Efficient quantum-resistant lattice cryptographic threshold signature method and system for distributed environment

Abstract

The application relates to a high-efficiency quantum-resistant lattice cryptography threshold signature method and system for a distributed environment, and belongs to the field of new-generation information technologies, which comprises the following steps: inputting a to-be-signed message, preset parameters and a pretreated MAC key share into a computer system of each participant; each participant extracts the MAC share of the participant, and outputs a globally shared MAC value; a private key polynomial, a public key containing noise and a key pair are generated through RLWE rejection sampling, and a key share is shared; a random value is generated by combining the key share and the MAC share of the participant, and a refreshed shared value is obtained; a private key related random input is generated based on the refreshed parameters and a preset mean standard deviation; a message commitment value is generated by combining the random input and the like, a partial signature is generated by selecting challenge bits, and the final signature is output by combining and outputting through Lagrange interpolation after broadcast verification; the message hash commitment and the comparison verification value are verified, and the computer system outputs a signature result, so that the problems of distributed quantum attack resistance and tamper resistance are solved.

Description

Technical Field

[0001] This invention belongs to the technical fields of blockchain, quantum computing and other related technologies in the new generation of information technology. Specifically, it involves specific technical categories such as digital signature, cryptography, quantum resistance, and threshold signature. In particular, it relates to an efficient quantum-resistant lattice cryptographic threshold signature method and system for distributed environments. It is applicable to application scenarios that require multi-party collaboration and high security, such as metaverse, blockchain nodes, Internet of Things security and distributed identity authentication. Background Technology

[0002] With the development of quantum computing, traditional public-key cryptosystems (such as RSA and ECC) face the risk of being cracked by quantum algorithms. Therefore, lattice cryptography, as an important branch of quantum-resistant cryptography, has become a research hotspot due to its strong security and feasibility, being based on difficult lattice problems (such as the RLWE hypothesis).

[0003] However, most existing lattice-based signature schemes are single-point key signatures, which are insufficient to meet the security and availability requirements of multi-party participation, key share management, and threshold signatures in distributed environments. In multi-party scenarios, without a reasonable threshold signature mechanism, the risks of key leakage and single point of failure will increase significantly.

[0004] For example, existing technologies (represented by CRYSTALS-Dilithium) have the following problems in the field of distributed quantum-resistant signatures. First, regarding architectural limitations, Dilithium is a single-point signature architecture, lacking multi-party collaboration capabilities, and cannot meet the threshold signature requirements of distributed systems (such as blockchains and multi-institutional collaborations). Furthermore, the centralized key generation and signing process makes it vulnerable to single-point failures or attacks. Second, these existing technologies rely on hash comparisons during the signature verification phase, lacking pre-emptive integrity checks on messages / shares, and cannot prevent tampering in the early stages of signature generation. Moreover, these existing technologies have fixed key parameters and no refresh mechanism, making them unsuitable for long-term storage or repeated use scenarios, and their attack resistance is very weak, with insufficient defense against fault attacks and side-channel attacks.

[0005] Therefore, there is an urgent need for a solution that is both quantum-resistant and supports efficient distributed key management and threshold signature generation and verification, in order to adapt to application environments with high security requirements such as blockchain and the Internet of Things. Summary of the Invention

[0006] The main objective of this invention is to provide an efficient quantum-resistant lattice cryptographic threshold signature method and system for distributed environments, in order to solve the problems of signatures being vulnerable to quantum attacks, messages being easily tampered with, and signatures being easily forged in distributed scenarios, to ensure the security and effectiveness of multi-participant collaborative signatures, and to meet the requirements of distributed environments for high-security quantum-resistant signatures.

[0007] Based on the first main aspect of the present invention, an efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments is provided, comprising:

[0008] Participants input the message to be signed, preset parameters, and pre-processed MAC key share into the computer system.

[0009] Each participant extracts its own MAC share, generates a random vector, and performs multiple rounds of splitting, recombination, hashing, and consistency verification. Once the verification is successful, a globally shared MAC value is output.

[0010] Participants generate a private key polynomial from a discrete Gaussian distribution through RLWE rejection sampling, generate a uniformly distributed random polynomial and a public key containing an error term, obtain a key pair with noise protection, and share the key share with other participants.

[0011] The participating parties generate a random shared value and a random multiplication factor for the shared value of the key share and their own MAC share. After multiple rounds of modular addition and modular multiplication iterations, the refreshed shared value is obtained.

