Cooperative signature method, device and equipment based on SPHINCS + and storage medium

Abstract

The invention discloses a collaborative signature method and device based on SPHINCS +, equipment and a storage medium, and relates to the technical field of information security, and the method comprises the steps: generating a first WOTS + key pair corresponding to each leaf node on a top layer XMSS tree of an SPHINCS + hypertree based on a first key seed and by using a pseudo-random function algorithm; sending the initial parameter and the public key seed to a collaborative signature party, so that the collaborative signature party sends a second public key component in a second WOTS + key pair generated based on a second key seed to the server; and recursively signing the message to be signed, determining a complete signature component based on the obtained partial signature component, and sending a target signature obtained by signing the complete signature component to a verification party, so that the verification party verifies the target signature based on the root node of the top XMSS tree and a target public key determined by the public key seed to complete the signature operation. Collaborative signatures are designed without depending on a lattice-based cryptographic algorithm.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and particularly relates to a collaborative signature method, device, equipment and storage medium based on SPHINCS+. Background Art

[0002] In the context that the development of quantum computing technology poses a potential threat to the traditional cryptographic system, post-quantum cryptographic algorithms have emerged. Their design ideas are diverse. Among them, the hash-based signature algorithm has become a feasible alternative to traditional digital signatures due to the characteristics that its security does not depend on mathematical problem assumptions and can maintain security with the upgrade of the hash algorithm. Moreover, SPHINCS+ (a stateless signature scheme based on hash functions), as the only selected hash-based encryption algorithm for post-quantum cryptography standardization, has advantages in terms of public and private key sizes, implementation difficulty, and signature verification complexity. However, existing post-quantum collaborative signature schemes are basically designed based on lattice cryptographic algorithms. Once the lattice hard problem is solved, the security of the signature scheme is difficult to guarantee, and the technical risk is high.

[0003] As can be seen from the above, how to design a collaborative signature without relying on lattice cryptographic algorithms and ensure security is an urgent problem to be solved currently. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a collaborative signature method, device, equipment and storage medium based on SPHINCS+, which can design a collaborative signature without relying on lattice cryptographic algorithms and ensure security. The specific scheme is as follows:

[0005] In the first aspect, the present application provides a collaborative signature method based on SPHINCS+, which is applied to a server and includes:

[0006] Generate initial parameters, a first key seed, a pseudo-random function seed and a public key seed, and generate a first WOTS+ key pair corresponding to each leaf node of the top-level XMSS tree of the SPHINCS+ supertree based on the first key seed and using the pseudo-random function algorithm; the first WOTS+ key pair includes a first private key component and a first public key component;

[0007] Send the initial parameters and the public key seed to the collaborative signer, so that after receiving the initial parameters and the public key seed, the collaborative signer generates a second WOTS+ key pair based on a second key seed, and sends the second public key component in the second WOTS+ key pair to the server;

[0008] Determine the WOTS+ public key based on the first public key component and the second public key component, generate the root node of the top-level XMSS tree, determine the target public key using the root node and the public key seed, and after publishing the target public key, perform recursive signing on the message to be signed in a multi-layer tree structure to obtain partial signature components;

[0009] Determine the complete signature components based on the partial signature components, sign the complete signature components, and send the obtained target signature to the verifier so that the verifier can verify the target signature based on the target public key to complete the corresponding signature operation.

[0010] Optionally, generating the initial parameters, the first key seed, the pseudorandom function seed, and the public key seed, and generating the first WOTS+ key pair corresponding to each leaf node on the top-level XMSS tree of the SPHINCS+ supertree based on the first key seed and using the pseudorandom function algorithm includes:

[0011] Generate the initial parameters and a set of random numbers to obtain the first key seed, the pseudorandom function seed, and the public key seed of the server;

[0012] Based on the first key seed and the position information corresponding to each leaf node of the top-level XMSS tree on the SPHINCS+ supertree, and using the pseudorandom function algorithm to generate the first private key component of WOTS+ corresponding to each leaf node;

[0013] Based on the first private key component, the initial parameters, the public key seed, and the position information, and using a preset key chain generation algorithm to generate the corresponding first public key component, and determine the first WOTS+ key pair based on the first private key component and the first public key component.

[0014] Optionally, sending the initial parameters and the public key seed to the co-signing party so that after receiving the initial parameters and the public key seed, the co-signing party generates a second WOTS+ key pair based on the second key seed and sends the second public key component in the second WOTS+ key pair to the server, includes:

[0015] Send the initial parameters and the public key seed to the co-signing party so that after receiving the initial parameters and the public key seed, the co-signing party generates a second key seed corresponding to the co-signing party;

[0016] Based on the second key seed and the position information, and using the pseudorandom function algorithm to generate the second private key component of WOTS+ corresponding to each leaf node;

[0017] Generate a corresponding second public key component based on the second private key component, the initial parameters, the public key seed, and the location information, and use the preset key chain generation algorithm. Then determine the second WOTS+ key pair based on the second private key component and the second public key component, and send the second public key component in the second WOTS+ key pair to the server.

[0018] Optionally, determining the WOTS+ public key based on the first public key component and the second public key component, generating the root node of the top-level XMSS tree, and determining the target public key using the root node and the public key seed includes:

[0019] Combine the first public key component and the second public key component to obtain the WOTS+ public key;

[0020] Determine the root node of the top-level XMSS tree based on the initial parameters, the first public key component, and the second public key component using the preset hash aggregation algorithm;

[0021] Determine the target public key based on the root node and the public key seed, and publish the target public key.

