A constant-time quantum-resistant signature method, system and medium

Abstract

The application discloses a constant-time quantum-resistant signature method and system and a medium, relates to the field of post-quantum cryptography, and solves the problems of heavy hardware computing burden, easy time sequence side channel attack and poor security level adaptability of an existing quantum-resistant signature algorithm. The method comprises the following steps: receiving a lattice polynomial matrix rank dimension parameter scalar k, deducing and configuring corresponding security parameters and norm check thresholds; setting a candidate mask vector sampling interval as an asymmetric closed interval, realizing constant-time sampling through pure bit operation; constraining a lattice cryptographic module space to an integer power of 2, generating a compressed public key through logical right shift, and completing error prompt feature generation and high-bit lossless reconstruction through bit operation. The system comprises corresponding function modules and can be deployed on an edge computing node or a financial gateway firmware. The application is free of a divider throughout the whole process, realizes O(1) constant-time execution, supports dynamic scaling of security levels, has high quantum-resistant security strength, and has low hardware overhead.

Description

Technical Field

[0001] This invention belongs to the field of post-quantum cryptography technology, and in particular relates to a constant-time quantum-resistant signature method, system and medium. Background Technology

[0002] In recent years, quantum computing technology has achieved breakthrough iterations and large-scale evolution. Traditional asymmetric public-key cryptosystems built on classical number theory problems (the large integer factorization problem and the discrete logarithm problem) have suffered a fundamental security threat. These cryptographic algorithms are no longer resistant to quantum computing attacks, necessitating the development of post-quantum cryptosystems adapted to quantum computing environments. Module-lattice-based digital signature algorithms (typically represented by the ML-DSA algorithm), with their security advantages against quantum computing attacks and mature theoretical foundation, have been established as the core technology direction of the next generation of international standards for post-quantum cryptography, becoming the preferred alternative to traditional public-key cryptographic algorithms.

[0003] Currently, although the modular lattice-based digital signature algorithm has been standardized and implemented, in actual engineering deployments, for scenarios such as resource-constrained edge nodes (e.g., micro IoT terminals, embedded sensing devices) and high-frequency financial gateways with high real-time and high security requirements, the existing standardized algorithm and corresponding hardware implementation technology have many insurmountable physical engineering limitations. They cannot meet the actual application needs of large-scale, multi-scenario, and high-security applications. The specific shortcomings are as follows:

[0004] First, existing technologies suffer from excessive hardware computational load and significant risks of leakage due to side-channel attacks. Current mainstream post-quantum cryptography international standards generally select large prime numbers that are not powers of 2 as the algorithm modulus (typical parameter such as q=8380417), and employ absolutely symmetric boundary values ​​during the generation of uniformly distributed random masks. This parameter design and implementation logic directly leads to frequent calls to high-power, high-latency hardware dividers in the underlying hardware operations, significantly increasing hardware computational power consumption and energy overhead. Simultaneously, the mask sampling stage relies on a rejection sampling mechanism with an indeterminate while loop. This non-deterministic loop execution logic results in significant differences in the algorithm's hardware runtime sequence, making it highly susceptible to timing-side-channel attacks. Attackers can capture and analyze these differences in hardware runtime sequence to illegally steal key information, leading to private key leakage and severely compromising the core security of the cryptographic system.

[0005] Secondly, existing technologies suffer from drawbacks such as high costs for adapting to multiple scenarios, redundant computing power, and difficulties in operation and maintenance. Existing hardware implementations of modular lattice digital signature algorithms often employ a "siloed" fixed design. For different security levels, the core parameters of the algorithm (including polynomial Hamming weights, upper limits of error correction features, etc.) are hard-coded as independent constants in the hardware netlist. This design lacks dynamic adjustability and scenario adaptability. In heterogeneous computing network environments, a single hardware module cannot dynamically switch between multiple security levels and flexibly adjust security defenses without reprogramming firmware or reconstructing the hardware netlist. This not only results in severe waste of hardware computing resources but also significantly increases the deployment, management, and maintenance costs of cryptographic modules in heterogeneous networks, making it difficult to adapt to the large-scale deployment needs of multiple scenarios and security levels. Summary of the Invention

[0006] The purpose of this invention is to provide a constant-time quantum-resistant signature method, which at least overcomes the technical problems of excessive hardware resource consumption, poor physical security in side-channel defense, and high adaptation costs of existing technologies.

[0007] Another objective of this invention is to provide a constant-time quantum-resistant signature system;

[0008] A third objective of this invention is to provide a computer-readable storage medium.

[0009] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is a constant-time quantum-resistant signature method, comprising the following steps:

[0010] Real-time parameter dynamic reconstruction: The global parameter scheduling unit receives a global configuration parameter scalar k that represents the security strength of the target. The parameter scalar k is the rank dimension of the lattice cryptographic polynomial matrix. The system derives and configures the challenge polynomial Hamming weight and the upper limit of the number of public key shift truncation error correction prompt features corresponding to the current security level through a preset linear algebra equation based on the value of k. At the same time, it dynamically calculates the security check boundary threshold for the infinite norm of the candidate signature matrix.

