Hybrid signature generation and verification method and system based on post-quantum and national cryptographic algorithm

Abstract

The application discloses a hybrid signature generation and verification method and system based on post-quantum and national secret algorithms, and belongs to the technical field of digital signatures. The generation method comprises the following steps: obtaining a digital certificate, setting one of a national secret signature public key and a post-quantum signature public key in a subject public key information field of the digital certificate, and setting the other in a self-defined non-key extension item; calculating a first hash value of a to-be-signed message according to a national secret hash algorithm; dividing the first hash value into a first subset and a second subset; performing signature operation on one of the first subset and the second subset by using a national secret signature private key to generate a national secret signature value; performing signature operation on the other subset by using a post-quantum signature private key to generate a post-quantum signature value; and encapsulating the national secret signature value and the post-quantum signature value into a composite signature object and outputting. The application is suitable for a single entity autonomous signature scene, does not need to depend on a client-server collaborative architecture, and has a wider application range.

Description

Technical Field

[0001] This invention relates to the field of digital signature technology, and in particular to a hybrid signature generation and verification method and system based on post-quantum and national cryptographic algorithms. Background Technology

[0002] With the rapid development of quantum computing technology, traditional public-key cryptosystems based on large integer factorization and the discrete logarithm problem (such as RSA and ECC) face the risk of being completely cracked by quantum attacks such as Shor's algorithm. To address this challenge, the National Institute of Standards and Technology (NIST) in the United States has initiated post-quantum cryptography (PQC) standardization work and has successively released algorithm standards such as ML-DSA (Lattice-based Digital Signature). Meanwhile, my country is vigorously promoting commercial cryptography (national cryptography) standards, among which the SM2 elliptic curve public-key cryptography algorithm and the SM3 cryptographic hash algorithm have been widely applied in e-government, financial payments, and critical information infrastructure.

[0003] In the practice of transitioning from traditional cryptography to post-quantum cryptography, the industry has mainly developed the following two hybrid deployment schemes:

[0004] The first approach is the independent dual-certificate mode. This mode applies for two separate digital certificates for the SM2 and ML-DSA algorithms, and the application layer calls each certificate for signature generation and verification according to business needs. However, this approach leads to complex certificate management (requiring the maintenance of two sets of certificate generation cycles), significantly increased storage overhead (doubling the number of certificates), and the need to transmit certificates and signature results multiple times during the interaction process, resulting in protocol redundancy and decreased efficiency.

[0005] The second method is the collaborative signature mode. This mode splits the signature private key, with the client and server each holding a component of the national cryptographic private key and the other holding a component of the PQC private key. Each party generates a partial signature, which is then merged into a complete signature. This scheme heavily relies on a specific network communication architecture, requiring the client and server to collaborate online to complete the signature. It is not suitable for typical application scenarios such as smart cards and hardware security modules (HSMs) that require offline or single-entity devices to autonomously complete complete signatures.

[0006] In addition to the aforementioned individual shortcomings, existing hybrid solutions also suffer from the following fundamental deficiencies:

[0007] 1. Fragmented identity credentials. Existing solutions fail to achieve organic binding between the national cryptographic public key and the PQC public key within a single X.509 certificate, resulting in the identity credentials of the same entity being scattered across multiple certificates, thus undermining the semantic integrity of the certificate as a unified identity carrier.

[0008] 2. Fragmented signing process. Existing solutions lack a mechanism for segmented parallel signing of the same original data. The signature generation process often depends on different cryptographic modules in sequence, making it difficult to guarantee the consistency of data integrity verification. Furthermore, if part of the signature fails, the overall process rollback becomes complex.

[0009] 3. Dispersed verification logic. The signature verification logic of existing solutions is usually completed by the application layer calling different verification interfaces separately. It lacks an atomic verification mechanism, that is, it is necessary for both algorithm signatures to be valid in order to determine that the overall signature is valid. Dispersed verification is prone to internal logic vulnerabilities or can be bypassed.

