Digital signature method, electronic device, and non-transitory machine-readable storage medium

Abstract

The embodiments of the present application provide a digital signature method, an electronic device, and a non-temporary machine-readable storage medium, which are applied to the field of information security technology, and generate a digital signature key pair through collaboration between two parties, wherein the key pair contains two private keys, which are privately stored by the two devices respectively. When one of the devices needs to send a message with a digital signature, the digital signature is collaboratively completed by using the lattice-based rejected LWE assumption as the security basis, ensuring that the digital signature requires both parties to complete the digital signature using their own private keys, and that their own private keys will not be exposed during the signing process. Neither party can complete the digital signature, and even if the private key of either party is illegally stolen, the thief cannot forge the signature. In addition, the digital signature generated by this solution can be verified by the verification algorithm of ML‑DSA, which is more compatible with the previous digital signature system. In the scenario where the original signature mechanism is improved, the modification cost is low.

Description

Technical Field

[0001] The present application relates to the technical field of cryptography, and in particular to a digital signature method, an electronic device, and a non-transitory machine-readable storage medium. Background Art

[0002] Post-quantum cryptography (PQC), also known as quantum-resistant cryptography, is a field of cryptography designed to resist attacks based on quantum computers. With the advancement of quantum computing technology, digital signature schemes within post-quantum cryptography have been applied in a variety of scenarios.

[0003] In post-quantum cryptography, digital signature schemes, such as Module Lattice-Based Digital Signature (ML-DSA), typically involve the sender storing the private key from a key pair. When signing a message, the sender uses its own private key to sign the message. The sender then sends the message and the signature to the recipient. The recipient then obtains the public key from the key pair and uses it to verify the signature and message.

[0004] However, the private key is stored in the sender's device. Once the sender's device is attacked, the private key in the digital signature key pair may be leaked. The attacker can then use the private key to forge the digital signature of the sender's device, which is not very secure. Summary of the Invention

[0005] Embodiments of the present application provide a digital signature method, an electronic device, and a non-transitory machine-readable storage medium to improve the convenience of prompt word input.

[0006] In a first aspect, an embodiment of the present application provides a digital signature method, which is applied to a first device, wherein the first device and a second device collaboratively generate a digital signature key pair, wherein the digital signature key pair includes a public key, a first private key, and a second private key, wherein the first device stores the first private key; the second device stores the second private key; the first private key includes a first matrix, and the second private key includes the first matrix; the method includes:

[0007] generating a first random vector and a second random vector;

[0008] obtaining a first variable value according to the first matrix, the first random vector, and the second random vector, and sending the first variable value to the second device;

[0009] receiving a second variable value sent by the second device, where the second variable value is obtained by the second device according to the first matrix, the third random vector, and the fourth random vector;

[0010] Generate a first signature value according to the first random vector, the first variable value, the second variable value, the message, and the first private key;

[0011] receiving a second signature value sent by the second device, where the second signature value is generated by the second device according to the third random vector, the first variable value, the second variable value, a message, and the second private key;

[0012] Generate a target signature corresponding to the message according to the first signature value, the second signature value, the public key and the first matrix.

[0013] In one embodiment, obtaining a first variable value according to the first matrix, the first random vector, and the second random vector includes:

[0014] Obtaining a first product value between the first matrix and the first random vector;

[0015] Obtaining the sum of the first product value and the second random vector to obtain the first variable value;

[0016] Correspondingly, the second variable value is obtained by the second device obtaining a second product value between the first matrix and the third random vector, and obtaining the sum of the second product value and the fourth random vector.

[0017] In one embodiment, the public key includes a private key component; and generating a first signature value according to the first random vector, the first variable value, the second variable value, the message, and the first private key includes:

[0018] Generate a first signature factor according to the first variable value, the second variable value, and the message;

[0019] Generate a first signature value according to the first random vector, the first signature factor, and the first private key;

[0020] Generating a target signature corresponding to the message according to the first signature value, the second signature value, the public key, and the first matrix includes:

[0021] Obtaining the sum of the first signature value and the second signature value to obtain a second signature factor;

[0022] generating a third signature factor based on the first signature factor, the second signature factor, the private key component, and the first matrix;

[0023] The target signature is composed of the first signature factor, the second signature factor, and the third signature factor.

[0024] In one embodiment, generating a first signature factor according to the first variable value, the second variable value, and the message includes:

[0025] Obtaining a total variable value according to the first variable value and the second variable value;

[0026] Perform hash processing on the message and the total variable value to obtain the first signature factor.

[0027] In one embodiment, the method further comprises:

[0028] generating a first random matrix, a fifth random vector, and a sixth random vector;

[0029] Sending the first random matrix and the first hash value to the second device;

[0030] receiving a second random matrix and a second hash value sent by the second device, where the second hash value is obtained by the second device by performing a hash operation on the second random matrix;

[0031] Verifying the second random matrix based on the first hash value, and if the verification passes, synthesizing the first random matrix and the second random matrix to obtain a first matrix;

[0032] Obtaining a first sum value according to the first matrix, the fifth random vector, and the sixth random vector;

[0033] sending the first sum and a third hash value to the second device, where the third hash value is obtained by performing a hash operation on the first sum, so that the second device verifies the first sum based on the third hash value; if the verification is successful, the first matrix, the second sum, the generated seventh random vector, and the eighth random vector constitute the second private key; and the second sum is obtained based on the first matrix, the seventh random vector, and the eighth random vector;

[0034] The first private key is composed of the first matrix, the first sum, the fifth random vector, and the sixth random vector.