[0022] Optionally, after publishing the target public key, perform recursive signing on the message to be signed with a multi-layer tree structure to obtain partial signature components, including:

[0023] After publishing the target public key, create a signature request corresponding to the message to be signed, and determine the message digest based on the signature request and the pseudo-random function seed using the pseudo-random function algorithm;

[0024] Determine the digest value for signing based on the message digest, the public key seed, the root node, and the message to be signed using the preset hash function;

[0025] Use the digest value and the initial parameters to determine the address information indicating the specific position of the current signing operation in the XMSS tree, and determine the starting leaf index based on the address information;

[0026] Perform recursive signing on the message to be signed with a multi-layer tree structure based on the starting leaf index, the address information, the digest value, and the message digest to obtain partial signature components.

[0027] Optionally, performing recursive signing on the message to be signed with a multi-layer tree structure based on the starting leaf index, the address information, the digest value, and the message digest to obtain partial signature components includes:

[0028] Determine the starting leaf node of the preset XMSS tree for the current layer of signing based on the starting leaf index;

[0029] Sign the message to be signed using the FORS instance corresponding to the starting leaf node, and sign the obtained FORS root node based on the WOTS+ instance corresponding to the starting leaf node to obtain the current signature component of the current layer;

[0030] Based on the bottom-up order and using the current signature component, sign the FORS root node of the preset XMSS tree of the next layer to obtain the next signature component of the next layer, determine the next signature component as the current signature component, and jump to the step of signing the FORS root node of the preset XMSS tree of the next layer based on the bottom-up order and using the current signature component to obtain the next signature component of the next layer until a preset termination condition is met;

[0031] Obtain partial signature components using the current signature components of each layer.

[0032] Optionally, determining the complete signature component based on the partial signature components, signing the complete signature component, and sending the obtained target signature to the verifier so that the verifier verifies the target signature based on the target public key to complete the corresponding signature operation, including:

[0033] Generate a corresponding signature component request based on the partial signature components, and then send the signature component request to the co-signing party so that the co-signing party generates the remaining signature components based on the signature component request and sends the remaining signature components to the server;

[0034] Obtain the complete signature component using the partial signature components and the remaining signature components, and sign the complete signature component to obtain the target signature;

[0035] Send the target signature to the verifier so that the verifier verifies the target signature based on the target public key and a preset verification algorithm to complete the corresponding signature operation.

[0036] In a second aspect, the present application provides a co-signature device based on SPHINCS+, which is applied to a server and includes:

[0037] A first key pair generation module, configured to generate initial parameters, a first key seed, a pseudo-random function seed, and a public key seed, and generate a first WOTS+ key pair corresponding to each leaf node on the top-level XMSS tree of the SPHINCS+ supertree based on the first key seed and using a pseudo-random function algorithm; the first WOTS+ key pair includes a first private key component and a first public key component;

[0038] The second key pair generation module is configured to send the initial parameters and the public key seed to the co-signing party, so that after receiving the initial parameters and the public key seed, the co-signing party generates a second WOTS+ key pair based on the second key seed, and sends the second public key component in the second WOTS+ key pair to the server;

[0039] The recursive signature module is configured to determine the WOTS+ public key based on the first public key component and the second public key component, generate the root node of the top-level XMSS tree, determine the target public key by using the root node and the public key seed, and after publishing the target public key, perform recursive signature on the message to be signed in a multi-layer tree structure to obtain partial signature components;

[0040] The target signature verification module is configured to determine the complete signature components based on the partial signature components, sign the complete signature components, and send the obtained target signature to the verifier, so that the verifier verifies the target signature based on the target public key to complete the corresponding signature operation.

[0041] In a third aspect, the present application provides an electronic device, including:

[0042] A memory for storing a computer program;

[0043] A processor for executing the computer program to implement the foregoing SPHINCS+-based co-signature method.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the foregoing SPHINCS+-based co-signature method.

[0045] This application generates initial parameters, a first key seed, a pseudo-random function seed, and a public key seed, and based on the first key seed, uses a pseudo-random function algorithm to generate a first WOTS+ key pair corresponding to each leaf node on the top-level XMSS tree of SPHINCS+; the first WOTS+ key pair includes a first private key component and a first public key component; sends the initial parameters and the public key seed to a co-signing party, so that after receiving the initial parameters and the public key seed, the co-signing party generates a second WOTS+ key pair based on a second key seed, and sends the second public key component in the second WOTS+ key pair to the server; determines a WOTS+ public key based on the first public key component and the second public key component, generates a root node of the top-level XMSS tree, determines a target public key using the root node and the public key seed, and after publishing the target public key, performs a recursive signature on the message to be signed in a multi-layer tree structure to obtain partial signature components; determines complete signature components based on the partial signature components, signs the complete signature components, and sends the obtained target signature to a verification party, so that the verification party verifies the target signature based on the target public key to complete the corresponding signature operation.

[0046] As can be seen from the above, this application generates corresponding private key components by the server and the co-signing party respectively, so that neither party can master the complete private key. Even if one party is attacked, the attacker cannot obtain the complete private key information, improving the security of key storage; then determines a target public key for signature verification based on the private key components of both parties, and then performs a recursive signature on the message to be signed in a multi-layer tree structure to obtain partial signature components, signs the complete signature components determined based on the partial signature components, and sends the obtained target signature to the verification party. In this way, the verification party uses the target public key to verify the target signature, and can quickly and accurately judge the legality of the signature, ensuring the availability and reliability of the signature system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained according to the provided drawings.

