Safe batch post-quantum digital signature algorithm based on arithmetic and Boolean mask

Abstract

The invention provides a safe batch post-quantum digital signature algorithm based on combined use of an arithmetic mask and a Boolean mask, and aims to solve the problems of low operation efficiency and side channel risk existing in a batch signature or parallel computing scene of an existing Dillithium algorithm. According to the algorithm, middle sensitive data and operation are subjected to mask processing, and leakage of side channel information such as power consumption and time sequence is effectively reduced. The algorithm comprises the key steps of generating a user message, processing a private key by using a mask decomposition technology, randomly generating a random vector for enhancing signature unpredictability, multiplying matrix vectors, preventing statistical leakage by using a sampling rejection technology, and carrying out security and efficiency demand optimization on the batch size. According to the method, the calculation efficiency is improved through the fast matrix multiplication algorithm, the zero point test technology is introduced, the safety and correctness of the algorithm in different environments are guaranteed, the signature generation efficiency is remarkably improved, and particularly, higher performance and safety are shown in multi-user and batch signature scenes.

Description

Technical Field

[0001] This invention relates to the field of information security, specifically a secure batch post-quantum digital signature algorithm based on arithmetic and Boolean masks. Background Technology

[0002] The continuous development of the electronic information industry, while bringing convenience and speed to people through information technologies such as big data and cloud computing, also exposes them to varying degrees of information security issues. Public-key cryptography is one such solution. [1] It is one of the most important components of today's digital infrastructure. Most secure communication protocols and applications rely on classical public-key cryptosystems, which are based on the difficulty of number theory assumptions, such as the difficult problems of large integer factorization and discrete logarithms, both of which are considered difficult for classical computers to compute.

[0003] However, Peter Shor [2] In 1994, a "quantum" algorithm was first proposed, claiming that with a sufficiently large quantum computer, the difficult problem of factoring large integers and the discrete logarithm problem could be solved in polynomial time, which would put the security of many commonly used public-key cryptosystems at risk.

[0004] The continuous progress in quantum computing towards large-scale quantum computers has prompted the cryptography community to develop public-key cryptography primitives resistant to quantum attacks, thus forming a new field of cryptographic research called post-quantum cryptography (PQC) or quantum-resistant cryptography. In 2016, the National Institute of Standards and Technology (NIST) of the United States... [3] NIST initiated a public post-quantum cryptography (PQC) standardization process to select quantum-resistant public-key encryption algorithms for standardization, aiming to provide a secure algorithm globally that is both resistant to quantum computing attacks and widely applicable in existing information systems. A total of 82 candidate algorithms were submitted to NIST for consideration. After three rounds of evaluation and analysis, NIST... [4] Four algorithms were selected for standardization. The Dilithium algorithm, which is the main focus of this study, is derived from one of the selected schemes.

[0005] In recent years, effective attack methods against post-quantum cryptography have focused on side-channel analysis. [5]Side-channel analysis (SCA), unlike traditional mathematical analysis methods, primarily focuses on the security of the algorithm implementation process, i.e., physical security. Side-channel attacks do not directly crack the encryption algorithm itself, but rather utilize physical or runtime information leaked by the system during the execution of the encryption algorithm. By analyzing side information related to the encryption process, they infer the key or other sensitive data. Common physical leaks include the device's electromagnetic radiation or power consumption, or the time required to execute the target operation. Representative side-channel analysis methods... [6] These include energy analysis attacks and fault attacks (FA). Among them, energy analysis attacks have low execution costs and simple principles, making them one of the most common attack methods in side-channel analysis.

[0006] Side-channel analysis is particularly important for implementing PQC schemes in embedded devices because attackers often have physical access to these devices. Without appropriate countermeasures, side-channel analysis can easily extract critical information stored in the device. Therefore, in the future implementation of PQC schemes to replace traditional public-key cryptography schemes, the potential for side-channel information leakage must be considered to ensure the security of the PQC algorithm.

[0007] Masking scheme [7] While side-channel attack protection is a relatively easy-to-implement and provably secure technique, it also introduces complex computations and significant resource consumption, making it difficult to implement on hardware platforms with limited computing resources. Therefore, when designing side-channel attack protection for cryptographic algorithms, it is crucial to find a secure, effective, and cost-effective solution. It is therefore essential to design a post-quantum algorithm masking method to ensure the confidentiality of the encryption.

