooperating terminals perform hash compression operations based on a common random seed to obtain a common polynomial, and perform hash compression operations based on the random seeds provided by each terminal to obtain the secret polynomial of each terminal.

[0038] The target terminal and the cooperating terminal determine the public key of each terminal based on the public polynomial and the secret polynomial in the corresponding terminal. Each terminal obtains the intermediate public key based on the XOR operation of the public keys of the two terminals shared by both parties.

[0039] The target terminal and the cooperating terminal respectively perform hash operations based on a public random seed and an intermediate public key to obtain the compressed public key of each terminal;

[0040] The target terminal and the cooperating terminal jointly determine a public random seed and an intermediate public key as the public key negotiated between the two terminals; the target terminal determines a public random seed, a compressed public key, random number parameters provided by the target terminal, a secret polynomial corresponding to the target terminal, and a public key corresponding to the cooperating terminal as the private key of the target terminal; the cooperating terminal determines a public random seed, a compressed public key, random number parameters provided by the cooperating terminal, a secret polynomial corresponding to the cooperating terminal, and a public key corresponding to the target terminal as the private key of the cooperating terminal.

[0041] An electronic device includes a memory and a processor, the memory storing computer instructions, and the processor being configured to execute the computer instructions to perform the method described above.

[0042] A storage medium storing computer instructions configured to execute the method described above at runtime.

[0043] Its beneficial effects are as follows: Since the public random seed is obtained by XOR operation of the random seeds provided by the two terminals, and the intermediate public key is obtained by XOR operation of the public keys of the two terminals shared through interaction between the two parties, the confidentiality and security of the negotiated public key and the private key determined by the public random seed and the intermediate public key are effectively guaranteed. Compared with conventional data encryption transmission and decryption operations, the number of data transmissions is reduced and the security of the signature is improved. Attached Figure Description

[0044] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0045] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0046] Figure 1 This specification provides a flowchart of a key generation method between two terminals, as illustrated in an embodiment.

[0047] Figure 2This specification provides a schematic diagram of the public and private key generation process for key generation between two terminals, as illustrated in an embodiment of the present specification.

[0048] Figure 3 This specification provides a schematic diagram of a signature generation process between two terminals, as illustrated in an embodiment of the present specification.

[0049] Figure 4 This specification provides an example of a key generation system architecture for two terminals.

[0050] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification;

[0051] Figure 6 This is a schematic diagram of a computer-readable medium provided for embodiments of this specification. Detailed Implementation

[0052] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0053] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0054] It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0055] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the invention or its application or use.

[0056] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0057] In all the examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0058] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0059] Reference Figure 1This specification provides a schematic diagram of a key generation principle between two terminals, comprising: S101: Each terminal obtains a common random seed by performing an XOR operation on random seeds shared by both terminals through mutual interaction; S102: A common polynomial is obtained by performing a hash compression operation on the common random seed, and a secret polynomial is obtained by performing a hash compression operation on the random seeds provided by each terminal; S103: Each terminal determines its public key based on the common polynomial and its corresponding secret polynomial, and an intermediate public key is obtained by performing an XOR operation on the public keys shared by both terminals through mutual interaction; S104: A compressed public key is obtained by performing a hash operation on the common random seed and the intermediate public key; S105: The common random seed and the intermediate public key are determined to be the negotiated public key of any terminal; the common random seed, the compressed public key, the random number parameters provided by each terminal, the secret polynomial corresponding to each terminal, and the public key corresponding to the other terminal are determined to be the private key of any terminal.

[0060] The process involves each terminal obtaining a common random seed based on an XOR operation of random seeds provided by the two terminals through mutual interaction. This includes verifying the trustworthiness of the random seeds provided by each terminal. Specifically, for one terminal selected as the target terminal and the other as the cooperating terminal, a hash commitment operation is performed on the random seed provided by the target terminal within the target terminal to obtain a target commitment value. The target terminal's random seed and target commitment value are then sent to the cooperating terminal. Within the cooperating terminal, a hash commitment operation is performed on the random seed provided by the target terminal to obtain a comparison commitment value. If the target commitment value matches the comparison commitment value, the random seed provided by the target terminal is trustworthy. (The second paragraph is repeated in the original text.)

