Signature method and signature system

Abstract

The invention provides a signature method and a signature system. The method of a signature end device comprises the following steps: sending a public parameter to a signature verification end device; constructing a Wharkel tree based on the public keys in the plurality of key pairs, wherein each leaf node in the Wharkel tree is the public key in each key pair; according to the public parameter, sending a root commitment public key of the Wharkel tree to the signature verification end equipment; signing the message to be signed to obtain signed data; according to the current secret key state value, the public parameter and the signed data, a signature packet is generated, and the signature packet and the to-be-signed message are sent to signature verification end equipment, so that the signature verification end equipment carries out signature verification on the signed data, the current secret key state value comprises a current time period index and an index of a next to-be-used secret key, and the current time period index comprises the current time period index and the index of the next to-be-used secret key; the anti-quantum security, the forward security and the verification efficiency of the signature are improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and more specifically, to a signature method and a signature system. Background Technology

[0002] With the deepening of digitalization and the gradual maturation of quantum computing technology, modern cryptographic systems are facing unprecedented challenges. The security of traditional public-key cryptosystems largely relies on mathematical problems such as large integer factorization and discrete logarithms. These problems can be efficiently solved using quantum computing models, which seriously undermines the security foundation of existing digital signature systems.

[0003] Traditional digital signature schemes have significant limitations in key management and long-term security. For example, the Merkle tree hash signature scheme, which possesses quantum resistance, suffers from a proof size that increases dramatically with data volume, leading to a significant reduction in verification efficiency and making it unsuitable for high-frequency, high-capacity real-world applications. Furthermore, most existing schemes lack key evolution capabilities. If the private key is leaked long-term, attackers can backtrack and forge all historical signatures, failing to guarantee the long-term confidentiality of communication content and the continued validity of signature non-repudiation.

[0004] Therefore, there is an urgent need for a digital signature method that can be efficiently verified and has forward security. Summary of the Invention

[0005] The purpose of this application is to address the shortcomings of the prior art by providing a signature method and signature system to solve the practical problem of the significant limitations of traditional digital signature schemes in terms of key management and long-term security.

[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, embodiments of this application provide a signature method applied to a signature terminal device, the method comprising: Send common parameters to the signature verification terminal device; A Walker tree is constructed based on the public keys of multiple key pairs, and each leaf node in the Walker tree is the public key of each key pair. Based on the public parameters, the root commitment public key of the Walker tree is sent to the signature verification terminal device; Sign the message to be signed to obtain the signed data; Based on the current key status value, the public parameters, and the signed data, a signature packet is generated, and the signature packet and the message to be signed are sent to the signature verification device so that the signature verification device can verify the signed data. The current key status value includes the current time period index and the index of the next key to be used.

[0007] As an optional implementation, sending the root commitment public key of the Vorkle tree to the signature verification terminal device according to the public parameters includes: The root commitment public key of the Volker tree is generated based on the public key in each key pair and the random matrix, lattice basis tool matrix and modulus in the public parameters. The root commitment public key of the Walker tree is sent to the signature verification device.

[0008] As an optional implementation, generating the root commitment public key of the Volker tree based on the public key in each of the key pairs and the random matrix, lattice basis tool matrix, and modulus in the public parameters includes: The root node of the Walker tree is determined based on the public key in each of the key pairs. Based on the random matrix, the lattice base tool matrix, the modulus, and the root node of the Walker tree, generate the root commitment public key corresponding to the root node of the Walker tree.

[0009] As an optional implementation, before generating the signature packet based on the current key state value, the public parameters, and the signed data, the following steps are included: Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether to destroy the private key in each key pair for the current time period.

[0010] As an optional implementation, determining whether to destroy the private key in each key pair of the current time period based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters includes: Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether all private keys in each key pair for the current time period have been used; If so, the private keys in each key pair of the current time period are destroyed, and the current time period index in the current key status value is updated to the next time period index of the current time period index. The index of the next key to be used in the current key status value is updated to the product of the new current time period index and the number of key pairs in each time period in the public parameters.

[0011] As an optional implementation, determining whether all private keys in each key pair of the current time period have been used based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters includes: Based on the current time period index and the number of key pairs for each time period in the public parameters, determine the first key index for the next time period; If the index of the next key to be used is greater than or equal to the index of the first key in the next time period, then it is determined that all private keys in each key pair in the current time period have been used.

[0012] As an optional implementation, signing the message to be signed to obtain signed data includes: The message digest of the message to be signed is determined based on the hash function in the public parameters; The index of the next key to be used is used as the current key index, and the private key in the key pair corresponding to the current key index is used to digitally sign the message digest to obtain the signed data.

[0013] As an optional implementation, generating a signature packet based on the current key state value, the public parameters, and the signed data includes: The index of the next key to be used is used as the current key index. Based on the current key index, the membership proof of the public key corresponding to the current key index is generated in the Walker tree. The signed data, the current key index, and the membership proof of the public key corresponding to the current key index are integrated into the signature package.

[0014] Secondly, embodiments of this application provide a signature method applied to a signature verification terminal device, the method comprising: Receive common parameters sent by the signing device; Receive the root commitment public key of the Walker tree sent by the signing terminal device; Receive the signature packet and the message to be signed sent by the signature terminal device; The signed data in the signature packet is verified based on the message to be signed, the public parameters, and the root commitment public key.

[0015] As an optional implementation, the step of verifying the signed data in the signature packet based on the message to be signed, the public parameters, and the root commitment public key includes: The signature packet is parsed to obtain the signed data, the current key index, and the membership proof of the public key corresponding to the current key index; Based on the random matrix, lattice basis tool matrix and modulus in the public parameters, the root commitment public key and the current key index, determine the public key corresponding to the current key index; Based on the message to be signed, determine the message digest of the message to be signed; Based on the public key corresponding to the current key index, verify whether the signed data is valid for the message digest; If so, then based on the public parameters, the root commitment public key, and the membership proof of the public key corresponding to the current key index, verify whether the public key corresponding to the current key index is a legitimate member of the Walker tree constructed by the signing device.

