Extensible anti-quantum signature method and system

Abstract

The application discloses an extensible anti-quantum signature method and system, and relates to the technical field of computers, and comprises the following steps: acquiring a pre-constructed Merkle tree, which is recorded as tree 1, and the tree height of the tree 1 is h; when it is monitored that the signature number of a signer reaches 2 h times for the tree 1, a Merkle tree is re-constructed and recorded as tree 2; a corresponding private key is generated for each leaf node of the tree 2, and a public key of each leaf node is generated according to the private key of each leaf node of the tree 2; a root node public key of the tree 2 is generated according to the public keys of all the leaf nodes of the tree 2; a new root node public key of an extension tree is generated according to the root node public key of the tree 1 and the root node public key of the tree 2; the extension tree is constructed according to the tree 1 and the tree 2, and the tree height of the extension tree is h+1; a signature value is obtained by signing a to-be-processed message M by using the private key of any leaf node of the tree 2; and a verification result is obtained by verifying the to-be-processed message M and the signature value. The application can improve the signature number.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a scalable quantum-resistant signature method and system. Background Technology

[0002] Existing quantum-resistant signature schemes based on hash functions (such as LMS signatures in RFC8554, XMSS signatures in RFC8391, and XMSS signatures in NIST FIPS 205) achieve quantum resistance by combining Merkle trees (also known as perfect Merkle trees) with one-time signatures (such as LM-OTS, WOTS+, etc.).

[0003] However, existing LMS or XMSS signatures have a fixed number of signatures: once the signer has used up their signatures (e.g., an LMS / XMSS tree of height h can only sign 2 signatures), the signature limit is reached. h If the LMS or XMSS tree fails, it will become invalid. Summary of the Invention

[0004] The main purpose of this application is to provide a scalable quantum-resistant signature method and system, which aims to increase the signature count of LMS or XMSS signatures.

[0005] To achieve the above objectives, this application proposes a scalable quantum-resistant signature method, comprising:

[0006] Obtain the pre-constructed Merkle tree, denoted as tree1, where the height of tree1 is h, and the public key of the root node of tree1 is rpk1;

[0007] When the number of signatures by the signer for tree 1 reaches 2, h After this, a new Merkle tree is constructed, denoted as tree 2, where the height of tree 2 is the same as the height of tree 1, and tree 2 has a total of 2... h A new leaf node;

[0008] Generate a private key for each leaf node in tree 2, and generate a public key for each leaf node based on the private key of each leaf node in tree 2.

[0009] Based on the public keys of all leaf nodes in tree 2, generate the public key of the root node of tree 2, denoted as rpk2;

[0010] Based on the public key rpk1 of the root node of tree 1 and the public key rpk2 of the root node of tree 2, generate the new public key rpk of the extended tree. new The extended tree is constructed based on tree 1 and tree 2, and its height is (h+1). The public key rpk1 of the root node of tree 1 is stored, and the public key rpk of the new root node is also stored. new Publish it;

[0011] Using the private key of any leaf node in tree 2, sign the message M to be processed to obtain the signature value sigvalue. new ;

[0012] Combined with the new root node's public key RPK new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained.

[0013] In one embodiment, generating a corresponding private key for each leaf node of tree 2, and generating a public key for each leaf node based on the private key of each leaf node of tree 2, includes:

[0014] Using the private key seed corresponding to tree 1, generate a private key sk for each leaf node of tree 2. i Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1};

[0015] Based on the private key sk of each leaf node in tree 2 i Generate the public key pk corresponding to each leaf node. i Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}.

[0016] In one embodiment, generating a corresponding private key for each leaf node of tree 2, and generating a public key for each leaf node based on the private key of each leaf node of tree 2, includes:

[0017] Generate a new private key seed new Use private key seed new Generate a private key sk for each leaf node of tree 2. i Where the key index i∈{0,1,2,...,2} h -1};

[0018] Based on the private key sk of each leaf node in tree 2 i Generate the public key pk corresponding to each leaf node. i Where the key index i∈{0,1,2,...,2} h -1}.

[0019] In one embodiment, the step of generating a new root node public key rpk of the extended tree based on the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2 is described.new ,include:

[0020] Concatenate the public key rpk1 of the root node of tree 1 with the public key rpk2 of the root node of tree 2, and perform a hash calculation on the concatenation result to obtain the new public key rpk of the extended tree. new The formula for calculating the public key of the new root node is rpk. new =H(rpk1||rpk2); || indicates concatenation, and H represents the preset hash function.

