Method and device for hiding secret in check digital signature, and medium

Abstract

The invention provides a method and device for hiding secrets in a check digital signature and a medium. The method comprises the steps that a signer generates a key pair through a Fiat-Shamir key construction method; wherein the key pair comprises a public key and a private key; obtaining a to-be-signed message; generating a digital signature based on the private key and the to-be-signed message by using a constant convolution sampling method; and transmitting the to-be-signed message, the digital signature and the public key to a verification party, and performing verification by the verification party. According to the novel method for hiding the secret in the lattice digital signature, deep research is carried out on the digital signature algorithm based on the lattice cryptographic algorithm, the limitation on modulus in the prior art is avoided, the signature length is reduced, the parameter selection flexibility is improved, and a signature algorithm with a shorter bandwidth can be designed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital signature, and particularly relates to a method and device for masking secrets in lattice digital signature and a medium. BACKGROUND

[0002] Digital signature technology is a key technology for guaranteeing information security and integrity. Electronic documents or other digital information are signed using encryption algorithms to ensure the integrity and authenticity of the information, while verifying the identity of the sender. In the research of quantum computing, Shor algorithm and Grover algorithm are two key milestones.

[0003] In 1994, Shor proved that the factorization problem and the discrete logarithm problem are polynomial solvable under the model of a quantum computer; subsequently, Grover gave a quantum search algorithm for unordered databases in 1996, and since then, research on quantum algorithms and related hardware has received widespread attention and made great progress. This has also prompted the research of cryptography to gradually move towards the post-quantum era, and how to design a cryptographic system that can resist quantum computing attacks has become one of the current research hotspots.

[0004] To cope with this situation, post-quantum cryptographic algorithm standards, the "Horizon" plan and Japan's CREST and other cryptographic mathematics projects have followed. So far, NIST has completed the first batch of post-quantum standard algorithm collection work and released three algorithms as post-quantum standard algorithms. At the same time, NIST has launched post-quantum standard algorithm migration work, aiming to layout the transition from classical public key cryptography to post-quantum cryptography to get rid of the serious threat that quantum computers may bring as soon as possible. The current cryptographic systems with potential quantum resistance mainly include lattice problem-based cryptographic systems, coding-based cryptographic systems, multivariate-based cryptographic systems, hash algorithm-based cryptographic systems, and hyperelliptic curve isogeny problem-based cryptographic systems. Among them, lattice problem-based cryptographic systems occupy an important position due to their perfect security proof, excellent algorithm performance and rich functions, and among the three post-quantum standard algorithms announced by NIST, two are based on lattice problem-based cryptography.

[0005] In a digital signature algorithm based on a lattice difficult problem, the Fiat-Shamir structure is a classical signature construction method. In a signature in the Fiat-Shamir structure, a key technical core is how to carry the secret S in the output message in the signature algorithm. If not handled, an attacker can collect a large number of signatures and statistically obtain the private key information. In order to solve the problem of leaking private key information, there are currently various processing methods, such as flooding, rejection sampling or convolution theorem. The above methods can be used to mask secret information in the Fiat-Shamir structure signature, but all have certain limitations. For example, the modulus of the flooding method is too large to design a practical scheme; the modulus of the rejection sampling method is limited by the rejection rate, such as the modulus of the Dilithium algorithm is 8380417; the modulus of the HEAT AE algorithm is 64513; the modulus of the convolution theorem method is limited by the smoothing parameter, such as the modulus of the G+G algorithm is 64513, 50177 and 202753. The existing secret information masking method has a lower limit for the modulus of the algorithm, and the modulus and the bandwidth of the signature have a linear relationship, so that the bandwidth of the Fiat-Shamir structure signature is larger than that of other route signatures. SUMMARY

[0006] In view of the above problems, the present application provides a method, device and medium for masking secrets in lattice digital signatures to overcome the problem that the modulus of the existing algorithm has a lower limit, the modulus and the bandwidth of the signature have a linear relationship, and the bandwidth of the Fiat-Shamir structure signature is larger than that of other route signatures.

[0007] The present application provides a method for masking secrets in lattice digital signatures, comprising: The signature party generates a key pair through the Fiat-Shamir key construction method; wherein the key pair includes a public key and a private key, and the components of each item of the private key are randomly and uniformly selected from [-1, 1] except that the first item is 1; Obtain a message to be signed; Generate a digital signature based on the private key and the message to be signed by using a constant convolution sampling method; Transmit the message to be signed, the digital signature and the public key to a verification party for verification by the verification party.