[0035] In one embodiment, generating a first signature value according to the first random vector, the first signature factor, and the first private key includes:

[0036] Sampling the first signature factor to obtain a sampled first signature factor;

[0037] Obtaining a third product value of the sampled first signature factor and the fifth random vector;

[0038] Obtaining a sum of the third product value and the first random vector to obtain a first signature value;

[0039] Correspondingly, the second signature value is obtained by the second device sampling the first signature factor to obtain the sampled first signature factor; obtaining the fourth product value of the sampled first signature factor and the seventh random vector; and obtaining the sum of the fourth product value and the first random vector.

[0040] In a second aspect, an embodiment of the present application provides a digital signature method, which is applied to a second device, where the second device and the first device collaboratively generate a digital signature key pair, where the digital signature key pair includes a public key, a first private key, and a second private key, wherein the first device stores the first private key; the second device stores the second private key; the first private key includes a first matrix, and the second private key includes the first matrix; the method includes:

[0041] receiving a first variable value sent by the first device, where the first variable value is obtained by the first device according to the first matrix, the first random vector, and the second random vector;

[0042] generating a third random vector and a fourth random vector;

[0043] Obtaining a second variable value according to the first matrix, the third random vector, and the fourth random vector;

[0044] sending the second variable value to the first device;

[0045] receiving a first signature value sent by the first device, where the first signature value is generated by the first device according to the first random vector, the first variable value, the second variable value, a message, and the first private key;

[0046] Generate a second signature value according to the third random vector, the first variable value, the second variable value, the message, and the second private key;

[0047] The second signature value is sent to the first device, so that the first device generates a target signature corresponding to the message according to the first signature value, the second signature value, the public key and the first matrix.

[0048] In a third aspect, an embodiment of the present application provides an electronic device comprising: a memory, a processor, and a communication interface; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the digital signature method as described in the first aspect.

[0049] In a fourth aspect, an embodiment of the present application provides an electronic device comprising: a memory, a processor, and a communication interface; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the digital signature method as described in the second aspect.

[0050] In a fifth aspect, an embodiment of the present application provides a non-temporary machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of an electronic device, the processor can at least implement the digital signature method described in the first aspect.

[0051] In the sixth aspect, an embodiment of the present application provides a non-temporary machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of an electronic device, the processor can at least implement the digital signature method described in the second aspect.

[0052] In a seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it can implement the digital signature method described in the first aspect.

[0053] In an eighth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it can implement the digital signature method described in the second aspect.

[0054] In the digital signature scheme provided in the embodiment of the present application, a digital signature key pair is generated by two parties in collaboration, wherein the key pair contains two private keys, which are privately stored by two devices respectively, and the public key in the key pair is publicly shared. When one of the devices needs to send a message with a digital signature, the rejected learning with errors (rejected LWE) assumption based on the lattice is used as the security basis to achieve collaborative completion of the digital signature, ensuring that the digital signature requires both parties to complete the digital signature using their own private keys, and their own private keys will not be exposed during the signing process. Neither party can complete the digital signature, and even if the private key of either party is illegally stolen, the thief cannot forge the signature. In addition, the digital signature generated by this scheme can be verified by the verification algorithm of ML-DSA, which is more compatible with the previous digital signature system. In the scenario where the original signature mechanism is improved, the cost of modifying the original signature mechanism is low. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present application, a brief introduction will be given below to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0056] Figure 1 A schematic diagram of the structure of a digital signature generation system provided in an embodiment of the present application;

[0057] Figure 2 An interactive diagram of a digital signature method provided in an embodiment of the present application;

[0058] Figure 3 An interactive diagram of a method for generating a key for a digital signature provided in an embodiment of the present application;

[0059] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. In addition, the step timing in the following method embodiments is only an example and not a strict limitation.

[0061] It should be noted that when the embodiments of this application involve user information, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation portals for users to choose to authorize or refuse. In addition, the various models involved in this application (including but not limited to large language models or other models) are in compliance with relevant laws and standards.

[0062] In post-quantum cryptography, digital signature schemes, such as ML-DSA, typically involve the sender's device storing the private key from a key pair. When the sender needs to sign a message, it uses its stored private key to sign the message, resulting in a signature consisting of three signature factors. The sender then sends the message and the signature to the recipient. The recipient can then obtain the public key from the key pair and use it to verify the signature and message. In the present embodiments, a digital signature may also be referred to as a signature.

[0063] With the emergence of smart terminals and the development of network technology, new services such as mobile payments and mobile office have emerged. These new services require terminal operations, making cryptographic technology indispensable to protecting user privacy and security. Digital signature technology is a key technology, ensuring transaction data integrity, non-repudiation, and identity authentication.

[0064] The private key used by the terminal for digital signature is stored in the memory, and the terminal is relatively vulnerable to attack. The private key may be stolen, posing a hidden danger to the terminal's information security.