[0048] Figure 1 It is a flowchart of a collaborative signature method based on SPHINCS+ disclosed in this application;

[0049] Figure 2 It is a specific flowchart of a collaborative signature method based on SPHINCS+ disclosed in this application;

[0050] Figure 3 Schematic diagram of a collaborative design framework for SPHINCS+ disclosed in the present application;

[0051] Figure 4 Schematic diagram of the structure of a collaborative signature device based on SPHINCS+ disclosed in the present application;

[0052] Figure 5 Schematic diagram of the structure of an electronic device disclosed in the present application. Specific embodiments

[0053] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0054] Currently, most of the post-quantum collaborative signature schemes are designed based on lattice cryptography algorithms. Once the lattice difficult problem is solved, the security of the signature scheme is difficult to guarantee, and the technical risk is high. Therefore, the present application provides a collaborative signature method based on SPHINCS+, in which the verifier uses the target public key to verify the target signature, and can quickly and accurately judge the legality of the signature, ensuring the availability and reliability of the signature system.

[0055] See Figure 1 As shown, the embodiments of the present invention disclose a collaborative signature method based on SPHINCS+, which is applied to a server and includes:

[0056] Step S11: Generate initial parameters, a first key seed, a pseudo-random function seed, and a public key seed, and generate a first WOTS+ (a one-time signature scheme based on a hash chain) key pair corresponding to each leaf node on the top-level XMSS (i.e., one-time signature tree) of the SPHINCS+ supertree based on the first key seed and using the pseudo-random function algorithm; the first WOTS+ key pair includes a first private key component and a first public key component.

[0057] In this embodiment, initial parameters are generated , generate a set of random numbers to obtain the first key seed, pseudo-random function seed, and public key seed of the server, and then based on the first key seed and the position information corresponding to each leaf node of the top-level XMSS tree on the SPHINCS+ supertree, and use the pseudo-random function algorithm to generate the first private key components corresponding to each of the leaf nodes to obtain the first private key component. The formula corresponding to the first private key component is as follows:

[0058] ;

[0059] wherein, is the first private key component; is the pseudo-random function algorithm; is the first key seed; is the position information corresponding to each leaf node of the top-level XMSS tree on the SPHINCS+ supertree.

[0060] It can be understood that after obtaining the first private key component, based on the first private key component, the initial parameters, the public key seed, and the position information, and using a preset key chain generation algorithm to generate the corresponding first public key component, the formula corresponding to the first public key component is as follows:

[0061] ;

[0062] wherein, is the first public key component; is the preset key chain generation algorithm; is the first private key component; is the initial parameter; is the public key seed; is the position information. After obtaining the first public key component, determine the first WOTS+ key pair based on the first private key component and the first public key component.

[0063] Specifically, generating the initial parameters, the first key seed, the pseudo-random function seed, and the public key seed, and based on the first key seed and using the pseudo-random function algorithm to generate the first WOTS+ key pair corresponding to each leaf node of the top-level XMSS tree on the SPHINCS+ supertree, includes: generating the initial parameters, and generating a set of random numbers to obtain the first key seed, the pseudo-random function seed, and the public key seed of the server; based on the first key seed and the position information corresponding to each leaf node of the top-level XMSS tree on the SPHINCS+ supertree, and using the pseudo-random function algorithm to generate the first private key component of WOTS+ corresponding to each leaf node; based on the first private key component, the initial parameters, the public key seed, and the position information, and using the preset key chain generation algorithm to generate the corresponding first public key component, and based on the first private key component and the first public key component, determine the first WOTS+ key pair.

[0064] Step S12: Send the initial parameters and the public key seed to the co-signing party. After receiving the initial parameters and the public key seed, the co-signing party generates a second WOTS+ key pair based on the second key seed and sends the second public key component in the second WOTS+ key pair to the server.

[0065] In this embodiment, after determining the first WOTS+ key pair, the initial parameters and the public key seed are sent to the co-signing party. After receiving the initial parameters and the public key seed, the co-signing party generates a random number as the second key seed corresponding to the co-signing party, and then generates the subsequent private key components of WOTS+ corresponding to each leaf node based on the second key seed and the location information using the pseudo-random function algorithm to obtain the second private key component. The formula for the second private key component is as follows: The second private key component corresponds to the following formula:

[0066] ;

[0067] Where, is the second private key component; is the pseudo-random function algorithm; is the second key seed; is the location information.

[0068] It can be understood that after obtaining the second private key component, based on the second private key component, the initial parameters, the public key seed, and the location information, and using the preset key chain generation algorithm to generate the corresponding second public key component. The formula for the second public key component is as follows:

[0069] ;

[0070] Where, is the second public key component; is the preset key chain generation algorithm; is the second private key component; is the initial parameter; is the location information. After obtaining the second public key component, determine the second WOTS+ key pair based on the second private key component and the second public key component, and send the second public key component to the server.

[0071] Specifically, sending the initial parameters and the public key seed to the co-signing party, so that after receiving the initial parameters and the public key seed, the co-signing party generates a second WOTS+ key pair based on the second key seed, and sends the second public key component in the second WOTS+ key pair to the server, includes: sending the initial parameters and the public key seed to the co-signing party, so that after receiving the initial parameters and the public key seed, the co-signing party generates a second key seed corresponding to the co-signing party; generating second private key components of WOTS+ corresponding to each leaf node based on the second key seed and the location information and using the pseudo-random function algorithm; generating a corresponding second public key component based on the second private key component, the initial parameters, the public key seed and the location information and using the preset key chain generation algorithm, and determining a second WOTS+ key pair based on the second private key component and the second public key component, and sending the second public key component in the second WOTS+ key pair to the server.