[0011] Pure bit operation sampling based on asymmetric boundary alignment: When generating candidate mask vectors, their uniformly distributed value range is configured as a non-absolutely symmetric closed interval. Make the total cardinality of discrete integers within the interval equal to 2. n n is a positive integer, γ is a constant boundary for matching hardware bits and operation thresholds, and then a status word is generated using a pseudo-random number generator, which is then processed by bit and mask (2 n -1) Perform a single-cycle bitwise AND operation to truncate positive integers, and subtract a constant γ from the truncation result to complete the centering shift, and complete the mask sampling in a constant time.

[0012] Full-bit operation public key compression and lossless error reconstruction: The underlying lattice cryptographic modulus space is constrained to an integer power of 2. The signing end performs a logical right shift operation on the generated public key matrix to truncate the low-bits to generate a compressed public key, and generates a sparse error indication feature matrix by simulating the verification end path through full-bit operations. After receiving the compressed public key and the error indication feature matrix, the verification end extracts the low-bit error features of the verification vector, determines the error direction through the bitwise AND operation of the local mask, and combines addition and subtraction instructions to reverse the high-bits with errors losslessly in a constant time.

[0013] Furthermore, in the real-time parameter dynamic reconstruction step, the derivation equation for the challenge polynomial Hamming weights is as follows: , The derivation equation for the upper limit of the number of public key shift tampering error correction hint features is as follows: (Based on the tamper-proof feature weight constant; public key shift truncation error correction hint feature upper limit) , The fault tolerance constant is used; the derivation equation for the security inspection boundary threshold is as follows: , is the upper bound of the absolute value of the private key, and the parameter scalar k is the rank dimension of the lattice cryptographic polynomial matrix.

[0014] Furthermore, the basic anti-tampering feature weight constant The value range is 15 to 25, and the fault tolerance constant is... The value range is from 22 to 32.

[0015] Furthermore, the modulus of the underlying lattice cryptographic modulus space The step size of the logical right shift operation of the public key matrix is ​​11; the constant boundary γ= The bit and mask are hexadecimal 0xFFFFF.

[0016] Furthermore, in the pure bitwise operation sampling step, the process of the pseudo-random number generator generating the state word is as follows: obtaining the seed sequence generated by the cryptographically secure hash function, initializing the internal state word using the cross-byte interleaving concatenation method, and performing random flow expansion through a cascaded structure based on pure shift and XOR gate logic. The process of the pseudo-random number generator generating the state word does not include multiplication and division instructions.

[0017] Furthermore, in the full-bit operation public key compression and error lossless reconstruction step, the signing end generates the error indication feature matrix through bitwise XOR and logical shift operations, and the verification end determines the error drift direction by combining the error indication feature matrix with a pure conditional adder or subtractor.

[0018] Furthermore, the end-to-end data flow process of the method includes three stages: key generation, signature generation, and signature verification. The key generation stage achieves public key compression through a logical right shift operation. The signature generation stage generates candidate mask vectors and generates an error hint feature matrix through pure bit operation sampling with asymmetric boundary alignment. The signature verification stage completes the error inverse lossless reconstruction based on the error hint feature matrix and outputs the verification result through norm constraint check and hash consistency check.

[0019] A constant-time quantum-resistant signature system includes a processor and a memory coupled to the processor. The memory stores executable instructions to implement the steps of the method described above. When executed by the processor, the instructions implement the following functional modules:

[0020] Adaptive parameter inference module: configured to receive global configuration parameter scalars It uses built-in circuit logic to deduce and output the challenge polynomial Hamming weights corresponding to the current security level. The upper limit of the number of public key shift truncation error correction hint features Simultaneously, dynamically calculate the security check boundary threshold for the infinite norm of the candidate signature matrix. ; and the deductions derived therefrom , and The global constraint parameters are sent to the asymmetric boundary constant-time sampling module and the bit operation compression and reconstruction module;

[0021] Asymmetric boundary constant-time sampling module: configured to receive constraint parameters from the adaptive parameter derivation module, and, without a floating-point divider unit, utilize a bit truncation extraction unit to combine bits and masks. Extract the positive integers with no branching periods, and map the positive integers to asymmetric closed intervals using a single-period translation unit. The candidate mask vector is generated internally, and then the candidate mask vector and its intermediate state data are sent to the bit operation compression and reconstruction module.

[0022] Bitwise operation compression and reconstruction module: configured to perform logical shift truncation of the public key matrix in an environment where the lattice cryptographic modulus space is an integer power of 2, and based on the candidate mask vector input by the asymmetric boundary constant-time sampling module, combined with the security check boundary threshold. Perform a constant-time norm constraint check; after the check passes, generate an error indication feature matrix based on bitwise AND comparison, and perform constant-time inverse error reconstruction based on low-bit error features.

[0023] Furthermore, the system, as asymmetric identity authentication and anti-tampering hardware logic, is integrated and deployed in the underlying resource authorization and control system of distributed edge computing nodes, or in the firmware of a high-frequency concurrent financial security gateway without hardware divider dependency.