[0008] Dilithium [8] Dilithium is a lattice-based post-quantum signature algorithm, specifically designed based on two classic lattice problems: the Learning with Noise (LWE) problem and the Short Integer Solution (SIS) problem. LWE and SIS are considered highly quantum-resistant; therefore, Dilithium's security has been verified not only in classical computing environments but also in quantum computing environments, demonstrating strong resistance to cracking. Dilithium utilizes Lyubashevsky's... [9] The developed "Fiat-Shamir with Aborts" technique, based on rejection sampling, ensures that signatures do not reveal information about the key. In recent years, numerous side-channel attacks against Dilithium have been described, highlighting the necessity of robust side-channel countermeasures. In the context of the current rapid increase in data processing demands, batch processing...

[10] Batch processing has become one of the key technologies for the practical application of post-quantum cryptography algorithms. Batch processing leverages the parallel computing capabilities of hardware to process multiple messages or signature requests simultaneously, significantly improving the overall system throughput and response speed. Especially in high-concurrency scenarios such as cloud services and blockchain, post-quantum algorithms face the dual requirements of efficient batch computation and security protection.

[0009] However, batch processing not only brings significant performance improvements but also poses new challenges to the side-channel security of algorithms. When multiple instances run simultaneously, the physical leakage information may become more complex due to operational dependencies, making existing single-instance masking schemes difficult to apply directly. For post-quantum algorithms under batch processing conditions, there is an urgent need to design masking techniques that balance efficiency and security to ensure resistance to advanced side-channel attacks and guarantee key security in batch processing environments.

[0010] Therefore, this paper will focus on the Dilithium digital signature scheme, a post-quantum cryptography scheme based on the lattice problem. It introduces the concept of batch processing to accelerate the algorithm under high throughput conditions and investigates masking strategies to protect the algorithm from side-channel attacks. References are as follows:

[0011] [1] Wenbo Sun, Wei Wang, Chenguang Bai. A new method of large integerprime decomposition for network public key cryptosystem. Int. J. Secur.Networks, 2024,19(3): 159-167

[0012] [2] Peter W. Shor. Polynominal time algorithms for discrete logarithms and factoring on a quantum computer. ANTS 1994: 289

[0013] [3] Gorjan A, Jacob AS, Daniel A, et al. Status report on the secondround of the NIST PQC standardization process [R]: NIST, 2020.

[0014] [4] Katerina Megas, Barbara Cuthill, Michael Fagan, Paul Watrobski.NIST Cybersecurity for IoT Program. Computer ,2024,57(12): 144-148

[0015] [5] Zhang Cong. Research on efficient hardware implementation of lattice-based post-quantum cryptography [D]. Huazhong University of Science and Technology, 2021.

[0016] [6] Jack Cook, Jules Drean, Jonathan Behrens, Mengjia Yan. There'sAlways a Bigger Fish: A Clarifying Analysis of a Machine-Learning-AssistedSide-Channel Attack. IEEE Micro ,2023,43(4): 28-36

[0017] [7] Xuefeng Zhao.Secure and Efficient Masking of Lightweight Ciphersin Software and Hardware. Comput. J. ,2024,67(2): 581-603

[0018] [8] Vadim Lyubashevsky,Basic Lattice Cryptography: The conceptsbehind Kyber (ML-KEM) and Dilithium (ML-DSA). IACR Cryptol. ePrint Arch., 2024, 1287

[0019] [9] Xu Z, Pemberton O, Roy SS, et al. Magnifying side-channelleakage of lattice-based cryptosystems with chosen ciphertexts: The casestudy of kyber [J]. IEEE Transactions on Computers, 2022, 71(9): 2163-2176.

[0020]

[10] Aguilar-Melchor, C., Albrecht, MR, Bailleux, T., Bindel, N., Howe, J., Hülsing, A., Joseph, D., Manzano, M.: Batch signatures, revisited. In: Cryptographers' Track at the RSA Conference. pp. 163–186. Springer (2024) Summary of the Invention

[0021] The purpose of this invention is to address the shortcomings of existing technologies by proposing a secure batch post-quantum digital signature algorithm based on arithmetic and Boolean masks. This algorithm enables the Dilithium algorithm to perform fast signing in multi-user and batch scenarios and has the ability to resist side-channel attacks such as power consumption and timing attacks.