[0012] Based on the parameters corresponding to the refreshed shared value and the preset mean and standard deviation, the participants generate random inputs that are related to the private key and conform to the statistical distribution through discrete Gaussian distribution sampling, sample discretization and acceptance judgment;

[0013] Based on the random input, the participants combine the globally shared MAC value, the refreshed shared value, and the key pair to generate a message commitment value for the message to be signed using a hash function and store it. They select a challenge bit and generate a partial signature through discrete Gaussian sampling. They perform a hash commitment consistency check on the partial signature. If the check passes, they broadcast the partial signature. All participants merge the final signatures through Lagrange interpolation.

[0014] The participating parties receive the final signature, the challenge bits broadcast during the signature generation phase, and the shared public key. They perform a hash commitment consistency check on the message to be signed, calculate and compare the verification value based on the final signature, the challenge bits, and the public key, and the computer system outputs the result of whether the signature is valid or invalid.

[0015] As a further preferred embodiment, in the aforementioned method, the preset parameters include one or a combination of two or more of the following: modulus, multinomial dimension, standard deviation of discrete Gaussian distribution, and challenge bit length; the random multinomial and the public key containing the error term are generated by multiplying the random multinomial modulo by the private key and adding the error term; the acceptance determination includes calculating the acceptance probability based on sample differences and determining it using a 0-1 uniformly distributed random number.

[0016] As a further preferred option, in the aforementioned method, the MAC share extracted by each participant is a share fragment corresponding to the message to be signed, and the generated random vector contains multiple random coefficients.

[0017] The multiple random coefficients are specifically random sampling coefficients corresponding to the number of participants or the number of message segments to be signed. Each random coefficient corresponds to a message part of a participant or a message segment to be signed.

[0018] In the multiple rounds of splitting and reorganization, each participant first splits its own MAC share into multiple sub-shares, and then combines the coefficients of the random vector to reorganize the multiple sub-shares.

[0019] During consistency verification, each participant first generates a hash value for its own recombined MAC-related value and broadcasts it. Then, it verifies whether the MAC-related values ​​broadcast by other participants are consistent with the corresponding hash values. If any participant's verification is inconsistent, the message authentication code share generation process is terminated. Only when all participants verify that the MAC value is consistent will the globally shared MAC value be output.

[0020] As a further preferred embodiment, in the aforementioned method, the participating parties generate a private key polynomial from a discrete Gaussian distribution through RLWE rejection sampling, generate a uniformly distributed random polynomial and a public key containing an error term, obtain a key pair with noise protection, and share the key share with other participating parties, specifically including:

[0021] When the participants perform RLWE rejection sampling, they generate a private key polynomial from a discrete Gaussian distribution based on a preset coefficient range and polynomial dimension.

[0022] The generated random polynomial is sampled from a uniform distribution corresponding to a preset modulus. When generating a public key with an error term, an error term conforming to a discrete Gaussian distribution is first generated by rejecting sampling. Then, the private key polynomial and the random polynomial are multiplied by a polynomial, the error term is superimposed, and a modulo operation is performed to obtain a public key with noise protection.

[0023] The generated key pair contains the random polynomial and the private key polynomial, and the participants share the corresponding shares of the random polynomial and the private key polynomial in the key pair with other participants respectively.

[0024] As a further preferred option, in the aforementioned method, when the shared value is refreshed, the random shared value and random multiplication factor generated by the participants are sampled from a uniform distribution corresponding to a preset modulus;

[0025] The multi-round modular addition and modular multiplication iterative operations are as follows: First, perform modular addition on the shared value of the key share and its own MAC share to obtain the initial modified shared value; then perform modular multiplication on the initial modified shared value to update it to the intermediate modified shared value; then repeat the operation five times. In each operation, first generate a new random addend and perform modular addition, then generate a new random multiplication factor and perform modular multiplication. The updated shared value is used as the input for the next round of operation, and finally the refreshed shared value is obtained.

[0026] As a further preferred option, in the aforementioned method, when the participants sample using a discrete Gaussian distribution, a sample set corresponding to the multinomial dimension is generated; sample discretization is achieved by performing a rounding operation on the sampled samples.

[0027] When making a decision, the acceptance probability is first calculated based on the difference between the sampled sample and the discretized sample. Then, a random number is generated from a uniform distribution of 0 to 1. If the random number is less than the acceptance probability, the discretized sample is accepted. Otherwise, the discrete Gaussian distribution sampling and sample discretization steps are repeated. This process is repeated until all participants have obtained a discretized sample that conforms to the expected statistical distribution. This sample is then used as a random input associated with the private key.