[0024] A computer-readable storage medium storing computer instructions that, when executed by a processor, cause the processor to implement the constant-time quantum-resistant signature method as described above.

[0025] Compared with the prior art, the beneficial effects of the present invention include the following points:

[0026] 1. This invention achieves absolute constant-time security: By employing low-level bit operations and asymmetric boundary shifts, this invention completely eliminates the rejection sampling mechanism, which relies on a while loop, found in traditional quantum-resistant signatures (such as standard ML-DSA). Regardless of the private key content, the physical instruction execution cycle of the signing process remains strictly constant, fundamentally blocking the information leakage path of the timing side-channel.

[0027] 2. This invention significantly reduces hardware physical overhead, achieving extreme lightweight design: The entire process of this invention uses pure shift, bitwise AND, and addition / subtraction logic operations to replace expensive hardware dividers and floating-point units. Especially in the public key compression and high / low bit splitting stages, it eliminates the dependence on division operations, greatly reducing the number of logic gates and power consumption of edge computing nodes and security chips (such as SoC, HSM).

[0028] 3. This invention possesses multi-level safety strength adaptive smooth scaling capability: It incorporates a dynamic polynomial matrix rank scheduling engine, capable of scheduling within the underlying algebraic ring dimension ( Under the premise that the matrix rank remains unchanged, only by changing the matrix rank ( With this configuration, seamless hot reconfiguration of security levels can be achieved between limited computing power devices (low configuration) and national-level high-level defense networks (high configuration), taking into account both flexibility and system compatibility, with low adaptation costs and the ability to provide on-demand computing power savings. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is the overall method flowchart of this implementation method. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] like Figure 1 This embodiment provides a constant-time quantum-resistant signature method based on a constant-time quantum-resistant signature system based on full-bit operations and rank adaptation. Through underlying algebraic structure distortion and linear parameter derivation, a comprehensive optimization of the security architecture is achieved at the physical level. Addressing the problems of divider dependency, timing-side channel leakage, and poor security level adaptability in the hardware deployment of existing post-quantum signature algorithms, this embodiment utilizes core technologies such as modulus space alignment, asymmetric boundary sampling, matrix rank parameter abstraction, and full-bit operation error reconstruction to achieve constant-time execution, no divider dependency, and support for dynamic scaling of multi-level security parameters. The technical solution of this method can be integrated and deployed in heterogeneous computing power and high-concurrency environments such as the underlying resource authorization and management system of distributed edge computing nodes and the firmware of high-frequency concurrent financial security gateways without hardware divider dependence. The following describes the specific implementation method of this method in detail with specific technical parameters, hardware module architecture and complete algorithm flow. The underlying lattice cryptography related operations involved in this invention are all based on the Module-LWE hard problem on the circular ring, ensuring that the quantum security strength is of the same order as the standard prime number modular scheme, and all operation steps are implemented through pure bit operation and basic addition and subtraction operation, completely eliminating the need for dividers and floating-point operation units.

[0033] Specifically, the constant-time quantum-resistant signature method based on full-bit operation and rank adaptation described in this embodiment is based on a constant-time quantum-resistant signature system. At the physical hardware level, it consists of a secure chip deployed in an edge IoT computing node or a high-frequency financial gateway (HSM). This secure chip integrates a processor and a memory coupled to the processor. The memory stores executable instructions. When the instructions are executed by the processor, three main physical hardware logic units are implemented: a global parameter scheduling unit, a mask sampling and core operation unit, and an error feature compression and reconstruction unit. At the functional level, it includes an adaptive parameter derivation module, an asymmetric boundary constant-time sampling module, and a bit operation compression and reconstruction module. The global parameter scheduling unit, as the system's control bus interface, is responsible for receiving the externally input global configuration parameter scalar k representing the rank dimension of the lattice cryptographic polynomial matrix and distributing it to the adaptive parameter... The number deduction module, where the parameter scalar k is the core parameter characterizing the security strength of the target, can adapt to multiple security parameters without resetting the firmware state by dynamically adjusting the value of k. The mask sampling and core operation unit integrates an asymmetric boundary constant-time sampling module, which is responsible for generating pseudo-random numbers for full-bit operations, sampling candidate w and performing polynomial multiplication and addition calculations for the core of the cipher. The error feature compression and reconstruction unit corresponds to the bit operation compression and reconstruction module, which is responsible for performing logical shift truncation of the public key, generating error prompt features based on bit operations, and constant-time inverse error reconstruction at the verification end. The three physical units work together to complete the entire process from parameter deduction, signature generation to signature verification. The physical execution cycle of all operations is independent of the input key and mask data, achieving O(1) constant-time execution and preventing the risk of timing side-channel leakage from the physical signal level.

[0034] It is worth noting that the O(1) constant time execution described in this invention refers to the physical execution cycle of the signature generation and verification process being O(1) time complexity. That is, the execution time is independent of sensitive data such as input keys and mask vectors, and there is no timing difference caused by conditional branches, which can effectively prevent timing side-channel attacks.