[0016] Thirdly, embodiments of this application provide a signature apparatus corresponding to a signature method executed by a signature terminal device, the signature apparatus comprising: The sending module is used to send common parameters to the signature verification terminal device; The building module is used to construct a Walker tree based on the public keys of multiple key pairs, wherein each leaf node of the Walker tree is the public key of each key pair; The sending module is further configured to send the root commitment public key of the Walker tree to the signature verification terminal device according to the public parameters; The signature module is used to sign messages to be signed, obtaining signed data. The generation module is used to generate a signature package based on the current key status value, the public parameters, and the signed data, and send the signature package and the message to be signed to the verification terminal device so that the verification terminal device can verify the signed data. The current key status value includes the current time period index and the index of the next key to be used.

[0017] As an optional implementation, the sending module is specifically used for: The root commitment public key of the Volker tree is generated based on the public key in each key pair and the random matrix, lattice basis tool matrix and modulus in the public parameters. The root commitment public key of the Walker tree is sent to the signature verification device.

[0018] As an optional implementation, the sending module is specifically used for: The root node of the Walker tree is determined based on the public key in each of the key pairs. Based on the random matrix, the lattice base tool matrix, the modulus, and the root node of the Walker tree, generate the root commitment public key corresponding to the root node of the Walker tree.

[0019] As an optional implementation, the signature device further includes: a determining module, the determining module being used for: Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether to destroy the private key in each key pair for the current time period.

[0020] As an optional implementation, the determining module is specifically used for: Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether all private keys in each key pair for the current time period have been used; If so, the private keys in each key pair of the current time period are destroyed, and the current time period index in the current key status value is updated to the next time period index of the current time period index. The index of the next key to be used in the current key status value is updated to the product of the new current time period index and the number of key pairs in each time period in the public parameters.

[0021] As an optional implementation, the determining module is specifically used for: Based on the current time period index and the number of key pairs for each time period in the public parameters, determine the first key index for the next time period; If the index of the next key to be used is greater than or equal to the index of the first key in the next time period, then it is determined that all private keys in each key pair in the current time period have been used.

[0022] As an optional implementation, the signature module is specifically used for: The message digest of the message to be signed is determined based on the hash function in the public parameters; The index of the next key to be used is used as the current key index, and the private key in the key pair corresponding to the current key index is used to digitally sign the message digest to obtain the signed data.

[0023] As an optional implementation, the generation module is specifically used for: The index of the next key to be used is used as the current key index. Based on the current key index, the membership proof of the public key corresponding to the current key index is generated in the Walker tree. The signed data, the current key index, and the membership proof of the public key corresponding to the current key index are integrated into the signature package.

[0024] Fourthly, embodiments of this application provide a signature device corresponding to the signature method executed by the signature verification terminal device, the signature device comprising: The receiving module is used to receive common parameters sent by the signing device; The receiving module is also used to receive the root commitment public key of the Walker tree sent by the signing terminal device; The receiving module is also used to receive the signature packet and the message to be signed sent by the signing terminal device; The signature verification module is used to verify the signed data in the signature packet based on the message to be signed, the public parameters, and the root commitment public key.

[0025] As an optional implementation, the signature verification module is specifically used for: The signature packet is parsed to obtain the signed data, the current key index, and the membership proof of the public key corresponding to the current key index; Based on the random matrix, lattice basis tool matrix and modulus in the public parameters, the root commitment public key and the current key index, determine the public key corresponding to the current key index; Based on the message to be signed, determine the message digest of the message to be signed; Based on the public key corresponding to the current key index, verify whether the signed data is valid for the message digest; If so, then based on the public parameters, the root commitment public key, and the membership proof of the public key corresponding to the current key index, verify whether the public key corresponding to the current key index is a legitimate member of the Walker tree constructed by the signing device.

[0026] Fifthly, embodiments of this application provide an electronic device, which is either the signature terminal device or the signature verification terminal device. The electronic device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus, and the processor executes the machine-readable instructions to perform the method steps as described in the first aspect or the signature verification terminal device described in the second aspect.

[0027] Sixthly, embodiments of this application provide a signature system, which includes a signature terminal device and a signature verification terminal device; The signature terminal device is used to perform the steps of the method described in the first aspect above; The signature verification terminal device is used to perform the steps of the method described in the second aspect above.

[0028] The beneficial effects of this application are: This application provides a signature method and system. The signing device sends public parameters to the verification device, constructs a Walker tree based on the public keys of multiple key pairs, and sends the root commitment public key of the Walker tree to the verification device according to the public parameters. The signing device signs the message to be signed to obtain signed data, and generates a signature packet based on the current key state value, public parameters, and signed data. The signing packet and the message to be signed are then sent to the verification device. The verification device verifies the signed data in the signature packet based on the message to be signed, public parameters, and the root commitment public key. The signing device constructs the Walker tree using the public keys of each key pair as leaf nodes. The tree structure of the Walker tree integrates multiple public keys into a single root commitment public key, reducing key management complexity and achieving efficient aggregation management of multiple public keys. The signing device employs a forward security mechanism to divide the key usage period into multiple time periods, tracking the key usage in the current time period through the current key state value, enhancing the long-term confidentiality and reliability of the signature and ensuring forward security. The signing device enhances resistance to quantum attacks by combining lattice-based cryptography, Volker tree structure, and forward security mechanisms during the signing process. It significantly reduces the proof size and improves the verification efficiency. Under the premise of ensuring quantum security, it achieves small signature size, fast verification speed, and efficient key management, and ensures the long-term reliability of digital signatures. Attached Figure Description