[0022] The technical solution to achieve the objective of this invention is:

[0023] A secure batch post-quantum digital signature algorithm based on arithmetic and Boolean masks includes the following steps:

[0024] 1. User message generation

[0025] Assume there are i users in the current system: Each user Independently generate messages to be signed. All messages It will be used as input to the signature algorithm.

[0026] Generate keys for users Generate independent parameters for each message. and initialization Define the wait list This is used to represent the index of a message waiting to be signed. After each round of signing, if a message is correctly signed, its signature index is removed from this list. This is done before the signature operation. Represented in NTT format. 2. Multi-signature generation.

[0027] 1) Data preprocessing: The user's private key sk is processed using masking techniques to separate each user's private key. Divide the data into n equal-length shares. Specifically, initialize the first share with the original data, and add a random value to the first share modulo q for the remaining shares. This ensures randomness while allowing the sum of the shares to revert to the original data.

[0028] 2) Randomly generate y:

[0029] The system uses a pseudo-random number generator to randomly generate independent random vectors for user i. This method enhances the unpredictability of signatures. Specifically, it first randomly generates a μ-bit integer and represents it as N shares using a Boolean mask, ensuring the original value can be recovered through bitwise XOR. Then, it uses a fast Boolean-to-arithmetic mask conversion to transform it into an arithmetic mask form modulo q, ensuring direct use in subsequent arithmetic operations. This fast conversion method involves modulo expansion and switching, which introduces a small error, requiring arithmetic shifting using `shiftMod` to compensate for and eliminate this error.

[0030] 3) Matrix-vector multiplication

[0031] The fast matrix multiplication algorithm proposed by Rosowski and Strassen et al. is adopted. The vectors y corresponding to the messages are used to form a matrix Y, which is then multiplied by a matrix A obtained by expanding the matrix A through a seed ρ. That is, the calculation... This step embeds the message and user identity information into the algebraic operation structure. The calculation process is represented using an arithmetic mask to ensure the security of intermediate variables during the calculation.

[0032] 4) Reject sampling

[0033] In Dilitiuhm, if or or The signature will be rejected and the message will be re-signed. During batch signing, messages that fail the rejection sampling will be re-signed in the next batch cycle.

[0034] Masking rejection sampling techniques can prevent statistical leakage. For example, by setting a threshold, if the matrix multiplication result... If the distribution is not within the expected safe range, the data is discarded and parameters are regenerated until the signature meets the security criteria. This step effectively reduces the risks of simulation attacks and distinguishing attacks. This invention introduces a new technique—zero-point testing—whose complexity is independent of the modulus q; the new complexity depends only on the size of the rejection interval. First, consider a single coefficient x. We can easily obtain the arithmetic mask from x. The ZeroTestMult tool can be used to quickly convert it to a Boolean mask, and then to an arithmetic mask again, allowing for application to any modulus. Finally, an arithmetic shift of α bits is used to eliminate the error e from the modulus switching. Most importantly, the result of whether it is in the rejection interval is represented by 0 or 1; the rejection result is 1 only if all coefficients are within the interval.

[0035] 5) Select a suitable p for testing.

[0036] Setting the batch size p based on security and efficiency requirements requires comprehensive consideration of both safety boundaries and algorithm performance. By testing different values ​​of p, the correctness and security of the algorithm under various environments are verified, providing parameter references for subsequent applications.

[0037] 3. Multi-signature verification for a single user

[0038] The verifier receives a batch signature (which may contain multiple users and multiple messages), takes the message M, the user's public key pk, and the corresponding signature sig as input, and performs verification for each message. Generate independent The message index is represented by `status`. The matrix A obtained by expanding the seed is multiplied by Z using a fast matrix multiplication algorithm to accelerate batch processing and achieve overall high efficiency. The signature value is then compared to see if it falls within a predetermined security range. If all conditions are met, the signature is considered valid; otherwise, the batch signature is rejected.

[0039] The method of the present invention has the following advantages compared with the prior art:

[0040] Dilithium is a lattice-based post-quantum digital signature algorithm. In practical applications, the efficiency of a single signature operation is limited and incurs some performance loss. Therefore, batch processing can significantly accelerate the signing speed, allowing multiple users or multiple signatures to be processed simultaneously, greatly improving throughput and engineering practicality. To mitigate side-channel attacks, the algorithm incorporates arithmetic and Boolean masks for sensitive variables and employs the ZeroTestMult rejection sampling method, further increasing the difficulty of key recovery and cracking. Furthermore, the masking scheme's complexity does not depend on the modulus q, improving the speed of the masked scheme. The improved Dilithium algorithm balances security and efficiency, better adapting to modern high-performance processing needs and making it ideal for applications in cloud computing, IoT, and big data storage. Attached Figure Description

