Method and system for generating digital signatures
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-02-06
- Publication Date
- 2026-08-07
Smart Images
Figure CN122533753A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to a method for generating digital signatures (DSAs) for messages. Although its applicability is not limited thereto, the method is particularly important for stateless hash-based signatures (SLH-DSAs). This disclosure also relates to an apparatus for performing this method. Background Technology
[0002] A digital signature is a mathematical algorithm that provides each user with a way to sign messages or documents so that third parties can later verify these signatures. Digital signatures are based on the concepts of private and public keys: a user can sign a message using their private key and then transmit the signed message using their public key. The public key is used to verify the authenticity of the private key.
[0003] With the introduction of quantum computers, hash-based signature schemes were also introduced: these signatures rely on the security of hash functions and one-time signature schemes. Summary of the Invention
[0004] The aspects of this disclosure are defined in the appended claims.
[0005] In a first aspect of this disclosure, a computer-implemented method for generating digital signatures is disclosed. The method includes the steps of: calculating a public key via a hash function; and calculating a signature comprising an authentication path, wherein the authentication path is a path traversing at least one node of at least one binary subtree belonging to a supertree having d-level binary subtrees. The supertree includes a bottom layer, a top layer, and at least one intermediate layer between the top and bottom layers. Each binary subtree includes a root node and a plurality of leaf nodes. The method further includes the step of: at the top layer... The leaf nodes of the binary subtree are stored at the first level, and the intermediate level is also used for storage. At one of the intermediate layers, at least one leaf node of a binary subtree is stored, where The method further includes the following steps: extracting the binary subtree index. And infer the extracted binary subtree index. Whether it is associated with at least one binary subtree linked to a leaf node stored in the intermediate layer. The method further includes the steps of: selecting an operation mode between a first operation mode and a second operation mode, and based on the selected operation mode and the extracted binary subtree index. A digital signature is generated by associating it with at least one binary subtree that links to a leaf node stored in a leaf node in an intermediate layer.
[0006] In one or more embodiments of the first aspect of this disclosure, the method may include the steps of: detecting that a first operating mode is selected and the extracted binary subtree index. A binary subtree is associated with a leaf node that is stored in a leaf node in an intermediate layer, and a digital signature is generated in response by using the leaf node stored at the top level and the leaf node stored in an intermediate layer.
[0007] In one or more embodiments of the first aspect of this disclosure, the method may include the steps of: detecting that a second operating mode is selected and the extracted binary subtree index. A digital signature is generated by not associating a binary subtree with a leaf node of a leaf node stored in an intermediate layer, and in response to such detection, performing the following steps: generating a digital signature by updating the leaf node of at least one binary subtree stored in an intermediate layer with the leaf node of the binary subtree associated with the current authentication path in an intermediate layer, using the leaf node stored at the top level and the leaf node of the binary subtree associated with the current authentication path in an intermediate layer.
[0008] In one or more embodiments of the first aspect of this disclosure, the hash function of the method may be a function of at least one random value. In one or more embodiments, the random value is calculated using a pseudo-random function, which has at least the following inputs: the message to be signed, the secret key, and n bytes of randomness.
[0009] In one or more embodiments of the first aspect of this disclosure, the method may include the steps of: detecting that a first operating mode is selected and the extracted binary subtree index. Not associated with a binary subtree containing a leaf node stored in the intermediate layer, or detecting that the second operation mode is selected and the extracted binary subtree index. It is associated with a binary subtree of one of the leaf nodes stored in the intermediate layer; and in response to this detection, the following steps are performed: recalculate the random value and recalculate the hash function.
[0010] In one or more embodiments of the first aspect of this disclosure, the binary subtree is an extended Merkel signature scheme tree.
[0011] In one or more embodiments of the first aspect of this disclosure, the leaf nodes of the binary subtree correspond to one-time signatures.
[0012] In one or more embodiments of the first aspect of this disclosure, at least one binary subtree in a binary subtree at one of the intermediate layers is randomly selected, and leaf nodes are stored for the binary subtree.
[0013] In one or more embodiments of the first aspect of this disclosure, the digital signature is a stateless hash-based digital signature.