[0035] In some specific implementations, the adaptive parameter derivation module is configured to receive global configuration parameter scalars. It uses built-in circuit logic to deduce and output the challenge polynomial Hamming weights corresponding to the current security level. The upper limit of the number of public key shift truncation error correction hint features Simultaneously, dynamically calculate the security check boundary threshold for the infinite norm of the candidate signature matrix. ; and the deductions derived therefrom , and The global constraint parameters are sent to the asymmetric boundary constant-time sampling module and the bit operation compression and reconstruction module;

[0036] The asymmetric boundary constant-time sampling module is configured to receive the constraint parameters from the adaptive parameter derivation module, and, without a floating-point divider unit, utilize a bit truncation extraction unit to combine bits and masks. Extract the positive integers with no branching periods, and map the positive integers to asymmetric closed intervals using a single-period translation unit. The candidate mask vector is generated internally, and then the candidate mask vector and its intermediate state data are sent to the bit operation compression and reconstruction module.

[0037] The bitwise operation compression and reconstruction module is configured to perform logical shift truncation of the public key matrix in an environment where the lattice cryptographic modulus space is an integer power of 2, and based on the candidate mask vector input by the asymmetric boundary constant-time sampling module, combine it with the security check boundary threshold. Perform a constant-time norm constraint check; after the check passes, generate an error indication feature matrix based on bitwise AND comparison, and perform constant-time inverse error reconstruction based on low-bit error features.

[0038] The asymmetric boundary constant-time sampling module is configured to utilize a bit-truncation extraction unit combined with a mask (2) in the absence of a floating-point divider unit. n -1) Extract the positive integers of the unbranched period and map them to the asymmetric closed interval [-γ, γ-1] by a single-period translation unit;

[0039] The bitwise operation compression and reconstruction module is configured to perform logical shift truncation, error hint feature generation based on bitwise AND comparison, and constant-time inverse error reconstruction based on low-bit features in an environment where the modulus space is aligned to an integer power of 2.

[0040] Furthermore, this embodiment constrains the core algebraic parameters of the underlying lattice cipher; the modulus space of the underlying lattice cipher is forcibly set to an integer power of 2 (optionally, in this embodiment...). This configuration completely eliminates dividers and floating-point operations in the algebraic architecture of the system. Simultaneously, at the security reduction level, it maps the security model to a Module-LWE hard problem on a specific circular ring, ensuring that when facing quantum lattice basis reduction attacks (such as the BKZ algorithm), it maintains the shortest vector in the lattice (SVP) solution complexity of the same order as the standard prime modulus, guaranteeing no algebraic structural degradation in the resistance to quantum bit security. For the public key compression and error reconstruction stages, the logical right shift step size for public key truncation is set to keep the error of low-order public key truncation within a controllable range. For the asymmetric boundary alignment mask sampling stage, a mask boundary constant is set. The corresponding bit and truncation mask are strictly set to hexadecimal 0xFFFFF, so that the boundary of the random mask sampling distribution is strictly aligned with the bit width of the power of 2 modulus, while the discrete integer base of the asymmetric sampling interval precisely matches the integer power of 2, providing parameter support for constant time sampling.

[0041] In some specific implementations, before the system performs signature-related operations, the global parameter scheduling unit first receives externally input parameter scalars. This triggers a real-time parameter dynamic reconstruction step, where the adaptive parameter deduction module automatically deduces and configures all the core parameters required for the current security level using preset linear algebraic equations, providing parameter basis for subsequent signature generation and verification. The specific deduction process is as follows:

[0042] The first step is to deduce the challenging polynomial Hamming weights. ; Perform linear equations , The basic anti-tampering feature weight constant has a value range between 15 and 25.

[0043] The basic anti-tampering feature weight constant The range of values ​​determines the size of the Hamming weights for the challenge polynomial;

[0044] like (Lower Bound Critical): If the number of valid non-zero coefficients in the challenge polynomial is too small, the search space (entropy) of the hash challenge will decrease exponentially. The probability of an attacker forging a signature through collisions will increase significantly, failing to meet the minimum 128-bit anti-qubit security strength required by post-quantum cryptography standards (such as NISTPQC).

[0045] like (Upper Limit Criterion): Although security is further improved, in the signature generation stage (Fiat-Shamir transform), excessively large Hamming weights can lead to problems with candidate signature vectors. The absolute value expands rapidly. This will have a very high probability of triggering the norm safety check boundary ( ). This leads to frequent rejections of signatures due to out-of-bounds errors. The hardware will then be trapped in an infinite loop of repeated retry sampling, causing the latency and dynamic power consumption of signature generation to increase exponentially, completely negating the engineering feasibility of deploying on edge computing nodes.

[0046] The second step is to deduce the upper limit of the number of public key shift truncation error correction hint features; the equation for deduce the upper limit of the number of public key error correction hint features is as follows: ,in It is the fault tolerance constant, and its value ranges from 22 to 32.