[0041] Figure 1 This is a flowchart of the method of the present invention;

[0042] Figure 2 A schematic diagram illustrating the rapid random generation of secret vectors under a mask;

[0043] Figure 3 A diagram illustrating the implementation of rejection sampling; Detailed Implementation

[0044] This invention proposes a highly efficient Dilithium batch masking scheme that combines Boolean and arithmetic masks, optimizing both mask security and computation speed for batch message signing. The following examples and illustrations further illustrate the invention's content, with the specific scheme flow as follows:

[0045] In this example, the post-quantum Dilithium digital signature algorithm is masked during the batch signing process to ensure that the data maintains consistent security throughout subsequent processes.

[0046] First, a message set M20 to be signed is collected. To ensure the reproducibility of the experiment, fixed message content is used in the example. Then, the message set is divided according to batch number p. For security levels 2, 3, and 5, p is 4, 5, and 4 respectively. Within each batch, the signing program is executed in a loop to maximize parallelism and throughput. During batch processing, the arrays waitlist[p] and passlist[p] are used to control the signing order and progress of the loop.

[0047] In the overall process, refer to Figure 1 The red and orange lines in the diagram represent sensitive processes and variables that require masking protection. For example... Figure 1 As shown, the key process includes: expanding the seed generation matrix A, and transforming the secret information such as parameters s1 and s2 into an arithmetic mask form. For each batch, p vectors y are securely generated using Boolean masking and arithmetic masking, which can be regarded as a matrix Y. In batch processing scenarios, a fast matrix multiplication algorithm can be used to calculate w=AY to improve the calculation speed. It should be noted that for security level 2, since it is a square matrix multiplication, a faster matrix multiplication can be used. Subsequently, similar to the dilithium algorithm, the high-order part w1 of w is calculated, and then the challenge value c is obtained through hash calculation.

[0048] For each message i in this batch, calculate its respective... and And it is necessary to Rejection sampling is performed on all of them, that is, to determine whether their infinity norm is within a certain range. This is accomplished using a fast rejection sampling method under a mask—ZeroTestMult.

[0049] The following section provides a special explanation of the optimization aspects:

[0050] For sampling y, the algorithm uses a fast Boolean-to-arithmetic mask conversion technique, which is described below in conjunction with... Figure 2 This step will be explained in detail below:

[0051] Since each batch loop generates p instances of y, leakage of y would lead to the leakage of secret information, so masking is required. First, a μ-bit integer x is randomly generated, and its Boolean mask representation is... Then, using the BtoAqDelta algorithm, it is converted to modulo 2. k Arithmetic mask representation: Execute the analog-to-digital switching algorithm to obtain At this point, due to the change in modulus, there will be a small error (0 ≤ e < n). The shiftmod algorithm can be used to eliminate the error to obtain the arithmetic mask representation of y mod q: Finally, Refreshmasks refresh its randomness, at which point all shares are in the range [0, q). The signature algorithm uses the centered representation of y, therefore the first share needs to be... Subtract q / 2.

[0052] For w=AY, in batch scenarios, the p vectors y can be treated as matrices, thus enabling acceleration through fast matrix multiplication algorithms. Currently, at security levels of 3 or 5, the fastest matrix multiplication algorithm is Rosowski's fast matrix exchange algorithm. However, at security level 2, Strassen's square matrix multiplication algorithm can be used instead, as it is superior for square matrices.

[0053] For the rejection sampling step, the batch signature candidates awaiting verification enter the rejection sampling phase in sequence. When all data is verified according to batch number, p-1 messages will remain. These messages are then independently processed p-1 times using the Dilithium signature algorithm under masking conditions; that is, no special fast matrix multiplication algorithm is used. During the rejection sampling period, for... The maximum absolute value of the coefficient is used to reject samples. If any signature does not meet the range condition of the maximum absolute value, status is incremented by 1 to check the next signature, and so on, until all signatures have been checked. Finally, the batch signature products are used to recover the signature results according to the masking scheme, producing the final signature set.

