Extensible anti-quantum signature method and system

Abstract

The invention discloses an extensible anti-quantum signature method and system, and relates to the technical field of computers, and the method comprises the steps: obtaining a pre-constructed Merkle tree, recording the Merkle tree as a tree 1, and enabling the height of the tree 1 to be h; when it is monitored that the signature times of the signer for the tree 1 reach 2 h, a Merkle tree is reconstructed and recorded as a tree 2; generating a corresponding private key for each leaf node of the tree 2, and generating a public key of each leaf node according to the private key of each leaf node of the tree 2; generating a root node public key of the tree 2 according to the public keys of all leaf nodes of the tree 2; generating a new root node public key of the extension tree according to the root node public key of the tree 1 and the root node public key of the tree 2; the extension tree is constructed according to a tree 1 and a tree 2, and the height of the extension tree is h + 1; signing the message M to be processed by using a private key of any leaf node of the tree 2 to obtain a signature value; and verifying the message M to be processed and the signature value to obtain a verification result. The signature frequency can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to an extensible anti-quantum signature method and system. BACKGROUND

[0002] The existing anti-quantum signature scheme based on hash function (such as LMS signature of RFC8554 specification, XMSS signature of RFC8391 specification, XMSS signature of NIST FIPS 205 standard) realizes anti-quantum attack by combining Merkle tree (also known as perfect Merkle tree) with one-time signature (such as LM-OTS, WOTS+ and the like).

[0003] However, the signature number of the existing LMS or XMSS signature is fixed: when the signature number of the signer is used up (such as the LMS / XMSS tree with a tree height equal to h can only sign 2 h times), the LMS or XMSS tree will be invalid. SUMMARY

[0004] The main purpose of the present application is to provide an extensible anti-quantum signature method and system, aiming to improve the signature number of LMS or XMSS signature.

[0005] To achieve the above purpose, the present application provides an extensible anti-quantum signature method, comprising: obtaining a pre-constructed Merkle tree, denoted as tree 1, wherein the tree height of tree 1 is h, and the root node public key of tree 1 is rpk1; when it is monitored that the signature number of the signer for tree 1 reaches 2 h times, reconstructing a Merkle tree denoted as tree 2, wherein the tree height of tree 2 is the same as that of tree 1, and tree 2 has 2 h new leaf nodes in total; generating a corresponding private key for each leaf node of tree 2, and generating a public key corresponding to each leaf node of tree 2 according to the private key of each leaf node of tree 2; generating the root node public key of tree 2 denoted as rpk2 according to the public keys of all leaf nodes of tree 2; generating a new root node public key rpk new of an extended tree according to the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2; wherein the extended tree is constructed according to tree 1 and tree 2, and the tree height of the extended tree is (h+1); saving the root node public key rpk1 of tree 1, and publishing the new root node public key rpk new ; using the private key of any leaf node of tree 2 to sign a to-be-processed message M to obtain a signature value sigvalue new ; Combined with the new root node's public key RPK new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained.

[0006] In one embodiment, generating a corresponding private key for each leaf node of tree 2, and generating a public key for each leaf node based on the private key of each leaf node of tree 2, includes: Using the private key seed corresponding to tree 1, generate a private key sk for each leaf node of tree 2. i Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}; Based on the private key sk of each leaf node in tree 2 i Generate the public key pk corresponding to each leaf node. i Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}.

[0007] In one embodiment, generating a corresponding private key for each leaf node of tree 2, and generating a public key for each leaf node based on the private key of each leaf node of tree 2, includes: Generate a new private key seed new Use private key seed new Generate a private key sk for each leaf node of tree 2. i Where the key index i∈{0,1,2,...,2} h -1}; Based on the private key sk of each leaf node in tree 2 i Generate the public key pk corresponding to each leaf node. i Where the key index i∈{0,1,2,...,2} h -1}.

[0008] In one embodiment, the step of generating a new root node public key rpk of the extended tree based on the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2 is described. new ,include: Concatenate the public key rpk1 of the root node of tree 1 with the public key rpk2 of the root node of tree 2, and perform a hash calculation on the concatenation result to obtain the new public key rpk of the extended tree. new The formula for calculating the public key of the new root node is rpk. new= H(rpk1||rpk2); || represents concatenation, and H represents a preset hash function.