[0061] In one alternative embodiment, such as Figure 2As shown, taking the target terminal and cooperating terminal as an example, the target terminal performs a hash commitment operation on the first random seed ρ1 of the common polynomial provided by the target terminal to obtain a target commitment value h1; and sends the target commitment value h1 to the cooperating terminal; then, the target terminal sends the first random seed ρ1 to the cooperating terminal, and the cooperating terminal performs a hash commitment operation on the first random seed ρ1 to obtain a comparison commitment value h2. When the comparison commitment value h2 is the same as the target commitment value h1, it indicates that the first random seed ρ1 sent by the target terminal to the cooperating terminal has not been tampered with, and the first random seed provided by the target terminal is valid. If seed ρ1 is trustworthy, then similarly, the cooperating terminal performs a hash commitment operation on the second random seed ρ2 of the public polynomial provided by the cooperating terminal to obtain the target commitment value h3; and sends the target commitment value h3 to the target terminal; then, the cooperating terminal sends the second random seed ρ2 to the target terminal, and the target terminal performs a hash commitment operation on the second random seed ρ2 to obtain a comparison commitment value h4. When the comparison commitment value h4 is the same as the target commitment value h3, it indicates that the second random seed ρ2 sent by the cooperating terminal to the target terminal has not been tampered with, and the second random seed provided by the cooperating terminal is trustworthy; thereby improving the security of the public and private keys generated at both ends.

[0062] Optionally, each terminal obtains an intermediate public key based on an XOR operation of the public keys shared by both terminals through mutual interaction. The method also includes verifying the trustworthiness of the public keys provided by each terminal. Specifically, this includes: selecting one terminal as the target terminal and the other as the cooperating terminal; performing a hash commitment operation on the public key provided by the target terminal within the target terminal to obtain a target commitment value; and sending the public key and target commitment value of the target terminal to the cooperating terminal; performing a hash commitment operation on the public key provided by the target terminal within the cooperating terminal to obtain a comparison commitment value; and if the target commitment value matches the comparison commitment value, the public key provided by the target terminal is trustworthy. Alternatively, selecting one terminal as the target terminal and the other as the cooperating terminal; performing a hash commitment operation on the public key provided by the cooperating terminal within the cooperating terminal to obtain a target commitment value; and sending the public key and target commitment value of the cooperating terminal to the target terminal; performing a hash commitment operation on the public key provided by the target terminal within the target terminal to obtain a comparison commitment value; and if the target commitment value matches the comparison commitment value, the public key provided by the cooperating terminal is trustworthy.

[0063] In one alternative embodiment, such as Figure 2As shown, taking the target terminal and cooperating terminal as examples, the target terminal performs an XOR operation on the first random seed ρ1 and the second random seed ρ2 to obtain a common random seed ρ, and performs a hash compression operation on the common random seed ρ, that is, performs Keccak operation and uniform sampling on the common random seed ρ to obtain the common polynomial A, and performs a hash compression operation on the random seed ρ1' of the secret polynomial provided by the target terminal, that is, performs Keccak operation and uniform sampling on the random seed ρ1' to obtain the first secret polynomial s1_s and the second secret polynomial s2_s; then, the target terminal, based on the common polynomial A and the first secret polynomial... The first public key t_s is determined by the second secret polynomial s1_s and s2_s, i.e., t_s = As1_s + s2_s is calculated using the formula t = As1 + s2, and a hash commitment operation is performed on the first public key t_s to obtain the target commitment value h5; and the target commitment value h5 is sent to the cooperating terminal; finally, the target terminal sends the first public key t_s to the cooperating terminal, and the cooperating terminal performs a hash commitment operation on the first public key t_s to obtain a comparison commitment value h6. When the comparison commitment value h6 is the same as the target commitment value h5, it indicates that the first public key t_s sent by the target terminal to the cooperating terminal has not been tampered with, and the first public key t_s provided by the target terminal is trustworthy; Similarly, the cooperating terminal performs an XOR operation on the second random seed ρ2 and the first random seed ρ1 to obtain the common random seed ρ, and performs a hash compression operation on the common random seed ρ, that is, performs Keccak operation and uniform sampling on the common random seed ρ to obtain the common polynomial A, and performs a hash compression operation on the random seed ρ2' of the secret polynomial provided by the cooperating terminal, that is, performs Keccak operation and uniform sampling on the random seed ρ2' to obtain the third secret polynomial s1_h and the fourth secret polynomial s2_h; then, the cooperating terminal determines the second public key based on the common polynomial A, the third secret polynomial s1_h, and the fourth secret polynomial s2_h. t_h is calculated using the formula t = As1 + s2, resulting in t_h = As1_h + s2_h. A hash commitment operation is then performed on the second public key t_h to obtain the target commitment value h7. This target commitment value h6 is then sent to the target terminal. Finally, the cooperating terminal sends the second public key t_h to the target terminal, which performs a hash commitment operation on the second public key t_h to obtain a comparison commitment value h8. When the comparison commitment value h8 is the same as the target commitment value h7, it indicates that the second public key t_h sent by the cooperating terminal to the target terminal has not been tampered with, and the second public key provided by the cooperating terminal is trustworthy. This further enhances the security of the public and private keys generated by both ends.