[0028] As a further preferred option, in the aforementioned method, when the participants generate a partial signature by combining random input, they first generate a random value through rejection sampling, which is performed according to a preset challenge bit length and polynomial dimension; then they calculate the polynomial product of the public key and the random value, and perform number theory transformation on the product result.

[0029] When selecting a challenge bit, the challenge bit is sampled from a uniform distribution containing the three values ​​-1, 0, and 1.

[0030] After generating a partial signature, each participant first uses a hash function to generate a corresponding hash commitment value for its own partial signature and broadcasts this hash commitment value to all other participants. Subsequently, when performing hash commitment consistency verification on the partial signature, each participant checks whether its own generated partial signature hash commitment value is consistent with the hash commitment values ​​already broadcast by other participants for their own partial signatures. This hash commitment value is different from the message commitment value generated using a hash function for the message to be signed; the former is generated for partial signatures, while the latter is generated for the message to be signed. Only when the verification is consistent will the participant broadcast its own partial signature; if the verification is inconsistent, the signature generation operation of the current participant will be suspended.

[0031] As a further preferred option, in the aforementioned method, when performing a hash commitment consistency check on the message to be signed, the hash value of the message to be signed is first recalculated, and then compared with the message commitment value retained during the signature generation stage. If they are inconsistent, the signature is directly determined to be invalid. When calculating the verification value, the first verification value is obtained by performing a number theory transformation on the polynomial product of the public key and the final signature, and the second verification value is obtained by performing a number theory transformation on the polynomial product of the public key and the challenge bit. When comparing the verification values, the first verification value and the second verification value are respectively subjected to a modulo operation, and the results of the modulo operation are checked to see if they are consistent. Only when the check results of all participants are consistent is the signature determined to be successful.

[0032] Based on a second key aspect of the present invention, a high-efficiency quantum-resistant lattice cryptographic threshold signature system for distributed environments is provided, comprising a multi-participant terminal and a computer system, wherein the computer system includes a storage module and a processing module; the multi-participant terminal includes participants and a coordinator; the processing module includes one or a combination of the following units:

[0033] The MAC share generation unit extracts the MAC share of each participant, generates it through random vector generation, multiple rounds of splitting and recombining hashing and consistency verification, and outputs a globally shared MAC value.

[0034] The key generation unit generates a private key polynomial, a noisy public key, and a key pair through RLWE rejection sampling, and shares the key share.

[0035] The shared value refresh unit generates random values ​​for the key share and MAC share, and obtains the refreshed shared value through multiple rounds of modular addition and modular multiplication.

[0036] Reject sampling units and generate private key-related random inputs that conform to a statistical distribution;

[0037] The signature generation unit generates a partial signature by combining random input, etc., and after hash commitment verification, it merges and outputs the final signature using Lagrange interpolation.

[0038] The verification unit verifies the message hash promise and compares the verification value.

[0039] The storage module stores data from each stage, and the computer system outputs the signature result.

[0040] Based on a third key aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed, implements the aforementioned efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments.

[0041] Compared with existing technologies, this invention is based on the RLWE assumption, combines multi-party participation and threshold signature mechanism, supports flexible threshold settings, and adapts to different security requirements.

[0042] This invention ensures key share security and signature consistency by introducing stages such as message authentication code share generation, key generation, shared value refresh, rejection sampling, signature generation and verification.

[0043] This invention employs a local weighted calculation and merging method to compress multi-round communication into a single round, significantly reducing communication overhead and improving efficiency and scalability in large-scale networks.

[0044] This invention improves computational uniformity and resistance to side-channel attacks through discrete Gaussian sampling, number theory transformation, and modular arithmetic; multiple rounds of shared value refresh enhance randomness and prevent information leakage.

[0045] This invention is applicable to scenarios requiring high security and distributed key management, such as blockchain and the Internet of Things, and can achieve efficient and verifiable threshold signatures in multi-party environments. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0047] Figure 1 The following is a flowchart illustrating the execution of an efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments according to one embodiment of the present invention.

[0048] Figure 2 A schematic diagram of a local weighted calculation and merging algorithm in one embodiment of the present invention is shown;

[0049] Figure 3 A schematic diagram of an efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments is shown in one embodiment of the present invention. Detailed Implementation

[0050] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the invention. It should be understood that the following embodiments are not intended to limit the scope of the invention, but are merely illustrative of the essential spirit of the technical solution of the invention.