[0009] In an embodiment, the private key of any leaf node of the tree 2 is used to sign the message M to be processed to obtain a signature value sigvalue new , comprising: Hashing the message M to be processed to obtain m, wherein the calculation formula of m is m = H(M); H represents a preset hash function; Using any leaf node private key sk i , the signature of m is calculated to obtain sig new , wherein the key index i ∈ {2 h , 2 h +1, 2 h +2,..., 2 h+1 -1} is calculated. Determine the authentication path path of the leaf node used for signature calculation in the extended tree, and the signature value obtained by concatenating the authentication path path and sig new is recorded as sigvalue new ; The formula for concatenation is sigvalue new = sig new || path.

[0010] In an embodiment, the new root node public key rpk new of the extended tree is generated according to the root node public key rpk1 of the tree 1 and the root node public key rpk2 of the tree 2, comprising: Hashing the message M to be processed to obtain m, wherein the calculation formula of m is m = H(M); H represents a preset hash function; Using any leaf node private key sk i , the signature of m is calculated to obtain sig new , wherein the key index i ∈ {0, 1, 2,..., 2 h -1} is calculated. Determine the authentication path path of the leaf node used for signature calculation in the extended tree, and the signature value obtained by concatenating the authentication path path and sig new is recorded as sigvalue new ; The formula for concatenation is sigvalue new = sig new || path.

[0011] In an embodiment, the new root node public key rpk new is combined with the message M to be processed and the signature value sigvaluenew The verification is performed to obtain a verification result, including: Hash calculation is performed on the to-be-processed message M to obtain m, where the calculation formula of m is m=H(M); H represents a preset hash function; According to m and sigvalue new , the root node rpk new ' of the extended tree is calculated; rpk new is compared with rpk new '; When rpk new ' is equal to rpk new , the verification result is that the signature verification is successful; When rpk new ' is not equal to rpk new , the verification result is that the signature verification fails.

[0012] In an embodiment, the method further includes: When it is detected that the number of signable times of the extended tree with a tree height of (h+1) is 0, the extension process is triggered again: the extended tree with a tree height of (h+1) is extended to a new extended tree with a tree height of (h+2); The above operation is repeatedly performed to continuously extend the extended tree after the number of signable times of the extended tree is 0.

[0013] In addition, to achieve the above object, the application further provides an expandable quantum-resistant signature system, which includes: An acquisition module is configured to acquire a pre-constructed Merkle tree, denoted as tree 1, where the tree height of tree 1 is h, and the root node public key of tree 1 is rpk1; A construction module is configured to, when it is monitored that the number of signatures of a signer on tree 1 reaches 2 h times, reconstruct a Merkle tree, denoted as tree 2, where the tree height of tree 2 is the same as that of tree 1, and tree 2 has 2 h new leaf nodes in total; A first generation module is configured to generate a corresponding private key for each leaf node of tree 2, and generate a corresponding public key for each leaf node of tree 2 according to the private key of each leaf node of tree 2; A second generation module is configured to generate a root node public key of tree 2, denoted as rpk2, according to the public keys of all leaf nodes of tree 2; A third generation module is configured to generate a new root node public key rpk new; wherein the extension tree is constructed according to the tree 1 and the tree 2, and the height of the extension tree is (h+1); the root node public key rpk1 of the tree 1 is saved, and a new root node public key rpk new is published out; The signature module is configured to sign the to-be-processed message M by using the private key of any leaf node of the tree 2 to obtain a signature value sigvalue new . The verification module is configured to verify the to-be-processed message M and the signature value sigvalue new by using the new root node public key rpk new , and obtain a verification result.

[0014] In addition, to achieve the above-mentioned purpose, the present application further provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the computer program is configured to implement the steps of the expandable quantum-resistant signature method as described above.

[0015] In addition, to achieve the above-mentioned purpose, the present application further provides a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the expandable quantum-resistant signature method as described above.

[0016] In addition, to achieve the above-mentioned purpose, the present application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the expandable quantum-resistant signature method as described above.