[0029] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a schematic diagram of the architecture of the signature system provided in the embodiments of this application; Figure 2 Flowchart of the signature method provided in the embodiments of this application Figure 1 ; Figure 3 Flowchart of the signature method provided in the embodiments of this application Figure 2 ; Figure 4 Flowchart of the signature method provided in the embodiments of this application Figure 3 ; Figure 5 Flowchart of the signature method provided in the embodiments of this application Figure 4 ; Figure 6 Flowchart of the signature method provided in the embodiments of this application Figure 5 ; Figure 7 Flowchart of the signature method provided in the embodiments of this application Figure 6 ; Figure 8 Flowchart of the signature method provided in the embodiments of this application Figure 7 ; Figure 9 Flowchart of the signature method provided in the embodiments of this application Figure 8 ; Figure 10 A module structure diagram of a signature device provided in an embodiment of this application; Figure 11 A module structure diagram of another signature device provided in the embodiments of this application; Figure 12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0032] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0033] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0034] In the field of information security technology, with the deepening of digitalization and the gradual maturation of quantum computing technology, traditional digital signature schemes have significant limitations in key management and long-term security. Taking the Merkle tree hash signature scheme, which has quantum resistance, as an example, its proof size increases dramatically with the data scale, leading to a significant reduction in verification efficiency and making it difficult to adapt to high-frequency, high-capacity real-world application scenarios. At the same time, most existing schemes lack key evolution capabilities, failing to guarantee the long-term confidentiality of communication content and the continued validity of signature non-repudiation.

[0035] Based on the above-mentioned problems, this application provides a signature method that combines the efficient verification capability of the Vorkell tree, the forward-secure long-term protection mechanism, and the quantum-resistant properties of lattice cryptography to improve the quantum-resistant security, forward security, and verification efficiency of the signature.

[0036] Figure 1 This is a schematic diagram of the architecture of the signature system provided in the embodiments of this application, such as... Figure 1 As shown, the signature system includes a signature terminal device and a signature verification terminal device.

[0037] The signing device generates quantum-resistant public parameters and sends them to the verification device. Based on these public parameters, it generates multiple key pairs, constructs a Verkle tree using the public keys from these key pairs, and generates the root commitment public key of the Verkle tree, which is then sent to the verification device. Using the root commitment public key of the Verkle tree reduces the proof size, lowers the difficulty of key management, and facilitates improved signature verification efficiency at the verification device.

[0038] The signing device employs a forward security mechanism to divide the key usage period into multiple time slots. It tracks key usage within the current time slot using the current key status value. If all private keys in each key pair within the current time slot have been used, the private keys for each key pair within that time slot are destroyed. This ensures that even if an attacker obtains a key during a certain time slot, they cannot trace back and forge historical signatures, thus greatly enhancing the long-term confidentiality and reliability of the signature and ensuring forward security.

[0039] The signing device generates a signature package containing the signature data, the current key index, and the membership proof of the public key corresponding to the current key index, based on the current key status value, public parameters, and the signature data obtained after signing the message to be signed. The signing device then sends the signature package and the message to be signed to the verification device.

[0040] After parsing the signature packet, the verification device verifies the validity and authenticity of the signed data based on the public parameters, the message to be signed, and the root commitment public key, obtains the verification result, and feeds the verification result back to the signing device.

[0041] Because the signing device combines lattice-based cryptography, Volker tree structure, and forward security mechanisms during the signing process, it enhances resistance to quantum attacks through lattice-based cryptography, significantly compresses the proof size and improves verification efficiency through Volker tree structure, and achieves forward security features through time-based key management and automatic key destruction in the forward security mechanism. This ensures that even if the current private key is leaked, the security of historical signatures will not be compromised. While guaranteeing quantum resistance, it achieves small signature size, fast verification speed, efficient key management, and ensures the long-term reliability of digital signatures.

[0042] Figure 2 Flowchart of the signature method provided in the embodiments of this application Figure 1 Taking the interaction between the signing device and the verification device in a signature system as an example, the process of the signature method is explained. Figure 2 As shown, the method includes: S101. The signature terminal device sends common parameters to the signature verification terminal device.

[0043] Optionally, the signing device constructs a lattice-based cryptographic environment to generate public parameters. Among them, common parameters It can include random matrices Lattice tool matrix Hash function Modulus Grid Dimension Column number Number of key pairs in each time period Preset index Total number of time periods and current time period index Common parameters .

[0044] Specifically, the signing device randomly selects a security parameter. Based on security parameters Derive the lattice dimension and modulus Among them, safety parameters The larger the lattice dimension, the higher the computational complexity, and the stronger the resistance to quantum attacks. The complexity of a lattice is determined by its lattice dimension. Even number, modulus The prime modulus that satisfies the congruence condition, i.e. .

[0045] Signature device selects hash function ,in, It is a binary bit string of arbitrary length. It is a length of A binary bit string. Through a hash function. It can map bit strings of arbitrary length to bits of fixed length. Bit strings, adapted to lattice dimensions .

[0046] Signature terminal device from modulus set of integers In the middle, sample one OK Random matrix of columns random matrix for OK Modulus of column Matrix, i.e. , where the number of columns .

[0047] The signature terminal device defines a lattice basis tool matrix. lattice base tool matrix ,in, for 1D identity matrix This represents the Kronen product. The signature terminal device is configured with the number of key pairs for each time period. That is, the number of key pairs used in each time period is ,in, To use a preset exponent, the number of key pairs used in each time period is represented as a power of 2, facilitating binary operations and fast indexing. If the total number of key pairs is... The total number of time periods for Among them, the index for the current time period. .

[0048] The signing device will display common parameters The data is sent to the signature verification device, which then receives the common parameters. In other words, common parameters These are parameters shared between the signing device and the server device.

[0049] S102. The signing device constructs a Walker tree based on the public keys of multiple key pairs, where each leaf node in the Walker tree represents the public key of each key pair.