[0014] In a second aspect of this disclosure, a system is provided configured to implement the method according to the first aspect of this disclosure. The system includes at least one processor, a storage device including memory instructions, a user interface, and at least one communication bus. The at least one processor is configured to compute a public key via a hash function and to compute a signature including an authentication path, wherein the authentication path is a path traversing at least one node of at least one binary subtree belonging to a supertree having d-level binary subtrees, wherein the supertree includes a top level, a bottom level, and at least one intermediate level between the bottom and top levels, and wherein each binary subtree of the supertree includes at least one root node and a plurality of leaf nodes. The storage device is configured to store leaf nodes of the binary subtrees at the top level of the supertree and is configured to store leaf nodes of at least one binary subtree in the binary subtrees at one of the intermediate levels of the supertree. The storage device further includes memory instructions for: retrieving a binary subtree index and inferring whether the binary subtree index is associated with at least one binary subtree linked to a leaf node of one of the leaf nodes stored at one of the intermediate levels. The user interface is configured to select an operating mode between a first operating mode and a second operating mode. The at least one communication bus is configured to connect the storage device, the user interface, and at least one processor; wherein the at least one processor is further configured to generate a digital signature based on the selected operating mode and the association between a binary subtree index and at least one binary subtree linked to a leaf node of a leaf node stored in an intermediate layer.
[0015] In one embodiment of the second aspect, the selection between a first operating mode and a second operating mode is performed via a user interface.
[0016] In one embodiment of the second aspect, the user interface is further configured to input a message to be signed by the digital signature scheme.
[0017] In a third aspect of this disclosure, a non-transitory computer-readable storage medium is provided, comprising program instructions for calculating a digital signature, wherein execution of the program instructions by one or more processors of a computer causes the one or more processors to perform the steps of the method described according to a first aspect of this disclosure. Attached Figure Description
[0018] Embodiments of this disclosure will be described in more detail with reference to the accompanying drawings, in which:
[0019] Figure 1 A digital signature scheme according to a first embodiment of the present disclosure is shown.
[0020] Figure 2A A simplified depiction of a supertree according to an embodiment of the first aspect of this disclosure is shown.
[0021] Figure 2B A simplified depiction of the authentication path according to an embodiment of the first aspect of this disclosure is shown.
[0022] Figure 3 A simplified flowchart of an embodiment according to a first aspect of this disclosure is shown.
[0023] Figure 4 A simplified system according to the third aspect of this disclosure is shown.
[0024] It should be noted that the accompanying drawings are schematic and not to scale. For clarity and convenience in the drawings, the relative dimensions and scales of the parts have been enlarged or reduced. The same reference numerals are generally used to indicate corresponding or similar features in modified and different embodiments. Detailed Implementation
[0025] Digital signature generation is the process of creating a digital signature on data using a digital signature scheme and a private key. The private key is a cryptographic key uniquely associated with the owner and is private, meaning it is not disclosed. The private key is used with an asymmetric cryptographic algorithm, also known as a public-key algorithm. The private key is used to generate a digital signature, which can be verified using the corresponding public key.
[0026] A public key is a cryptographic key associated with a private key. A public key can be accessible, meaning it is publicly available. The public key is used to verify digital signatures generated using the corresponding private key. The private key and its corresponding public key are commonly referred to as a key pair.
[0027] Stateless hash-based digital signature schemes (SLH-DSA) are a type of digital signature that comprises multiple signature schemes and multi-tree signature schemes. Stateless hash-based signatures rely on hash functions and do not maintain any internal state information between signature generation processes. Multiple signature schemes can be Forest Random Subset (FORS) schemes, while multi-tree signature schemes can be Extended Merkel Signature Schemes (XMSS). Specifically, an SLH-DSA signature can include a FORS signature and d XMSS signature sequences that authenticate the FORS public key. When the XMSS key begins with the public key, the sequence of d XMSS signatures required to authenticate the FORS public key is called a supertree signature. XMSS signatures can be constructed using a hash-based one-time signature scheme (Winternitz one-time signature + (WOTS+)).