[0008] In a possible implementation, the signature party generates a key pair through the Fiat-Shamir key construction method, comprising: The signature party generates a random integer matrix A of kxd uniformly modulo q through the key construction method, and generates a secret matrix S of dxm; The random integer matrix A and the secret matrix S satisfy AS=qj mod 2q, wherein j is a matrix of kxd whose first item is 1 and the rest are 0; Set the public key as an integer matrix A, and the private key as a secret matrix S.

[0009] In a possible implementation, generating a digital signature based on the private key and a message to be signed by using a constant convolution sampling method comprises: generating a d*1 random vector y according to chi-square distribution sampling, and calculating a vector w based on the random vector y, w=Aymod2q; calculating an m*1 fixed hamming weight vector c based on the message to be signed M, c=H(w,M); generating an m*1 vector h according to vector c sampling; when c i is 0, h i is 0; when c i is 1, h i is uniformly randomly selected from {-2,0}; calculating a vector z based on the secret matrix S of the private key, the vector c and the vector h, z=y+Sc+Sh, generating a digital signature (z,c) based on the vector z and the vector c.

[0010] In a possible implementation, the process of verification by the verifier comprises: the verifier decrypts the digital signature based on the public key to obtain a vector c'; checking whether the vector c' is equal to the vector c and whether the vector z is a short vector; if yes, the message verification is successful.

[0011] In a possible implementation, the formula for calculating the vector c' by the verifier is as follows: the verifier calculates a vector w' based on the public key, w'=Az-qjc=Ay+ASc+ASh-Tcmod2q; calculating a vector c' based on the vector w', c'=H(w',M).

[0012] The application further provides a computing device comprising: a processor and a memory: the memory is configured to store program code and transmit the program code to the processor; the processor is configured to execute the method for masking secrets in lattice digital signatures according to the instructions in the program code.

[0013] The application further provides a computer readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the method for masking secrets in lattice digital signatures according to any one of the above.

[0014] The application further provides a computer program product, which stores a computer program, and the computer program is executed by a processor to implement the method for masking secrets in lattice digital signatures according to any one of the above.

[0015] The application provides a novel method for masking secrets in lattice digital signatures, based on the in-depth research on digital signature algorithms based on lattice cryptography algorithms, focusing on security, parameter selection flexibility and signature length, researching a novel public key cryptography algorithm based on the MLWE problem, improving the signature algorithm by adopting a new technology, reducing the signature length while improving the parameter selection flexibility, so as to realize the unification of the parameter selection of the key encapsulation algorithm. The method of the application avoids the limitation of the modulus in the prior art, can obtain a smaller modulus, including but not limited to 3329, 769, 257 and the like, and thus a signature algorithm with shorter bandwidth can be designed.

[0016] The above description is only a summary of the technical scheme of the application, in order to more clearly understand the technical means of the application, the specific embodiments of the application can be implemented according to the content of the specification, and in order to make the above and other purposes, characteristics and advantages of the application more obvious and easy to understand, the following specific embodiments of the application are described.

[0017] The above and other purposes, advantages and characteristics of the application will be more apparent to those skilled in the art from the following detailed description of specific embodiments of the application in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0018] Various other advantages and benefits will become apparent to those of ordinary skill in the art, upon reading the following detailed description of the preferred embodiments. The accompanying drawings are intended to illustrate the preferred embodiments for purposes of a better understanding of the present application and are not intended to limit the present application thereto. Moreover, like reference numerals designate similar parts throughout the several views in the drawings. In the drawings: Figure 1 is a method flow diagram for masking secrets in lattice digital signatures according to an embodiment of the application; Figure 2 is a Sample-x algorithm parameter diagram in digital signatures according to an embodiment of the application; Figure 3 is a Sample-x algorithm parameter diagram in digital signatures according to an embodiment of the application; Figure 4 is a key generation stage parameter selection diagram in digital signatures according to an embodiment of the application; Figure 5 is a signature stage parameter selection diagram in digital signatures according to an embodiment of the application; Figure 6 is a verification stage parameter selection diagram in digital signatures according to an embodiment of the application. DETAILED DESCRIPTION

[0019] Exemplary embodiments of the present application will be described in greater detail below with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it is understood that the present application can be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the application to those skilled in the art.