[0050] Optionally, the signature device invokes the Quantum Random Number Generator (QRNG) to generate a random seed. random seed The QRNG generates truly random numbers based on the uncertainty principle of quantum mechanics, resulting in extremely high entropy. The signature-end device uses a random seed. Initialize a pseudo-random number generator (PRNG).

[0051] Because QRNG generates random numbers relatively slowly, it cannot directly meet the demand for a large number of random numbers. Therefore, a high-entropy random seed is used. After initializing the PRNG, it can quickly generate a large number of pseudo-random numbers, balancing the security and efficiency of random number generation.

[0052] The signing device calls the PRNG to generate a large number of key pairs in batches. Each key pair is a Lamport one-time key pair, avoiding the performance overhead of frequent QRNG calls and ensuring the randomness and quantum-resistant security of each key pair. Specifically, the signing device calls the PRNG to generate key pairs in batches. Key pairs ,in, for The index of any key pair in a set of key pairs. .

[0053] The signing device uses the public key from each key pair as a leaf node in the Walker tree to construct the Walker tree. That is, the signature terminal device will Construct a Volker tree by using each node as a leaf node. Among them, Walker trees The branching factor is Walker Tree The height is .

[0054] S103. The signing device sends the root commitment public key of the Walker tree to the verification device according to the public parameters.

[0055] Optionally, the signature terminal device determines the signature based on common parameters. Generate a Walker tree Long-term root commitment public key Among them, Walker tree Root commitment public key For Walker Tree The commitment value of the root node ,Right now Signature private key .

[0056] The signature device will use the Walker tree Root commitment public key Send to the signature verification device and the signature private key Stored in a secure local environment.

[0057] Signature device with Construct a Walker tree using the public keys of each key pair as leaf nodes. via Walker tree The tree structure will Each public key is integrated into a single root commitment public key. This reduces the complexity of key management and enables efficient aggregation and management of multiple public keys.

[0058] S104. The signing device signs the message to be signed and obtains the signed data.

[0059] Optionally, the signing device uses a signing private key. A private key in the process of signing messages. Perform digital signature to obtain signed data .

[0060] Since the private key is a one-time private key in a one-time key pair, the signing device uses the one-time private key to treat the message to be signed. Perform a one-time signature to obtain the signed data. This is a one-time signature data.

[0061] S105. The signing device generates a signature packet based on the current key status value, public parameters, and signed data. The current key status value includes the current time period index and the index of the next key to be used.

[0062] Optionally, the current key state value This includes the current time period index. and the index of the next key to be used The signing device uses the current key state value. Parsing the index for the current time period and the index of the next key to be used And indexed according to the current time period. and the index of the next key to be used Determine the current key index .

[0063] The signing device indexes the current key. and common parameters Generate data containing signatures Current key index and current key index Corresponding public key Membership proof The signature package.

[0064] S106. The signing device sends the signature packet and the message to be signed to the verification device.

[0065] Optionally, the signing device sends a signature packet and a message to be signed to the verification device. The signature verification device receives the signature packet and the message to be signed from the signature terminal device. .

[0066] S107. The signature verification device verifies the signed data in the signature packet based on the message to be signed, public parameters, and the root commitment public key, and obtains the signature verification result.

[0067] Optionally, the signature verification device determines the signature based on the message to be signed. Common parameters and root commitment public key The validity and authenticity of the signed data in the signature packet are verified to obtain the signature verification result.

[0068] S108. The verification terminal device sends the verification result to the signature terminal device.

[0069] Optionally, the verification device may send the verification result back to the signature device as feedback data.

[0070] In this embodiment, the signing device sends public parameters to the verification device, constructs a Walker tree based on the public keys of multiple key pairs, and sends the root commitment public key of the Walker tree to the verification device according to the public parameters. The signing device signs the message to be signed to obtain signed data, and generates a signature packet based on the current key state value, public parameters, and signed data. The signing packet and the message to be signed are then sent to the verification device. The verification device verifies the signed data in the signature packet based on the message to be signed, public parameters, and the root commitment public key. The signing device constructs a Walker tree using the public keys of each key pair as leaf nodes. The tree structure of the Walker tree integrates multiple public keys into a single root commitment public key, reducing key management complexity and achieving efficient aggregation management of multiple public keys. The signing device employs a forward security mechanism to divide the key usage period into multiple time periods, tracking the key usage in the current time period through the current key state value, enhancing the long-term confidentiality and reliability of the signature, and ensuring forward security. The signing device enhances resistance to quantum attacks by combining lattice-based cryptography, Volker tree structure, and forward security mechanisms during the signing process. It significantly reduces the proof size and improves the verification efficiency. Under the premise of ensuring quantum security, it achieves small signature size, fast verification speed, and efficient key management, and ensures the long-term reliability of digital signatures.

[0071] Figure 3 Flowchart of the signature method provided in the embodiments of this application Figure 2 ,like Figure 3As shown, in step S103 above, the signing device sends the root commitment public key of the Vorkle tree to the verification device according to the public parameters, including: S201. Generate the root commitment public key of the Volker tree based on the public key in each key pair and the random matrix, lattice basis tool matrix and modulus in the public parameters.

[0072] Optionally, the signature device is based on Key pairs Public key and public parameters in random matrix in Lattice tool matrix and modulus The Vector Commitment algorithm is used to generate the Volker tree. Root commitment public key .in, Key pairs The public key in includes .

[0073] Since vector commitment is for constructing a Volker tree The core cryptographic primitives employ a vector commitment algorithm based on Key pairs Public key and public parameters in random matrix in Lattice tool matrix and modulus Generated Walker Tree Root commitment public key Its security is built on lattice-hard problems, possessing quantum resistance, and through mathematical structure optimization, it achieves a more compact proof than traditional hash chains, reducing the proof size and lowering the difficulty of key management.