[0064] Then, the target terminal performs an XOR operation on the first public key t_s and the second public key t_h to obtain the intermediate public key t, and performs a hash operation on the public random seed ρ and the intermediate public key t to obtain the compressed public key tr, and determines that the public random seed ρ and the intermediate public key t together constitute the target terminal's negotiation public key (ρ, t); the target terminal determines that the public random seed ρ, the compressed public key tr, the random number parameter K1 provided by the target terminal, the secret polynomials s1_s and s2_s corresponding to the target terminal, and the public key t_h corresponding to the cooperating terminal constitute the target terminal's private key (ρ, tr, K1, s1_s, s2_s, t_h); The process involves the cooperating terminal performing an XOR operation on the first public key t_s and the second public key t_h to obtain the intermediate public key t, and performing a hash operation on the public random seed ρ and the intermediate public key t to obtain the compressed public key tr. The public random seed ρ and the intermediate public key t are then determined to be the cooperating terminal's negotiated public key (ρ, t). The cooperating terminal further determines the public random seed ρ, the compressed public key tr, the random number parameter K2 provided by the cooperating terminal, the secret polynomials s1_h and s2_h corresponding to the cooperating terminal, and the public key t_s corresponding to the target terminal as the cooperating terminal's private key (ρ, tr, K2, s1_h, s2_h, t_s). This significantly improves the security of the negotiated public and private keys on either end. One terminal acts as the signer, using the negotiated public key to sign the message to be signed. The other terminal acts as the verifier, using its private key to verify the signed message, thus achieving secure transmission of the message to be signed.

[0065] Optionally, a commitment key can be obtained by performing a hash operation based on the information to be signed and the target public key, which includes the public key information of both terminals.

[0066] In one optional embodiment, the target terminal performs a hash operation on the message to be signed M and the target public key T to obtain the commitment key ck; similarly, the cooperating terminal performs a hash operation on the message to be signed M and the target public key T to obtain the commitment key ck. The target public key of the public key information of the two terminals is one of the compressed public key tr, the public random seed ρ, and the intermediate public key t. When the target seed is the compressed public key tr, it contains more information and is more secure. Therefore, it is best to use the compressed public key tr as the target seed.

[0067] Optionally, the initial commitment value to be verified is obtained by encrypting the result of the homomorphic hash commitment operation using the commitment key; specifically: a homomorphic hash commitment operation is performed based on the random number provided by the terminal and the intermediate commitment value to obtain an intermediate result; the intermediate result is then encrypted using the commitment key to obtain the initial commitment value to be verified. The intermediate commitment value is obtained by signing the terminal's private key, specifically: a secret value is obtained by hashing the random number parameter stored in the terminal's private key; the secret value is then signed based on a common polynomial.