[0020] Embodiments of the present application provide a method for masking secrets in lattice digital signatures. Digital signature is used to verify the integrity of data and the identity of the sender, while preventing data from being tampered with or forged. It is widely used in the fields of electronic documents, electronic commerce, electronic government affairs, etc. The process of digital signature usually includes key generation phase, signature phase and verification phase. Among them, the key generation phase and the previous phase are completed by the signing party such as computer equipment, and the verification phase is completed by the verification party such as server.

[0021] The digital signature algorithm of the present embodiment is designed based on the Fiat-Shamir structure. The original design of the Fiat-Shamir signature framework is based on the discrete logarithm problem, in which the public parameter is the base point G of the elliptic curve, the private key is a random integer a, and the public key is the corresponding point pk=aG on the curve; in the signature, the signer first selects a random integer r, calculates the corresponding point R=rG on the curve, and then calculates c=hash(m,R), z=r+c a, the signature is (c,z); the verifier calculates R'=zG-c pk, and verifies whether c'=hash(m,R') is equal to c, and returns verification success or failure according to the result.

[0022] In the discrete logarithm version, the signature is calculated by z=r+c a, where c is a challenge vector generated by a hash function related to the message and commitment, a is a fixed vector as a private key, and r is a masking vector used to prevent the leakage of s by analyzing z. Since y is taken from a uniform distribution, it is easy to verify that z also obeys a uniform distribution, that is, z can ensure that no information of s is leaked.

[0023] However, when the algorithm is extended to the lattice problem, according to the scheme of Lyu09 and Lyu12, the private key is a high matrix , and the public key is calculated by multiplying S by a random matrix , which is represented as . The masking vector According to a certain distribution, sampling is performed, and a commitment w=Ay is calculated. Then the signature calculation is z=y+cS. The verifier can easily check Az=w+cT. However, in this design, a major problem is how to select the distribution of y, because too large a boundary will lead to a forgery attack, and too small a boundary may leak information of s.

[0024] One way to solve this problem is to choose a large standard deviation of y to mask the center cS, which will cause the signature size to expand rapidly. Another way is to use rejection sampling to eliminate the information of S, that is, set the target distribution p_t, and output the result of each time with the probability of p_t(x) / (Mq(x)). This method needs to be calculated multiple times, and according to the latest work of Yu25, the rejection sampling process may lead to a side channel attack to recover the key. In addition, the G+G scheme proposes a third method, that is, the distribution of y is selected according to S, and another variable h is sampled to ensure that z=y+cS+hS is close to the known distribution z'. They use the convolution theorem of Gaussian distribution to control the distance between z and z', but this method uses high-dimensional Gaussian sampling, which is not easy to implement.

[0025] Based on this, the method for masking secrets in lattice digital signature of the embodiment of the application can include the following steps S1-S4. Figure 1 As shown in the figure, the method for masking secrets in lattice digital signature of the embodiment of the application can include the following steps S1-S4.

[0026] S1, the signing party generates a key pair through the Fiat-Shamir key construction method; wherein the key pair includes a public key and a private key, and the components of each item of the private key are randomly and uniformly selected from [-1, 1] except that the first item is 1.

[0027] In the key generation phase, the signing party generates a random integer matrix A of q uniform kxd through the Fiat-Shamir key construction method, that is, the size of the matrix A is k rows and d columns, and each element in the matrix is a random integer between 0 and (q-1), and the probability of each integer appearing is equal. In addition, a secret matrix S of dxm is generated, that is, the size of the matrix S is d rows and m columns. The parameters in the above random matrix A and the secret matrix S can be adjusted according to the specific application requirements, and the embodiment does not make any provisions thereon.

[0028] The random integer matrix A and the secret matrix S satisfy AS=qj mod 2q, wherein j is a kxd matrix whose first item is 1 and the rest are 0; the public key is set as the integer matrix A, and the private key is set as the secret matrix S.

[0029] S2, obtaining a message to be signed. The message to be signed can be obtained directly by the signing party or from the verifying party. The message to be signed can be an electronic document, an email, transaction information, or other types of data. The specific type of data can be set according to different application fields and actual needs.

[0030] S3, generating a digital signature based on the private key and the message to be signed by using a constant convolution sampling method.