[0074] S202. Send the root commitment public key of the Walker tree to the signature verification device.

[0075] Optionally, the signature device will use a Walker tree. Root commitment public key As Key pairs The aggregated credentials of the public key are sent to the signature verification terminal device.

[0076] In other words, Walker tree Root commitment public key Aggregated Key pairs The core information of the public key does not need to be transmitted from the signing device to the verification device. Key pairs The public key in the data significantly reduces transmission overhead.

[0077] In this embodiment, the signing device generates a root commitment public key of a Volcker tree based on the public key in each key pair and the random matrix, lattice basis tool matrix, and modulus in the public parameters, and sends the root commitment public key of the Volcker tree to the verification device. The root commitment public key of the Volcker tree achieves resistance to quantum attacks and reduces the overhead of public key transmission.

[0078] Figure 4 Flowchart of the signature method provided in the embodiments of this application Figure 3 ,like Figure 4 As shown, in step S201 above, the root commitment public key of the Volker tree is generated based on the public key in each key pair and the random matrix, lattice basis tool matrix, and modulus in the public parameters, including: S301. Determine the root node of the Walker tree based on the public key in each key pair.

[0079] Optionally, the signing device will Key pairs The public keys in the data are aggregated into a Vokel tree. root node Among them, Walker tree root node For all leaf nodes Key pairs The hierarchical aggregation result of the public keys in the data includes Key pairs The core information of the public key in the system.

[0080] S302. Based on the random matrix, lattice basis tool matrix, modulus, and the root node of the Walker tree, generate the root commitment public key corresponding to the root node of the Walker tree.

[0081] Optionally, the signature device will use a Walker tree. root node As the input vector, the vector commitment algorithm is used, based on the common parameters. random matrix in Lattice tool matrix and modulus Perform deterministic inversion operations on the input vector, i.e., the Volker tree. root node Generate a concise commitment value and obtain a Volker tree. root node Commitment value and Walker Tree root node Commitment value As a Walker tree root node The corresponding root commitment public key .

[0082] Specifically, Walker tree root node Commitment value ,in, Lattice basis tool matrix The inverse matrix of represents the deterministic inversion operation. It is a random matrix. It is the modulus.

[0083] In this embodiment, the signing device determines the root node of the Walker tree based on the public keys in each key pair, and generates the root commitment public key corresponding to the root node of the Walker tree based on the random matrix, lattice basis tool matrix, modulus, and the root node of the Walker tree. This results in a smaller proof size for the concise root commitment public key, reduces public key transmission overhead, and ensures the root commitment public key's resistance to quantum attacks.

[0084] As an optional implementation, before generating the signature packet based on the current key state value, public parameters, and signed data in step S105 above, the following steps are included: Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether to destroy the private keys in each key pair for the current time period.

[0085] Optionally, the signing device determines the signature based on the current key state value. Current Time Index and the index of the next key to be used and common parameters Number of key pairs in each time period This determines the usage status of the private key in each key pair during the current time period.

[0086] The signing device determines whether to destroy the private keys in each key pair for the current time period based on the usage status of the private keys in each key pair for the current time period.

[0087] In this embodiment, the signing device determines whether to destroy the private keys in each key pair of the current time period based on the current time period index, the index of the next key to be used, and the number of key pairs in each time period in the public parameters. By determining the usage status of the private keys in each key pair of the current time period, it determines whether to trigger the destruction operation of the private keys in each key pair of the current time period. Forward security features are achieved by introducing time-based key management and automatic key destruction in the forward security mechanism.

[0088] Figure 5 Flowchart of the signature method provided in the embodiments of this application Figure 4 ,like Figure 5As shown, the above steps determine whether to destroy the private keys in each key pair of the current time period based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters. This includes: S401. Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether all private keys in each key pair for the current time period have been used.

[0089] Optionally, the signing device determines the signature based on the current key state value. Current Time Index and the index of the next key to be used and common parameters Number of key pairs in each time period This determines whether all private keys in each key pair during the current time period were used by the signing device in the historical signing process.

[0090] In other words, the signing device determines the key status value based on the current key status value. Current Time Index and the index of the next key to be used and common parameters Number of key pairs in each time period It determines whether there are any unused private keys in each key pair during the current time period.

[0091] S402. If so, destroy the private key in each key pair of the current time period, update the current time period index in the current key status value to the next time period index of the current time period index, and update the index of the next key to be used in the current key status value to the product of the new current time period index and the number of key pairs of each time period in the public parameters.

[0092] Optionally, if all private keys in each key pair during the current time period have been used by the signing device in historical signing processes, meaning there are no unused private keys in any key pair during the current time period, the signing device triggers private key destruction for the current time period, completely deleting the private keys in all key pairs within the current time period. This ensures that the private keys in all key pairs during the current time period are only retained during the current usage period. Even if a key is subsequently leaked, attackers cannot obtain the destroyed private keys and cannot trace back to forge signatures from historical periods, thus guaranteeing the long-term security of past signatures.

[0093] After destroying the private keys in each key pair for the current time period, the signing device updates the current key state value. Current time period index and the index of the next key to be used Specifically, index the current time period. The next time period index is As the updated current key state value Current time period index ,Right now And index the new current time period. With common parameters Number of key pairs in each time period The product of these two values ​​is used as the updated current key state value. The index of the next key to be used ,Right now This allows us to index the next key to be used. Switch to the index of the first key pair in the next time period of the current time period to avoid the signing device omitting or reusing the private key when using the private key of each key pair in each time period during the signing process.

[0094] In this embodiment, the signing device determines whether all private keys in each key pair of the current time period have been used based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters. If so, the private keys in each key pair of the current time period are destroyed, and the current time period index in the current key status value is updated to the next time period index of the current time period index. The index of the next key to be used in the current key status value is also updated to the product of the new current time period index and the number of key pairs for each time period in the public parameters. This ensures the long-term security of past signatures and prevents the signing device from omitting or reusing private keys when using private keys in each key pair of each time period during the signing process.