[0072] Step S13, determining a WOTS+ public key based on the first public key component and the second public key component, generating a root node of the top-level XMSS tree, determining a target public key using the root node and the public key seed, and after publishing the target public key, performing recursive signature on the message to be signed in a multi-layer tree structure to obtain partial signature components.

[0073] In this embodiment, after receiving the second public key component, the first public key component and the second public key component are combined to obtain a WOTS+ public key, and then based on the initial parameters, the first public key component and the second public key component, and using a preset hash aggregation algorithm, the root node of the top-level XMSS tree is determined. Based on the root node and the public key seed, a target public key is determined and the target public key is published. It is worth mentioning that the server stores the first key seed, the pseudo-random function seed, the public key seed and the root node, and the co-signing party stores the second public key component and the public key seed, that is, the server and the co-signing party each hold part of the private key, ensuring that the private key is always distributed and stored, and neither party can master the complete private key.

[0074] Specifically, determining the WOTS+ public key based on the first public key component and the second public key component, generating the root node of the top-level XMSS tree, and determining the target public key using the root node and the public key seed includes: combining the first public key component and the second public key component to obtain the WOTS+ public key; determining the root node of the top-level XMSS tree based on the initial parameters, the first public key component, and the second public key component and using a preset hash aggregation algorithm; determining the target public key based on the root node and the public key seed, and publishing the target public key.

[0075] It can be understood that after publishing the target public key, a corresponding signature request is created based on the message to be signed, and a message digest is determined based on the signature request and the pseudo-random function seed and using the pseudo-random function algorithm. The formula corresponding to the message digest is as follows:

[0076] ;

[0077] where, is the message digest; is the pseudo-random function seed; is the message to be signed. After obtaining the message digest, a digest value for signature is determined based on the message digest, the public key seed, the root node, the message to be signed and using a preset hash function. The formula corresponding to the digest value is as follows:

[0078] ;

[0079] where, is the digest value; is the message digest; is the public key seed; is the root node; is the message to be signed.

[0080] Further, after obtaining the digest value, the address information for identifying the specific position of the current signature operation in the XMSS tree is determined using the digest value and the initial parameters. The address information is used to determine the position in the hierarchical structure, and then the starting leaf index is determined based on the address information. And the message to be signed is recursively signed with a multi-layer tree structure using the starting leaf index, the address information, the digest value and the message digest to obtain partial signature components.

[0081] Specifically, after publishing the target public key, a recursive signature of a multi-layer tree structure is performed on the message to be signed to obtain partial signature components, including: after publishing the target public key, creating a signature request corresponding to the message to be signed, and determining a message digest based on the signature request, the pseudo-random function seed, and using the pseudo-random function algorithm; determining a digest value for signature based on the message digest, the public key seed, the root node, the message to be signed, and using a preset hash function; using the digest value and the initial parameters to determine address information for identifying the specific position of the current signature operation in the XMSS tree, and determining a starting leaf index based on the address information; performing a recursive signature of a multi-layer tree structure on the message to be signed based on the starting leaf index, the address information, the digest value, and the message digest to obtain partial signature components.

[0082] In this embodiment, when performing a recursive signature of a multi-layer tree structure on the message to be signed based on the starting leaf index, the address information, the digest value, and the message digest, first, based on the starting leaf index, determine the starting leaf node of the preset XMSS tree of the current layer for signature, use the FORS instance corresponding to the starting leaf node to sign the message to be signed to obtain a FORS root node, and based on the WOTS+ instance corresponding to the starting leaf node, sign the FORS root node to obtain the current signature component of the current layer. Then, based on the bottom-up order and using the current signature component, sign the FORS root node of the preset XMSS tree of the next layer to obtain the next signature component of the next layer, and determine the next signature component as the current signature component, and jump to the step of signing the FORS root node of the preset XMSS tree of the next layer based on the bottom-up order and using the current signature component to obtain the next signature component of the next layer until a preset termination condition is met, so as to obtain partial signature components using the current signature components of each layer. The preset termination condition can be adjusted according to the actual situation and is not limited here.

[0083] In a specific embodiment, the FORS instance corresponding to the starting leaf node of the XMSS tree corresponding to the address information in the 0th layer is used to sign the message to be signed, so as to obtain the FORS root node of the FORS instance. The FORS root node is signed based on the WOTS+ instance corresponding to the starting leaf node to obtain the current signature component in the 0th layer. Then, the WOTS+ instance corresponding to the starting leaf node of the XMSS tree in the 1st layer is used to sign the FORS root node in the 0th layer to obtain the current signature component in the 1st layer. By analogy in the order from bottom to top until the WOTS+ instance corresponding to the leaf node of the XMSS tree in the d-2th layer is used to sign the FORS root node in the d-3th layer, and the partial signature components are determined based on the current signature components of each layer.

[0084] Specifically, the recursive signature of the message to be signed in a multi-layer tree structure based on the starting leaf index, the address information, the digest value, and the message digest to obtain partial signature components includes: determining the starting leaf node of the preset XMSS tree in the current layer for signature based on the starting leaf index; using the FORS instance corresponding to the starting leaf node to sign the message to be signed, and signing the obtained FORS root node based on the WOTS+ instance corresponding to the starting leaf node to obtain the current signature component in the current layer; signing the FORS root node of the preset XMSS tree in the next layer based on the order from bottom to top and using the current signature component to obtain the next signature component in the next layer, determining the next signature component as the current signature component, and jumping to the step of signing the FORS root node of the preset XMSS tree in the next layer based on the order from bottom to top and using the current signature component to obtain the next signature component in the next layer until the preset termination condition is met; and obtaining partial signature components by using the current signature components of each layer.