[0068] In one alternative embodiment, such as Figure 3 As shown, taking the target terminal and cooperating terminal as examples, the target terminal performs a hash operation on the random number parameter K1 in the target terminal's private key (ρ, tr, K1, s1_s, s2_s, t_h) and the preset initial count value to obtain a fixed-length random seed. Then, it performs Keccak operation and uniform sampling on the fixed-length random seed to obtain the secret value y1. Finally, it performs a signature calculation on the secret value y1 based on the common polynomial A to obtain the intermediate commitment value w1. The signature calculation formula is w1 = Ay1. Finally, the target terminal performs a homomorphic hash commitment operation on the random number rand1 and the intermediate commitment value w1 provided by the target terminal to obtain an intermediate result, and encrypts the intermediate result with the commitment key ck to obtain the initial commitment value com1 to be verified, where com1 = Commit(w1, rand1, ck); similarly, the cooperating terminal performs a hash operation on the random number parameter K2 in the cooperating terminal's private key (ρ, tr, K2, s1_h, s2_h, t_s) and the preset initial count value to obtain a fixed-length random seed, and performs Keccak operation and uniform sampling on the fixed-length random seed to obtain the secret value y2. Then, based on the common polynomial A, the secret value y2 is signed to obtain the intermediate commitment value w2; where the signature calculation formula is w2 = Ay2. Finally, the terminal performs a homomorphic hash commitment operation on the random number rand2 and the intermediate commitment value w2 provided by the terminal to obtain an intermediate result, and encrypts the intermediate result with the commitment key ck to obtain the initial commitment value to be verified com2, where com2 = Commit(w2,rand2,ck). By performing a homomorphic hash commitment operation on the random number rand1 and the intermediate commitment value w1 to obtain an intermediate result, and by performing a homomorphic hash commitment operation on the random number rand2 and the intermediate commitment value w2 to obtain an intermediate result, the randomness of the intermediate result is improved, thereby enhancing the signing security of subsequent messages to be signed.

[0069] Optionally, a public commitment value is obtained by performing an XOR operation on the initial commitment values ​​to be verified of the two terminals shared through mutual interaction; a target parameter for reconstructing the intermediate commitment value is obtained by performing a hash derivation operation on the public commitment value, the information to be signed, and the target public key.

[0070] In one alternative embodiment, such as Figure 3As shown, taking the target terminal and cooperating terminal as an example, the target terminal sends the initial commitment value to be verified, com1, to the cooperating terminal. Then, the cooperating terminal performs an XOR operation on the initial commitment value to be verified, com1, and com2 to obtain the common commitment value, com. Finally, the cooperating terminal performs a hash derivation operation based on the common commitment value, com, the information to be signed, M, and the target public key to obtain the target parameters for reconstructing the intermediate commitment value. Similarly, the cooperating terminal sends the initial commitment value to be verified, com2, to the target terminal. Then, the target terminal performs an XOR operation on the initial commitment value to be verified, com1, and com2 to obtain the common commitment value, com. Finally, the target terminal performs a hash derivation operation based on the common commitment value, com, the information to be signed, M, and the target public key to obtain the target parameters for reconstructing the intermediate commitment value. Through the above method, the target terminal and the cooperating terminal can each obtain the target parameters for reconstructing the intermediate commitment value, providing data support for the subsequent calculation of the reconstructed intermediate commitment value.

[0071] Optionally, the step of obtaining target parameters for reconstructing intermediate commitment values ​​by performing hash derivation operations based on the public commitment value, the information to be signed, and the target public key includes: obtaining a challenge value by performing hash derivation operations based on the public commitment value, the information to be signed, and the target public key; determining the response value of each terminal based on the challenge value and the relationship between the challenge and the response, wherein the relationship between the challenge and the response is the relationship between the response value and the challenge value and the secret item, wherein the secret item includes a secret value obtained by hashing the random number parameter stored in the terminal's private key and a secret polynomial; wherein the number of secret polynomials is greater than 1; and determining the challenge value and the response value as target parameters.