[0095] Figure 6 Flowchart of the signature method provided in the embodiments of this application Figure 5 ,like Figure 6 As shown, in step S401 above, determining whether all private keys in each key pair of the current time period have been used is based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters. This includes: S501. Determine the first key index of the next time period based on the current time period index and the number of key pairs for each time period in the public parameters.

[0096] Optionally, the signature device indexes based on the current time period. and common parameters Number of key pairs in each time period Determine the first key index of the next time period after the current time period as .

[0097] S502. If the index of the next key to be used is greater than or equal to the index of the first key in the next time period, then it is determined that all private keys in each key pair in the current time period have been used.

[0098] Optionally, if the next index of the key to be used Greater than or equal to the first key index of the next time period, i.e., if If so, the signing device determines that all private keys in each key pair for the current time period have been used.

[0099] In this embodiment, the signature device determines the first key index of the next time period based on the current time period index and the number of key pairs in each time period in the public parameters. If the index of the next key to be used is greater than or equal to the first key index of the next time period, it is determined that all private keys in each key pair of the current time period have been used. This enables precise tracking of the usage status of the private keys in each key pair of the current time period.

[0100] Figure 7 Flowchart of the signature method provided in the embodiments of this application Figure 6 ,like Figure 7 As shown, in step S104 above, the signing device signs the message to be signed to obtain signed data, including: S601. Determine the message digest of the message to be signed based on the hash function in the public parameters.

[0101] Optionally, the signing device calls public parameters. hash function in Confirm message to be signed message summary .

[0102] Specifically, the signing device calls the hash function. For messages to be signed of any length Perform a hash operation to obtain a fixed length. message summary message digest .

[0103] S602. Use the index of the next key to be used as the index of the current key, and use the private key in the key pair corresponding to the current key index to digitally sign the message digest to obtain the signed data.

[0104] Optionally, if all private keys in each key pair during the current time period are used, the signing device will update the current key state value. The index of the next key to be used As the current key index If not all private keys in the key pairs for the current time period are used, the signing device will change the current key status value. The index of the next key to be used As the current key index .

[0105] The signing device uses the current key index. corresponding key pair private key in message digest Perform a one-time digital signature to obtain the signed data. Among them, the signed data , Indicates the signature algorithm, Index of the current key corresponding key pair The private key in This is a message summary.

[0106] In this embodiment, the signing device determines the message digest of the message to be signed based on the hash function in the public parameters, uses the index of the next key to be used as the current key index, and digitally signs the message digest using the private key in the key pair corresponding to the current key index to obtain the signed data. The signed data is one-time signed data, ensuring the security of the signed data.

[0107] Figure 8 Flowchart of the signature method provided in the embodiments of this application Figure 7 ,like Figure 8 As shown, in step S105 above, the signing device generates a signature packet based on the current key state value, public parameters, and signed data, including: S701. Take the index of the next key to be used as the current key index, and generate the membership proof of the public key corresponding to the current key index in the Volker tree based on the current key index.

[0108] Optionally, if all private keys in each key pair during the current time period are used, the signing device will update the current key state value. The index of the next key to be used As the current key index Accordingly, if not all private keys in each key pair are used in the current time period, the signing device will change the current key status value. The index of the next key to be used As the current key index .

[0109] The signing device indexes the current key. In the Walker Tree Index of the current key Corresponding public key Generate membership proof Membership certificate Used to prove the current key index Corresponding public key For Walker Tree The valid leaf nodes (i.e., valid members).

[0110] Among them, membership proof ,in, As the first proof value, This is the second proof value. For Walker Tree branching factor, For Walker Tree The number of leaf nodes in a Walker tree The number of public keys.

[0111] S702. Integrate the signed data, the current key index, and the membership proof of the public key corresponding to the current key index into a signature package.

[0112] Optionally, the signing device will sign the data. Current key index and current key index Corresponding public key Membership proof Integrated into a signature pack In other words, the signature package. .

[0113] In this embodiment, the signing device uses the index of the next key to be used as the current key index. Based on the current key index, it generates a membership proof of the public key corresponding to the current key index in the Vogel tree. The signed data, the current key index, and the membership proof of the public key corresponding to the current key index are then integrated into a signature packet. This ensures that the signature packet contains the signed data, the current key index, and the membership proof of the public key corresponding to the current key index, facilitating signature verification by the verification device.

[0114] Figure 9 Flowchart of the signature method provided in the embodiments of this application Figure 8 ,like Figure 9 As shown, in step S107 above, the verification device verifies the signed data in the signature packet based on the message to be signed, public parameters, and the root commitment public key, including: S801. Parse the signature packet to obtain the signed data, the current key index, and the membership proof of the public key corresponding to the current key index.

[0115] Optionally, the signature verification device verifies the signature packet. The data is parsed to obtain the signed data. Current key index and current key index Corresponding public key Membership proof .

[0116] S802. Determine the public key corresponding to the current key index based on the random matrix, lattice basis tool matrix and modulus, root commitment public key and current key index in the public parameters.

[0117] Optionally, the signature verification terminal device uses common parameters. random matrix in Lattice tool matrix and modulus and root commitment public key and current key index Based on the position extraction logic of lattice cryptographic vector commitment, the current key index is located and reconstructed. Corresponding public key .

[0118] S803. Determine the message digest of the message to be signed based on the message to be signed.

[0119] Optionally, the signature verification terminal device uses common parameters. hash function in Review the message awaiting signature. message summary Specifically, the signature verification device calls the hash function. For messages to be signed of any length Perform a hash operation to obtain a fixed length. message summary message digest .

[0120] S804. Based on the public key corresponding to the current key index, verify whether the signed data is valid for the message digest.