[0051] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0052] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0053] like Figure 1 As shown, in one embodiment of the present invention, an efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments includes the following steps S110-S170:

[0054] S110, the participant inputs the message to be signed, preset parameters and pre-processed MAC key share into the computer system;

[0055] S120, each participant extracts its own MAC share, generates a random vector and performs multiple rounds of splitting, recombination, hashing and consistency verification. If the verification is successful, the globally shared MAC value is output.

[0056] S130, the participants generate a private key polynomial from a discrete Gaussian distribution through RLWE rejection sampling, generate a uniformly distributed random polynomial and a public key containing an error term, obtain a key pair containing noise protection, and share the key share with other participants;

[0057] S140, the participants generate a random shared value and a random multiplication factor for the shared value of the key share and their own MAC share, and obtain the refreshed shared value through multiple rounds of modular addition and modular multiplication iteration operations;

[0058] S150, the participants generate a random input that is related to the private key and conforms to the statistical distribution based on the parameters corresponding to the refreshed shared value and the preset mean and standard deviation, through discrete Gaussian distribution sampling, sample discretization and acceptance judgment;

[0059] S160, based on the random input, the participants combine the globally shared MAC value, the refreshed shared value and the key pair, use a hash function to generate the message commitment value of the message to be signed and store it, select the challenge bit and generate a partial signature through discrete Gaussian sampling, perform hash commitment consistency verification on the partial signature, and broadcast the partial signature if the verification is successful; all participants merge the final signature through Lagrange interpolation.

[0060] S170, the participants receive the final signature, the challenge bits broadcast during the signature generation phase, and the shared public key, perform a hash commitment consistency check on the message to be signed, calculate and compare the verification value based on the final signature, the challenge bits, and the public key; the computer system outputs the result of whether the signature is passed or invalid.

[0061] In most possible embodiments, steps S120-S170 can be divided into the following six stages of the present invention, and the main objectives and concepts of each stage are described in detail below.

[0062] (1) Message Authentication Code Share Generation Stage: A shared MAC value is generated for each participant, and necessary calculations are performed to ensure message integrity. After receiving the message, each participant extracts a share from its own shared MAC value and preprocessed MAC key share, generates a random vector, and performs multiple rounds of splitting, recombination, hashing, and consistency verification to finally obtain a globally shared MAC value for subsequent signing and verification. If the consistency verification fails, the process is terminated to prevent tampering and forgery from the source.

[0063] (2) Key generation stage: Each participant uses the RLWE rejection sampling method to generate a private key polynomial from a discrete Gaussian distribution, and further generates a public key and error term that satisfy the finite field polynomial structure to form a key pair with noise protection. The relevant key shares are shared with other participants to provide distributed key support for subsequent threshold signatures.

[0064] (3) Shared value refresh phase: Each participant performs multiple rounds of randomization and complex modular operations on the shared value generated in the previous phase. Through multiple addition and multiplication iterations, the nonlinearity and computational complexity of the shared value are effectively improved, thereby enhancing the resistance to potential attacks and ensuring the freshness and security of the secret share.

[0065] (4) Rejection sampling phase: The participants generate random numbers related to the private key based on the discrete Gaussian distribution and rejection sampling mechanism, and perform multiple rounds of sampling, discretization and acceptance judgment on the generated samples to ensure that the generated samples strictly conform to the expected statistical distribution characteristics, providing high-security random input for subsequent signatures.

[0066] (5) Signature generation stage: Based on the shared MAC, the refreshed shared value, and the key pair, all participants generate partial signatures for the message. The partial signatures must be verified for consistency of the hash commitment value. If they are inconsistent, the signing process is terminated. By selecting the challenge bit and using discrete Gaussian sampling, each participant generates a partial signature and broadcasts it. All participants merge the signatures using Lagrange interpolation to generate the final signature, thus achieving an efficient and verifiable threshold signature generation process.

[0067] (6) Signature Verification Phase: Each participant receives the message, signature, challenge bit, and related public key, performs a hash commitment consistency check on the message, calculates the verification value based on the signature, challenge bit, and public key, and compares the verification results to see if they are consistent. If the verifications of all participants are consistent, the signature passes verification; otherwise, the signature is deemed invalid, effectively preventing signature forgery and message tampering.