[0017] The present application provides an expandable quantum-resistant signature method and system, when the number of signable times reaches 0, the height of the tree is automatically increased to h+1, and the number of 2 h times of signature can be supported, thereby improving the number of signature times of LMS or XMSS signature, and the public key is always the root node value of the current tree, and the root node public key is automatically updated when the height of the tree increases. BRIEF DESCRIPTION OF DRAWINGS

[0018] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application together with the specification.

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows, and obviously, other drawings can also be obtained by those skilled in the art without any creative effort on the premise of not paying any creative effort.

[0020] Figure 1 A flowchart provided by an embodiment of the anti-quantum signature method of the application; Figure 2 An embodiment of the Merkle tree provided by the application; Figure 3 A module structure diagram of the anti-quantum signature system of the embodiment of the application; Figure 4 A device structure diagram of the hardware running environment involved in the anti-quantum signature method of the embodiment of the application.

[0021] The object implementation, functional features and advantages of the application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0022] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the application and do not limit the application.

[0023] In order to better understand the technical solutions of the application, the following will be described in detail with reference to the drawings and specific embodiments.

[0024] It should be noted that the execution subject of the embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, a big data service platform, an expandable anti-quantum signature system, etc. capable of realizing the above functions. The following will take the expandable anti-quantum signature system as an example to describe the embodiment and the following embodiments.

[0025] Based on this, the embodiment of the application provides an expandable anti-quantum signature method, which will be described in detail with reference to Figure 1 , Figure 1 A flowchart provided by an embodiment of the anti-quantum signature method of the application. In this embodiment, the expandable anti-quantum signature method comprises the following steps: Step S11, obtaining a pre-constructed Merkle tree, denoted as tree 1, wherein the tree height of tree 1 is h, and the root node public key of tree 1 is rpk1; It should be noted that the Merkle tree can be an LMS tree or an XMSS tree. In an embodiment, LMS is the RFC8554 standard; XMSS is the RFC8391 standard.

[0026] Obtain a pre-constructed Merkle tree, denoted as tree 1, wherein the tree height of tree 1 is h, and there are 2 h In order to generate the key of the LMS / XMSS tree, the signer performs the following operations: 1. Randomly generate a private key seed seed; 2. Generate a private key for each leaf node using the private key seed; 3. Generate a public key corresponding to each leaf node private key according to the way of calculating the public key of the leaf node of the LMS tree or XMSS tree; 4. Generate the LMS / XMSS tree root node public key rpk1 according to the public keys of all leaf nodes according to the way of calculating the root node public key of the LMS tree or XMSS tree.

[0027] 5. The key pair of the signer is (seed, rpk1), and the signer keeps the private key seed as a secret and publishes the root node public key.

[0028] It should be noted that the way of calculating the public key of the leaf node of the LMS tree or XMSS tree and the way of calculating the root node public key of the LMS tree or XMSS tree are existing algorithms. For example, for LMS, the calculation principle of the public key of the leaf node is: through a hash function, the private key of the leaf node is iterated a fixed number of times to obtain the public key of the leaf node. The calculation principle of the root node public key is: calculate the parent node layer by layer: the hash values of every two adjacent nodes are spliced and then hashed to generate the hash value of the node of the upper layer, and the above process is repeated until the calculation result of the unique root node is obtained, which is taken as the root node public key of LMS. For example, the height of the tree is 2, and there are 4 leaf nodes, the leaf layer: L0, L1, L2, L3 (all are OTS public keys); the intermediate layer: P0=H(L0||L1), P1=H(L2||L3); the root node (public key): Root=H(P0||P1); wherein || represents splicing, H represents a hash function, and the hash function can be SHA256, SM3, etc.

[0029] Step S12, when it is monitored that the number of signatures of the signer against tree 1 reaches 2 h times, a Merkle tree is reconstructed and is denoted as tree 2, wherein the height of tree 2 is the same as the height of tree 1, and tree 2 has 2 h new leaf nodes; It should be noted that when the number of signatures of the signer reaches 2 h times, the number of signable times of the signer is 0, and the signer triggers the expansion of the LMS or XMSS tree, and the specific process is as follows: a Merkle tree is reconstructed and is denoted as tree 2, wherein the height of tree 2 is the same as the height of tree 1, and tree 2 has 2 h new leaf nodes.