[0065] Taking the above situation into consideration, an embodiment of the present application provides a digital signature scheme, in which two parties collaborate to generate a digital signature key pair, wherein the key pair contains two private keys, which are privately stored by two devices respectively, and the public key in the key pair is publicly shared. When one of the devices needs to send a message with a digital signature, the rejected learning with errors (rejected LWE) assumption based on the lattice is used as the security basis to achieve collaborative completion of the digital signature, ensuring that the digital signature requires both parties to complete the digital signature using their own private keys, and their own private keys will not be exposed during the signing process. Neither party can complete the digital signature, and even if the private key of either party is illegally stolen, the thief cannot forge the signature. In addition, the digital signature generated by this scheme can be verified by the verification algorithm of ML-DSA, which is more compatible with the previous digital signature system. In the scenario where the original signature mechanism is improved, the cost of modifying the original signature mechanism is low.

[0066] See also Figure 1 , Figure 1 This is a schematic diagram of the structure of a digital signature generation system provided in an embodiment of the present application. The digital signature generation system includes a first device and a second device. The first device and the second device collaborate to generate a digital signature key pair, which includes a public key, a first private key, and a second private key. The first device stores the first private key. The second device stores the second private key. The first private key includes a first matrix. The second private key also includes the first matrix.

[0067] Typically, either the first device or the second device is the signature initiator. This embodiment of the present application uses the first device as the signature initiator for illustrative purposes. Both the first device and the second device can be electronic devices, such as personal computers, mobile phones, tablets, smart wearable devices, application programs, and servers. For example, in scenarios such as mobile payment, the first device can be a terminal and the second device can be a server.

[0068] In an embodiment of the present application, when a first device needs to sign a message, the first device can generate a first random vector and a second random vector. Based on the LWE-rejection assumption, the first device can obtain a first variable value from the first matrix, the first random vector, and the second random vector. The first variable value is then sent to the second device. Based on the LWE-rejection assumption, the second device can obtain a second variable value from the first matrix, a third random vector generated by itself, and a fourth random vector. The second variable value is then sent to the first device. This ensures that the random numbers generated by each device are private and not leaked during the signing process. The first and second devices generate their own signature values using the random vectors they generate, the first variable value, the second variable value, the message, and their own private keys. The first and second devices then exchange their generated signature values, thus completing the distributed signing process. The first device obtains the target signature corresponding to the generated message based on the first signature value, the second signature value, the first signature factor, the public key, and the first matrix. Based on the LWE-rejection assumption of the lattice, the first and second devices collaborate to sign through two interactions without leaking their own random vectors. Digital signatures require both parties to complete the digital signature using their own private keys, and neither party is exposed during the signing process, ensuring that neither party is able to complete the digital signature. Even if either party's private key is illegally stolen, the thief cannot forge the signature. Furthermore, the digital signature generated by this solution can be verified using the ML-DSA verification algorithm, providing better compatibility with existing digital signature systems. This reduces the cost of modifying the original signature mechanism when improving it.

[0069] The following describes in detail the execution process of the digital signature method provided in the embodiment of the present application with reference to the accompanying drawings.

[0070] Figure 2 This is an interactive diagram of a digital signature method provided in an embodiment of the present application, such as Figure 2 As shown, the first device and the second device jointly generate a digital signature key pair, which includes a public key, a first private key, and a second private key. The first device stores the first private key, which includes the first matrix. The second device stores the second private key, which includes the first matrix. This method can be applied to the above Figure 1The digital signature system shown in FIG. 1 includes the following steps:

[0071] 201. A first device generates a first random vector and a second random vector, obtains a first variable value according to a first matrix, the first random vector, and the second random vector, and sends the first variable value to a second device.

[0072] 202. The second device generates a third random vector and a fourth random vector, obtains a second variable value according to the first matrix, the third random vector, and the fourth random vector, and sends the second variable value to the first device.

[0073] 203. The first device generates a first signature value according to the first random vector, the first variable value, the second variable value, the message, and the first private key.

[0074] 204. The second device generates a second signature value according to the third random vector, the first variable value, the second variable value, the message, and the second private key, and sends the second signature value to the first device.

[0075] 205. The first device generates a target signature corresponding to the message according to the first signature value, the second signature value, the public key, and the first matrix.

[0076] In actual applications, the first device and the second device collaboratively generate a digital signature key pair. This digital signature key pair is referred to herein as a key pair. The key pair includes a publicly shared public key, a first private key privately stored by the first device, and a second private key privately stored by the second device. It is understood that the first private key of the first device and the second private key of the second device have the same structure, but some or all of the contents of the private key of either device are not accessible to the other device.

[0077] After the first device and the second device have collaboratively generated a digital signature key pair, if either device needs to digitally sign a message, the two devices can collaboratively generate the digital signature. The following example uses the first device as the initiator of the digital signature as an example, but it should be understood that this does not constitute a limitation of this application.

[0078] The first device and the second device can respectively use the two generated random vectors to generate their own variable values. Specifically, the first device generates the first random vector and the second random vector, obtains the first variable value based on the first matrix, the first random vector and the second random vector, and sends the first variable value to the second device. The generated first random vector and the second random vector are private to the first device, and other devices including the second device are not aware of the first random vector and the second random vector. Based on the rejection of the LWE assumption, the first variable value is obtained based on the first matrix, the first random vector and the second random vector, so that even if the first variable value and the first matrix are known, the first random vector and the second random vector cannot be inferred, and the device can resist the attack of quantum computers.

[0079] In an optional embodiment, the first device may obtain the first variable value by: obtaining a first product value between the first matrix and the first random vector, and obtaining the sum of the first product value and the second random vector to obtain the first variable value.