[0028] Figure 1A digital signature scheme (100) according to a first aspect of this disclosure is illustrated. The digital signature scheme may be an SLH-DSA scheme. The SLH-DSA scheme may include a set of binary trees schematically represented by triangle 120. This set of binary trees may be signed using the FORS scheme. The SLH-DSA scheme further includes a supertree having d-level binary subtrees represented by triangles 102 and 104. The binary subtrees of the supertree may be XMSS binary trees. Each binary subtree 102 and 104 has a height. The top level (106) of the supertree is defined as And it includes a single binary subtree 102. The bottom layer (110) of the supertree is the lowest level of the supertree and is defined as level 0 and includes There are 104 binary subtrees. The intermediate level (108) of the supertree lies between the bottom and top levels and is defined as... (in Each intermediate layer includes... 104 binary subtrees.
[0029] The bottom layer of each binary subtree includes the leaf nodes of the binary subtree. This is because each binary subtree (102, 104) has a height. Therefore, a binary subtree contains There are leaf nodes. Each leaf node in the binary subtree (102, 104) is a public key, and... Figure 1 The public key is represented by a square. WOTS + Public key. Circles in each binary subtree (102, 104) represent internal nodes of the binary subtree. The top-level node of each binary subtree is identified as the root node. Therefore, each binary subtree can then be represented as a binary hash tree with a WOTS+ scheme at the leaves: the value of each node in each binary subtree is the hash output of its children. The signature then includes the WOTS+ signature and the authentication path from the leaf node to the root node. Figure 2A and Figure 2B The authentication path is discussed in more detail in the text.
[0030] The method for generating a digital signature disclosed herein includes the step of receiving a message M 112 to be signed. Message M includes all data to be signed using a digital signature.
[0031] According to embodiments of this disclosure, the method further includes the following step 116: i) in the layer The location, that is, at the top level, stores the binary subtree. leaf nodes, and ii) in layer At one or more intermediate levels, a randomly selected binary subtree is stored. Each leaf node. The two steps described above may additionally include the action of storing an index tree of a binary subtree, which includes the stored leaf nodes.
[0032] The method disclosed herein also includes calculating random values. (Steps not shown). To calculate random values, a pseudo-random function is chosen. Alternatively, either a random mode or a deterministic mode can be selected. The random mode, during signature generation, [further details about the random mode and deterministic mode are needed]. Byte randomness Sampling is performed to generate random values. (before digital signature) (number of bytes), as shown below:
[0033] Equation 1
[0034] Where SK.PRF is a component of the private key for the digital signature. In another embodiment, the mode of SLH-DSA can be set to deterministic. If the mode is set to deterministic, then PK.SEED ( The public key seed (bytes) is used to generate random values according to the following equation. :
[0035] Equation 2
[0036] In the method disclosed herein, a possible approach using a deterministic variant would be to add a counter to message M.
[0037] Then the hash function 118 is applied to the message. The result obtained by applying a hash function to message M is also called a "message digest" or "hash value". Several instances of hash functions can be applied depending on the set of SLH-DSA parameters used. Examples of hash functions can be SHA2 (Secure Hash Algorithm 2) or SHAKE (Secure Hash Algorithm and Keccak). The message digest of message M can be calculated as follows:
[0038] Equation 3
[0039] Where PK.ROOT is the public key root of the binary subtree at the top level (i.e., level d−1). The FORS key is then selected using the computed message digest. This is done by combining the message digest components... The FORS authentication scheme is divided into k-bit blocks, and leaf nodes in one of the k binary trees (120) that construct the FORS authentication scheme are selected using each of these blocks. The authentication path from the leaf node to the corresponding root, together with the pseudo-randomly generated FORS key, forms the FORS signature SIG. FORSThe authentication path begins with the sibling node of the selected leaf node and reaches the root node of the binary subtree. If the binary subtree has more levels than the top level and level 0, the authentication path may traverse several nodes of the binary subtree. The root node of the binary subtree can be considered the destination of the authentication path, but it is not itself part of the authentication path, which can be inferred from its child nodes. The FORS public key at position 122 is generated by hashing the k cascading root nodes of the FORS binary tree.
[0040] The public key PK.FORS is calculated as follows:
[0041] Equation 4
[0042] The root contains the k root nodes of the FORS binary tree.
[0043] As mentioned earlier, after selecting a FORS key pair, use the FORS key pair to sign parts of the message.