[0047] Range of values ​​for the fault tolerance constant This determines the maximum number of error correction hints that can be carried in the signature; if (Lower Boundary Criterion): The fault tolerance margin is too strict. In real-world lattice cryptography with noisy operations, normally generated legitimate signatures can easily produce more than this number of boundary flip errors. If the limit is forcibly set below 22, a large number of legitimate candidate signatures will be incorrectly judged as out of bounds and discarded, resulting in an extremely low first-time signature success rate and severely slowing down the response speed of high-frequency concurrent financial gateways.

[0048] like (Upper Limit Criterion): Hint Matrix It becomes too dense. On the one hand, too many hints will significantly expose the statistical side-channel characteristics of the private key noise distribution, introducing potential security degradation risks; on the other hand, a dense hint matrix will directly lead to a sharp increase in the size of the final serialized signature packet, undermining the core of this implementation method of low hardware overhead and low channel bandwidth usage.

[0049] The and The range of values ​​is defined by the system based on the dynamic requirements of heterogeneous networks for multi-level security strength, combined with the anti-tampering theoretical entropy model and the hardware comprehensive simulation data of the high-frequency gateway. and The range of values ​​can minimize the overhead of signature generation time and communication bandwidth (e.g., within a few KB) under each configuration, while maintaining the corresponding lower limit of quantum security level, achieving the optimal trade-off between computing power and fault tolerance.

[0050] The third step is to deduce the security check boundary threshold for the infinite norm of the candidate signature matrix. First, based on the derived challenge polynomial Hamming weights... Calculate the maximum error drift (This is the upper limit of the absolute value of the private key coefficients) and then dynamically calculates the norm security check boundary threshold. (in As a constant boundary, this implementation is set as The boundary threshold This will serve as the core basis for security checks on candidate signature vectors during the signature generation stage. If the infinity norm of the candidate signature vector z exceeds this threshold ( If the constant-time state word is reset and the signature is rejected, the statistical characteristics of the private key are not disclosed.

[0051] In some specific implementations, the complete end-to-end data flow process of the quantum-resistant signature includes three core stages: key generation, signature generation, and signature verification. All three stages are implemented based on the aforementioned parameter configurations and functional modules, and the entire process uses pure bitwise operations and basic addition and subtraction, without relying on dividers or floating-point operations. The following details the specific execution flow, core operations, and improvements to the implementation methods of the three stages:

[0052] S1, Key Generation Phase (KeyGen)

[0053] The input for this stage is a cryptographically secure random seed, and the output is a compressed public key. and private key The core implementation of public key compression for full-bit operations completely eliminates the division dependency in traditional public key generation. The specific execution sub-process is as follows:

[0054] S11. Matrix and Private Key Generation: Based on the input cryptographically secure random seed, a uniformly distributed lattice cipher matrix is ​​generated using a cryptographically secure generation algorithm. And a short private key vector s1, wherein the absolute value of the coefficient of the short private key vector s1 does not exceed the upper limit η of the absolute value of the private key, to ensure that the short vector characteristic of the private key meets the security requirements of the Module-LWE hard problem;

[0055] S12. Precise Public Key Calculation: Performing Core Operations of Lattice Cryptography The exact public key t is calculated through polynomial multiplication and addition operations. This step is the basic operation for generating lattice cryptographic public keys. In this implementation, its operation logic is adapted to full-bit operation to ensure that no divider is called.

[0056] S13. Full-bit operation public key compression: This is a core improvement step in the key generation stage. The signing end does not publicly disclose the exact public key t, but instead aligns the modulus of the underlying lattice cryptographic modulus space to... Under the premise of this, a single-cycle 11-bit logical right shift instruction (bit offset operator >> 11) is directly called to truncate the lower 11 bits of the precise public key t, retaining only the high-order bits and outputting the pure bitwise compressed public key. In the standard lattice cryptography public key generation process, to separate the high and low bits of the public key ( The traditional algebraic division operation, which relies on high-energy-consuming hardware dividers or modulo operations, is reduced to a pure hardware logic shift operation in this implementation. This completely eliminates the dependency on dividers and completes public key compression in O(1) constant time, which greatly reduces the hardware computing power burden and data flow delay.

[0057] in, Represents the complete public-key polynomial vector at the underlying level; The preset cutoff displacement step size parameter; This represents the high-order polynomial preserved by arithmetic right shift, which is the compressed public key that is actually published and transmitted. This represents the discarded lower-order polynomial residuals. This implementation discards them through physical truncation. This not only compresses the size of the public key but also mixes it in as implicit noise, enhancing its security against lattice reduction attacks.

[0058] S2, Signature Generation Phase

[0059] The inputs for this stage are the message M to be signed and the private key output from the key generation stage. The output is a signed packet containing error message features. This stage integrates core improvements such as asymmetric boundary constant-time sampling, norm safety checks, and full-bit operation hint generation. The specific execution sub-process is as follows:

[0060] The signature package middle: Represents a hash challenge scalar (Challenge), used to bind a message to be signed to an internal commitment; The core response vector representing the signer is derived from the mask vector and the private key. The representative error hint feature matrix (Hint) is used to assist the verifier in detecting missing low-order bits of the public key. In this case, the high-order alignment state is accurately reconstructed. These three elements together constitute a complete data chain for verifying the signature.