[0085] Step S14: Determine the complete signature component based on the partial signature components, sign the complete signature component, and send the obtained target signature to the verification party so that the verification party can verify the target signature based on the target public key to complete the corresponding signature operation.

[0086] In this embodiment, after obtaining the partial signature components, a signature component request including the root node to be signed and the corresponding address information is generated based on the partial signature components, and the signature component request is sent to the collaborative signature party. So that after receiving the signature component request, the collaborative signature party generates the corresponding remaining signature components based on the signature component request. The formula corresponding to the remaining signature components is as follows:

[0087] ;

[0088] Among them, is the remaining signature component; is the second private key component; is the message to be signed; is the public key seed; is the location information. After obtaining the remaining signature component, the remaining signature component is sent to the server, and then the complete signature component is obtained by using the partial signature component and the remaining signature component, and the complete signature component is signed to obtain the target signature, and then the target signature is sent to the verifier so that the verifier can verify the target signature based on the target public key and a preset verification algorithm to complete the corresponding signature operation; the preset verification algorithm is the verification algorithm of SPHINCS+.

[0089] Specifically, determining the complete signature component based on the partial signature component, signing the complete signature component, and sending the obtained target signature to the verifier so that the verifier can verify the target signature based on the target public key to complete the corresponding signature operation includes: generating a corresponding signature component request based on the partial signature component, and then sending the signature component request to the collaborative signer so that the collaborative signer can generate the remaining signature component based on the signature component request and send the remaining signature component to the server; obtaining the complete signature component by using the partial signature component and the remaining signature component, and signing the complete signature component to obtain the target signature; sending the target signature to the verifier so that the verifier can verify the target signature based on the target public key and a preset verification algorithm to complete the corresponding signature operation.

[0090] As can be seen from the above, in this application, the server and the collaborative signer respectively generate corresponding private key components, so that neither party can master the complete private key. Even if one party is attacked, the attacker cannot obtain the complete private key information, which improves the security of key storage; then, based on the private key components of both parties, the target public key for signature verification is determined, and then the message to be signed is recursively signed with a multi-layer structure to obtain the partial signature component, the complete signature component determined based on the partial signature component is signed, and the obtained target signature is sent to the verifier. In this way, the verifier uses the target public key to verify the target signature, and can quickly and accurately judge the legality of the signature, ensuring the availability and reliability of the signature system.

[0091] As can be seen from the above embodiments, this application is based on the server and the collaborative signer to jointly determine the target signature for the signature operation. Therefore, the process of jointly determining the target signature for the signature operation based on the server and the collaborative signer is described.

[0092] See Figure 2 As shown, an embodiment of the present invention discloses a specific collaborative signature method based on SPHINCS +, including:

[0093] This embodiment includes three parts: collaborative key generation, collaborative signature, and signature verification. Among them, the collaborative key generation part and the collaborative signature part are collaboratively transformed for the corresponding algorithms of SPHINCS +, completed collaboratively by the server S and the collaborative signatory A, while the signature verification algorithm remains unchanged and is completed by the verifier. Specifically, Figure 3 As shown, each layer represents an XMSS tree, each node represents a hash value, and the leaf nodes represent specific signature instances. The key point of the collaborative transformation lies in the distributed design of the WOTS + component in the top-level XMSS tree of SPHINCS +, that is, the private key components of WOTS + are separately generated and stored, while the XMSS algorithms of other layers and the FORS algorithm at the bottom layer remain unchanged.

[0094] First is the collaborative key generation part. The server S generates system parameters (i.e., initial parameters), and generates a set of random numbers as the first key seed, pseudo-random function seed, and public key seed of the server. Then, based on the first key seed and the position information corresponding to each leaf node of the top-level XMSS tree on the SPHINCS + supertree, and using the pseudo-random function algorithm, the first private key components corresponding to each leaf node of WOTS + are generated to obtain the first private key component. Based on the first private key component, the initial parameters, the public key seed, and the position information, and using a preset key chain generation algorithm, the corresponding first public key component is generated, so as to determine the first WOTS + key pair based on the first private key component and the first public key component. Then, the initial parameters and the public key seed are sent to the collaborative signatory A. After the collaborative signatory A receives the initial parameters and the public key seed, a random number is generated as the second key seed of the collaborative signatory A, and based on the second key seed and the position information, and using the pseudo-random function algorithm, the second A private key component is obtained to get the second private key component. Then, based on the second private key component, the initial parameters, the public key seed, and the location information, and by using the preset key chain generation algorithm, the corresponding second public key component is generated. Based on the second private key component and the second public key component, a second WOTS+ key pair is determined, and the second public key component is sent to the server S. After the server S receives the second public key component, the first public key component and the second public key component are combined to obtain the WOTS+ public key; the WOTS+ public key is used to verify the legality of the signature. Then, based on the initial parameters, the first public key component, and the second public key component, and by using the preset hash aggregation algorithm, the root node of the top-level XMSS tree is determined. Based on the root node and the public key seed, the target public key is determined, and the target public key is published.