[0068] In the following embodiments, the parameters that may be involved are described as follows:

[0069] Indicates the participating parties; This represents a vector of random coefficients jointly generated by the participants; m represents the number of shares into which the MAC value is divided. Indicates the share of the shared MAC value; Indicates the number of parts the message is divided into; Indicates difference from and not adjacent Another participant; The index representing the MAC share, and ; The message indicates the first Each part; A fragment of a message; For a participant targeting a message fragment The MAC sharing share; K is the total number of participants in MAC generation and verification; Q is the global calculation result, which is the local calculation result of all participants. The final result was obtained after multiple rounds of mergers.

[0070] Represented as two polynomials and Multiplication operations modulo q.

[0071] It is represented as a random noise polynomial of dimension n, with coefficients following a discrete Gaussian distribution with a mean of 0 and a standard deviation of η. K=8 is set, which is the total number of participants in MAC generation and verification. This represents the local data obtained by participant i.

[0072] In addition to the above, the parameters or expressions that may be involved are commonly used mathematical parameters or expressions in this technical field.

[0073] In one possible implementation, during the message authentication code share generation phase, in order to generate a shared MAC value for each participant and perform the necessary calculations to ensure message integrity, each participant... Retrieve the message and extract its share from its shared MAC value, in the following format: and preprocessed MAC key shares, All parties jointly generate a random vector, in the following form: And calculate:

[0074]

[0075] in, Participants The message section, and These are the coefficients from the random sampling. For each Each participant Perform the following calculations:

[0076] Split MAC Shares for and calculate

[0077]

[0078] calculate ,in, It's the Lagrange multiplier. Then, each participant... calculate ,in It is a hash function, which generates a hash value. Used as the MAC value for the current participant. Broadcast by each participant. And verify the following consistency conditions:

[0079] = If the consistency check fails, output 0 and abort. Finally, all participants compute the globally shared signature value:

[0080]

[0081] Final MAC value sharing For subsequent verification and use, that is, if all For each If the MAC values ​​are correct, the output is 1, indicating that all MAC values ​​are valid. Otherwise, the output is 0, indicating that an inconsistency or fraud has been detected.

[0082] In one possible implementation, during the key generation phase, each participant... Generate a private key Its security relies on sampling from a discrete Gaussian distribution using the RLWE (Ring-LearningWithErrors) rejection sampling method. Specifically, the private key generation process is as follows: ,in, It refers to the range of coefficients, controlling the standard deviation of the sampling. It is a multinomial dimension. Subsequently, each participant... Generate a random polynomial Its coefficients are derived from the modulus. Sampling in a uniform distribution: ,in, It is a large prime number, used as a modulus to ensure the correctness of polynomial operations and the structure of finite fields.

[0083] Participants Calculate the corresponding public key ,in This represents a polynomial multiplication operation, which produces the encrypted part of the participating parties, and This sampling is used to generate the error term, introducing moderate noise to ensure security and resistance to attacks. Ultimately, this yields the key pair. And share it with other participants.

[0084] In one possible implementation, during the shared value refresh phase, the computational complexity is increased by performing complex transformations and modifications on each shared value, thereby enhancing the resistance to attacks.

[0085] Suppose we obtain a set of shared values ​​from the previous stage. Each shared Include The nth element, and represents the nth element. The shared value of each participant originates from the original secret sharing. For each share... Generate a random value This value is from the modulus Sampling in a uniform distribution: Then, the sharing was modified, performing a series of complex modulo operations on each shared value. First, addition was performed:

[0086] ,

[0087] Then, multiplication is performed, increasing the computational complexity:

[0088] ,

[0089] in, From the mold The value is obtained by random sampling. Then, multiple rounds of calculation are performed: for each modified shared value, multiple rounds of modular addition and modular multiplication operations are executed. The operation of each round is shown in formula (1):

[0090]

[0091]

[0092] These steps are repeated multiple times (executed 5 times in the code), each time using a new random addend and multiplication factor to increase the complexity of the operation. Ultimately, each shared value... It will be converted to the refreshed shared version, that is, This increases computational complexity and enhances security.

[0093] In one possible implementation, during the rejection sampling phase, to sample from a discrete Gaussian distribution, random numbers associated with the private key are generated. A rejection sampling method is used to ensure that the generated samples conform to the expected distribution. First, parameters received by the participants in the sampling phase, such as the mean, are given. The standard deviation is and the sampling size is (Corresponding to the dimension of the polynomial), these parameters are provided by the protocol and determine the distribution characteristics of the samples.