[0121] Optionally, due to the signed data The signature device uses the current key index. corresponding key pair private key in message digest If the signature is obtained, the verification device uses the current key index. Corresponding public key It can accurately verify signed data. message digest The validity of the data after signature verification is determined. message digest Is it effective?

[0122] S805. If so, then based on the public parameters, the root commitment public key, and the member proof of the public key corresponding to the current key index, verify whether the public key corresponding to the current key index is a legitimate member of the Walker tree constructed by the signing device.

[0123] Optionally, if so, the signature verification device will use common parameters. Root commitment public key and current key index Corresponding public key Membership proof Verify the current key index Corresponding public key Is it a Walker tree built for the signing device? Legitimate members of the organization.

[0124] Specifically, if With root commitment public key That is, Walker tree root node Commitment value If they match, then determine the current key index. Corresponding public key Walker tree built for signature devices Legitimate members of the organization.

[0125] in, As the first proof value, This is the second proof value. This is the third proof value. For Walker Tree branching factor, For Walker Tree The number of leaf nodes in a Walker tree The number of public keys. This represents AND logic, i.e., a Volker tree. All levels of verification must pass; if any level of verification fails, the membership proof is invalid. It is invalid. For the position verification function of the vector commitment, if the Volker tree If all levels of verification pass, it indicates that the current key index... Corresponding public key Walker tree built for signature devices Legitimate members of the organization.

[0126] In this embodiment, the verification device parses the signature packet to obtain the signed data, the current key index, and the membership proof of the public key corresponding to the current key index. Based on the random matrix, lattice basis tool matrix and modulus, root commitment public key, and current key index in the public parameters, it determines the public key corresponding to the current key index. Based on the message to be signed, it determines the message digest of the message to be signed and verifies whether the signed data is valid for the message digest based on the public key corresponding to the current key index. If so, it verifies whether the public key corresponding to the current key index is a legitimate member of the Volker tree constructed by the signing device, based on the public parameters, root commitment public key, and the membership proof of the public key corresponding to the current key index. This achieves the verification of the validity and authenticity of the signed data.

[0127] Based on the same inventive concept, this application also provides a signature device corresponding to the signature method executed by the signature terminal device. Since the principle of the device in this application is similar to the signature method executed by the signature terminal device in the above-mentioned application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0128] Figure 10 A module structure diagram of a signature device provided in an embodiment of this application is shown below. Figure 10 As shown, the device includes: The sending module 1001 is used to send common parameters to the signature verification terminal device; Module 1002 is used to construct a Walker tree based on the public keys of multiple key pairs, where each leaf node of the Walker tree is the public key of each key pair. The sending module 1001 is also used to send the root commitment public key of the Walker tree to the signature verification terminal device according to the public parameters; The signature module 1003 is used to sign the message to be signed and obtain the signed data. The generation module 1004 is used to generate a signature package based on the current key status value, public parameters, and signed data, and send the signature package and the message to be signed to the verification terminal device so that the verification terminal device can verify the signed data. The current key status value includes the current time period index and the index of the next key to be used.

[0129] As an optional implementation, the sending module 1001 is specifically used for: Generate the root commitment public key of the Volker tree based on the public key in each key pair and the random matrix, lattice basis tool matrix and modulus in the public parameters; Send the root commitment public key of the Walker tree to the signature verification device.

[0130] As an optional implementation, the sending module 1001 is specifically used for: Determine the root node of the Walker tree based on the public key in each key pair; Generate the root commitment public key corresponding to the root node of the Walker tree based on the random matrix, lattice basis tool matrix, modulus, and the root node of the Walker tree.

[0131] As an optional implementation, the device further includes: a determining module 1005, the determining module 1005 being configured to: Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether to destroy the private keys in each key pair for the current time period.

[0132] As an optional implementation, the determining module 1005 is specifically used for: Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether all private keys in each key pair for the current time period have been used. If so, destroy the private keys in each key pair of the current time period, update the current time period index in the current key status value to the next time period index of the current time period index, and update the index of the next key to be used in the current key status value to the product of the new current time period index and the number of key pairs in each time period in the public parameters.

[0133] As an optional implementation, the determining module 1005 is specifically used for: Based on the current time period index and the number of key pairs for each time period in the public parameters, determine the first key index for the next time period; If the index of the next key to be used is greater than or equal to the index of the first key in the next time period, then it is determined that all private keys in each key pair in the current time period have been used.

[0134] As an optional implementation, the signature module 1003 is specifically used for: The message digest of the message to be signed is determined based on the hash function in the public parameters; Use the index of the next key to be used as the index of the current key, and use the private key in the key pair corresponding to the current key index to digitally sign the message digest to obtain the signed data.

[0135] As an optional implementation, the generation module 1004 is specifically used for: Use the index of the next key to be used as the index of the current key, and generate the membership proof of the public key corresponding to the current key index in the Volker tree based on the current key index; The signed data, the current key index, and the membership proof of the public key corresponding to the current key index are integrated into a signature package.

[0136] Based on the same inventive concept, this application also provides a signature device corresponding to the signature method executed by the signature verification terminal device. Since the principle of the device in this application is similar to the signature method executed by the signature verification terminal device in the above-mentioned application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0137] Figure 11 A module structure diagram of another signature device provided in the embodiments of this application is shown below. Figure 11 As shown, the device includes: The receiving module 1101 is used to receive common parameters sent by the signing device; The receiving module 1101 is also used to receive the root commitment public key of the Walker tree sent by the signing terminal device; The receiving module 1101 is also used to receive the signature packet and the message to be signed sent by the signing terminal device; The signature verification module 1102 is used to verify the signed data in the signature packet based on the message to be signed, public parameters, and the root commitment public key.