[0021] In one embodiment, the message M to be processed is signed using the private key of any leaf node of tree 2 to obtain a signature value sigvalue. new ,include:

[0022] The message M to be processed is hashed to obtain m, where the formula for calculating m is m=H(M); H represents the preset hash function.

[0023] Use the private key sk of any leaf node i Calculate the signature of m to obtain sig new Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1};

[0024] Determine the authentication path (path) of the leaf node used to compute the signature in the extended tree, and compare the authentication path (path) with the signature (sign). new The concatenated signature value is denoted as sigvalue. new ;

[0025] The formula for splicing is sigvalue. new =sig new ||path.

[0026] In one embodiment, the step of generating a new root node public key rpk of the extended tree based on the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2 is described. new ,include:

[0027] The message M to be processed is hashed to obtain m, where the formula for calculating m is m=H(M); H represents the preset hash function.

[0028] Use the private key sk of any leaf node i Calculate the signature of m to obtain sig new Where the key index i∈{0,1,2,...,2} h -1};

[0029] Determine the authentication path (path) of the leaf node used to compute the signature in the extended tree, and compare the authentication path (path) with the signature (sign). new The concatenated signature value is denoted as sigvalue. new ;

[0030] The formula for splicing is sigvalue. new =sig new ||path.

[0031] In one embodiment, the combination of the new root node public key rpk new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained, including:

[0032] The message M to be processed is hashed to obtain m, where the formula for calculating m is m=H(M); H represents the preset hash function.

[0033] Based on m and sigvalue new The root node rpk of the extended tree is calculated. new ';

[0034] rpk new With RPK new 'Make a comparison;

[0035] When rpk new 'equals to rpk new At that time, the verification result is that the signature verification was successful;

[0036] When rpk new Not equal to RPK new At that time, the verification result was that the signature verification failed.

[0037] In one embodiment, it further includes:

[0038] When it is detected that the number of signatures for the extended tree with a height of (h+1) is 0, the extension process is triggered again: the extended tree with a height of (h+1) is extended to a new extended tree with a height of (h+2).

[0039] Repeat the above operations to continuously expand the expansion tree after the number of signatures available for the expansion tree reaches 0.

[0040] Furthermore, to achieve the above objectives, this application also proposes a scalable quantum-resistant signature system, which includes:

[0041] The acquisition module is used to acquire a pre-built Merkle tree, denoted as tree1, where the height of tree1 is h and the public key of the root node of tree1 is rpk1;

[0042] The construction module is used to detect when the number of times a signer has signed tree 1 reaches 2. h After this, a new Merkle tree is constructed, denoted as tree 2, where the height of tree 2 is the same as the height of tree 1, and tree 2 has a total of 2... h A new leaf node;

[0043] The first generation module is used to generate a corresponding private key for each leaf node of tree 2, and generate a public key for each leaf node based on the private key of each leaf node of tree 2.

[0044] The second generation module is used to generate the root node public key of tree 2, denoted as rpk2, based on the public keys of all leaf nodes of tree 2.

[0045] The third generation module is used to generate a new root node public key rpk for the extended tree based on the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2. new The extended tree is constructed based on tree 1 and tree 2, and its height is (h+1). The public key rpk1 of the root node of tree 1 is stored, and the public key rpk of the new root node is also stored. new Publish it;

[0046] The signature module is used to sign the message M to be processed using the private key of any leaf node in tree 2, and obtain the signature value sigvalue. new ;

[0047] The verification module is used to combine the new root node's public key RPK. new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained.

[0048] In addition, to achieve the above objectives, this application also proposes an electronic device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the scalable quantum-resistant signature method as described above.

[0049] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the scalable quantum-resistant signature method described above.

[0050] In addition, to achieve the above objectives, this application also provides a computer program product comprising a computer program that, when executed by a processor, implements the steps of the scalable quantum-resistant signature method described above.