[0061] S21. Generating candidate mask vectors through pure bitwise operation sampling based on asymmetric boundary alignment. This step is a necessary technical step to achieve zero-knowledge blinding, used to mask the statistical characteristics of the long-term private key s1 when calculating the intermediate state of the signature, preventing the leakage of the private key through the side channel. The specific sampling process is as follows: First, a seed sequence generated by a cryptographically secure hash function is obtained, and the internal state word is initialized using a cross-byte interleaving concatenation method; then, a random stream expansion is performed using a cascaded structure based on pure shift and XOR gate logic (Xorshift). This pseudo-random number generation process completely excludes multiplication and division instructions, ensuring the absolute constant-time characteristics of the execution path; finally, the generated pseudo-random number state word is used in conjunction with a bitwise truncation mask. Perform a single-cycle bitwise AND operation to truncate positive integers; finally, subtract a constant γ from the truncated result to complete the centering shift towards the target mask space, ultimately generating a uniformly distributed candidate mask vector within the constant time of the unconditional retry branch. This step breaks with the traditional absolutely central symmetric sampling logic, configuring the sampling interval as an asymmetric closed interval. Make the total cardinality of discrete integers within the interval exactly equal to 2. nIt completely eliminates the nondeterministic retry loop of rejection sampling with a while loop in traditional sampling, and achieves absolute constant-time execution;

[0062] S22, Commitment Calculation and Challenge Generation: First, execute the polynomial multiplication and addition high-order commitment. Then, a cryptographically secure hash function is used to treat the signed message M and the high-order commitment. The concatenated result is hashed to generate a challenge scalar. ;

[0063] in, It represents a public multinomial matrix expanded from a cryptographically secure random seed, serving as a shared algebraic lattice reference base. This refers to the candidate mask vector generated in this round; The high-order bit extraction operator is physically implemented by performing a multi-bit logical right shift operation on the input level signal to strip away the low-order data that is susceptible to noise interference, thereby extracting a stable high-order commitment bit string. H represents a hash function;

[0064] S23. Signature Calculation and Norm Security Check: First, determine the candidate signature vector. Subsequently, the system retrieves the security check boundary thresholds derived from the real-time parameter dynamic reconstruction step. Check whether the infinity norm ||z||∞ of the candidate signature vector z satisfies ||z||∞ < The constraint condition is: If ||z||∞≥ If ||z||∞ < 0, then a constant-time state word reset is triggered, and the candidate signature is rejected. Operations S21 to S23 are then re-executed, and the reset process is performed in a constant-time manner, without revealing any private key information; If the candidate signature vector z meets the security requirements, then the subsequent steps will continue.

[0065] S24. Full-bit operation hint generation (MakeHint): This is a core improvement step in the signature generation stage, used to correct the error caused by the low-bit truncation of the public key in S13, providing a basis for lossless reconstruction of errors at the verification end. Specifically, the signing end simulates the verification end's computation path through full-bit operations to restore the compressed public key. The truncated recovery value is then compared with the low-bit difference between the uncrunted exact value of the precise public key t and the truncated recovery value. At the hardware level, only XOR gate arrays and logical shift operations are used to extract the Boolean sparse hint matrix h representing the low-bit error, and this matrix is ​​then packaged into the signature. middle.

[0066] S3, Signature Verification Phase

[0067] The inputs for this stage are the message M to be signed and the signature packet output from the signature generation stage. The compressed public key output during the key generation phase The output is the verification result of "Accept" or "Reject". The core implementation is the lossless reconstruction of the error from full-bit operations, and the signature verification is completed in constant time. The specific execution sub-process is as follows:

[0068] S31. Approximate Vector Calculation: The verification end first receives the compressed public key. The process involves generating a signature packet σ and a message M to be signed, followed by polynomial multiplication and addition, and linear operations to calculate an approximate state vector. ;

[0069] in, This indicates the compressed public key. The dimensional reduction factor. Because the original public key underwent an arithmetic right shift during the previous key generation phase. Physical compression of bits (discarding low-order bits) )get Therefore, during the verification phase, the verifier must send the received compressed public key. Multiply (In the underlying physical implementation of full-bit operations, it is equivalent to...) The level signal is logically shifted to the left. bits, that is and in low (by padding with zeros), so that it is restored to the high-bit alignment state consistent with the original public key in the numerical modulus space, thereby ensuring the alignment and dimensional consistency of the entire polynomial linear operation system.