[0072] In one alternative embodiment, such as Figure 3 As shown, taking the target terminal and cooperating terminal as examples, the target terminal performs key derivation operations based on the public commitment value com, the information to be signed M, and the target public key to obtain the challenge value c. Then, it uses the challenge value c, the secret value y1, the secret polynomial s1_s, and the second secret polynomial s2_s to determine the first response value z1, that is, it calculates the first response value z1 using the formula z1 = y1 + cs1_s + cs2_s. Similarly, the configuration terminal performs key derivation operations based on the public commitment value com, the information to be signed M, and the target public key to obtain the challenge value c. Then, it uses the challenge value c, the secret value y2, the secret polynomial s1_h, and the second secret polynomial s2_h to determine the first response value z2, that is, it calculates the first response value z2 using the formula z2 = y2 + cs1_h + cs2_h. The target parameters are calculated in the above way to provide data support for the subsequent reconstruction of intermediate commitment values. At the same time, the above method of calculating response values ​​reduces the complexity of subsequent calculations of intermediate commitment values.

[0073] Optionally, the step of obtaining the target parameter for reconstructing the intermediate commitment value by performing hash derivation operation based on the public commitment value, the information to be signed, and the target public key further includes: verifying whether the response value of each terminal meets the preset conditions; if the response value of any terminal does not meet the preset conditions, then after updating the secret item, re-execute the determination of the response value of each terminal based on the challenge value and the relationship between the challenge and the response.

[0074] In one alternative embodiment, such as Figure 3 As shown, taking the target terminal and cooperating terminal as an example, the target terminal verifies whether the first response value z1 meets a preset condition, that is, whether the first response value z1 is less than a preset infinity norm threshold. When the first response value z1 is less than the preset infinity norm threshold, the first response value z1 meets the preset condition, and the target terminal sends the first response value z1 and the random number rand1 to the cooperating terminal; otherwise, the secret item is updated and the process of determining the response value of each terminal based on the challenge value c and the relationship between challenge and response is re-executed until the first response value z1 meets the preset requirement. Similarly, the cooperating terminal verifies whether the second response value z2 meets a preset condition, that is, whether the second response value z2 is less than a preset infinity norm threshold. When the second response value z2 is less than the preset infinity norm threshold, the second response value z2 meets the preset condition, and the cooperating terminal sends the second response value z2 and the random number rand2 to the target terminal; otherwise, the secret item is updated and the process of determining the response value of each terminal based on the challenge value c and the relationship between challenge and response is re-executed until the second response value z2 meets the preset requirement. The above method ensures that the response values ​​from each end meet the signature requirements, guaranteeing the validity of subsequent signatures of messages to be signed. Updating the secret item essentially involves updating the preset initial count value. For example, the target terminal performs a hash operation on the random number parameter K1 in its private key (ρ, tr, K1, s1_s, s2_s, t_h) and the updated preset initial count value to obtain a new fixed-length random seed. Then, it performs a Keccak operation and uniform sampling on the new fixed-length random seed to obtain a new secret value y1.

[0075] Optionally, the result of the homomorphic hash commitment operation is encrypted using the commitment key to obtain the target verification commitment value; wherein, the target commitment is obtained by reconstructing the commitment based on the target parameters, specifically: for either of the two terminals selected as the target terminal, and the other terminal as the cooperating terminal; the target terminal obtains the target commitment by reconstructing the commitment based on the common polynomial, the challenge value, the response value of the cooperating terminal, and the public key of the cooperating terminal.

[0076] In one alternative embodiment, such as Figure 3As shown, taking the target terminal and cooperating terminal as an example, the target terminal calculates the target commitment w3 based on the second response value, the public polynomial A, the challenge value c, and the second public key t_h, that is, it calculates the target commitment w3 using the formula w3 = Az2 - ct_h. The target terminal performs a homomorphic hash commitment operation on the target commitment w3 and the random number rand2 provided by the cooperating terminal to obtain an intermediate result, and encrypts the intermediate result using the commitment key ck to obtain the target verification commitment value com3, where com3 = Commmit(w3, rand2, ck). Similarly, the cooperating terminal calculates the target commitment w4 based on the second response value, the public polynomial A, the challenge value c, and the first public key t_s, that is, it calculates the target commitment w4 using the formula w4 = Az1 - ct_s. The cooperating terminal performs a homomorphic hash commitment operation on the target commitment w4 and the random number rand1 provided by the target terminal to obtain an intermediate result, and encrypts the intermediate result using the commitment key ck to obtain the target verification commitment value com4, where com4 = Commit(w4, rand1, ck). The above method is used to calculate the target verification commitment value, providing data support for the subsequent comparison between the initial commitment value to be verified and the target verification commitment value.