[0051] This application provides a scalable quantum-resistant signature method and system. When the number of signatures reaches 0, the tree height automatically increases to h+1, and can then support 2... h This allows for multiple signatures, thereby increasing the number of signatures for LMS or XMSS signatures. The public key is always the value of the root node of the current tree, and the root node's public key is automatically updated when the tree height grows. Attached Figure Description

[0052] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0053] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 A flowchart illustrating a first embodiment of the scalable quantum-resistant signature method of this application;

[0055] Figure 2 An example diagram of an extended Merkle tree provided in an embodiment of this application;

[0056] Figure 3 This is a schematic diagram of the modular structure of a scalable quantum-resistant signature system according to an embodiment of this application;

[0057] Figure 4 This is a schematic diagram of the device structure of the hardware operating environment involved in the scalable quantum-resistant signature method in the embodiments of this application.

[0058] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0059] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0060] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0061] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device, big data service platform, or scalable quantum-resistant signature system capable of implementing the above functions. The following description uses a scalable quantum-resistant signature system as an example to illustrate this embodiment and the subsequent embodiments.

[0062] Based on this, embodiments of this application provide a scalable quantum-resistant signature method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the scalable quantum-resistant signature method of this application. In this embodiment, the scalable quantum-resistant signature method includes the following steps:

[0063] Step S11: Obtain the pre-constructed Merkle tree, denoted as tree 1, where the height of tree 1 is h, and the public key of the root node of tree 1 is rpk1;

[0064] It should be noted that the Merkle tree can be an LMS tree or an XMSS tree. In one embodiment, LMS is the RFC8554 standard; XMSS is the RFC8391 standard.

[0065] Obtain the pre-constructed Merkle tree, denoted as tree1, where tree1 has a height of h and a total of 2. h There are leaf nodes; to generate the key for the LMS / XMSS tree, the signer performs the following operations:

[0066] 1. Randomly generate a private key seed;

[0067] 2. Generate a private key for each leaf node using the private key seed;

[0068] 3. Generate a public key corresponding to each leaf node based on the public key calculation method of the leaf nodes of the LMS tree or XMSS tree;

[0069] 4. Following the method for calculating the root node public key of an LMS tree or XMSS tree, generate the root node public key of the LMS / XMSS tree, denoted as rpk1, based on the public keys of all leaf nodes.

[0070] 5. The signer's key pair is (seed, rpk1). The signer keeps the private key seed as a secret and publishes the root node's public key.

[0071] It should be noted that the methods for calculating the public keys of leaf nodes and root nodes in LMS or XMSS trees are existing algorithms. For example, taking LMS as an example, the principle for calculating the public key of a leaf node is as follows: The private key of the leaf node is hashed a fixed number of times using a hash function to obtain the public key of the leaf node. The principle for calculating the public key of the root node is as follows: The hash values ​​of every two adjacent nodes are concatenated and then hashed again to generate the hash value of the node at the next higher level. This process is repeated until a unique result for the root node is obtained. This result is used as the public key of the LMS root node. Example: The tree height is 2, with 4 leaf nodes. Leaf layer: L0, L1, L2, L3 (all OTS public keys); Middle layer: P0=H(L0||L1), P1=H(L2||L3); Root node (public key): Root=H(P0||P1); where || represents concatenation, and H represents a hash function, which can be SHA256, SM3, etc.

[0072] Step S12, when it is detected that the number of times the signer has signed Tree 1 reaches 2. h After this, a new Merkle tree is constructed, denoted as tree 2, where the height of tree 2 is the same as the height of tree 1, and tree 2 has a total of 2... h A new leaf node;

[0073] It should be noted that when the number of signatures by the signer reaches 2... h After this, the signer's remaining signature count is 0. The signer then triggers an expansion of the LMS or XMSS tree. The specific process is as follows: A new Merkle tree, denoted as tree 2, is constructed. The height of tree 2 is the same as the height of tree 1. Tree 2 has a total of 2... h A new leaf node.

[0074] Step S13: Generate a corresponding private key for each leaf node of tree 2, and generate a public key for each leaf node based on the private key of each leaf node of tree 2.

[0075] In one embodiment, the private key seed corresponding to tree 1 is used to generate a private key sk for each leaf node of tree 2. i Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}; then, according to the public key calculation method of the leaf nodes of the LMS tree or XMSS tree, based on the private key sk of each leaf node of tree 2. i The public key pk corresponding to each leaf node is calculated. i Where the key index i∈{2} h ,2 h+1,2 h +2,...,2 h+1 -1}.

[0076] It should be noted that the private key seed is the same as the private key seed of multiplexing tree 1; therefore, the range of available key indices becomes 2. h Up to 2 h+1 -1 can reduce storage costs and is suitable for resource-constrained devices.