[0030] Step S13, generate a corresponding private key for each leaf node of tree 2, and generate a public key corresponding to each leaf node of tree 2 according to the private key of each leaf node of tree 2; In one embodiment, the private key seed corresponding to tree 1 is used to generate a private key sk for each leaf node of tree 2. i Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}; then, according to the public key calculation method of the leaf nodes of the LMS tree or XMSS tree, based on the private key sk of each leaf node of tree 2. i The public key pk corresponding to each leaf node is calculated. i Where the key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}.

[0031] It should be noted that the private key seed is the same as the private key seed of multiplexing tree 1; therefore, the range of available key indices becomes 2. h Up to 2 h+1 -1 can reduce storage costs and is suitable for resource-constrained devices.

[0032] In another embodiment, a new private key seed is generated. new Use private key seed new Generate a private key sk for each leaf node of tree 2. i Where the key index i∈{0,1,2,...,2} h -1}; then, according to the public key calculation method of the leaf nodes of the LMS tree or XMSS tree, based on the private key sk of each leaf node of tree 2. i The public key pk corresponding to each leaf node is calculated. i Where the key index i∈{0,1,2,...,2} h -1}.

[0033] It should be noted that generating a new private key seed new Since the private key seed of tree 1 is not the same as the seed of tree 1, the key index can be reset to 0 to 2. h -1 indicates that the private key seed is rotated, which is suitable for high-security scenarios.

[0034] It should be noted that the public key calculation method for the leaf nodes of the LMS tree or XMSS tree is an existing algorithm, which will not be elaborated here.

[0035] Step S14: Generate the root node public key of tree 2, denoted as rpk2, based on the public keys of all leaf nodes of tree 2. It should be noted that, according to the root node public key calculation mode of the LMS tree or the XMSS tree, the root node public key of the tree 2 is calculated as rpk2 according to the public keys of all leaf nodes of the tree 2; the root node public key calculation mode of the LMS tree or the XMSS tree is an existing algorithm, which is not described herein.

[0036] Step S15, generating a new root node public key rpk of the extended tree according to the root node public key rpk1 of the tree 1 and the root node public key rpk2 of the tree 2. new ; wherein the extended tree is constructed according to the tree 1 and the tree 2, and the tree height of the extended tree is (h+1); the root node public key rpk1 of the tree 1 is saved, and the new root node public key rpk new is published. It should be noted that the root node of the tree 1 and the root node of the tree 2 are connected to construct the extended tree, and the tree height of the extended tree is (h+1), which can be referred to Figure 2 , Figure 2 The Merkle tree expansion example provided by an embodiment of the present application is shown in the following table, Figure 2 Taking the LMS / XMSS tree with a tree height of 3 as an example, it is expanded into a new LMS / XMSS tree with a tree height of 4. The number of signatures that the signer can sign is expanded from 0 times to 2 h times, that is, 2 h new signatures are added.

[0037] In this embodiment, the root node public key rpk1 of the tree 1 and the root node public key rpk2 of the tree 2 are spliced, and the spliced result is subjected to hash calculation to obtain a new root node public key rpk of the extended tree. new , wherein the calculation formula of the new root node public key is rpk new =H(rpk1||rpk2); || represents splicing, and H represents a preset hash function. The root node public key rpk1 of the tree 1 is saved, and the new root node public key rpk new is published.

[0038] At this time, after expansion, the new key pair of the signer is (seed, rpk new ) or (seed new , rpk new ).