[0095] Next is the collaborative signature part. A signature is initiated for the message to be signed, and FORS signature and bottom-up XMSS signature are performed, and the first signature components of the WOTS+ instance are generated to obtain partial signature components. A signature component request is generated based on the partial signature components and sent to the collaborative signer A. So that after the collaborative signer A receives the signature component request, the last signature components of the WOTS+ instance are generated based on the signature component request to obtain the remaining signature components, and the remaining signature components are sent to the server. Then, the complete signature components of the WOTS+ instance are obtained by using the partial signature components and the remaining signature components, and the complete signature components are signed to obtain the final SPHINCS+ complete signature (i.e., the target signature).

[0096] As can be seen from the above, the server of the present application, as the signature initiator, completes the main signature operation, and only needs the assistance of the collaborative signer when performing the top-level WOTS+ signature. Through the hierarchical structure and multiple signatures, the distributed signature generation is realized, and the SPHINCS+ algorithm is used to provide higher security. Even if a certain layer or a certain signature component is compromised, the security of the entire signature can still be guaranteed. In this way, while maintaining the original algorithm framework and signature format, the purpose of distributed generation and storage of signature keys is achieved, and no complex interaction burden is introduced, reducing the security risk.

[0097] Correspondingly, as shown in Figure 4 the present application further provides a collaborative signature device based on SPHINCS+, which is applied to a server and includes:

[0098] The first key pair generation module 11 is used to generate initial parameters, a first key seed, a pseudo-random function seed, and a public key seed, and generate a first WOTS+ key pair corresponding to each leaf node on the top-level XMSS tree of SPHINCS+ supertree based on the first key seed and using the pseudo-random function algorithm; the first WOTS+ key pair includes a first private key component and a first public key component;

[0099] The second key pair generation module 12 is used to send the initial parameters and the public key seed to the collaborative signer, so that after receiving the initial parameters and the public key seed, the collaborative signer generates a second WOTS+ key pair based on a second key seed and sends the second public key component in the second WOTS+ key pair to the server;

[0100] The recursive signature module 13 is used to determine the WOTS+ public key based on the first public key component and the second public key component, generate the root node of the top-level XMSS tree, determine the target public key using the root node and the public key seed, and after publishing the target public key, perform recursive signature on the message to be signed in a multi-layer tree structure to obtain partial signature components;

[0101] The target signature verification module 14 is used to determine the complete signature component based on the partial signature components, sign the complete signature component, and send the obtained target signature to the verifier, so that the verifier verifies the target signature based on the target public key to complete the corresponding signature operation.

[0102] As can be seen from the above, in this application, the server and the collaborative signer respectively generate corresponding private key components, so that neither party can master the complete private key. Even if one party is attacked, the attacker cannot obtain the complete private key information, improving the security of key storage; then, based on the private key components of both parties, the target public key for signature verification is determined, and then the message to be signed is recursively signed in a multi-layer tree structure to obtain partial signature components, the complete signature component determined based on the partial signature components is signed, and the obtained target signature is sent to the verifier. In this way, the verifier uses the target public key to verify the target signature, and can quickly and accurately judge the legality of the signature, ensuring the availability and reliability of the signature system.

[0103] In some specific embodiments, the first key pair generation module 11 may specifically include:

[0104] The seed generation unit is used to generate initial parameters and generate a set of random numbers to obtain the first key seed, the pseudo-random function seed, and the public key seed of the server;

[0105] A first private key component generation unit, configured to generate, based on a first key seed and position information corresponding to each leaf node of a top-level XMSS tree on the SPHINCS+ supertree, and by using a pseudo-random function algorithm, a first private key component of WOTS+ corresponding to each of the leaf nodes;

[0106] A first key pair determination unit, configured to generate, based on the first private key component, the initial parameters, a public key seed, and the position information, and by using a preset key chain generation algorithm, a corresponding first public key component, and determine a first WOTS+ key pair based on the first private key component and the first public key component.

[0107] In some specific embodiments, the second key pair generation module 12 may specifically include:

[0108] A second key seed generation unit, configured to send the initial parameters and the public key seed to a co-signature party, so that after receiving the initial parameters and the public key seed, the co-signature party generates a second key seed corresponding to the co-signature party;

[0109] A second private key component generation unit, configured to generate, based on the second key seed and the position information, and by using the pseudo-random function algorithm, a second private key component of WOTS+ corresponding to each of the leaf nodes;

[0110] A second key pair determination unit, configured to generate, based on the second private key component, the initial parameters, the public key seed, and the position information, and by using the preset key chain generation algorithm, a corresponding second public key component, and determine a second WOTS+ key pair based on the second private key component and the second public key component, and send the second public key component in the second WOTS+ key pair to the server.

[0111] In some specific embodiments, the recursive signature module 13 may specifically include:

[0112] A public key component combination unit, configured to combine the first public key component and the second public key component to obtain a WOTS+ public key;

[0113] A root node determination unit, configured to determine a root node of the top-level XMSS tree based on the initial parameters, the first public key component, and the second public key component, and by using a preset hash aggregation algorithm;

[0114] A target public key determination unit, configured to determine a target public key based on the root node and the public key seed, and publish the target public key.

[0115] In some specific embodiments, the recursive signature module 13 may specifically include:

[0116] A message digest determination unit, configured to create a signature request corresponding to the message to be signed after the target public key is published, and determine a message digest based on the signature request, the pseudo-random function seed, and using the pseudo-random function algorithm;

[0117] A digest value determination unit, configured to determine a digest value for signature based on the message digest, the public key seed, the root node, the message to be signed, and using a preset hash function;

[0118] A starting index determination unit, configured to use the digest value and the initial parameters to determine address information for identifying the specific position of the current signature operation in the XMSS tree, and determine a starting leaf index based on the address information;

[0119] A recursive signature completion unit, configured to perform a recursive signature of the multi-layer tree structure on the message to be signed based on the starting leaf index, the address information, the digest value, and the message digest to obtain partial signature components.