[0080] For example, the first device randomly generates a first random vector , and the second random vector ,in, , , is a security parameter. Get the first matrix A. Get the first matrix A and the first random vector The first product value between . Get the first product value With the second random vector The sum of the first variable is obtained .Right now .

[0081] Accordingly, the second device generates a third random vector and a fourth random vector, obtains the value of the second variable based on the first matrix, the third random vector, and the fourth random vector, and sends the second variable value to the first device. The generated third and fourth random vectors are private to the second device and are unknown to other devices, including the first device. Furthermore, based on the rejection of the LWE assumption, the value of the second variable is obtained based on the first matrix, the third random vector, and the fourth random vector. This ensures that even if the value of the second variable and the first matrix are known, the third and fourth random vectors cannot be inferred, thereby resisting attacks by quantum computers.

[0082] In an optional embodiment, the second device may obtain the second variable value by: obtaining a second product value between the first matrix and the third random vector, and obtaining the sum of the second product value and the fourth random vector to obtain the second variable value.

[0083] For example, the second device randomly generates a third random vector , and the fourth random vector ,in, , , Is a security parameter. Get the first matrix A. Get the first matrix A and the third random vector The second product value between . Get the second product value With the fourth random vector The sum of the two variables gives the value of the second variable. .Right now .

[0084] At this point, the first and second devices have each obtained their own variable values and sent them to each other. They then each perform a distributed signature on the message using their own private keys. The first device generates a first signature value based on the first random vector, the first and second variable values, the message, and the first private key.

[0085] In an optional embodiment, the first device generates a first signature factor based on the first variable value, the second variable value, and the message. It will be appreciated that the target signature corresponding to the message contains three signature factors, one of which is the first signature factor. A first signature value is generated based on the first random vector, the first signature factor, and the first private key.

[0086] Optionally, the first private key stored in the first device also includes: a fifth random vector and a sixth random vector. After the first device obtains the first signature factor, the implementation process of generating the first signature value may be: sampling the first signature factor to obtain the sampled first signature factor; obtaining a third product value of the sampled first signature factor and the fifth random vector; and obtaining the sum of the third product value and the first random vector to obtain the first signature value.

[0087] For example, the first device determines the value of the first variable , the second variable value Get the total variable value .calculate ,in, is the signature range parameter, Used to extract the high-order bits from the data input to this function. Indicates from Extract higher Bit value. First signature factor , hash() represents hash processing or hash operation, m is the message, It is a safety parameter. Indicates concatenation or connection. For the first signature factor Perform sampling to obtain the first signature factor after sampling , which can be expressed as The first random vector is , the fifth random vector in the first private key is , then you can get the first signature factor With the fifth random vector The third product value of , get the third product value With the first random vector The sum of the two gets the first signature value. ,Right now .

[0088] Correspondingly, the second device generates a second signature value according to the third random vector, the first variable value, the second variable value, the message and the second private key.

[0089] In an optional embodiment, the second device generates the first signature factor based on the first variable value, the second variable value, and the message. The process of generating the first signature factor by the second device is the same as that of the first device and is not further described here.

[0090] Optionally, the second private key stored in the second device also includes: a seventh random vector and an eighth random vector. After the second device obtains the first signature factor, the second signature value may be generated by: sampling the first signature factor to obtain a sampled first signature factor; obtaining a fourth product value of the sampled first signature factor and the seventh random vector; and obtaining the sum of the fourth product value and the third random vector to obtain the second signature value.

[0091] For example, the second device determines the value of the first variable , the second variable value Get the total variable value .calculate ,in, is the signature range parameter, Used to extract the high-order bits from the data input to this function. Indicates from Extract higher Bit value. First signature factor , hash() represents hash processing or hash operation, m is the message, is a safety parameter, Indicates concatenation or connection. For the first signature factor Perform sampling to obtain the first signature factor after sampling , which can be expressed as The third random vector is , the seventh random vector in the second private key is , then you can get the first signature factor and the seventh random vector is The fourth product value , get the fourth product value and the third random vector is The sum of the two gets the second signature value. ,Right now .

[0092] In addition, the first device and the second device in the embodiment of the present application collaboratively generate a target signature based on a lattice-based digital signature algorithm. Therefore, the generated signature value should satisfy the mathematical difficulty problem of the lattice. Only in this way can the generated target signature be more resistant to quantum computer attacks. In an optional embodiment, after the first device generates the first signature value, it can also verify whether the first signature value satisfies the mathematical difficulty problem of the lattice. If it does, the collaborative signing continues. If not, the first device re-determines the value of the first variable used for signing. Similarly, after the second device generates the second signature value, it can also verify whether the second signature value satisfies the mathematical difficulty problem of the lattice. This operation will not be repeated here.

[0093] Since the signature is initiated by the first device, the second device sends the second signature value to the first device, and the first device proceeds with the subsequent signing process. Furthermore, after sending the second signature value, the second device completes the current signature and can proceed with the subsequent signing process. The subsequent signing process is identical to that of the first device. Therefore, to avoid further details, we will only describe the subsequent signing process of the first device.

[0094] The first device generates a target signature corresponding to the message according to the first signature value, the second signature value, the public key and the first matrix.

[0095] In an optional embodiment, the public key includes a private key component, and the target signature may be generated by obtaining the sum of the first signature value and the second signature value to obtain the second signature factor. A third signature factor is generated based on the first signature factor, the second signature factor, the private key component, and the first matrix. The target signature is then obtained based on the first signature factor, the second signature factor, and the third signature factor.