[0077] In another embodiment, a new private key seed is generated. new Use private key seed new Generate a private key sk for each leaf node of tree 2. i Where the key index i∈{0,1,2,...,2} h -1}; then, according to the public key calculation method of the leaf nodes of the LMS tree or XMSS tree, based on the private key sk of each leaf node of tree 2. i The public key pk corresponding to each leaf node is calculated. i Where the key index i∈{0,1,2,...,2} h -1}.

[0078] It should be noted that generating a new private key seed new Since the private key seed of tree 1 is not the same as the seed of tree 1, the key index can be reset to 0 to 2. h -1 indicates that the private key seed is rotated, which is suitable for high-security scenarios.

[0079] It should be noted that the public key calculation method for the leaf nodes of the LMS tree or XMSS tree is an existing algorithm, which will not be elaborated here.

[0080] Step S14: Generate the root node public key of tree 2, denoted as rpk2, based on the public keys of all leaf nodes of tree 2.

[0081] It should be noted that, following the method for calculating the root node public key of an LMS tree or XMSS tree, the root node public key of tree 2 is calculated based on the public keys of all leaf nodes of tree 2, and is denoted as rpk2. The method for calculating the root node public key of an LMS tree or XMSS tree is an existing algorithm, and will not be elaborated here.

[0082] Step S15: Based on the public key rpk1 of the root node of tree 1 and the public key rpk2 of the root node of tree 2, generate a new public key rpk for the extended tree. new The extended tree is constructed based on tree 1 and tree 2, and its height is (h+1). The public key rpk1 of the root node of tree 1 is stored, and the public key rpk of the new root node is also stored. new Publish it;

[0083] It should be noted that connecting the root node of tree 1 and the root node of tree 2 constructs an extended tree with a height of (h+1). (See reference...) Figure 2 , Figure 2 This is an example diagram of a Merkle tree extension provided in one embodiment of this application. Figure 2 Taking an LMS / XMSS tree with a height h=3 as an example, we expand it into a new LMS / XMSS tree with a height of 4. The number of times a signer can sign is increased from 0 to 2. h This time, that is, 2 new signatures were added. h Second-rate.

[0084] In this embodiment, the public key rpk1 of the root node of tree 1 and the public key rpk2 of the root node of tree 2 are concatenated, and the concatenation result is hashed to obtain the new public key rpk of the extended tree. new The formula for calculating the public key of the new root node is rpk. new =H(rpk1||rpk2); || represents concatenation, and H represents the preset hash function. Save the public key rpk1 of the root node of tree 1, and add the public key rpk2 of the new root node. new Release it.

[0085] At this point, after expansion, the signer's new key pair is (seed, rpk). new ) or (seed new rpk new ).

[0086] Step S16: Using the private key of any leaf node in tree 2, sign the message M to be processed to obtain the signature value sigvalue. new ;

[0087] In one embodiment, a hash calculation is performed on the message M to be processed to obtain m, where the formula for calculating m is m = H(M); H represents a preset hash function; then, the private key sk of any leaf node is used. i Calculate the signature of m to obtain sig new Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}; Further, determine the authentication path path in the extended tree for calculating the signature of the leaf node, and match the authentication path path with the signature. new The concatenated signature value is denoted as sigvalue. new The formula for splicing is as follows: sigvalue new =sig new ||path

[0088] In another embodiment, the message M to be processed is hashed to obtain m, where the formula for calculating m is m = H(M); H represents a preset hash function; and then the private key sk of any leaf node is used. i Calculate the signature of m to obtain sig new Where the key index i∈{0,1,2,...,2} h -1}; Further, determine the authentication path path in the extended tree for calculating the signature of the leaf node, and match the authentication path path with the signature. new The concatenated signature value is denoted as sigvalue. new The formula for splicing is as follows:

[0089] sigvalue new =sig new ||path

[0090] It should be noted that the authentication path length is equal to the tree height, resulting in a high proportion of redundant data in the signature, which is unsuitable for low-bandwidth scenarios. In this embodiment, the public key rpk1 of the root node of tree 1 can be used to participate in the calculation of the authentication path, thereby reducing authentication path redundancy. It should be noted that the calculation of the authentication path is based on the standard algorithms of LMS and XMSS, which will not be elaborated here.

[0091] Step S17, combine the new root node public key rpk new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained.