[0120] In some specific embodiments, the recursive signature module 13 may specifically include:

[0121] A starting node determination unit, configured to determine a starting leaf node of the preset XMSS tree of the current layer for signature based on the starting leaf index;

[0122] A message to be signed signature unit, configured to sign the message to be signed using the FORS instance corresponding to the starting leaf node, and sign the FORS root node obtained by signature using the WOTS+ instance corresponding to the starting leaf node to obtain the current signature component of the current layer;

[0123] A root node signature unit, configured to sign the FORS root node of the preset XMSS tree of the next layer based on a bottom-up order and using the current signature component to obtain the next signature component of the next layer, determine the next signature component as the current signature component, and jump to the step of signing the FORS root node of the preset XMSS tree of the next layer based on a bottom-up order and using the current signature component to obtain the next signature component of the next layer until a preset termination condition is met;

[0124] A partial signature component determination unit, configured to obtain partial signature components using the current signature components of each layer.

[0125] In some specific embodiments, the target signature verification module 14 may specifically include:

[0126] The remaining signature component determination unit is configured to generate a corresponding signature component request based on the partial signature component, and then send the signature component request to the collaborative signatory, so that the collaborative signatory generates the remaining signature component based on the signature component request and sends the remaining signature component to the server;

[0127] The target signature determination unit is configured to obtain the complete signature component by using the partial signature component and the remaining signature component, and sign the complete signature component to obtain the target signature;

[0128] The target signature verification completion unit is configured to send the target signature to the verifier, so that the verifier verifies the target signature based on the target public key and a preset verification algorithm to complete the corresponding signature operation.

[0129] Furthermore, an embodiment of the present application also discloses an electronic device, Figure 5 which is a structural diagram of an electronic device 20 shown according to an exemplary embodiment. The content in the figure should not be regarded as any limitation on the scope of use of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the collaborative signature method based on SPHINCS+ disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0130] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows is any communication protocol applicable to the technical solution of the present application, and no specific limitation is imposed on it here; the input / output interface 25 is used to obtain external input data or output data to the outside, and its specific interface type can be selected according to specific application needs, and no specific limitation is made here.

[0131] In addition, as a carrier for resource storage, the memory 22 may be a read-only memory, a random access memory, a magnetic disk, or an optical disc, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0132] Among them, the operating system 221 is used to manage and control each hardware device and computer program 222 on the electronic device 20, and it can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the SPHINCS+-based collaborative signature method executed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 can further include computer programs that can be used to complete other specific tasks.

[0133] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the SPHINCS+-based collaborative signature method disclosed above is implemented. For the specific steps of this method, reference can be made to the corresponding content disclosed in the foregoing embodiments, and details will not be repeated here.

[0134] In this specification, the various embodiments are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the various embodiments, reference can be made to each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple. For the relevant parts, reference can be made to the description in the method section.

[0135] Those skilled in the art can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed in this article can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0136] The steps of the method or algorithm described in combination with the embodiments disclosed in this article can be directly implemented by hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the technical field.

[0137] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the said element.

[0138] The technical solutions provided by this application have been introduced in detail above. Specific examples have been used in this text to elaborate on the principles and implementation manners of this application. The description of the above embodiments is only used to help understand the method and its core idea of this application; at the same time, for those of ordinary skill in the art, according to the idea of this application, there will be changes in the specific implementation manners and application scopes. In summary, the content of this specification should not be construed as a limitation to this application.

Claims

1. A collaborative signature method based on SPHINCS+, characterized in that, Applied to a server, including: Generating initial parameters, a first key seed, a pseudorandom function seed, and a public key seed, and generating a first WOTS+ key pair corresponding to each leaf node on the top-level XMSS tree of the SPHINCS+ supertree based on the first key seed and using a pseudorandom function algorithm; the first WOTS+ key pair includes a first private key component and a first public key component; Sending the initial parameters and the public key seed to a co-signing party, so that after receiving the initial parameters and the public key seed, the co-signing party generates a second WOTS+ key pair based on a second key seed and sends the second public key component in the second WOTS+ key pair to the server; Determining a WOTS+ public key based on the first public key component and the second public key component, generating a root node of the top-level XMSS tree, determining a target public key using the root node and the public key seed, and after publishing the target public key, performing recursive signing on the message to be signed with a multi-layer tree structure to obtain partial signature components; Determining complete signature components based on the partial signature components, signing the complete signature components, and sending the obtained target signature to a verification party, so that the verification party verifies the target signature based on the target public key to complete the corresponding signature operation.

2. The collaborative signature method based on SPHINCS+ according to claim 1, wherein The generating of the initial parameters, the first key seed, the pseudorandom function seed, and the public key seed, and the generating of the first WOTS+ key pair corresponding to each leaf node on the top-level XMSS tree of the SPHINCS+ supertree based on the first key seed and using a pseudorandom function algorithm includes: Generating initial parameters and generating a set of random numbers to obtain the first key seed, the pseudorandom function seed, and the public key seed of the server; Based on the first key seed and the position information corresponding to each leaf node of the top-level XMSS tree on the SPHINCS+ supertree, and using a pseudorandom function algorithm to generate the first private key component of WOTS+ corresponding to each leaf node; Generating a corresponding first public key component based on the first private key component, the initial parameters, the public key seed, and the position information and using a preset key chain generation algorithm, and determining a first WOTS+ key pair based on the first private key component and the first public key component.