[0096] For example, following the above example, the first signature value is , the second signature value is , get the first signature value With the second signature value The sum of the two gets the second signature factor ,Right now . Calculate the third signature factor , where c is the first signature factor after sampling, is the low bit of the private key component, is the high bit of the private key component, is the system parameter, is the signature range parameter, To extract the high bit function. Output the target signature , is the first signature factor, z is the second signature factor, and h is the third signature factor.

[0097] In this embodiment, when a first device needs to sign a message, it can generate a first random vector and a second random vector. Based on the LWE-rejection assumption, it can obtain a first variable value from the first matrix, the first random vector, and the second random vector. The first variable value is then sent to the second device. The second device, based on the LWE-rejection assumption, can obtain a second variable value from the first matrix, a third random vector generated by itself, and a fourth random vector. The second variable value is then sent to the first device. This ensures that the random numbers generated by each device are private and cannot be leaked during the signing process. The first and second devices use the random vectors they generate, the first variable value, the second variable value, the message, and their own private keys to generate their own signature values. The first and second devices then exchange their generated signature values, completing the distributed signing process. The first device obtains the target signature corresponding to the generated message based on the first signature value, the second signature value, the first signature factor, the public key, and the first matrix. Based on the LWE-rejection assumption of the lattice, the first and second devices collaborate to sign through two interactions without leaking their own random vectors. Digital signatures require both parties to complete the digital signature using their own private keys, and neither party is exposed during the signing process, ensuring that neither party is able to complete the digital signature. Even if either party's private key is illegally stolen, the thief cannot forge the signature. Furthermore, the digital signature generated by this solution can be verified using the ML-DSA verification algorithm, providing better compatibility with existing digital signature systems. This reduces the cost of modifying the original signature mechanism when improving it.

[0098] The following describes a method for generating a key for a digital signature provided by the present application. It will be understood that the method of this embodiment can be executed alone or in combination with the digital signature method of the above embodiment. If this embodiment is executed in combination with the digital signature method of the above embodiment, the method of this embodiment is executed before the digital signature method of the above embodiment, and is a process for the first device and the second device to collaboratively generate a digital signature key pair. That is, after the first device and the second device collaboratively generate a digital signature key pair, the public key in the key pair can be publicly shared, and the first device and the second device each privately save their own private key. When the first device and / or the second device needs to generate a signature, the digital signature method provided in the above embodiment is used to obtain the signature.

[0099] See also Figure 3 , Figure 3 This is an interactive diagram of a method for generating a key for a digital signature provided in an embodiment of the present application. The method provided in this embodiment includes the following steps:

[0100] 301. A first device generates a first random matrix, a fifth random vector, and a sixth random vector, performs a hash operation on the first random matrix to obtain a first hash value, and sends the first random matrix and the first hash value to a second device.

[0101] 302. The second device generates a second random matrix, a seventh random vector, and an eighth random vector, performs a hash operation on the second random matrix to obtain a second hash value, and sends the second random matrix and the second hash value to the second device.

[0102] 303. The first device verifies the second random matrix based on the second hash value. If the verification passes, the first random matrix and the second random matrix are combined to obtain a first matrix. A first sum is obtained based on the first matrix, the fifth random vector, and the sixth random vector. A hash operation is performed on the first sum to obtain a third hash value. The first sum and the third hash value are sent to the second device.

[0103] 304. The second device verifies the first random matrix based on the first hash value. If the verification passes, the second device combines the first random matrix and the second random matrix to obtain a first matrix. A second sum is obtained based on the first matrix, the seventh random vector, and the eighth random vector. A hash operation is performed on the second sum to obtain a fourth hash value. The second sum and the fourth hash value are sent to the first device.

[0104] 305. The first device performs verification using the second sum and the fourth hash value. If the verification passes, the first matrix, the first sum, the fifth random vector, and the sixth random vector constitute a first private key.

[0105] 306. The second device performs verification using the first sum and the third hash value. If the verification passes, the first matrix, the second sum, the seventh random vector, and the eighth random vector constitute a first private key.

[0106] In some embodiments, the first device and / or the second device outputs a public key composed of a public matrix and a private key component, wherein the public matrix is obtained by the first matrix and the identity matrix, and the private key component is obtained by the first sum and the second sum.

[0107] In practical applications, the first device generates a first random matrix and performs a hash operation on the first random matrix to obtain a hash value corresponding to the first random matrix. The hash value and the first random matrix are then sent to the second device. The second device generates a second random matrix and performs a hash operation on the second random matrix to obtain a hash value corresponding to the second random matrix. The hash value and the second random matrix are then sent to the first device. The exchange of randomly generated random matrices between the first and second devices ensures that both parties have a common basis for randomness, and that the generation of the first and second random matrices is independent of each other's device, thereby increasing the security of the method.

[0108] The first random matrix and the second random matrix may be a k×l matrix. Alternatively, a k×l matrix may be randomly and uniformly selected from the ring Rq as the first random matrix. A k×l matrix may be randomly and uniformly selected from the ring Rq as the second random matrix.