[0070] S32. Reverse lossless reconstruction of full-bit operation error (UseHint) to restore accurate high-bit commitment. This is the core improvement step in the signature verification stage, completely eliminating the complex operations of polynomial modular division and rounding in the traditional verification process. Specifically, the verification end receives a matrix containing hints... After signing the packet, the approximate vector is first extracted using a bitwise AND operation of the local mask. The low-order overflow flag is used to initially determine the form of the error; subsequently, a pure conditional adder / subtractor, combined with a hint matrix, is used. Based on the indicated information, the drift direction of the error is accurately determined within a constant time; finally, basic addition and subtraction operations are performed according to the error direction to transform the approximate vector with error. Reverse lossless restoration to accurate high-level commitment The entire reconstruction process consists of pure bitwise operations and basic addition and subtraction operations, with an execution cycle of O(1), and does not require calling any hardware divider unit;

[0071] S33. Dual security decision, output verification result: The verification end performs two core security checks. The first is a norm constraint check, which verifies again whether the infinite norm of the candidate signature vector z is satisfied. The first step ensures that the candidate signature vector does not leak out of bounds; the second step is a hash consistency check: verifying the challenge scalar. Is it equal to This ensures that the message and signature have not been tampered with. If both checks pass, the signature is deemed valid and the verification is accepted; if either check fails, the signature is deemed invalid and the message is rejected.

[0072] The constant-time quantum-resistant signature method based on full-bit operations and rank adaptation described in this embodiment implements all operations based on pure bit operations (bitwise AND, bitwise XOR, logical shift) and basic addition and subtraction operations during the execution of the key generation, signature generation, and signature verification process. This completely eliminates the dependence on hardware dividers and floating-point units, significantly reducing the data flow latency and dynamic power consumption of hardware modules. At the same time, through designs such as asymmetric boundary constant-time sampling, constant-time norm checking, and constant-time error reconstruction, the physical execution cycle of the entire process is made independent of the input key and mask data, achieving true O(1) constant-time execution. This completely prevents the risk of private key leakage caused by timing side-channel attacks from the physical signal level. In addition, by abstracting the matrix rank dimension into a global configuration parameter scalar k, the linear derivation and dynamic scaling of multi-level security parameters are realized. The system can adjust the security level according to the actual security requirements of heterogeneous computing networks without re-burning firmware, significantly reducing the adaptation cost for multiple scenarios and solving the problems of computing power redundancy and management difficulties when deploying existing technologies in resource-constrained edge nodes or high-requirement financial gateways.

[0073] Correspondingly, this embodiment also protects a constant-time quantum-resistant signature system based on full-bit operations and rank adaptation. This system serves as the hardware carrier for implementing the aforementioned signature method, integrating a processor and a memory coupled to the processor. The memory stores execution instructions. When these instructions are executed, the system implements the three main functional modules: the adaptive parameter derivation module, the asymmetric boundary constant-time sampling module, and the bit operation compression and reconstruction module. The functions of each module are fully matched with the corresponding steps in the aforementioned method, enabling collaborative completion of real-time parameter dynamic reconstruction, asymmetric boundary pure bit operation sampling, full-bit operation public key compression and error-free reconstruction, and the entire signature process. As asymmetric identity authentication and tamper-proof hardware logic, this system can be integrated into heterogeneous computing power and high-concurrency network environments such as the underlying resource authorization and control system of distributed edge computing nodes and high-frequency concurrent financial security gateway firmware without hardware divider dependency. It effectively defends against the physical analysis of malicious time-series probes while reducing channel bandwidth usage. While maintaining the same order of quantum-resistant security strength as the standard prime number modular scheme, it achieves a balance between high efficiency, flexibility, and security in hardware deployment.

[0074] Furthermore, this embodiment also protects a computer-readable storage medium storing computer instructions, which, when executed by a processor, cause the processor to implement the aforementioned constant-time quantum-resistant signature method based on full-bit arithmetic and rank adaptation. This computer-readable storage medium can be any one or more combinations of storage media such as flash memory, hard disk, solid-state drive, optical disk, read-only memory (ROM), and random access memory (RAM). It can be integrated into the aforementioned security chip or coupled to the processor as an independent storage module, ensuring that the signature method of this embodiment can be executed stably and efficiently on various hardware platforms, achieving the technical effects of constant-time quantum-resistant signatures, no divider dependency, and dynamically scalable security levels.

[0075] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0076] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A constant-time quantum-resistant signature method, characterized in that, Includes the following steps: Real-time parameter dynamic reconstruction: The global parameter scheduling unit receives a global configuration parameter scalar k that represents the security strength of the target. The parameter scalar k is the rank dimension of the lattice cryptographic polynomial matrix. The system derives and configures the challenge polynomial Hamming weight and the upper limit of the number of public key shift truncation error correction prompt features corresponding to the current security level through a preset linear algebra equation based on the value of k. At the same time, it dynamically calculates the security check boundary threshold for the infinite norm of the candidate signature matrix. Pure bit operation sampling based on asymmetric boundary alignment: When generating candidate mask vectors, their uniformly distributed value range is configured as a non-absolutely symmetric closed interval. Make the total cardinality of discrete integers within the interval equal to 2. n n is a positive integer, γ is a constant boundary for matching hardware bits and operation thresholds, and then a status word is generated using a pseudo-random number generator, which is then processed by bit and mask (2 n -1) Perform a single-cycle bitwise AND operation to truncate positive integers, and subtract a constant γ from the truncation result to complete the centering shift, and complete the mask sampling in a constant time. Full-bit operation public key compression and lossless error reconstruction: The underlying lattice cryptographic modulus space is constrained to an integer power of 2. The signing end performs a logical right shift operation on the generated public key matrix to truncate the low-bits to generate a compressed public key, and generates a sparse error indication feature matrix by simulating the verification end path through full-bit operations. After receiving the compressed public key and the error indication feature matrix, the verification end extracts the low-bit error features of the verification vector, determines the error direction through the bitwise AND operation of the local mask, and combines addition and subtraction instructions to reverse the high-bits with errors losslessly in a constant time.