[0092] In this embodiment, in order to process the message M to be processed by the signer and its signature value sigvalue new To perform verification, the verifier performs the following operation: performs a hash calculation on the message M to be processed to obtain m, where the calculation formula for m is m=H(M); H represents the preset hash function.

[0093] According to the signature verification calculation method of LMS or XMSS, based on m and sigvalue new The root node rpk of the extended tree is calculated. new The signature verification calculation methods of LMS or XMSS are existing algorithms and will not be elaborated here.

[0094] Furthermore, rpk new With RPK new 'Compare; when rpk new 'equals to rpk new When the verification result is successful, the signature is verified; when rpk new Not equal to RPK newAt that time, the verification result was that the signature verification failed.

[0095] In addition, it also includes:

[0096] When the number of signatures for the extended tree with a height of (h+1) is detected to be 0, the extension process is triggered again: the extended tree with a height of (h+1) is extended to a new extended tree with a height of (h+2); the above operation is repeated so that the extended tree is continuously extended after the number of signatures for the extended tree is 0.

[0097] It should be noted that when the signer has exhausted the signing count for the LMS or XMSS tree of height (h+1), and the signer triggers the expansion of the LMS / XMSS tree again, the signer performs the following operations:

[0098] Using steps S11 to S17, the LMS / XMSS tree of height (h+1) is expanded to a new LMS / XMSS tree of height (h+2). After expansion, the new LMS / XMSS tree has a height of (h+2), and the number of times a signer can sign is increased from 0 to 2. h+1 This is the second time (i.e., 2 new signatures) h+1 Repeating the above operations continuously expands the LMS / XMSS tree.

[0099] This embodiment automatically increases the tree height to h+1 after the number of signatures reaches 0, thus supporting 2. h This allows for multiple signatures, thereby increasing the number of signatures for LMS or XMSS signatures. The public key is always the value of the root node of the current tree, and the root node's public key is automatically updated when the tree height grows.

[0100] It should be noted that the examples in the figure are only for understanding this application and do not constitute a limitation on the scalable quantum-resistant signature method of this application. Any simple transformations based on this technical concept are within the protection scope of this application.

[0101] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0102] This application also provides a scalable quantum-resistant signature system, please refer to... Figure 3 The scalable quantum-resistant signature system includes:

[0103] Module 21 is used to obtain a pre-built Merkle tree, denoted as tree 1, where the height of tree 1 is h and the public key of the root node of tree 1 is rpk1;

[0104] Module 22 is used to detect when the number of signatures made by the signer for tree 1 reaches 2. h After this, a new Merkle tree is constructed, denoted as tree 2, where the height of tree 2 is the same as the height of tree 1, and tree 2 has a total of 2... h A new leaf node;

[0105] The first generation module 23 is used to generate a corresponding private key for each leaf node of tree 2, and generate a public key for each leaf node based on the private key of each leaf node of tree 2.

[0106] The second generation module 24 is used to generate the root node public key of tree 2, denoted as rpk2, based on the public keys of all leaf nodes of tree 2.

[0107] The third generation module 25 is used to generate a new root node public key rpk of the extended tree based on the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2. new The extended tree is constructed based on tree 1 and tree 2, and its height is (h+1). The public key rpk1 of the root node of tree 1 is stored, and the public key rpk of the new root node is also stored. new Publish it;

[0108] The signature module 26 is used to sign the message M to be processed using the private key of any leaf node in tree 2, and obtain the signature value sigvalue. new ;

[0109] Verification module 27 is used to combine the new root node's public key rpk new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained.

[0110] The scalable quantum-resistant signature system provided in this application, employing the scalable quantum-resistant signature method in the above embodiments, can solve the technical problems described in the background section. Compared with the prior art, the beneficial effects of the scalable quantum-resistant signature system provided in this application are the same as those of the scalable quantum-resistant signature method provided in the above embodiments, and other technical features of the scalable quantum-resistant signature system are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0111] This application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute the scalable quantum-resistant signature method in Embodiment 1 above.

[0112] The following is for reference. Figure 4The diagram illustrates a structural schematic of an electronic device suitable for implementing embodiments of this application. The electronic devices in these embodiments may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 4 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0113] like Figure 4 As shown, the electronic device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the electronic device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following devices can be connected to the input / output interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. The communication device 1009 allows the electronic device to communicate wirelessly or wiredly with other devices to exchange data. Although the figures show electronic devices with various devices, it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or included alternatively.