[0109] The first device receives the second random matrix and the hash value corresponding to the second random matrix sent by the second device, and verifies the second random matrix using the hash value corresponding to the second random matrix. If the verification is successful, the first random matrix and the second random matrix are synthesized to obtain the first matrix. Similarly, the second device receives the first random matrix and the hash value corresponding to the first random matrix sent by the first device, and verifies the first random matrix using the hash value corresponding to the first random matrix. If the verification is successful, the first random matrix and the second random matrix are synthesized to obtain the first matrix.

[0110] The first device and the second device exchange hash values to verify whether the other party has generated a random matrix. Specifically, the first device can perform a hash operation on the second random matrix to obtain a result. If the result is equal to the hash value corresponding to the received second random matrix, the verification is successful, indicating that the second device has indeed generated a second random matrix. Similarly, the second device can perform a hash operation on the received first random matrix to obtain a result. If the result is equal to the hash value corresponding to the received first random matrix, the verification is successful, indicating that the first device has indeed generated a second random matrix.

[0111] Optionally, the first random matrix and the second random matrix are synthesized to obtain the first matrix in a specific implementation manner: determining the sum of the first random matrix and the second random matrix, and determining the sum as the first matrix. For example, the first random matrix is , the second random matrix is , then the first matrix obtained is A, .

[0112] In practical applications, the signature public key is typically public. If the first matrix is directly used as part of the signature public key, then if an attacker obtains the random matrix corresponding to either end, they can directly infer the random matrix corresponding to the other end based on the first matrix and the random matrix corresponding to one end, and then forge the corresponding target signature, thus threatening the security of the target signature. Therefore, to improve the security of this signature method, after obtaining the first matrix, a public matrix can be determined based on the first matrix and the identity matrix, and this public matrix can be used as part of the signature public key.

[0113] Optionally, a specific implementation method for determining the common matrix can be: horizontally concatenate the first matrix and the identity matrix to obtain the first matrix. The first matrix can be a k×l matrix whose elements come from the ring Rq, and the identity matrix can be a k×k matrix whose diagonal elements are all identity elements in Rq. Then the common matrix obtained is a For example, the first matrix is , the identity matrix is , the obtained common matrix is .

[0114] In addition, after obtaining the first matrix, the first device may generate a fifth random vector and a sixth random vector, and generate a first private key corresponding to the first device based on the first matrix, the fifth random vector, and the sixth random vector, wherein the first private key includes the first matrix, the fifth random vector, and the sixth random vector. The second device generates a seventh random vector and an eighth random vector, and generates a second private key corresponding to the second device based on the first matrix, the seventh random vector, and the eighth random vector, wherein the second private key includes the first matrix, the seventh random vector, and the eighth random vector.

[0115] To improve the security of the private keys generated for the first device and the second device, when generating the corresponding private keys, after the first device generates the fifth and sixth random vectors, the first sum corresponding to the first device can be determined based on the first matrix, the fifth and sixth random vectors. Similarly, the second device can determine the second sum corresponding to the second device based on the first matrix, the seventh and eighth random vectors.

[0116] In an optional embodiment, the product value of the first matrix and the fifth random vector is obtained, and the first sum value of the product value and the sixth random vector is obtained. For example, continuing the above example, the first matrix is A, the fifth random vector is , the sixth random vector is , then the first sum is The value ranges of the fifth and sixth random vectors can also be specified. , .

[0117] For the second device, the product value of the first matrix and the seventh random vector can be obtained, and the second sum value of the product value and the eighth random vector can be obtained. For example, the first matrix is A, and the seventh random vector is , the eighth random vector is , then the second sum is The value ranges of the seventh and eighth random vectors can also be specified. , .

[0118] After obtaining the first sum, the first device may perform a hash operation on the first sum to obtain a third hash value, and send the first sum and the third hash value to the second device. After obtaining the second sum, the second device may perform a hash operation on the second sum to obtain a fourth hash value, and send the second sum and the fourth hash value to the first device. The first device verifies the fourth hash value. If the verification passes, it synthesizes the first sum and the second sum to obtain a private key component, and determines the signature public key based on the public matrix and the private key component. The first device determines the first private key based on the target matrix, the private key component, the fifth random vector, and the sixth random vector. The second device verifies the third hash value. If the verification passes, it synthesizes the first sum and the second sum to obtain a private key component, and determines the second private key based on the first matrix, the private key component, the seventh random vector, and the eighth random vector.

[0119] For example, the first matrix is A and the first sum is , the second sum is , the private key component is , the fifth random vector is , the sixth random vector is , the seventh random vector is , the eighth random vector is , the confirmed signature public key is , the first private key corresponding to the first device is , the second private key corresponding to the second device is .

[0120] In the method provided in this embodiment, a first device generates a first random matrix, performs a hash operation on the first random matrix to obtain a first hash value, and sends the first random matrix and the first hash value to a second device. Similarly, the second device generates a second random matrix, performs a hash operation on the second random matrix to obtain a second hash value, and sends the second random matrix and the second hash value to the first device. Next, the first device verifies the second random matrix based on the second hash value. If the verification passes, the first random matrix and the second random matrix are combined to obtain the first matrix. Similarly, the second device verifies the first random matrix based on the first hash value. If the verification passes, the first random matrix and the second random matrix are combined to obtain the first matrix. At this point, the first and second devices have securely transferred their generated random matrices to each other through hash operations. The first device then generates a fifth random vector and a sixth random vector, and generates a first private key based on the target matrix, the fifth random vector, and the sixth random vector. The second device generates a seventh random vector and an eighth random vector, and generates a second private key based on the target matrix, the seventh random vector, and the eighth random vector. Finally, a signature public key is generated according to the target matrix, the fifth random vector, the sixth random vector, the seventh random vector, and the eighth random vector.