[0031] In the embodiment of the present application, the step S3 can specifically include: generating a d x 1 random vector y according to chi-square distribution sampling, and calculating a vector w based on the random vector y, w = Aymod2q; calculating an m x 1 fixed Hamming weight vector c based on the message to be signed M, c = H(w, M); generating an m x 1 vector h by sampling based on the vector c; when c i is 0, h i is 0; when c i is 1, h i is uniformly randomly selected from {-2, 0}; calculating a vector z based on the secret matrix S of the private key, the vector c, and the vector h, z = y + Sc + Sh, and generating a digital signature (z, c) based on the vector z and the vector c. c = H(w, M) is a method of mapping the message M and the commitment w = Ay into a vector c composed of 0 and 1 elements by a hash function, c i represents the components of c, and since c is m 1, the value of i is a positive integer between 1 and m, h is a masking vector generated based on c, and the purpose of h is to make each component of c + h subject to a symmetric distribution, that is, (c i + h i ) is either 0 or a uniform distribution of {-1, 1}.

[0032] S4, transmitting the message to be signed, the digital signature, and the public key to the verifying party for verification.

[0033] After generating the digital signature, the signing party completes the key generation phase and the signing phase, and then transmits the message to be signed, the public key, and the digital signature to the verifying party for verification.

[0034] When the verifying party verifies, the verifying party can first decrypt the digital signature based on the public key A to obtain a vector c'; check whether the vector c' is equal to the vector c and whether the vector z is a short vector; if so, the message verification is successful.

[0035] The vector w' is calculated according to the following formula: w'=Az-qj c=Ay+ASc+ASh-Tc mod 2q; the vector c' is calculated according to the following formula: c'=H(w',M); it is checked whether the vector c' is equal to the vector c and whether the vector z is a short vector; if yes, the message verification is successful. Since qj=AS mod 2q and each component of h is a 2 integer multiple, AS h mod 2q=0, the correctness of the above formula is ensured. Generally, T represents the product of AS, that is, T=AS, and T=qj in the embodiment.

[0036] In the embodiment of the present application, considering the distribution of z, it is known that z=y+S(c+h), when c i is 0, h i is uniformly randomly selected from {-2,0}, thus when c i is 0, c i +h i =0, when c i is 1, c i +h i satisfies the uniform distribution of {-1,1}, that is, c i +h i is a symmetric distribution about 0. For any symmetric distribution about 0 , there is . Since the components of S are selected from {-1,1}, it can be proved that the distribution of S(c+h) is irrelevant to the value of S, that is, z does not leak the information of S. In addition, it is known from the above analysis that the embodiment only has requirements for the values of S and c, and has no requirement for y, thus the modulus q required to meet the security can be greatly reduced, and the signature bandwidth is extremely small.

[0037] The embodiment of the present application uses one-dimensional binomial distribution instead of high-dimensional Gaussian distribution sampling, which reduces the implementation difficulty while ensuring that the distribution of z can be accurately described. That is, there is no error between the target distribution and the source distribution, and this feature can effectively reduce the size of the signature.

[0038] Specifically, first, the basic distribution can be defined. Let σ represent a probability distribution uniformly selected from {-1,1}. Let χ(c,k) represent a binomial distribution with c as the center and kZ as the support set. The probability distribution involved in the embodiment can be effectively sampled by the algorithm Sample_χ as shown below.

[0039]

[0040]

[0041]

[0042] Sampleχfunction, which can be used to sample χ(0, 1), χ(0, 2), and χ(-1, 2), which are the three required distributions. In the algorithm, rtrepresents a random bit string, and the getbit function is used to obtain a certain number of random bits from this random bit string, as shown in Figure 2 The sample_X function is used to sample x in the signature algorithm, which calls Sampleχ, as shown in Figure 3 .

[0043] In this embodiment, three distributions are defined, y is sampled by χ(0, 1) + χ(0, 1), and h is sampled by χ(-1, 2) and c i =1 corresponds to the part, so that (c i +h i ) is taken from the uniform distribution of {-1, 1}, which is called σ, and in addition σ + σ = χ(0, 2), so the three distributions defined here cover the required distributions in this embodiment.

[0044] Secondly, how to select the distributions of h and y will be shown. Since AS = qj mod 2q, the support set of Shmust be , where m represents the integer dimension of m, and the components of h can be set as h i According to the different values of c i , when c i =0, h i =0, and when c i =1, h i is sampled from χ(-c i , 2). It can be found that when c i =1, h i +c i obeys the σ distribution; when c i =0, h i +c i =0; in addition, it can also be verified that σ + σ = χ(0, 2).