[0039] Step S16, signing the to-be-processed message M using the private key of any leaf node of the tree 2 to obtain a signature value sigvalue new . In an embodiment, the to-be-processed message M is subjected to hash calculation to obtain m, wherein the calculation formula of m is m=H(M); H represents a preset hash function; and then any leaf node private key sk i is used to calculate and sign m to obtain signew wherein the key index i e {2 h ,2 h +1,2 h +2,...,2 h+1 -1}; further, determining an authentication path path of the leaf node used for calculating the signature in the extended tree, and recording a signature value obtained by splicing the authentication path path and the signature sig new as sigvalue new ; wherein the splicing formula is as follows: sigvalue new =sig new ||path In another embodiment, a hash calculation is performed on the to-be-processed message M to obtain m, wherein the calculation formula of m is m=H(M); H represents a preset hash function; further, a signature sig i is calculated on m using any leaf node private key sk new , wherein the key index i e {0, 1, 2,..., 2 h -1}; further, determining an authentication path path of the leaf node used for calculating the signature in the extended tree, and recording a signature value obtained by splicing the authentication path path and the signature sig new as sigvalue new ; wherein the splicing formula is as follows: sigvalue new =sig new ||path It should be noted that the authentication path length is equal to the tree height, and the proportion of redundant data in the signature is high, which is not suitable for a low-bandwidth scenario. In the present embodiment, the saved root node public key rpk1 of tree 1 can be used to participate in the calculation of the authentication path path, thereby reducing the authentication path redundancy. It should be noted that the calculation of the authentication path is a standard algorithm of LMS and XMSS, and is not described herein.

[0040] In step S17, the to-be-processed message M and the signature value sigvalue new are verified in combination with the new root node public key rpk new , to obtain a verification result.

[0041] In the present embodiment, in order to verify the to-be-processed message M and the signature value sigvalue new of the signer, the verifier performs the following operation: performing a hash calculation on the to-be-processed message M to obtain m, wherein the calculation formula of m is m=H(M); H represents a preset hash function.

[0042] According to the signature verification calculation manner of LMS or XMSS, the m and the sigvalue new, the root node rpk of the extended tree is calculated new The signature verification calculation of LMS or XMSS is an existing algorithm, which is not described herein.

[0043] Further, rpk new is compared with rpk new 'When rpk new 'is equal to rpk new , the verification result is that the signature verification succeeds; when rpk new 'is not equal to rpk new , the verification result is that the signature verification fails.

[0044] In addition, it also includes: When it is detected that the number of signatures of the extended tree with a tree height of (h+1) is 0, the extension process is triggered again: the extended tree with a tree height of (h+1) is extended to a new extended tree with a tree height of (h+2); the above operation is repeatedly performed to continuously extend the extended tree after the number of signatures of the extended tree is 0.

[0045] It should be noted that when the signer exhausts the number of signatures of the LMS or XMSS tree with a tree height of (h+1) again, the signer triggers the extension of the LMS / XMSS tree, and the signer performs the following operations: The LMS / XMSS tree with a tree height of (h+1) is extended to a new LMS / XMSS tree with a tree height of (h+2) by using the method of steps S11 to S17; after the extension, the tree height of the new LMS / XMSS tree is (h+2), and the number of signatures of the signer is extended from 0 to 2 h+1 times (that is, 2 h+1 new signatures). The above operation is repeatedly performed to continuously extend the LMS / XMSS tree.

[0046] The present embodiment can support 2 h signatures by automatically increasing the tree height to h+1 when the number of signatures reaches 0, thereby increasing the number of signatures of LMS or XMSS, and the public key is always the root node value of the current tree, and the root node public key is automatically updated when the tree height increases.

[0047] It should be noted that the examples in the figures are only used to understand the present application and do not constitute a limitation on the extendable quantum-resistant signature method of the present application. Further simple transformations based on this technical concept are within the protection scope of the present application.

[0048] It should be understood that the size of the serial number of each step in the above embodiments does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0049] The application further provides an expandable anti-quantum signature system, which comprises Figure 3 , and the expandable anti-quantum signature system comprises: An acquisition module 21 is configured to acquire a pre-constructed Merkle tree, denoted as tree 1, wherein the tree height of the tree 1 is h, and the root node public key of the tree 1 is rpk1; A construction module 22 is configured to re-construct a Merkle tree, denoted as tree 2, when it is monitored that the number of signatures of a signer on the tree 1 reaches 2 h h, and the tree 2 has 2 h new leaf nodes in total; A first generation module 23 is configured to generate a corresponding private key for each leaf node of the tree 2, and generate a corresponding public key for each leaf node of the tree 2 according to the private key of each leaf node of the tree 2; A second generation module 24 is configured to generate a root node public key of the tree 2, denoted as rpk2, according to the public keys of all leaf nodes of the tree 2; A third generation module 25 is configured to generate a new root node public key of an expansion tree, denoted as rpk new , according to the root node public key rpk1 of the tree 1 and the root node public key rpk2 of the tree 2; wherein the expansion tree is constructed according to the tree 1 and the tree 2, the tree height of the expansion tree is (h+1), the root node public key rpk1 of the tree 1 is saved, and the new root node public key rpk new is published; A signature module 26 is configured to sign a to-be-processed message M by using the private key of any leaf node of the tree 2 to obtain a signature value sigvalue new ; A verification module 27 is configured to verify the to-be-processed message M and the signature value sigvalue new by using the new root node public key rpk new , and obtain a verification result.