[0094] To sample from a discrete Gaussian distribution, random numbers associated with the private key are generated. This process is based on the standard normal distribution and transforms the samples into discrete values ​​through a rejection sampling method. Each participant Based on the given mean and standard deviation Independently generate from a normal distribution a size of The sample set, that is,

[0095]

[0096] Subsequently, each sample is rounded to map it to the integer space, thus conforming to the discrete property of the key. This step produces a discretized sample form as follows: For each sample, the participants Calculate the acceptance probability based on the difference between the sample value and the discretized sample value. The form is shown in Formula 2.

[0097]

[0098] Each participant Generate a random number using a uniform distribution to determine whether to accept the sample: from a uniform distribution Generate a random number ,Right now, If random numbers Less than the probability of acceptance If the sample is positive, accept it; otherwise, reject it and resample. The judgment format is as follows: Each participant The sampling and acceptance standard procedures will be repeated until the accepted samples meet the requirements. Until all... The sampling process only ends when the acceptance criteria are met.

[0099] If all participants pass the acceptance decision, the rejection sampling process will end, and the accepted discretized samples will be passed to subsequent operations as part of the key, represented as... .

[0100] In one possible implementation, the signature generation phase employs a distributed signature protocol, designed to have participants generate partial signatures of the message and merge these partial signatures into a final signature through multiple steps. Specifically, each participant... Receives parameters from the MAC message sharing value phase, sharing refresh phase, and key generation phase: message, and This serves as input to generate a partial signature of the message. Each participant... It is necessary to verify that the received message matches its promised value:

[0101] Use a hash function to generate the promise value of the message. .

[0102] Compare the calculated commitment value with If there is no match, an error is output and the signing process is terminated. The format is as follows: If the commitments do not match, the signing process terminates.

[0103] Subsequently, each participant To generate a partial signature of the message, random values ​​are generated by sampling from a discrete Gaussian distribution using the rejection sampling method. ,and ,in It is the bit length of the challenge bit. It has a multinomial dimension. Each participant computes the public key. With random values The product of polynomials, i.e. ,in Represents number theory transformations.

[0104] Participants select challenge positions based on probability distribution. ,Right now, ,in It's a probability distribution derived from the challenge. The challenge bit controls the signature generation and uses random values. Challenge Position and private key Calculate partial signature ,Right now, Each participant The generated partial signature and challenge position The broadcast is sent to all other participants. After receiving the partial signatures from the other participants, all participants use Lagrange interpolation to merge the partial signatures into the final signature. ,Right now:

[0105]

[0106] in, It is the Lagrange multiplier, ensuring that all partial signatures can be combined into a single signature. Final Signature It was completed and signed by all participating parties.

[0107] In one possible implementation, during the signature verification phase, each participant... Receives parameters from the MAC message sharing phase, signing phase, sharing refresh phase, and key generation phase: message, , , , and As input. Each participant It is necessary to verify that the message corresponding to the signature matches its promised value to prevent message tampering. A hash function is used to commit to the message and match it with the provided... To compare, that is,

[0108] If there is no match, the verification process terminates and outputs "verification failed". Each participant... Based on the received signature and challenge position and public key And t, calculate the verification value:

[0109] calculate Using public keys and signature calculate: .

[0110] calculate Using public keys And the calculation of challenge position c: .

[0111] Each participant right and To compare, that is,

[0112] If the verification results of all participants are consistent, that is = If all [signatures are correct], the signature is valid; otherwise, the signature is invalid. If all verification results are true, output "verification passed"; otherwise, output "verification failed".

[0113] Figure 2 This diagram illustrates the principle of a local weighted calculation and merging algorithm provided in an embodiment of the present invention. The diagram showcases the computational model of the present invention. Let's take an example to analyze, such as Figure 2 As shown, each participant acquires local data. And according to the preset weighting coefficients Weight the data with its neighbors.

[0114] Assuming the participants The neighboring parties are and Each participant weights and sums the data of its neighbors according to a weighting coefficient. For each participant... The calculation can be expressed as

[0115]

[0116] in, Participants The results of local weighted calculation, , and These are the weighting coefficients for the data of adjacent participants. The calculation process for participants 1 to 8 is as follows:

[0117]

[0118] In each round of calculation, the participants will share the local calculation results. The calculation results are merged with those of other participants, gradually reducing the scope of the merge to obtain the final global calculation result. The merge operation can be completed through local merging. The specific details are shown in Protocol 1.