[0114] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0115] The electronic device provided in this application, employing the scalable quantum-resistant signature method in the above embodiments, can solve the technical problems described in the background section. Compared with the prior art, the beneficial effects of the electronic device provided in this application are the same as those of the scalable quantum-resistant signature method provided in the above embodiments, and other technical features of this electronic device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0116] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0117] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0118] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the scalable quantum-resistant signature method in the above embodiments.

[0119] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor devices or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution device or apparatus. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0120] The aforementioned computer-readable storage medium may be included in an electronic device or may exist independently without being assembled into an electronic device.

[0121] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by an electronic device, cause the electronic device to:

[0122] Obtain the pre-constructed Merkle tree, denoted as tree1, where the height of tree1 is h, and the public key of the root node of tree1 is rpk1;

[0123] When the number of signatures by the signer for tree 1 reaches 2, h After this, a new Merkle tree is constructed, denoted as tree 2, where the height of tree 2 is the same as the height of tree 1, and tree 2 has a total of 2... h A new leaf node;

[0124] Generate a private key for each leaf node in tree 2, and generate a public key for each leaf node based on the private key of each leaf node in tree 2.

[0125] Based on the public keys of all leaf nodes in tree 2, generate the public key of the root node of tree 2, denoted as rpk2;

[0126] Based on the public key rpk1 of the root node of tree 1 and the public key rpk2 of the root node of tree 2, generate the new public key rpk of the extended tree. newThe extended tree is constructed based on tree 1 and tree 2, and its height is (h+1). The public key rpk1 of the root node of tree 1 is stored, and the public key rpk of the new root node is also stored. new Publish it;

[0127] Using the private key of any leaf node in tree 2, sign the message M to be processed to obtain the signature value sigvalue. new ;

[0128] Combined with the new root node's public key RPK new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained.

[0129] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0130] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0131] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0132] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described scalable quantum-resistant signature method, thereby solving the technical problems described in the background section. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the scalable quantum-resistant signature method provided in the above embodiments, and will not be repeated here.

[0133] This application provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the scalable quantum-resistant signature method described above.

[0134] The computer program product provided in this application can solve the technical problems described in the background section. Compared with the prior art, the beneficial effects of the computer program product provided in the embodiments of this application are the same as the beneficial effects of the scalable quantum-resistant signature method provided in the above embodiments, and will not be repeated here.

[0135] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A scalable quantum-resistant signature method, characterized in that, include: Obtain the pre-constructed Merkle tree, denoted as tree1, where the height of tree1 is h, and the public key of the root node of tree1 is rpk1; When the number of signatures by the signer for tree 1 reaches 2, h After this, a new Merkle tree is constructed, denoted as tree 2, where the height of tree 2 is the same as the height of tree 1, and tree 2 has a total of 2... h A new leaf node; Generate a private key for each leaf node in tree 2, and generate a public key for each leaf node based on the private key of each leaf node in tree 2. Based on the public keys of all leaf nodes in tree 2, generate the public key of the root node of tree 2, denoted as rpk2; Based on the public key rpk1 of the root node of tree 1 and the public key rpk2 of the root node of tree 2, generate the new public key rpk of the extended tree. new The extended tree is constructed based on tree 1 and tree 2, and its height is (h+1). The public key rpk1 of the root node of tree 1 is stored, and the public key rpk of the new root node is also stored. new Publish it; Using the private key of any leaf node in tree 2, sign the message M to be processed to obtain the signature value sigvalue. new ; Combined with the new root node's public key RPK new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained.

2. The scalable quantum-resistant signature method as described in claim 1, characterized in that, The process of generating a private key for each leaf node of tree 2, and generating a public key for each leaf node based on the private key of each leaf node of tree 2, includes: Using the private key seed corresponding to tree 1, generate a private key sk for each leaf node of tree 2. i Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}; Based on the private key sk of each leaf node in tree 2 i Generate the public key pk corresponding to each leaf node. i Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}.

3. The scalable quantum-resistant signature method as described in claim 1, characterized in that, The process of generating a private key for each leaf node of tree 2, and generating a public key for each leaf node based on the private key of each leaf node of tree 2, includes: Generate a new private key seed new Use private key seed new Generate a private key sk for each leaf node of tree 2. i Where the key index i∈{0,1,2,...,2} h -1}; Based on the private key sk of each leaf node in tree 2 i Generate the public key pk corresponding to each leaf node. i Where the key index i∈{0,1,2,...,2} h -1}.