[0050] The expandable anti-quantum signature system provided by the application can solve the technical problems in the background art by using the expandable anti-quantum signature method in the above embodiment. Compared with the prior art, the expandable anti-quantum signature system provided by the application has the same beneficial effects as the expandable anti-quantum signature method provided by the above embodiment, and other technical features in the expandable anti-quantum signature system are the same as the features disclosed in the above embodiment method, which will not be described here.

[0051] The application provides an electronic device, comprising: at least one processor; and a memory connected with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the scalable quantum-resistant signature method in the above embodiment one.

[0052] Reference is made below in conjunction with Figure 4 which shows a structural schematic diagram of an electronic device suitable for implementing the embodiments of the application. The electronic device in the embodiments of the application can include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (for example, vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 4 The electronic device shown is merely an example and should not impose any limitation on the functions and use range of the embodiments of the application.

[0053] As shown in Figure 4 , the electronic device can include a processing device 1001 (for example, a central processor, a graphics processor, and the like) which can perform various appropriate actions and processes according to programs stored in a read-only memory 1002 or loaded from a storage device 1003 into a random access memory 1004. Various programs and data required for operation of the electronic device are also stored in the random access memory 1004. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are connected to each other through a bus 1005. An input / output interface 1006 is also connected to the bus. Generally, the following devices can be connected to the input / output interface 1006: input devices 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, and the like; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, and the like; the storage device 1003 including, for example, a magnetic tape, a hard disk, and the like; and a communication device 1009. The communication device 1009 can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the electronic device with various devices is shown in the figure, it should be understood that it is not required to implement or have all the devices shown. More or fewer devices can be alternatively implemented or provided.

[0054] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a read-only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiments disclosed in the present application are executed.

[0055] The electronic device provided by the present application adopts the scalable quantum-resistant signature method in the above-mentioned embodiments, and can solve the technical problems in the background art. Compared with the prior art, the electronic device provided by the present application has the same beneficial effects as the scalable quantum-resistant signature method provided by the above-mentioned embodiments, and other technical features in the electronic device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0056] It should be understood that parts of the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above-mentioned embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0057] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0058] The present application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e. computer program) for executing the scalable quantum-resistant signature method in the above-mentioned embodiments.

[0059] The computer readable storage medium provided in the application may be, for example, a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor device or apparatus, or any combination thereof. More specific examples of the computer readable storage medium may include, but are not limited to, an electric connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an optical fiber, a portable compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the embodiment, the computer readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution device or apparatus. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), and the like, or any suitable combination thereof.

[0060] The computer readable storage medium described above may be contained in an electronic device, or may exist separately without being assembled into an electronic device.

[0061] The computer readable storage medium described above carries one or more programs, which, when executed by the electronic device, cause the electronic device to: obtain a pre-constructed Merkle tree, denoted as tree 1, wherein the tree height of tree 1 is h, and the root node public key of tree 1 is rpk1; when it is monitored that the number of signatures of the signer on tree 1 reaches 2 h times, reconstruct a Merkle tree, denoted as tree 2, wherein the tree height of tree 2 is the same as that of tree 1, and tree 2 has 2 h new leaf nodes in total; generate a corresponding private key for each leaf node of tree 2, and generate a public key corresponding to each leaf node of tree 2 according to the private key of each leaf node of tree 2; generate a root node public key of tree 2, denoted as rpk2, according to the public keys of all leaf nodes of tree 2; generate a new root node public key rpk new of an extended tree according to the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2; wherein the extended tree is constructed according to tree 1 and tree 2, and the tree height of the extended tree is (h+1); save the root node public key rpk1 of tree 1, and save the new root node public key rpk newpublishing out; signing the message M to be processed using the private key of any leaf node of tree 2 to obtain a signature value sigvalue new ; combining the new root node public key rpk new , the message M to be processed and the signature value sigvalue new to obtain a verification result.