[0121] To facilitate understanding of the digital signature implementation process, let's illustrate it with reference to a specific application scenario. For this specific application, assume that the first device is a client device, the second device is a server device, and the server can be a cloud server. The specific implementation process can include the following steps.

[0122] Step 1: Get system parameters.

[0123] The system parameters include n, k, l, q, η, τ, γ, γ ', and β. n is the degree of the polynomial in the ring R, k and l are the number of rows and columns of the first matrix A, q is the modulus, η is the range of the private key, and τ is the number of ±1 in c. 、 is the signature range parameter, and β is the signature interception parameter.

[0124] Step 2: Generate a signing key.

[0125] The client device and the server device collaborate to generate their respective private keys and signature public keys. The user's signature key is generated partly on the client device and partly on the server device. The two parties interact to generate the final key pair, which improves key security. Specifically, the steps are as follows:

[0126] Step 21: The client device randomly generates a first random matrix , which means randomly and uniformly selecting a Matrix. And calculate the first hash value ,Will Sent to the server device.

[0127] Step 22: The server device randomly generates a second random matrix , and calculate the second hash value , Will Sent to the client device.

[0128] Step 23: The client device receives , the first random matrix Sent to the server device, the server device receives , the second random matrix Sent to the client device.

[0129] Step 24: Client Authentication , if they are not equal, terminate, otherwise, calculate the first matrix , generating a common matrix .

[0130] Step 25: The client device randomly generates a child private key , and calculate , and calculate the third hash value , the third hash value Sent to the server device. It means randomly selecting an element or subset from the l-dimensional space associated with the private key range η and assigning this element or subset to the variable.

[0131] Step 26: The server device randomly generates a child private key , and calculate , and calculate the fourth hash value , the fourth hash value Sent to the client device.

[0132] Step 27: Client Device Verification If it is not true, terminate the signature, otherwise, calculate .

[0133] Step 28: Output the public key , the first private key of the client device , the second private key of the server device .

[0134] Step 3: Both ends interact and collaborate to generate the target signature.

[0135] Step 31: The client device randomly generates a first random vector and the second random vector ,in, , , is the system parameter, and calculates the value of the first variable ,Will Sent to the server device.

[0136] Step 32: Randomly generate server-side devices , and calculate the value of the second variable ,Will Sent to the client device.

[0137] Step 33: The client device calculates the total variable value And, calculate , the first signature factor , calculate the first signature value ,if Stop, otherwise, Sent to the server device.

[0138] Step 34: The server calculates the total variable value And, calculate , the first signature factor , calculate the second signature value ,if , then stop, otherwise, Sent to the client device. Represents the infinity norm or maximum norm.

[0139] Step 35: Client device calculation ,if , then terminate the signature, otherwise, calculate the third signature factor .

[0140] Step 36: The client device outputs the signature result .

[0141] This example proposes a two-party collaborative post-quantum signature method that leverages a lattice-based homomorphic commitment mechanism to effectively protect the security of ML-DSA private keys. Signature keys are generated in a distributed manner, independently on the client and server. Even if the client is compromised, signature forgery is unsuccessful. Furthermore, no modifications to the ML-DSA verification algorithm are required.

[0142] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, in practice, the electronic device includes: a memory 21 and a processor 22.

[0143] The memory 21 is used to store computer programs and can be configured to store various other data to support operations on the electronic device. Examples of such data include instructions for any application or method operating on the electronic device, data structures, contact data, phone book data, messages, images, videos, etc.

[0144] The processor 22 is coupled to the memory 21 and is used to execute the computer program in the memory 21 to implement the digital signature method provided in the above embodiment.

[0145] Further, if Figure 4 As shown, the electronic device also includes: a communication component 23, a display 24, a power component 25, an audio component 26 and other components. Figure 4 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 4 The electronic device of this embodiment can be implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone or an IOT device, or a server device such as a conventional server, a cloud server or a server array.

[0146] The above-mentioned memory can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0147] The communication component is configured to facilitate wired or wireless communication between the device in which the communication component resides and other devices. The device in which the communication component resides can access a wireless network based on a communication standard, such as a 2G, 3G, 4G / LTE, 5G, or other mobile communication network, or a combination thereof. In an exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel.

[0148] The display includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, it may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensors can detect not only the boundaries of a touch or slide action, but also the duration and pressure associated with the touch or slide operation.

[0149] The power supply assembly provides power to various components of the device in which the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply assembly is located.

[0150] The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC). When the device where the audio component is located is in an operating mode, such as call mode, recording mode, and voice recognition mode, the microphone is configured to receive external audio signals. The received audio signal can be further stored in the memory or sent via the communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0151] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement each step in the above-mentioned method embodiment. The computer-readable storage medium includes volatile or non-volatile storage, or a combination thereof, and may be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape, disk storage or other magnetic storage devices, or any other non-transmission medium.