3. The collaborative signature method based on SPHINCS+ according to claim 2, wherein The sending of the initial parameters and the public key seed to the co-signing party, so that after receiving the initial parameters and the public key seed, the co-signing party generates a second WOTS+ key pair based on a second key seed and sends the second public key component in the second WOTS+ key pair to the server includes: Sending the initial parameters and the public key seed to the co-signing party, so that after receiving the initial parameters and the public key seed, the co-signing party generates a second key seed corresponding to the co-signing party; Based on the second key seed and the position information and using the pseudorandom function algorithm to generate the second private key component of WOTS+ corresponding to each leaf node; Generate a corresponding second public key component based on the second private key component, the initial parameters, the public key seed, and the location information and using the preset key chain generation algorithm, determine a second WOTS+ key pair based on the second private key component and the second public key component, and send the second public key component in the second WOTS+ key pair to the server.

4. The collaborative signature method based on SPHINCS+ according to claim 1, wherein Determining the WOTS+ public key based on the first public key component and the second public key component, generating the root node of the top-level XMSS tree, and determining the target public key using the root node and the public key seed includes: Combine the first public key component and the second public key component to obtain the WOTS+ public key; Determine the root node of the top-level XMSS tree based on the initial parameters, the first public key component, and the second public key component and using the preset hash aggregation algorithm; Determine the target public key based on the root node and the public key seed, and publish the target public key.

5. The collaborative signature method based on SPHINCS+ according to claim 1, wherein After publishing the target public key, perform recursive signing on the message to be signed in a multi-layer tree structure to obtain partial signature components, including: After publishing the target public key, create a signature request corresponding to the message to be signed, and determine the message digest based on the signature request and the pseudo-random function seed and using the pseudo-random function algorithm; Determine the digest value for signing based on the message digest, the public key seed, the root node, the message to be signed and using the preset hash function; Use the digest value and the initial parameters to determine the address information for identifying the specific location of the current signing operation in the XMSS tree, and determine the starting leaf index based on the address information; Perform recursive signing on the message to be signed in a multi-layer tree structure based on the starting leaf index, the address information, the digest value, and the message digest to obtain partial signature components.

6. The collaborative signature method based on SPHINCS+ according to claim 5, wherein Performing recursive signing on the message to be signed in a multi-layer tree structure based on the starting leaf index, the address information, the digest value, and the message digest to obtain partial signature components includes: Determine the starting leaf node of the preset XMSS tree of the current layer for signing based on the starting leaf index; Sign the message to be signed using the FORS instance corresponding to the starting leaf node, and sign the FORS root node obtained by signing using the WOTS+ instance corresponding to the starting leaf node to obtain the current signature component of the current layer; Based on the bottom-up order and using the current signature component, sign the FORS root node of the preset XMSS tree of the next layer to obtain the next signature component of the next layer, determine the next signature component as the current signature component, and jump to the step of signing the FORS root node of the preset XMSS tree of the next layer based on the bottom-up order and using the current signature component to obtain the next signature component of the next layer until the preset termination condition is met; Obtain partial signature components using the current signature components of each layer.

7. The SPHINCS+-based collaborative signature method according to any one of claims 1 to 6, characterized in that, Determining a complete signature component based on the partial signature component, signing the complete signature component, and sending the obtained target signature to a verifier so that the verifier verifies the target signature based on the target public key to complete the corresponding signature operation, including: Generating a corresponding signature component request based on the partial signature component, and then sending the signature component request to the co-signature party so that the co-signature party generates the remaining signature components based on the signature component request and sends the remaining signature components to the server; Obtaining a complete signature component by using the partial signature component and the remaining signature components, and signing the complete signature component to obtain a target signature; Sending the target signature to a verifier so that the verifier verifies the target signature based on the target public key and a preset verification algorithm to complete the corresponding signature operation.

8. A collaborative signature device based on SPHINCS+, characterized in that, Applied to a server, including: A first key pair generation module, configured to generate initial parameters, a first key seed, a pseudorandom function seed, and a public key seed, and generate a first WOTS+ key pair corresponding to each leaf node of the top-level XMSS tree for SPHINCS+ supertrees based on the first key seed and using a pseudorandom function algorithm; the first WOTS+ key pair includes a first private key component and a first public key component; A second key pair generation module, configured to send the initial parameters and the public key seed to the co-signature party so that, after receiving the initial parameters and the public key seed, the co-signature party generates a second WOTS+ key pair based on a second key seed and sends the second public key component in the second WOTS+ key pair to the server; A recursive signature module, configured to determine a WOTS+ public key based on the first public key component and the second public key component, generate a root node of the top-level XMSS tree, determine a target public key by using the root node and the public key seed, and perform recursive signature on a message to be signed in a multi-layer tree structure after publishing the target public key to obtain partial signature components; A target signature verification module, configured to determine a complete signature component based on the partial signature component, sign the complete signature component, and send the obtained target signature to a verifier so that the verifier verifies the target signature based on the target public key to complete the corresponding signature operation.

9. An electronic device, characterized in that, Including: A memory, configured to store a computer program; A processor, configured to execute the computer program to implement the SPHINCS+-based co-signature method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, For storing a computer program, wherein the computer program, when executed by a processor, implements the SPHINCS+-based co-signature method according to any one of claims 1 to 7.

Images