[0062] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0063] The flow diagrams and block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a procedure, or a part of code, which comprises one or more executable instructions for implementing the specified functions. It should also be noted in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks depicted in succession can in fact be executed substantially concurrently or the blocks can sometimes be executed in reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flow diagrams and combinations thereof can be implemented by a dedicated hardware-based system that performs specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0064] The modules involved in the embodiments of the present application can be implemented in software or in hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0065] The readable storage medium provided by the application is a computer readable storage medium, which stores computer readable program instructions (i.e. computer programs) for executing the scalable quantum-resistant signature method described above, and can solve the technical problems in the background art. Compared with the prior art, the computer readable storage medium provided by the application has the same beneficial effects as the scalable quantum-resistant signature method provided by the above embodiments, which will not be repeated here.

[0066] The embodiment of the application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the scalable quantum-resistant signature method as described above.

[0067] The computer program product provided by the application can solve the technical problems in the background art. Compared with the prior art, the computer program product provided by the embodiment of the application has the same beneficial effects as the scalable quantum-resistant signature method provided by the above embodiments, which will not be repeated here.

[0068] The above only describes some embodiments of the application, and does not limit the patent scope of the application, and any equivalent structural transformation made by using the content of the application specification and drawings, or direct / indirect application in other related technical fields is included in the patent protection scope of the application.

Claims

1. A scalable anti-quantum signature method, characterized by, The method comprises the following steps: obtaining a pre-constructed Merkle tree, denoted as tree 1, wherein the tree height of the tree 1 is h, and the root node public key of the tree 1 is rpk1; When the number of signatures of the signer against tree 1 is monitored to reach 2 h times, a Merkle tree is restructured and denoted as tree 2, wherein the tree height of tree 2 is the same as that of tree 1, and tree 2 has 2 h new leaf nodes in total; generating a corresponding private key for each leaf node of the tree 2, and generating a corresponding public key for each leaf node of the tree 2 according to the private key of each leaf node of the tree 2; generating a root node public key of the tree 2 according to the public keys of all leaf nodes of the tree 2, denoted as rpk2; According to the root node public key rpk1 of the tree 1 and the root node public key rpk2 of the tree 2, a new root node public key rpk of an extended tree is generated new ; wherein the extended tree is constructed according to the tree 1 and the tree 2, and the tree height of the extended tree is (h+1); the root node public key rpk1 of the tree 1 is saved, and the new root node public key rpk new is published out; Using the private key of any leaf node of tree 2, sign the message M to be processed to obtain the signature value sigvalue new ; combining the new root node public key rpk new , the message M to be processed and the signature value sigvalue new , and obtaining a verification result.

2. The scalable anti-quantum signature method of claim 1, wherein, The method comprises the following steps: Using the private key seed seed corresponding to tree 1, generate a private key sk for each leaf node of tree 2 i where the key index i e {2 h ,2 h +1,2 h +2,...,2 h+1 -1}; According to the private key sk of each leaf node of tree 2 i , generate the public key pk corresponding to each leaf node i , wherein the key index i∈{2 h ,2 h +1,2 h +2,...,2 h+1 -1}.

3. The scalable anti-quantum signature method of claim 1, wherein, The method comprises the following steps: generating a new private key seed seed new ; using the private key seed seed new generating a private key sk for each leaf node of tree 2 i where the key index i ∈ {0, 1, 2,..., 2 h -1}; According to the private key sk of each leaf node of tree 2 i , generate the public key pk corresponding to each leaf node i , wherein the key index i∈{0,1,2,...,2 h -1}.