[0044] The FORS public key calculated in this way is then used by including binary subtrees 102 and 104. Supertree authentication at each layer.
[0045] The binary subtree index required to authenticate the FORS public key can be calculated as follows:
[0046] Equation 5
[0047] Then convert the value to an integer according to the following equation:
[0048] Equation 6
[0049] The computed binary subtree is associated with a specific underlying binary subtree. In other words, the binary subtree index identifies a specific underlying binary subtree. The binary subtree index in Equation 6 allows the computation of the authentication path from the leaf node to the root PK.ROOT. During the verification process, the signature is valid if hashing the authentication path provides the same root PK.ROOT. Typically, SLH-DSA signature generation requires performing the following computations in the XMSS multi-tree section: The calculation of the second leaf node requires The hash, where:
[0050] .
[0051] and Typical values are: .
[0052] In the method disclosed herein, there exists a method of storing binary subtrees at the top and intermediate levels. The memory performance tradeoff is derived from the number of leaf nodes. This results in a reduction of computational cost to [missing information].
[0053] The calculation of the second leaf node requires Secondary hash.
[0054] In addition, storage Each leaf node needs 1 byte. Each signature saves 1 byte. This is the second hash operation.
[0055] According to embodiments of this disclosure, the method further includes a step 114 of selecting between a first operating mode and a second operating mode. The first operating mode may be identified as a fast operating mode. The second operating mode may be identified as a refresh mode. The fast operating mode can be used when the signer wants to immediately utilize the leaf nodes stored in memory. The fast operating mode can be used when the signer has sufficient time to update some stored nodes and refresh the stored... A leaf node instead of When performing an SLH-DSA signature generation operation with only leaf nodes, a refresh operation mode can be used. In another embodiment, the refresh operation mode and the fast operation mode can be used alternately, such that, for example, after generating a predetermined number of signatures using the fast mode, the refresh mode is automatically selected. For example, after generating several signatures via the fast operation mode, the refresh operation mode can be selected, and then the leaf nodes can be updated.
[0056] According to embodiments of this disclosure, if a first operating mode (fast operating mode) is selected and the calculated... With links to layers If a binary subtree of a leaf node is associated with a leaf node stored at a certain location, then the method uses a layer... (Top level) and The leaf nodes stored in the (intermediate layer) are used to continue SLH-DSA signature generation. Because the leaf nodes of the binary subtrees have already been stored for the top and intermediate layers, there is no need to recalculate the leaf nodes. This reduces the computational cost of generating SLH-DSA signatures.
[0057] In another embodiment, if the second operation mode (refresh operation mode) is selected and the calculated binary subtree index... Not linked to in the layer The method uses the index associated with the binary subtree of a leaf node stored in the (intermediate layer) leaf node to... Leaf nodes are stored at the top level instead of at the layer level. The leaf nodes stored in the (intermediate layer) are used to continue SLH-DSA signature generation. Conversely, the execution layer... Update the leaf nodes stored at the layer: using layers Replace the leaf node of the binary subtree associated with the current authentication path with the previous one in the layer. The leaf node stored at that location.
[0058] In another embodiment, when a second operation mode (refresh operation mode) is used during signing and the calculated binary subtree... Indexes and links to layers When the binary subtree of a leaf node in the stored leaf nodes is associated; or when the first operation mode (fast operation mode) is used and the calculated binary tree is... Not linked to in the layer When a binary subtree of a leaf node in the upper storage is associated, the message needs to be rehashed to ultimately obtain the SLH-DSA signature. To perform the rehashing calculation, the random value R and the message digest should be recalculated. Every time because When a value does not fall into the expected binary subtree and needs to be rehashed, two hashes are required: one hash for recalculating the random value R, and one hash for recalculating the message digest. .
[0059] Figure 2A An example according to a first embodiment of the present disclosure is shown.