[0010] 4. Standard Compatibility. Existing solutions do not fully utilize the extensions reserved in the X.509 certificate standard to achieve secure embedding of PQC public keys, making it difficult to parse and be compatible with hybrid certificates in existing PKI infrastructures, increasing the difficulty and cost of system upgrades and modifications.

[0011] Therefore, how to design a hybrid digital signature scheme that can simultaneously bind the national cryptographic public key and the PQC public key within a single X.509 certificate, support parallel atomic signing and verification of the same data, and be compatible with existing certificate processing procedures is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0012] The purpose of this invention is to provide a hybrid signature generation and verification method and system based on post-quantum and national cryptographic algorithms, so as to solve the problems of fragmented identity credentials, fragmented signature process, scattered verification logic and poor standard compatibility in existing hybrid signature schemes.

[0013] To achieve the above objectives, this application adopts the following technical solution:

[0014] On the one hand, embodiments of this application provide a hybrid signature generation method based on post-quantum and national cryptographic algorithms, applied to the signing end. The method includes the following steps:

[0015] Obtain a digital certificate, wherein the public key information field of the digital certificate is set with either a national cryptographic signature public key or a post-quantum signature public key, and the other is set in the custom non-critical extension item;

[0016] Obtain the message to be signed, and calculate the first hash value of the message to be signed according to the national cryptographic hash algorithm;

[0017] The first hash value is divided into a first subset and a second subset according to a preset grouping rule;

[0018] Using the private key corresponding to the public key for national cryptographic signature, a signature operation is performed on one subset of the first subset and the second subset to generate a national cryptographic signature value; using the private key corresponding to the public key for post-quantum signature, a signature operation is performed on the other subset to generate a post-quantum signature value;

[0019] The national cryptographic signature value and the post-quantum signature value are encapsulated into a composite signature object and output.

[0020] Secondly, embodiments of this application also provide a hybrid signature verification method based on post-quantum and national cryptographic algorithms, applied at the verification end, the method comprising the following steps:

[0021] Obtain the digital certificate to be verified and the composite signature object to be verified. In the public key information field of the digital certificate to be verified, set one of the national cryptographic signature public key and the post-quantum signature public key, and set the other in the custom non-critical extension item.

[0022] Extract the national cryptographic signature public key and the post-quantum signature public key from the digital certificate to be verified, and parse the national cryptographic signature value and the post-quantum signature value from the composite signature object to be verified;

[0023] Obtain the message to be verified, and calculate the second hash value of the message to be verified according to the national cryptographic hash algorithm;

[0024] The second hash value is divided into a third subset and a fourth subset according to the same preset grouping rules as the signature end;

[0025] The extracted national cryptographic signature public key is used to verify the validity of the national cryptographic signature value for one subset of the third subset and the fourth subset, and the extracted post-quantum signature public key is used to verify the validity of the post-quantum signature value for the other subset;

[0026] The overall signature is deemed valid only if both the national cryptographic signature value and the post-quantum signature value are verified as valid.

[0027] Thirdly, embodiments of this application also provide a hybrid signature generation system based on post-quantum and national cryptographic algorithms, including:

[0028] The certificate acquisition module is used to acquire digital certificates. The public key information field of the digital certificate is set with either a national cryptographic signature public key or a post-quantum signature public key, and the other is set in the custom non-critical extension item.

[0029] The message processing module is used to obtain the message to be signed and calculate the first hash value of the message to be signed according to the national cryptographic hash algorithm.

[0030] The segmentation module is used to divide the first hash value into a first subset and a second subset according to a preset grouping rule;

[0031] The signature module is used to perform a signature operation on one subset of the first subset and the second subset using the national cryptographic signature private key corresponding to the national cryptographic signature public key, to generate a national cryptographic signature value; and to perform a signature operation on the other subset using the post-quantum signature private key corresponding to the post-quantum signature public key, to generate a post-quantum signature value.