4. The scalable anti-quantum signature method of claim 1, wherein, The new root node public key rpk of the extended tree is generated according to the root node public key rpk1 of the tree 1 and the root node public key rpk2 of the tree 2 new comprising: The root node public key rpk1 of the tree 1 is spliced with the root node public key rpk2 of the tree 2, and a hash calculation is performed on the spliced result to obtain a new root node public key rpk of the extended tree new , wherein the calculation formula of the new root node public key is rpk new =H(rpk1||rpk2); || represents splicing, and H represents a preset hash function.

5. The scalable anti-quantum signature method of claim 2, wherein, The private key of any leaf node of the tree 2 is used to sign the message M to be processed, and a signature value sigvalue is obtained new , comprising: performing hash calculation on the to-be-processed message M to obtain m, wherein the calculation formula of m is m=H(M); H represents a preset hash function; using either leaf node private key sk i , compute a signature sig new where the key index i e {2 h ,2 h +1,2 h +2,...,2 h+1 -1} determine an authentication path path in the extended tree for the leaf node used to compute the signature, and compare the authentication path path to sig new The concatenated signature value is denoted as sigvalue new ; wherein the formula for stitching is sigvalue new = sig new || path.

6. The scalable anti-quantum signature method of claim 3, wherein, The new root node public key rpk of the extended tree is generated according to the root node public key rpk1 of the tree 1 and the root node public key rpk2 of the tree 2 new , comprising: The method comprises the following steps: Using any leaf node private key sk i Compute signature sig on m new where key index i e {0, 1, 2,..., 2 h -1}; determine an authentication path path in the extended tree for the leaf node used to compute the signature, and compare the authentication path path to sig new The concatenated signature value is denoted as sigvalue new ; wherein the formula for stitching is sigvalue new = sig new || path.

7. The scalable anti-quantum signature method of claim 1, wherein, The new root node public key rpk is combined new Verifying the to-be-processed message M and the signature value sigvalue new Obtaining a verification result, including: performing hash calculation on the to-be-processed message M to obtain m, wherein the calculation formula of m is m=H(M); H represents a preset hash function; According to m and sigvalue new , the root node rpk of the extended tree is calculated new '; rpk new rpk new ' When rpk new is equal to rpk new , the verification result is that the signature verification succeeds. When rpk new is not equal to rpk new , the verification result is that the verification signature fails.

8. The scalable anti-quantum signature method of claim 1, wherein, The method comprises the following steps: The method further comprises the following steps: when it is detected that the signable number of the expansion tree with the tree height of (h+1) is 0, triggering the expansion process again: expanding the expansion tree with the tree height of (h+1) to a new expansion tree with the tree height of (h+2); 9. A scalable anti-quantum signature system, characterized by, repeatedly performing the above operations to continuously expand the expansion tree after the signable number of the expansion tree is 0. The method comprises the following steps: constructing a module for reconstructing a Merkle tree as tree 2 when the number of signatures of the signer against tree 1 reaches 2 h times is monitored, and reconstructing a Merkle tree as tree 2, wherein the tree height of tree 2 is the same as that of tree 1, and tree 2 has 2 h new leaf nodes in total; an obtaining module, configured to obtain a pre-constructed Merkle tree, denoted as tree 1, wherein the tree height of the tree 1 is h, and the root node public key of the tree 1 is rpk1; a first generating module, configured to generate a corresponding private key for each leaf node of the tree 2, and generate a corresponding public key for each leaf node of the tree 2 according to the private key of each leaf node of the tree 2; a second generating module, configured to generate a root node public key of the tree 2 according to the public keys of all leaf nodes of the tree 2, denoted as rpk2; a third generating module, configured to generate a new root node public key rpk of an extended tree according to the root node public key rpk1 of the tree 1 and the root node public key rpk2 of the tree 2 new ; wherein the extended tree is constructed according to the tree 1 and the tree 2, and a tree height of the extended tree is (h+1); the root node public key rpk1 of the tree 1 is saved, and the new root node public key rpk new is published out. a signature module configured to sign the message M to be processed using the private key of any leaf node of tree 2 to obtain a signature value sigvalue new ; a verification module, configured to verify the new root node public key rpk in combination with the message M and the signature value sigvalue new , the message M and the signature value sigvalue new , and obtain a verification result.

Images