[0077] S105: If the initial commitment value to be verified is consistent with the target commitment value to be verified, then the public commitment value is used to sign the information to be signed.

[0078] In one alternative embodiment, such as Figure 3 As shown, taking the target terminal and the cooperating terminal as examples, when the initial commitment value to be verified com2 in the target terminal is the same as the target verification commitment value com3, and the initial commitment value to be verified com1 in the cooperating terminal is the same as the target verification commitment value com4, it means that the common commitment value com obtained by the two terminals is the same. The two terminals can use the common commitment value com to sign the message M to be signed, thereby realizing the secure signing of the message M to be signed and ensuring that the message M to be signed is not tampered with or leaked.

[0079] The public commitment value in this application is obtained by XOR operation of the initial commitment values ​​to be verified of the two terminals. The initial commitment value to be verified of each terminal is obtained by homomorphic hash commitment operation of the signature calculation result of the public key information stored in the terminal's private key and encryption based on the commitment key. This effectively ensures the confidentiality and randomness of the public commitment value. The process only requires the two terminals to interact and share the initial commitment value to be verified. Compared with conventional data encryption, transmission and decryption operations, it reduces the number of data transmissions and improves the signature verification effect.

[0080] In one optional embodiment, the information to be signed is signed using a public commitment value com and a public response value z, which further enhances the security of the signature. Here, z is obtained by XORing the first response value z1 and the second response value z2.

[0081] In one optional embodiment, the signature information is signed using a public commitment value com, a public response value z, and a public random number rand, which further enhances the security of the signature. Rand is obtained by XORing random numbers ran1 and rand2.

[0082] In one optional embodiment, the verifier is first determined to verify the signed message. Then, the message to be signed, M, the signature, and the negotiated public key (ρ, t) are input to the verifier. The verifier then calculates the public matrix A, the commitment key ck, and the challenge c based on the message M, the signature, and the negotiated public key (ρ, t). Next, the verifier calculates the reconstructed commitment w = Az - ct, and uses the calculated commitment w to open the commitment to obtain the public commitment value com'. If the public commitment value com' is the same as the public commitment com, and the infinity norm of the challenge value z is less than twice the preset infinity norm threshold, the verifier considers the signed message to have passed verification. This method achieves signature verification, ensuring the secure transmission of the message to be signed.

[0083] In one optional embodiment, taking the target terminal and cooperating terminal as examples, the first random seed ρ1 of the public polynomial, the random seed ρ1' of the secret polynomial, and the random number parameter K1 in the target terminal are obtained by performing a key derivation algorithm on a random seed ζ1 randomly generated locally by the target terminal for key generation. That is, the first random seed ρ1, random seed ρ1', and random number parameter K1 are obtained by processing the random seed ζ1 with a key derivation algorithm. Similarly, the second random seed ρ2, random seed ρ2', and random number parameter K2 are obtained by performing a key derivation algorithm on a random seed ζ2 randomly generated locally by the cooperating terminal for key generation. This increases the complexity and security of the public and private keys of the target terminal and the cooperating terminal.

[0084] In one alternative embodiment, the two terminals can be a hardware-based terminal and a software-based terminal, suitable for the software architecture of a mobile phone and the cryptographic hardware device embedded in the mobile phone.

[0085] Reference Figure 4 This specification provides a schematic diagram of a key generation system architecture for two terminals, including a target terminal and a cooperating terminal. The system includes:

[0086] The target terminal and the cooperating terminal perform a hash operation based on the signature information of their respective terminals and the target public key including the public key information of their respective terminals to obtain the commitment key of their respective terminals;

[0087] The target terminal and the cooperating terminal use a commitment key to encrypt the result of the intermediate commitment value of the homomorphic hash commitment operation to obtain the initial commitment value to be verified for their respective terminals; wherein, the intermediate commitment value is obtained by signing the terminal's private key;

[0088] The target terminal and the cooperating terminal obtain a common commitment value based on the XOR operation of their respective initial commitment values ​​to be verified, which are shared through mutual interaction; the target terminal and the cooperating terminal perform hash derivation operations based on their respective common commitment values, the information to be signed, and the target public key to obtain the target parameters used by their respective terminals to reconstruct the intermediate commitment value;