[0045] Next, in order to define the distribution of y, the information of S and c needs to be used. Since c is a vector with a fixed Hamming weight τ, the ith row of (h + c)S can be expressed as , which is because σ is a symmetric distribution centered at 0 and is selected from {-1, 1}.

[0046] Therefore, the distribution of y can be set as . In this way, the distribution of z = y + cS + hS can be checked, and for any c, S value, z always follows the defined deterministic probability distribution, that is, .

[0047] Based on this constant convolution sampling method, a digital signature scheme and parameter selection can be designed, such as Figures 4-6 wherein, Figure 4 The key generation function used in the key generation phase of the digital signature is shown, and each row performs the following work: 1. Generate a random seed that meets the security length requirement 2. Expand the above seed into 4 independent parts through the hash function 3. Use seedA to generate uniform matrix Agen on Rq (polynomial ring modulo q) 4. Use seedsk to generate vector sgen, egen on (polynomial ring modulo q), each component of which is uniformly sampled on -1 or 1 5. Calculate b = Agensgen + egen mod q 6. Construct the matrix A on the ring R2q by splicing b and Agen 7. Construct the vector s by splicing sgen and egen 8. Use the compression algorithm to compress b into b' (this is an optimization method, which is irrelevant to the core technology of the present application, and can be omitted) 9. Use seeds' to generate vector s' on (polynomial ring modulo q), each component of which is uniformly sampled on -1 or 1, which will be used to enhance the security of the algorithm against attacks (this is an optimization method, which is irrelevant to the core technology of the present application, and can be omitted) 10. Construct the vector s by splicing s' (this is an optimization method, which is irrelevant to the core technology of the present application, and can be omitted) 11. Public key pk = (seedA, b'), private key sk = (s, s', \bar{s}', K) If the irrelevant technology is omitted, then pk = (seedA, b); sk = (s, K).

[0048] Figure 5 The signature function used in the signature phase of the digital signature is shown, and each row performs the following work: 1-3. Restore A (defined the same as in the key generation phase) from seedA and b'(b) in the public key 4. Get the seed mu from seedA, b'(b), message M through the hash function 5. Expand K and mu into 2 independent seeds using the hash function 6. Set the counter count = 0 7. Expand seedycx', count into 3 independent seeds using the hash function (this is an optimization method, which is irrelevant to the core technology of the present application, and can be omitted) 8. Generate two random elements c', c" on ring Rq from seed c' (This is an optimization method, which is not related to the core technology of the invention, and can be omitted) 9. Generate x' from c' (This is an optimization method, which is not related to the core technology of the invention, and can be omitted) 10. Generate x" from c" (This is an optimization method, which is not related to the core technology of the invention, and can be omitted) 11. Calculate y = (c' + x') s' + (c" + x") \bar{s}' + Y1, where Y1 is sampled from χ(0,1) + χ(0,1), and if the optimization method is ignored, y = sample_Y1 here 12. Calculate w = Ay mod 2q 13. Generate c from w and mu by sampling, which corresponds to c = H(w, M) in the document 14. Expand seedx to 1 independent seed seedx using a hash function according to seedx, count, which can be allowed to change according to the change of count 15. Sample x from c using random seed seedx, which has the same distribution as described above, that is, c i = 0, x i = 0; c i = 1, x i Randomly sampled from {-2, 0} 16. Calculate z = y + cs + xs 17. Determine whether the infinite norm of z is small enough, if not, add 1 to count and return to 7 to repeat 18. Compress z to get z' using compression algorithm (This is an optimization method, which is not related to the core technology of the invention, and can be omitted) 19. Sign as z', c; if the optimization technology is ignored, it is z, c.

[0049] Figure 6 The verification algorithm of the verification phase of the digital signature is shown, and each line performs the following work: 1. Decompress the signature (This is an optimization method, which is not related to the core technology of the invention, and can be omitted) 2~4. Restore A (defined the same as in the key generation phase) through seedA and b'(b) in the public key 5. Calculate w = Az - qcj mod 2q 6. Get seed mu from hash function according to seedA, b'(b), message M (the same as the signature algorithm) 7. Determine whether c corresponds to w, mu, i.e. whether c is equal to H(w, M), and whether the infinity norm of z is small enough, if so, the signature verification is successful.