[0060] exist Figure 2A In the example, the supertree has There are several layers. Therefore, the top layer is located at... In this example, there is a location located at... The middle layer at that point. Each binary subtree in this example has a height... And therefore possess There are leaf nodes. Therefore, the steps for storing leaf nodes will include: i) in the layer The location, that is, at the top level, stores the binary subtree. leaf nodes, and ii) in layer At the intermediate level, at least one binary subtree is stored. Leaf nodes. Layers can be randomly selected. The binary subtree at the specified location is used to store the binary tree. There are leaf nodes. The stored leaf nodes are in Figure 2AThe leaf nodes are represented by black rectangles. In this example, the stored leaf nodes belong to the first binary subtree of the intermediate level (counting from the left). Storing leaf nodes may include storing which binary subtree the leaf node is associated with. This can be done by storing the index tree of the corresponding binary subtree. To achieve this.
[0061] Then, either the first operating mode or the second operating mode should be selected. In this example, the first operating mode (fast mode) is selected. The method described above is for... Figure 1 The explanation process continues until the binary subtree index of the authentication path is calculated according to Equation 6. The steps. Figure 2B An example of an authentication path is shown. In this example, black rectangles represent leaf nodes being traversed, and black circles represent nodes being traversed. The authentication path is a cascade of nodes that traverse the binary subtree starting from the leaf node at level 0 until reaching the top level where PK.ROOT is located. The root node is required. Each node and each rectangle belongs to a binary subtree. At intermediate levels, each leaf node of each binary subtree is linked to the root of a specific binary tree at the next level (i.e., the lower level). For d=3, There is only one intermediate layer: at layer d-2, each leaf node of each binary subtree is linked to a specific subtree at layer 0 through a construction method. Each binary subtree at layer 0 has a specific index tree. This can be calculated based on equations 5 and 6 above. For example, refer to... Figure 2A and Figure 2B The binary subtree index can be calculated using equations 5 and 6. This index represents the third binary subtree starting from the left at level 0 (because...). (The numbers start from 0). From this, we can infer that the binary subtree is linked to the intermediate level. The third leaf node in the first binary subtree (starting from the left). This leaf node is one of the leaf nodes stored in the intermediate level during the preparation step (see...). Figure 2A Therefore, we can conclude that the extracted binary subtree index... This is associated with a binary subtree linked to the stored leaf nodes at the intermediate layer. Following the steps described above, the method then uses [the method] at the layer... (Top level) and The leaf nodes stored on the (intermediate layer) are used to continue SLH-DSA signature generation. This has the effect of moving the leaf node computation from... Reduce to .
[0062] As an alternative to the method explained in this disclosure, the complete top-level binary subtree (including leaf nodes and parent nodes) can be stored. As explained in this disclosure, the number of bytes required for this operation is approximately the same as the number of bytes required to store two levels of leaf nodes. The advantage of storing two levels of leaf nodes, as explained in this disclosure, is that it saves more hashes compared to storing the complete top-level subtree.
[0063] Figure 3 A simplified flowchart example 300 according to an embodiment of the present disclosure is shown. In this example, the value of d is set to 3. In the preparation steps (302, 304), an operation mode is selected between a fast operation mode and a refresh operation mode (step 302), and the storage layer... and The leaf node at that location (step 304). In step 306, a random mode is selected and calculation is performed. Byte randomness These bytes are used in step 308 to calculate a random value according to Equation 1. In step 310, the message digest is calculated according to Equation 3. In step 312, the binary subtree index is extracted according to Equation 6. In step 314, it is inferred whether the extracted binary subtree index is linked to the layer... The binary subtree of one of the leaf nodes stored is associated with the subtree. If the fast operation mode was selected in step 302, and the extracted binary subtree index is linked to the subtree in the layer... If a binary subtree of a leaf node is associated with a leaf node stored at a certain location, then it is used in the layer. and The leaf nodes stored in the middle are used to calculate the digital signature (316). If the refresh operation mode is selected in step 302, and the extracted binary subtree index is not linked to the layer If a binary subtree of a leaf node is associated with a leaf node stored at a certain location, then it is used in the layer. The leaf nodes stored at the current location are used to compute the digital signature, while the values of the leaf nodes in the current binary subtree associated with the current authentication path are used to update the values in the layer. The leaf node (318) is stored there. In all other cases, the random value and hash function are recalculated, and the method restarts at step 306.
[0064] according to Figure 3 The proposed scheme reduces computation time and optimizes the efficiency of digital signature generation algorithms. This makes digital signatures available to memory- or performance-constrained devices, such as microcontrollers or secure elements.