[0138] As an optional implementation, the signature verification module 1102 is specifically used for: The signature packet is parsed to obtain the signed data, the current key index, and the membership proof of the public key corresponding to the current key index; Based on the random matrix, lattice basis tool matrix and modulus, root commitment public key and current key index in the public parameters, determine the public key corresponding to the current key index; Determine the message digest of the message to be signed based on the message to be signed; Based on the public key corresponding to the current key index, verify whether the signed data is valid for the message digest; If so, then based on the public parameters, the root commitment public key, and the membership proof of the public key corresponding to the current key index, verify whether the public key corresponding to the current key index is a legitimate member of the Volker tree constructed by the signing device.

[0139] This application also provides an electronic device, which can be the aforementioned signature terminal device or signature verification terminal device. For example... Figure 12 The diagram shown is a structural schematic of an electronic device provided in an embodiment of this application, including a processor 121, a memory 122, and a bus 123. The memory 122 stores machine-readable instructions executable by the processor 121. When the electronic device is running, the processor 121 communicates with the memory 122 via the bus 123, and the processor 121 executes the machine-readable instructions to perform the method steps performed by the aforementioned signature terminal device or signature verification terminal device.

[0140] This application provides a signature system, which includes a signature terminal device and a signature verification terminal device.

[0141] The signature terminal device and the signature verification terminal device are used to execute the steps described in the foregoing embodiments.

[0142] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection can be through some communication interfaces; the indirect coupling or communication connection of devices or modules can be electrical, mechanical, or other forms.

[0143] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0144] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method of signing, characterized by, Applied to a signature terminal device, the method includes: Send common parameters to the signature verification terminal device; A Walker tree is constructed based on the public keys of multiple key pairs, and each leaf node of the Walker tree is the public key of each key pair. Based on the public parameters, the root commitment public key of the Walker tree is sent to the signature verification terminal device; Sign the message to be signed to obtain the signed data; Based on the current key status value, the public parameters, and the signed data, a signature packet is generated, and the signature packet and the message to be signed are sent to the signature verification device so that the signature verification device can verify the signed data. The current key status value includes the current time period index and the index of the next key to be used.

2. The method of claim 1, wherein, The step of sending the root commitment public key of the Walker tree to the signature verification terminal device according to the public parameters includes: The root commitment public key of the Walker tree is generated based on the public key in each key pair and the random matrix, lattice basis tool matrix and modulus in the public parameters. The root commitment public key of the Walker tree is sent to the signature verification terminal device.

3. The method of claim 2, wherein, The step of generating the root commitment public key of the Volker tree based on the public key in each of the key pairs and the random matrix, lattice basis tool matrix, and modulus in the public parameters includes: The root node of the Walker tree is determined based on the public key in each of the key pairs. Based on the random matrix, the lattice basis tool matrix, the modulus, and the root node of the Walker tree, generate the root commitment public key corresponding to the root node of the Walker tree.

4. The method of claim 1, wherein, Before generating the signature packet based on the current key state value, the public parameters, and the signed data, the process includes: Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether to destroy the private key in each key pair of the current time period.

5. The method of claim 4, wherein, The step of determining whether to destroy the private key in each key pair of the current time period based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters includes: Based on the current time period index, the index of the next key to be used, and the number of key pairs for each time period in the public parameters, determine whether all private keys in each key pair for the current time period have been used; If so, the private keys in each key pair of the current time period are destroyed, and the current time period index in the current key status value is updated to the next time period index of the current time period index. The index of the next key to be used in the current key status value is updated to the product of the new current time period index and the number of key pairs in each time period in the public parameters.

6. The method according to claim 5, characterized in that, The step of determining whether all private keys in each key pair of the current time period have been used based on the current time period index, the index of the next key to be used, and the number of key pairs in each time period in the public parameters includes: Based on the current time period index and the number of key pairs for each time period in the public parameters, determine the first key index for the next time period; If the index of the next key to be used is greater than or equal to the index of the first key in the next time period, then it is determined that all private keys in each key pair in the current time period have been used.

7. The method of claim 1, wherein, The process of signing the message to be signed to obtain signed data includes: The message digest of the message to be signed is determined based on the hash function in the public parameters; The index of the next key to be used is used as the current key index, and the private key in the key pair corresponding to the current key index is used to digitally sign the message digest to obtain the signed data.

8. The method of claim 1, wherein, The step of generating a signature packet based on the current key state value, the public parameters, and the signed data includes: The index of the next key to be used is used as the current key index. Based on the current key index, the membership proof of the public key corresponding to the current key index is generated in the Walker tree. The signed data, the current key index, and the membership proof of the public key corresponding to the current key index are integrated into the signature package.

9. A method of signing, characterized by The method, applied to a signature verification terminal device, includes: Receive common parameters sent by the signing device; Receive the root commitment public key of the Walker tree sent by the signing terminal device; Receive the signature packet and the message to be signed sent by the signature terminal device; The signed data in the signature packet is verified based on the message to be signed, the public parameters, and the root commitment public key.

10. The method of claim 9, wherein, The step of verifying the signed data in the signature packet based on the message to be signed, the public parameters, and the root commitment public key includes: The signature packet is parsed to obtain the signed data, the current key index, and the membership proof of the public key corresponding to the current key index; Based on the random matrix, lattice basis tool matrix and modulus in the public parameters, the root commitment public key and the current key index, determine the public key corresponding to the current key index; Based on the message to be signed, determine the message digest of the message to be signed; Based on the public key corresponding to the current key index, verify whether the signed data is valid for the message digest; If so, then based on the public parameters, the root commitment public key, and the membership proof of the public key corresponding to the current key index, verify whether the public key corresponding to the current key index is a legitimate member of the Walker tree constructed by the signing device.

11. A signature system characterized by comprising: The signature system includes a signature terminal device and a signature verification terminal device; The signature terminal device is used to perform the steps of the method according to any one of claims 1-8; The verification terminal device is used to perform the steps of the method described in any one of claims 9 or 10.

Images