[0089] The target terminal and the cooperating terminal use their respective commitment keys to encrypt the result of the homomorphic hash commitment operation on the target commitment to obtain the target verification commitment value of their respective terminals; wherein, the target commitment is obtained by reconstructing the commitment based on the target parameters;

[0090] If the initial commitment values ​​to be verified of the target terminal and the cooperating terminal are consistent with the target verification commitment values ​​of their respective terminals, then the target terminal and the cooperating terminal use the common commitment values ​​of their respective terminals to sign the information to be signed of their respective terminals.

[0091] Regarding the system in the above embodiments, the process of performing each step has been described in detail in the embodiments of the method, and will not be elaborated here.

[0092] Reference Figure 5 This is a schematic diagram of an electronic device provided as an embodiment of this specification. Refer to the following... Figure 5 The electronic device 300 according to this embodiment of the present invention will be described. Figure 5 The electronic device 300 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0093] like Figure 5 As shown, the electronic device 300 is presented in the form of a general-purpose computing device. The components of the electronic device 300 may include, but are not limited to: at least one processing unit 310, at least one storage unit 320, a bus 330 connecting different device components (including storage unit 320 and processing unit 310), a display unit 340, etc.

[0094] The storage unit stores program code that can be executed by the processing unit 310, causing the processing unit 310 to perform the steps described in the processing method section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 310 can perform, for example... Figure 1 The steps are shown.

[0095] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache storage unit 3202, and may further include a read-only memory unit (ROM) 3203.

[0096] The storage unit 320 may also include a program / utility 3204 having a set (at least one) of program modules 3205, such program modules 3205 including but not limited to: operating devices, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0097] Bus 330 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0098] Electronic device 300 can also communicate with one or more external devices 400 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with the electronic device 300, and / or with any device that enables the electronic device 300 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 350. Furthermore, electronic device 300 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 360. Network adapter 360 can communicate with other modules of electronic device 300 via bus 330. It should be understood that, although... Figure 5 As not shown, other hardware and / or software modules may be used in conjunction with electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID devices, tape drives, and data backup storage devices.

[0099] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described in this invention can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the method described above according to this invention. When the computer instructions are executed by a data processing device, the computer-readable medium is able to implement the method described above, i.e., as follows: Figure 1 The method shown.

[0100] Reference Figure 6 This is a schematic diagram of a computer-readable medium provided for embodiments of this specification.

[0101] accomplish Figure 1 The computer instructions of the method shown can be stored on one or more computer-readable media. A computer-readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0102] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution device, apparatus, or apparatus. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0103] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0104] In summary, this invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that in practice, general-purpose data processing devices such as microprocessors or digital signal processors (DSPs) can be used to implement some or all of the functions of some or all of the components according to the embodiments of the invention. The invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the invention can be stored on a computer-readable medium or can take the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0105] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the present invention is not inherently related to any specific computer, virtual device, or electronic device, and various general-purpose devices can also implement the present invention. The above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0106] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0107] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A key generation method for two terminals, characterized in that, Applied to either end, the method includes: Each terminal obtains a common random seed based on the XOR operation of the random seeds provided by the two terminals through mutual interaction; A public polynomial is obtained by performing hash compression operations based on a public random seed, and a secret polynomial is obtained by performing hash compression operations based on random seeds provided by each terminal. Each terminal determines its public key based on a public polynomial and a secret polynomial within the corresponding terminal. Each terminal obtains an intermediate public key by performing an XOR operation on the public keys of the two terminals shared through mutual interaction. A compressed public key is obtained by hashing based on a public random seed and an intermediate public key. The public random seed and the intermediate public key are determined to be the negotiation public key for any terminal; the public random seed, the compressed public key, the random number parameters provided by each terminal, the secret polynomial corresponding to each terminal, and the public key corresponding to another terminal are determined to be the private key for any terminal.

2. The method as described in claim 1, characterized in that, Each terminal obtains a common random seed based on an XOR operation of the random seeds provided by the two terminals through mutual interaction, including: Verify the reliability of the random seeds provided by each terminal.