[0119] First round of mergers: , , , , , , , These local calculation results are combined pairwise:

[0120] , , ,

[0121] Second round of merging: Further merging the results of the first round of merging: , .

[0122] Third round of merging: The results from the second round of merging are then merged to obtain the global result. .

[0123] Compared to traditional methods, which require 50 rounds of communication to complete the task, the method of this invention compresses the number of communication rounds to 1 round by merging calculations, thereby significantly improving efficiency.

[0124]

[0125] Figure 3 This diagram illustrates the principle of a high-efficiency quantum-resistant lattice cryptographic threshold signature system for distributed environments, as provided in this invention. The diagram showcases the principle of a lattice-based threshold signature system. The core process includes message passing, participant sampling to generate key shares, distribution of shares and commitment values, coordinator consistency verification, and finally, generation of a key pair for message encryption or signing. Participants are responsible for sampling and local distributed computation, while the coordinator is responsible for verifying the consistency of commitment values ​​and shares to prevent tampering or forgery. Through multi-party generation and combination, the distributed security of the keys and the reliability of the signature are guaranteed, making it suitable for blockchain or IoT environments requiring high security and multi-party collaboration.

[0126] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0127] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A highly efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments, characterized in that, include: Participants input the message to be signed, preset parameters, and pre-processed MAC key share into the computer system. Each participant extracts its own MAC share, generates a random vector, and performs multiple rounds of splitting, recombination, hashing, and consistency verification. Once the verification is successful, a globally shared MAC value is output. Participants generate a private key polynomial from a discrete Gaussian distribution through RLWE rejection sampling, generate a uniformly distributed random polynomial and a public key containing an error term, obtain a key pair with noise protection, and share the key share with other participants. The participating parties generate a random shared value and a random multiplication factor for the shared value of the key share and their own MAC share. After multiple rounds of modular addition and modular multiplication iterations, the refreshed shared value is obtained. Based on the parameters corresponding to the refreshed shared value and the preset mean and standard deviation, the participants generate random inputs that are related to the private key and conform to the statistical distribution through discrete Gaussian distribution sampling, sample discretization and acceptance judgment; Based on the random input, the participants combine the globally shared MAC value, the refreshed shared value, and the key pair to generate a message commitment value for the message to be signed using a hash function and store it. They select a challenge bit and generate a partial signature through discrete Gaussian sampling. They perform a hash commitment consistency check on the partial signature. If the check passes, they broadcast the partial signature. All participants merge the final signatures through Lagrange interpolation. The participating parties receive the final signature, the challenge bits broadcast during the signature generation phase, and the shared public key, perform a hash commitment consistency check on the message to be signed, and calculate and compare the verification value based on the final signature, the challenge bits, and the public key. The computer system outputs a result indicating whether the signature is valid or invalid.

2. The efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments according to claim 1, characterized in that, The preset parameters include one or more of the following: modulus, multinomial dimension, standard deviation of discrete Gaussian distribution, and challenge bit length; the random multinomial and the public key containing the error term are generated by multiplying the random multinomial modulo by the private key and adding the error term; the acceptance determination includes calculating the acceptance probability based on sample differences and determining it using a 0-1 uniformly distributed random number.

3. The efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments according to claim 1, characterized in that, Each participant extracts its own MAC share, which is a share fragment corresponding to the message to be signed, and the generated random vector contains multiple random coefficients; The multiple random coefficients are specifically random sampling coefficients corresponding to the number of participants or the number of message segments to be signed. Each random coefficient corresponds to a message part of a participant or a message segment to be signed. In the multiple rounds of splitting and reorganization, each participant first splits its own MAC share into multiple sub-shares, and then combines the coefficients of the random vector to reorganize the multiple sub-shares. During consistency verification, each participant first generates a hash value for its own recombined MAC-related value and broadcasts it. Then, it verifies whether the MAC-related values ​​broadcast by other participants are consistent with the corresponding hash values. If any participant's verification is inconsistent, the message authentication code share generation process is terminated. Only when all participants verify that the MAC value is consistent will the globally shared MAC value be output.