[0054] The following is a detailed description of the rejection of sampling, combined with... Figure 3 Explanation:

[0055] Suppose we need to determine the range of a coefficient x to ensure that its absolute value is within a certain range. First consider the arithmetic sharing of x. , x∈[-b, b], let 0 < a < b < q / 2, b − a < 2 ρ ρ ∈ Z, therefore we get:

[0056]

[0057] Therefore, the rejection coefficient x can be regarded as:

[0058]

[0059] First, you need to use LMSwitch to expand x mod q to x mod 2. ρ q, and then obtain it using the ShiftMod algorithm. and The SecMult algorithm is used to multiply the two results and determine whether the result is 0. If it is not 0, the sampling is rejected.

[0060] Taking z as an example, all coefficients on z need to be judged. We only need to multiply the judgment results. Only when the result is non-zero can we say that all coefficients have passed the judgment, that is, the signature is successful.

[0061] This invention addresses the computational efficiency bottlenecks and side-channel attack risks inherent in the current post-quantum digital signature Dilithium algorithm in batch signing or parallel computing scenarios. It proposes a data protection and processing mechanism combining arithmetic and Boolean masks. When batch signing messages, this method effectively blocks side-channel information leakage pathways such as power consumption and timing by applying arithmetic and Boolean mask representations and mutual conversion methods to intermediate data and temporary variables respectively. Simultaneously, the use of batch processing and fast matrix multiplication significantly improves the overall efficiency of signature generation and verification. This method balances security and performance, making it suitable for high-concurrency, high-security applications such as blockchain and identity authentication.

Claims

1. The arithmetic and Boolean mask based secure bulk post-quantum digital signature algorithm design, characterized in that, include: (1) User message generation. For i users in the system, each user independently generates a message to be signed, which is then collected in batches and used as the signature input along with the corresponding key; an independent index is assigned to each message and the corresponding index is deleted after the message is successfully signed. (2) Private key mask splitting process. To prevent the private key from being directly exposed, each user's private key is split into n equal-length shares. The first share is initialized with the original private key, and the remaining shares are generated by subtracting a random value in the modulo q sense, so as to ensure that the sum of each share in the modulo q sense is equal to the original coefficient. (3) Random vector y generation and mask conversion. A pseudo-random number generator is used to generate an independent μ-bit random vector for each user, which is then split into n shares in the form of a Boolean mask. The conversion is performed in modulo q using a fast Boolean to arithmetic mask algorithm, and arithmetic shift is used to correct the error e introduced by the modulo-digital switching during the process. (4) Matrix-vector multiplication. The batch of random vectors y are combined into a matrix Y, which is then multiplied by a matrix A generated from the seed ρ using fast matrix multiplication. Arithmetic masking is used throughout the calculation to prevent leakage of intermediate variables. (5) Rejection sampling and ZeroTestMult technique. If the matrix product result is not in the preset safe range, it is discarded and the parameters are regenerated until the safety standard is met; the ZeroTestMult technique is used to realize the range judgment independent of the modulus q, the arithmetic mask is quickly converted into a Boolean mask and then converted back to an arithmetic mask, and the error is eliminated by arithmetic shift. The test is only passed if all coefficients are in the range. (6) Selection of batch parameter p. Based on the requirements of security and performance, the batch size p and the modulus q are selected. The performance and security under different parameters are verified to provide a reference for subsequent implementation.

2. The multi-user batch signature verification method of claim 1, wherein, include: (1) The verifier receives the batch signature data. Take the message M, the user public key pk and the signature sig as input, generate an independent state index status for each message, define , which is used to identify the index of the message to be signed. (2) Generate matrix A by expanding the seed. The fast matrix multiplication algorithm proposed by Rosowski and Strassen et al. is used for batch operations with Z to accelerate the verification process and shorten the verification time. This step embeds the message and user identity information into the algebraic operation structure, and arithmetic masks are used throughout. (3) Determine if the signature value is within the predetermined safe range. If all conditions are met, the batch of signatures is considered valid; otherwise, the batch of signatures is rejected. Using the ZeroTestMult approach, we can convert the range size determination into a mathematical calculation and check if it is non-zero, which can be applied to any modulus. Finally, an arithmetic shift of α bits is used to eliminate the error e caused by modulus switching.

3. The method of claim 1, wherein the mask-based multi-user batch signature performance optimization is performed by a processor. include: (1) Reduce the overhead of repeated calculations and data migration through batch processing. (2) The time complexity of batch signature and verification operations is reduced by using the Rosowski and Strassen fast matrix multiplication algorithms. (3) Use the fast mask conversion algorithm to accelerate the generation of random vector y.

Images