[0065] Figure 4A simplified view of a processing system according to a second aspect of this disclosure is shown. The processing system 400 may be a system-on-a-chip (SoC) implemented on a single integrated circuit, or it may be a combination of chips. The processing system 400 includes at least one processor 402 for executing instructions stored in memory instructions 404. Such instructions may include all or part of the instructions required to generate a digital signature according to the method disclosed in this application. The at least one processor 402 may include one or more of any type of processing element, processor core, microprocessor, microcontroller, field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), digital signal processor, etc. The processing system 400 may include one or more processors 402.
[0066] Storage device 406 may include memory instructions 404. The storage device may be used to store leaf nodes according to the methods of this disclosure. Storage device 406 may be one or more of any type of volatile or non-volatile memory. Examples of memory types include non-volatile memory, such as flash memory, one-time programmable (OTP) memory, electrically erasable programmable read-only memory (EEPROM), etc. Volatile memory types include static random access memory (SRAM) and dynamic random access memory (DRAM). If leaf nodes are stored in storage device 406, non-volatile memory should be used.
[0067] User interface 408 allows a user to communicate with processing system 400. The user interface can be connected to one or more devices to enable communication with a user, such as an administrator. For example, user interface 408 can be enabled for coupling to a display, mouse, keyboard, or other input / output device. User interface 408 may also include a network interface having one or more means for enabling communication with other hardware devices external to processing system 400. According to this disclosure, a user can use the user interface to input a message to be digitally signed. According to the method of this disclosure, a user can also use the user interface to select a refresh mode or a fast mode.
[0068] The processing system 400 also includes Figure 4 At least one communication bus, indicated by arrow 410. This communication bus can be a conventional communication bus with multiple conductors for transmitting address, data, and control information.
[0069] At least one processor 402, memory instruction 404, storage device 406, and user interface 408 can be bidirectionally connected to the communication bus 410. This allows information exchange between all components of the processing system 400.
[0070] Other variations and modifications will be apparent to those skilled in the art upon reading this disclosure. Such variations and modifications may involve equivalents and other features known in the field of semiconductor device processing and may be used as substitutes for or supplements to the features described herein.
[0071] Although the appended claims are directed to specific combinations of features, it should be understood that the scope of this specification also includes any novel feature or combination of novel features or any generalization of such novel features, whether expressly or implicitly disclosed herein, regardless of whether such novel feature relates to the same specification as currently claimed in any of the claims and whether such novel feature alleviates any or all of the same technical problem as that alleviated by this specification.
[0072] This disclosure relates to elements or features that are “linked” or “coupled” together. As used herein, unless otherwise expressly stated, “linked” means that one element is directly engaged to (or directly connected to) another element, and not necessarily mechanically. Similarly, unless otherwise expressly stated, “coupled” means that one element is directly or indirectly engaged to (or directly or indirectly connected to) another element electrically or otherwise, and not necessarily mechanically. Therefore, while the schematic diagrams shown depict an exemplary arrangement of elements, additional intervening elements, means, features, or components may be present in embodiments of the depicted subject matter.
[0073] Features described in the context of a single embodiment may also be provided in combination in a single embodiment. Conversely, for the sake of brevity, various features described in the context of a single embodiment may also be provided individually or in any suitable sub-combination. The applicant hereby reminds that new claims may be made for such features and / or combinations of such features during the examination of this application or any other application derived therefrom.
[0074] For completeness, it is also specified that the term "comprising" does not exclude other elements or steps, and the terms "a" or "an" do not exclude multiple, a single processor or other unit may perform the functions of several components recited in the claims, and the reference numerals in the claims should not be construed as limiting the scope of the claims. Furthermore, the word "may" is used in an exercisive sense (i.e., meaning the possibility of...) rather than a mandatory sense (i.e., meaning the necessity). Similarly, the words "include," "including," and "includes" mean including but not limited to. Unless otherwise stated, terms such as "first" and "second" are used to arbitrarily distinguish the elements described by such terms. Therefore, these terms are not necessarily intended to indicate the temporal or other priority of such elements.