[0152] Accordingly, the present application embodiment also provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a processor, the processor is enabled to implement the steps in the above-mentioned method embodiment. It should be understood that each process or a combination of multiple processes in the above-mentioned method flow can be implemented by a computer program or instruction. In addition, these computer programs or instructions can be applied to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device, so that the processor of the general-purpose computer, the special-purpose computer, the embedded processor or other programmable data processing device can be implemented as a device for implementing the corresponding functions in the above-mentioned method embodiment.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A digital signature method, characterized in that: Applied to a first device, the first device and the second device collaboratively generate a digital signature key pair, the digital signature key pair including a public key, a first private key, and a second private key, wherein the first device stores the first private key; the second device stores the second private key; the first private key includes a first matrix, and the second private key includes the first matrix; the method includes: generating a first random vector and a second random vector; obtaining a first variable value according to the first matrix, the first random vector, and the second random vector, and sending the first variable value to the second device; receiving a second variable value sent by the second device, where the second variable value is obtained by the second device according to the first matrix, the third random vector, and the fourth random vector; Generate a first signature value according to the first random vector, the first variable value, the second variable value, the message, and the first private key; receiving a second signature value sent by the second device, where the second signature value is generated by the second device according to the third random vector, the first variable value, the second variable value, a message, and the second private key; Generate a target signature corresponding to the message according to the first signature value, the second signature value, the public key and the first matrix.

2. The method according to claim 1, characterized in that Obtaining a first variable value according to the first matrix, the first random vector, and the second random vector includes: Obtaining a first product value between the first matrix and the first random vector; Obtaining the sum of the first product value and the second random vector to obtain the first variable value; Correspondingly, the second variable value is obtained by the second device obtaining a second product value between the first matrix and the third random vector, and obtaining the sum of the second product value and the fourth random vector.

3. The method according to claim 1, characterized in that The public key includes a private key component; and generating a first signature value according to the first random vector, the first variable value, the second variable value, the message, and the first private key includes: Generate a first signature factor according to the first variable value, the second variable value, and the message; Generate a first signature value according to the first random vector, the first signature factor, and the first private key; Generating a target signature corresponding to the message according to the first signature value, the second signature value, the public key, and the first matrix includes: Obtaining the sum of the first signature value and the second signature value to obtain a second signature factor; generating a third signature factor based on the first signature factor, the second signature factor, the private key component, and the first matrix; The target signature is composed of the first signature factor, the second signature factor, and the third signature factor.

4. The method according to claim 3, characterized in that Generating a first signature factor according to the first variable value, the second variable value, and the message includes: Obtaining a total variable value according to the first variable value and the second variable value; Perform hash processing on the message and the total variable value to obtain the first signature factor.

5. The method according to claim 4, characterized in that The method further comprises: generating a first random matrix, a fifth random vector, and a sixth random vector; Sending the first random matrix and the first hash value to the second device; receiving a second random matrix and a second hash value sent by the second device, where the second hash value is obtained by the second device by performing a hash operation on the second random matrix; Verifying the second random matrix based on the first hash value, and if the verification passes, synthesizing the first random matrix and the second random matrix to obtain a first matrix; Obtaining a first sum value according to the first matrix, the fifth random vector, and the sixth random vector; sending the first sum and a third hash value to the second device, where the third hash value is obtained by performing a hash operation on the first sum, so that the second device verifies the first sum based on the third hash value; if the verification is successful, the first matrix, the second sum, the generated seventh random vector, and the eighth random vector constitute the second private key; and the second sum is obtained based on the first matrix, the seventh random vector, and the eighth random vector; The first private key is composed of the first matrix, the first sum, the fifth random vector, and the sixth random vector.

6. The method according to claim 5, characterized in that Generating a first signature value according to the first random vector, the first signature factor, and the first private key includes: Sampling the first signature factor to obtain a sampled first signature factor; Obtaining a third product value of the sampled first signature factor and the fifth random vector; Obtaining a sum of the third product value and the first random vector to obtain a first signature value; Correspondingly, the second signature value is obtained by the second device sampling the first signature factor to obtain the sampled first signature factor; obtaining the fourth product value of the sampled first signature factor and the seventh random vector; and obtaining the sum of the fourth product value and the first random vector.

7. A digital signature method, characterized in that: Applied to a second device, the second device and the first device collaboratively generate a digital signature key pair, the digital signature key pair including a public key, a first private key, and a second private key, wherein the first device stores the first private key; the second device stores the second private key; the first private key includes a first matrix, and the second private key includes the first matrix; the method includes: receiving a first variable value sent by the first device, where the first variable value is obtained by the first device according to the first matrix, the first random vector, and the second random vector; generating a third random vector and a fourth random vector; Obtaining a second variable value according to the first matrix, the third random vector, and the fourth random vector; sending the second variable value to the first device; receiving a first signature value sent by the first device, where the first signature value is generated by the first device according to the first random vector, the first variable value, the second variable value, a message, and the first private key; Generate a second signature value according to the third random vector, the first variable value, the second variable value, the message, and the second private key; The second signature value is sent to the first device, so that the first device generates a target signature corresponding to the message according to the first signature value, the second signature value, the public key and the first matrix.

8. An electronic device, characterized in that: include: A memory, a processor, and a communication interface; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the method according to any one of claims 1 to 7.

9. A non-transitory machine-readable storage medium, characterized in that The non-transitory machine-readable storage medium stores executable code, and when the executable code is executed by a processor of an electronic device, the processor is caused to perform the method according to any one of claims 1 to 7.

10. A computer program product, characterized in that include: A computer program, when executed by a processor of an electronic device, causes the processor to perform the method according to any one of claims 1 to 7.

Images