3. The method as described in claim 2, characterized in that, The verification of the trustworthiness of the random seeds provided by each terminal includes: One of the two terminals is selected as the target terminal, and the other terminal is the cooperating terminal; Within the target terminal, a hash commitment operation is performed on the random seed provided by the target terminal to obtain the target commitment value; and the random seed and target commitment value of the target terminal are sent to the cooperating terminal. The comparison commitment value is obtained by performing a hash commitment operation on the random seed provided by the target terminal within the cooperating terminal; If the target commitment value matches the comparison target commitment value, then the random seed provided by the target terminal is reliable.

4. The method as described in claim 2, characterized in that, The verification of the trustworthiness of the random seeds provided by each terminal also includes: One of the two terminals is selected as the target terminal, and the other terminal is the cooperating terminal; Within the cooperating terminal, a hash commitment operation is performed on the random seed provided by the target terminal to obtain the target commitment value; and the random seed and target commitment value of the cooperating terminal are sent to the target terminal. Within the target terminal, a hash commitment operation is performed on the random seed provided by the terminal to obtain a comparison commitment value; If the target commitment value matches the comparison target commitment value, then the random seed provided by the terminal is reliable.

5. The method as described in claim 1, characterized in that, Each terminal obtains an intermediate public key based on an XOR operation of the public keys of the two terminals shared through mutual interaction, and also includes: Verify the trustworthiness of the public keys provided by each terminal.

6. The method as described in claim 5, characterized in that, The verification of the trustworthiness of the public keys provided by each terminal includes: One of the two terminals is selected as the target terminal, and the other terminal is the cooperating terminal; Within the target terminal, perform a hash commitment operation on the public key provided by the target terminal to obtain the target commitment value; and send the public key of the target terminal and the target commitment value to the cooperating terminal; The comparison commitment value is obtained by performing a hash commitment operation on the public key provided by the target terminal within the cooperating terminal; If the target commitment value matches the comparison commitment value, then the public key provided by the target terminal is trustworthy.

7. The method as described in claim 5, characterized in that, The verification of the trustworthiness of the public keys provided by each terminal also includes: One of the two terminals is selected as the target terminal, and the other terminal is the cooperating terminal; Within the cooperating terminal, a hash commitment operation is performed on the public key provided by the cooperating terminal to obtain the target commitment value; and the public key of the cooperating terminal and the target commitment value are sent to the target terminal. Within the target terminal, a hash commitment operation is performed on the public key provided by the target terminal to obtain a comparison commitment value; If the target commitment value matches the comparison target commitment value, then the public key provided by the terminal is trusted.

8. A key generation system for two terminals, characterized in that, The system includes a target terminal and a cooperating terminal. The target terminal and the cooperating terminal obtain a common random seed based on the XOR operation of the random seeds provided by the two terminals through mutual interaction; The target terminal and cooperating terminals perform hash compression operations based on a common random seed to obtain a common polynomial, and perform hash compression operations based on the random seeds provided by each terminal to obtain the secret polynomial of each terminal. The target terminal and the cooperating terminal determine the public key of each terminal based on the public polynomial and the secret polynomial in the corresponding terminal. Each terminal obtains the intermediate public key based on the XOR operation of the public keys of the two terminals shared by both parties. The target terminal and the cooperating terminal respectively perform hash operations based on a public random seed and an intermediate public key to obtain the compressed public key of each terminal; The target terminal and the cooperating terminal jointly determine a public random seed and an intermediate public key as the public key negotiated between the two terminals; the target terminal determines a public random seed, a compressed public key, random number parameters provided by the target terminal, a secret polynomial corresponding to the target terminal, and a public key corresponding to the cooperating terminal as the private key of the target terminal; the cooperating terminal determines a public random seed, a compressed public key, random number parameters provided by the cooperating terminal, a secret polynomial corresponding to the cooperating terminal, and a public key corresponding to the target terminal as the private key of the cooperating terminal.

9. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores computer instructions and the processor is configured to execute the computer instructions to perform the method according to any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores computer instructions that, when executed by a processor, perform the method as described in any one of claims 1 to 7.

Images