4. The scalable quantum-resistant signature method as described in claim 1, characterized in that, The step involves generating a new root node public key rpk for the extended tree based on the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2. new ,include: Concatenate the public key rpk1 of the root node of tree 1 with the public key rpk2 of the root node of tree 2, and perform a hash calculation on the concatenation result to obtain the new public key rpk of the extended tree. new The formula for calculating the public key of the new root node is rpk. new =H(rpk1||rpk2); || indicates concatenation, and H represents the preset hash function.

5. The scalable quantum-resistant signature method as described in claim 2, characterized in that, The message M to be processed is signed using the private key of any leaf node in tree 2, resulting in a signature value sigvalue. new ,include: The message M to be processed is hashed to obtain m, where the formula for calculating m is m=H(M); H represents the preset hash function. Use the private key sk of any leaf node i Calculate the signature of m to obtain sig new Where, key index i∈{2} h ,2 h +1,2 h +2,...,2 h+1 -1}; Determine the authentication path (path) of the leaf node used to compute the signature in the extended tree, and compare the authentication path (path) with the signature (sign). new The concatenated signature value is denoted as sigvalue. new ; The formula for splicing is sigvalue. new =sig new ||path.

6. The scalable quantum-resistant signature method as described in claim 3, characterized in that, The step involves generating a new root node public key rpk for the extended tree based on the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2. new ,include: The message M to be processed is hashed to obtain m, where the formula for calculating m is m=H(M); H represents the preset hash function. Use the private key sk of any leaf node i Calculate the signature of m to obtain sig new Where the key index i∈{0,1,2,...,2} h -1}; Determine the authentication path (path) of the leaf node used to compute the signature in the extended tree, and compare the authentication path (path) with the signature (sign). new The concatenated signature value is denoted as sigvalue. new ; The formula for splicing is sigvalue. new =sig new ||path.

7. The scalable quantum-resistant signature method as described in claim 1, characterized in that, The combination of the new root node public key rpk new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained, including: The message M to be processed is hashed to obtain m, where the formula for calculating m is m=H(M); H represents the preset hash function. Based on m and sigvalue new The root node rpk of the extended tree is calculated. new '; rpk new With RPK new 'Make a comparison; When rpk new 'equals to rpk new At that time, the verification result is that the signature verification was successful; When rpk new Not equal to RPK new At that time, the verification result was that the signature verification failed.

8. The scalable quantum-resistant signature method as described in claim 1, characterized in that, Also includes: When it is detected that the number of signatures for the extended tree with a height of (h+1) is 0, the extension process is triggered again: the extended tree with a height of (h+1) is extended to a new extended tree with a height of (h+2). Repeat the above operations to continuously expand the expansion tree after the number of signatures available for the expansion tree reaches 0.

9. A scalable quantum-resistant signature system, characterized in that, include: The acquisition module is used to acquire a pre-built Merkle tree, denoted as tree1, where the height of tree1 is h and the public key of the root node of tree1 is rpk1; The construction module is used to detect when the number of signatures made by the signer for tree 1 reaches 2. h After this, a new Merkle tree is constructed, denoted as tree 2, where the height of tree 2 is the same as the height of tree 1, and tree 2 has a total of 2... h A new leaf node; The first generation module is used to generate a corresponding private key for each leaf node of tree 2, and generate a public key for each leaf node based on the private key of each leaf node of tree 2. The second generation module is used to generate the root node public key of tree 2, denoted as rpk2, based on the public keys of all leaf nodes of tree 2. The third generation module is used to generate a new root node public key rpk for the extended tree based on the root node public key rpk1 of tree 1 and the root node public key rpk2 of tree 2. new The extended tree is constructed based on tree 1 and tree 2, and its height is (h+1). The public key rpk1 of the root node of tree 1 is stored, and the public key rpk of the new root node is also stored. new Publish it; The signature module is used to sign the message M to be processed using the private key of any leaf node in tree 2, and obtain the signature value sigvalue. new ; The verification module is used to combine the new root node's public key RPK. new The message M to be processed and its signature value sigvalue new The verification was performed, and the verification results were obtained.

Images