4. The efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments according to claim 1, characterized in that, The participating parties generate a private key polynomial from a discrete Gaussian distribution through RLWE rejection sampling, generate a uniformly distributed random polynomial and a public key containing an error term, obtain a noise-protected key pair, and share the key share with other participating parties. Specifically, this includes: When the participants perform RLWE rejection sampling, they generate a private key polynomial from a discrete Gaussian distribution based on a preset coefficient range and polynomial dimension. The generated random polynomial is sampled from a uniform distribution corresponding to a preset modulus. When generating a public key with an error term, an error term conforming to a discrete Gaussian distribution is first generated by rejecting sampling. Then, the private key polynomial and the random polynomial are multiplied by a polynomial, the error term is superimposed, and a modulo operation is performed to obtain a public key with noise protection. The generated key pair contains the random polynomial and the private key polynomial, and the participants share the corresponding shares of the random polynomial and the private key polynomial in the key pair with other participants respectively.

5. The efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments according to claim 1, characterized in that, When the shared value is refreshed, the random shared value and random multiplication factor generated by the participants are sampled from the uniform distribution corresponding to the preset modulus; The multi-round modular addition and modular multiplication iterative operations are as follows: First, perform modular addition on the shared value of the key share and its own MAC share to obtain the initial modified shared value; then perform modular multiplication on the initial modified shared value to update it to the intermediate modified shared value; then repeat the operation five times. In each operation, first generate a new random addend and perform modular addition, then generate a new random multiplication factor and perform modular multiplication. The updated shared value is used as the input for the next round of operation, and finally the refreshed shared value is obtained.

6. The efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments according to claim 2, characterized in that, When participants sample using a discrete Gaussian distribution, they generate a sample set corresponding to the multinomial dimension; sample discretization is achieved by performing rounding operations on the sampled samples. When making a decision, the acceptance probability is first calculated based on the difference between the sampled sample and the discretized sample. Then, a random number is generated from a uniform distribution of 0 to 1. If the random number is less than the acceptance probability, the discretized sample is accepted. Otherwise, the discrete Gaussian distribution sampling and sample discretization steps are repeated. This process is repeated until all participants have obtained a discretized sample that conforms to the expected statistical distribution. This sample is then used as a random input associated with the private key.

7. The efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments according to claim 1, characterized in that, When participants generate a partial signature by combining random input, they first generate a random value through rejection sampling, which is performed according to the preset challenge bit length and polynomial dimension; then they calculate the polynomial product of the public key and the random value, and perform number theory transformation on the product result. When selecting a challenge bit, the challenge bit is sampled from a uniform distribution containing the three values ​​-1, 0, and 1. After generating a partial signature, each participant first uses a hash function to generate a corresponding hash commitment value for its own partial signature, and then broadcasts the hash commitment value to all other participants. Subsequently, when performing a hash commitment consistency check on the partial signature, the participant verifies whether its own generated partial signature hash commitment value is consistent with the hash commitment values ​​that other participants have broadcast for their own partial signatures.

8. The efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments according to claim 1, characterized in that, When performing a hash commitment consistency check on a message to be signed, the hash value of the message to be signed is first recalculated, and then compared with the message commitment value retained during the signature generation stage. If they do not match, the signature is directly deemed invalid. When calculating the verification value, the first verification value is obtained by performing a number theory transformation on the polynomial product of the public key and the final signature, and the second verification value is obtained by performing a number theory transformation on the polynomial product of the public key and the challenge bit. When comparing the verification values, the first verification value and the second verification value are respectively subjected to a modulo operation, and the results of the modulo operation are checked to see if they are consistent. The signature is deemed successful only when the results of the checks by all participants are consistent.

9. A highly efficient quantum-resistant lattice cryptographic threshold signature system for distributed environments, characterized in that, The system includes a multi-participant terminal and a computer system, wherein the computer system includes a storage module and a processing module; the multi-participant terminal includes participants and a coordinator; the processing module includes one or a combination of the following units: The MAC share generation unit extracts the MAC share of each participant, generates it through random vector generation, multiple rounds of splitting and recombining hashing and consistency verification, and outputs a globally shared MAC value. The key generation unit generates a private key polynomial, a noisy public key, and a key pair through RLWE rejection sampling, and shares the key share. The shared value refresh unit generates random values ​​for the key share and MAC share, and obtains the refreshed shared value through multiple rounds of modular addition and modular multiplication. Reject sampling units and generate private key-related random inputs that conform to a statistical distribution; The signature generation unit generates a partial signature by combining random input, etc., and after hash commitment verification, it merges and outputs the final signature using Lagrange interpolation. The verification unit verifies the message hash promise and compares the verification value. The storage module stores data from each stage, and the computer system outputs the signature result.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed, the program implements the efficient quantum-resistant lattice cryptographic threshold signature method for distributed environments as described in any one of claims 1-8.

Images