Claims
1. A computer-implemented method for generating digital signatures, characterized in that, The method includes the following steps: The public key is calculated using a hash function; Calculate a signature, which includes an authentication path, wherein the authentication path is a path that traverses at least one node of at least one binary subtree belonging to a supertree, the supertree having d-level binary subtrees, wherein the supertree includes a top level, a bottom level and at least one intermediate level between the bottom level and the top level, and wherein each binary subtree of the supertree includes at least one root node and multiple leaf nodes. The leaf nodes of the binary subtree are stored at the top level of the supertree; At least one leaf node of the binary subtree is stored in one of the intermediate layers of the supertree; Extracting the binary subtree index ; Inferring the binary subtree index Whether it is associated with at least one binary subtree that links to a leaf node of a leaf node stored in one of the intermediate layers; Select an operating mode between the first operating mode and the second operating mode; and Based on the selected operation mode and the binary subtree index The digital signature is generated by associating it with at least one binary subtree linked to one of the leaf nodes stored in one of the intermediate layers.
2. The computer-implemented method according to claim 1, characterized in that, The following steps are also included: Detecting that the first operation mode is selected and the binary subtree index Associated with at least one binary subtree linked to a leaf node of one of the leaf nodes stored in one of the intermediate layers, and In response to this detection, the following steps are performed: The digital signature is generated by using the leaf nodes stored at the top layer and the leaf nodes stored at one of the intermediate layers.
3. The computer-implemented method according to claim 1, characterized in that, The following steps are also included: Detecting that the second operation mode is selected and the binary subtree index Not associated with at least one binary subtree linked to a leaf node stored in one of the intermediate layers, and In response to this detection, the following steps are performed: The digital signature is generated by using the leaf nodes stored at the top level and updating the leaf nodes stored at one of the intermediate layers with the leaf nodes of the binary tree associated with the current authentication path at one of the intermediate layers.
4. The computer-implemented method according to any one of the preceding claims, characterized in that, The hash function is a function of at least one random value.
5. The computer-implemented method according to claim 4, characterized in that, The random value is calculated using a pseudo-random function, which has at least the following inputs: the message to be signed, the secret key, and n bytes of randomness.
6. The computer-implemented method according to claim 4 or claim 5, characterized in that, The following steps are also included: Detecting that the first operation mode has been selected and the binary subtree index Not associated with a binary subtree linked to a leaf node stored in one of the intermediate layers, and in response to such detection, the following steps are performed: recalculating the random value and recalculating the hash function.
7. The computer-implemented method according to claim 4 or claim 5, characterized in that, The following steps are also included: The second operation mode has been selected and the extracted binary subtree index has been detected. Associated with a binary subtree that links to a leaf node of a leaf node stored in one of the intermediate layers; In response to this detection, the following steps are performed: recalculate the random value and recalculate the hash function.
8. The computer-implemented method according to any one of the preceding claims, characterized in that, The binary subtree is an extended Merkel signature scheme tree.
9. A processing system, characterized in that, include: At least one processor is configured to compute the public key via a hash function, and Configured to compute a signature that includes an authentication path, wherein the authentication path is a path that traverses at least one node of at least one binary subtree belonging to a supertree having d-level binary subtrees, wherein the supertree includes a top level, a bottom level and at least one intermediate level between the bottom level and the top level, and wherein each binary subtree of the supertree includes at least one root node and multiple leaf nodes. A storage device configured to store the leaf nodes of the binary subtree at the top level of the supertree, and configured to store the leaf nodes of at least one binary subtree in the binary subtree at one of the intermediate layers of the supertree. This storage device includes memory instructions for retrieving a binary subtree index. And inferring the binary subtree index Whether it is associated with at least one binary subtree that links to a leaf node of a leaf node stored in one of the intermediate layers; The user interface is configured to select an operating mode between a first operating mode and a second operating mode. At least one communication bus configured to connect the storage device, the user interface, and the at least one processor; The at least one processor is further configured based on the selected operating mode and the binary subtree index. The digital signature is generated by associating it with at least one binary subtree linked to one of the leaf nodes stored in one of the intermediate layers.
10. A non-transitory computer-readable storage medium, characterized in that, The method includes program instructions for calculating digital signatures, wherein the program instructions are executed by one or more processors of a computer, causing the one or more processors to perform the steps of the method according to claims 1 to 11.