[0050] Table 1 is a parameter and performance index table when the modulus q is 257.

[0051] Table 1

[0052] Table 2 shows a comparison chart of the algorithm of the embodiment of the present application and other algorithms, wherein Rhyme is the scheme of the embodiment of the present application, HAETAE is a Korean post-quantum standard algorithm, and Dilithium is an American post-quantum standard algorithm.

[0053] Table 2

[0054] The length of the signature algorithm designed based on the scheme of the embodiment of the present application can be reduced by more than 50%.

[0055] The embodiment of the present application also provides a computing device, comprising a processor and a memory: the memory is used to store program code and transmit the program code to the processor; and the processor is used to execute the method for masking secrets in lattice digital signatures according to the instructions in the program code.

[0056] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the method for masking secrets in lattice digital signatures according to the above embodiment.

[0057] The embodiment of the present application also provides a computer program product, which stores a computer program, and the computer program is executed by a processor to realize the method for masking secrets in lattice digital signatures according to the above embodiment.

[0058] The technical scheme of the present application can be embodied in the form of a software product in essence or all or part of the technical scheme, the computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computing device (such as a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application when the instructions are run. The storage medium mentioned above includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various storage medium capable of storing program codes.

[0059] Alternatively, all or part of the steps of the foregoing method embodiments can be accomplished by program instruction related hardware (such as a computing device of a personal computer, a server, or a network device, etc.), which can be stored in a computer readable storage medium, and when the program instruction is executed by a processor of the computing device, the computing device executes all or part of the steps of the method according to the embodiments of the present application.

[0060] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: within the spirit and principles of the present application, the technical solutions recorded in the foregoing embodiments can still be modified, or part or all of the technical features can be replaced by equivalents; and these modifications or replacements do not make the corresponding technical solutions deviate from the protection scope of the present application.

Claims

1. A method for blinding a secret in lattice digital signatures, characterized in that, The method comprises the following steps: The signing party generates a key pair by a Fiat-Shamir key construction method; wherein the key pair comprises a public key and a private key, and the components of each item of the private key are randomly and uniformly selected from [-1, 1] except that the first item is 1; Obtaining a message to be signed; Generating a digital signature based on the private key and the message to be signed by using a constant convolution sampling method; Transmitting the message to be signed, the digital signature and the public key to a verifying party for verification by the verifying party.

2. The method of claim 1, wherein, The signing party generates a key pair by a Fiat-Shamir key construction method, which comprises the following steps: The signing party generates a random integer matrix A of kxd by a key construction method, and generates a secret matrix S of dxm; The random integer matrix A and the secret matrix S satisfy AS=qj mod 2q, wherein j is a matrix of kxd whose first item is 1 and the rest items are 0; The public key is set as the integer matrix A, and the private key is set as the secret matrix S.

3. The method of claim 1, wherein, Generating a digital signature based on the private key and the message to be signed by using a constant convolution sampling method comprises the following steps: A random vector y of dx1 is generated according to χ2 distribution sampling, and a vector w is calculated based on the random vector y, w=Aymod2q; A vector c of mx1 with fixed Hamming weight is calculated according to the message to be signed M, c=H(w,M); According to the vector c sampling generates an mxl vector h; when c i is 0, h i is 0; when c i is 1, h i is uniformly randomly selected from {-2, 0}; A vector z is calculated according to the secret matrix S of the private key, the vector c and a vector h, z=y+Sc+Sh, The digital signature (z, c) is generated based on the vector z and the vector c.

4. The method of claim 3, wherein, The process of verification by the verifying party comprises the following steps: The verifying party decrypts the digital signature based on the public key to obtain a vector c'; It is checked whether the vector c' is equal to the vector c and whether the vector z is a short vector; if yes, the message verification is successful.

5. The method of claim 4, wherein, The formula for calculating the vector c' by the verifying party is as follows: The verifying party calculates a vector w' based on the public key, w'=Az-qjc=Ay+ASc+ASh-Tc mod 2q; The vector c' is calculated according to the vector w', c'=H(w',M).

6. A computing device, comprising: The method comprises the following steps: A processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the method for masking secrets in lattice digital signatures according to the instructions in the program code.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to realize the method for masking secrets in lattice digital signatures according to any one of claims 1-6.

8. A computer program product having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the method for masking secrets in lattice digital signatures according to any one of claims 1-6.

Images