2. The constant-time quantum-resistant signature method according to claim 1, characterized in that, In the real-time parameter dynamic reconstruction step, the derivation equation for the challenging polynomial Hamming weights is as follows: , The weight constant of the basic anti-tampering feature; The derivation equation for the upper limit of the number of public key shift truncation error correction hint features is as follows: , The fault tolerance constant is used; the derivation equation for the security inspection boundary threshold is as follows: , is the upper bound of the absolute value of the private key, and the parameter scalar k is the rank dimension of the lattice cryptographic polynomial matrix.

3. The constant-time quantum-resistant signature method according to claim 2, characterized in that, The basic anti-tampering feature weight constant The value range is 15 to 25, and the fault tolerance constant is... The value range is from 22 to 32.

4. The constant-time quantum-resistant signature method according to claim 1, characterized in that, The modulus of the underlying lattice cryptographic modulus space The step size of the logical right shift operation of the public key matrix is ​​11; the constant boundary γ= The bit and mask are hexadecimal 0xFFFFF.

5. A constant-time quantum-resistant signature method according to claim 1, characterized in that, In the pure bitwise operation sampling step, the process of the pseudo-random number generator generating the state word is as follows: obtain the seed sequence generated by the cryptographically secure hash function, initialize the internal state word using the cross-byte interleaving concatenation method, and perform random stream expansion through a cascaded structure based on pure shift and XOR gate logic. The process of the pseudo-random number generator generating the state word does not include multiplication and division instructions.

6. A constant-time quantum-resistant signature method according to any one of claims 1 to 5, characterized in that, In the full-bit operation public key compression and error lossless reconstruction steps, the signing end generates the error indication feature matrix through bitwise XOR and logical shift operations, and the verification end determines the error drift direction by combining the error indication feature matrix with a pure conditional adder or subtractor.

7. A constant-time quantum-resistant signature method according to any one of claims 1 to 5, characterized in that, The end-to-end data flow process of the method includes three stages: key generation, signature generation, and signature verification. The key generation stage achieves public key compression through a logical right shift operation. The signature generation stage generates candidate mask vectors and generates an error hint feature matrix by sampling pure bit operations with asymmetric boundary alignment. The signature verification stage completes the lossless reconstruction of errors based on the error hint feature matrix and outputs the verification result through norm constraint checks and hash consistency checks.

8. A constant-time quantum-resistant signature system, comprising a processor and a memory coupled to the processor, characterized in that, The memory stores executable instructions to implement the steps of the method according to any one of claims 1-5, wherein when the instructions are executed by the processor, they implement the following functional modules: Adaptive parameter inference module: configured to receive global configuration parameter scalars It uses built-in circuit logic to deduce and output the challenge polynomial Hamming weight corresponding to the current security level. The upper limit of the number of public key shift truncation error correction hint features Simultaneously, dynamically calculate the security check boundary threshold for the infinite norm of the candidate signature matrix. ; And the deduction derived therefrom , and The global constraint parameters are sent to the asymmetric boundary constant-time sampling module and the bit operation compression and reconstruction module; Asymmetric boundary constant-time sampling module: configured to receive constraint parameters from the adaptive parameter derivation module, and, without a floating-point divider unit, utilize a bit truncation extraction unit to combine bits and masks. Extract the positive integers with no branching periods, and map the positive integers to asymmetric closed intervals using a single-period translation unit. The candidate mask vector is generated internally, and then the candidate mask vector and its intermediate state data are sent to the bit operation compression and reconstruction module. Bitwise operation compression and reconstruction module: configured to perform logical shift truncation of the public key matrix in an environment where the lattice cryptographic modulus space is an integer power of 2, and based on the candidate mask vector input by the asymmetric boundary constant-time sampling module, combined with the security check boundary threshold. Perform a constant-time norm constraint check; after the check passes, generate an error indication feature matrix based on bitwise AND comparison, and perform constant-time inverse error reconstruction based on low-bit error features.

9. The constant-time quantum-resistant signature system according to claim 8, characterized in that, The system, as an asymmetric identity authentication and anti-tampering hardware logic, is integrated and deployed in the underlying resource authorization and control system of distributed edge computing nodes, or in the firmware of a high-frequency concurrent financial security gateway without hardware divider dependency.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, cause the processor to implement the constant-time quantum-resistant signature method as described in any one of claims 1 to 5.

Images