[0032] The encapsulation module is used to encapsulate the national cryptographic signature value and the post-quantum signature value into a composite signature object and output it.

[0033] Fourthly, embodiments of this application also provide a hybrid signature verification system based on post-quantum and national cryptographic algorithms, including:

[0034] The input acquisition module is used to acquire the digital certificate to be verified and the composite signature object to be verified. The public key information field of the digital certificate to be verified is set with either the national cryptographic signature public key or the post-quantum signature public key, and the other is set in the custom non-critical extension item.

[0035] The parsing module is used to extract the national cryptographic signature public key and the post-quantum signature public key from the digital certificate to be verified, and to parse the national cryptographic signature value and the post-quantum signature value from the composite signature object to be verified.

[0036] The message processing module is used to obtain the message to be verified and calculate the second hash value of the message to be verified according to the national cryptographic hash algorithm.

[0037] The segmentation module is used to divide the second hash value into a third subset and a fourth subset according to the same preset grouping rules as the signature end;

[0038] The verification module is used to verify the validity of the national cryptographic signature value for one subset of the third subset and the fourth subset using the extracted national cryptographic signature public key, and to verify the validity of the post-quantum signature value for another subset using the extracted post-quantum signature public key;

[0039] The determination module is used to determine the overall signature is valid only when both the national cryptographic signature value and the post-quantum signature value are verified to be valid.

[0040] This application has the following beneficial effects:

[0041] This application proposes for the first time the technical concept of "segmented parallel signature," which divides the message hash value into two subsets based on bit parity. These subsets are signed in parallel by a national cryptographic private key and a post-quantum private key, respectively. This overcomes the traditional limitation held by those skilled in the art that dual algorithms can only be used sequentially or collaboratively. By requiring both signatures to be valid before determining the overall signature validity, the security vulnerability of "partial validity" is completely resolved, ensuring the atomicity of the certificate and signature. The fusion of the national cryptographic public key and the post-quantum public key is implemented within a single X.509 certificate, balancing security and compatibility. It meets national cryptographic compliance requirements while preparing for future quantum attacks. Furthermore, it is applicable to single-entity self-signing scenarios (such as smart cards, HSMs, and TEEs), without relying on a client-server collaborative architecture, thus broadening its applicability.

[0042] In terms of certificate management, this application adopts a single-certificate integration approach, requiring only the management of a single certificate, reducing CA operation and maintenance costs by 50%. The relying party (verifier) ​​does not need to maintain two trust chains for the same entity, simplifying certificate path construction logic and improving verification efficiency. In large-scale PKI systems (such as scenarios with millions of users), certificate store storage capacity is reduced by half, significantly reducing the burden of LDAP / OCSP queries. Furthermore, the handshake phase of security protocols such as TLS / IPSec does not require the transmission of two certificates, reducing network bandwidth consumption and handshake latency; there is no need to implement dual-certificate selection logic at the application layer, avoiding connection failures due to certificate mismatches; for storage-constrained scenarios such as mobile terminals and smart cards, saving storage space is particularly critical.

[0043] Regarding downgrade compatibility and smooth migration, the post-quantum public key extension in the certificate is marked as non-critical. Existing traditional systems that only support Chinese cryptographic algorithms require no modification and can automatically ignore this extension, functioning normally only by verifying SM2 signatures, achieving zero-cost downgrade compatibility. The same certificate can be reused between old and new systems, eliminating the need to issue separate certificates for systems with different capabilities, thus avoiding duplicate issuance and management fragmentation. Upgraded systems can enforce dual-signature atomic verification, achieving enhanced quantum security and ensuring uninterrupted business continuity. This design allows the transition from Chinese cryptographic algorithms to post-quantum algorithms to be carried out on demand and in stages, reducing migration risks and costs. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1This is a flowchart of a hybrid signature generation method based on post-quantum and national cryptographic algorithms provided in Embodiment 1 of this application;

[0046] Figure 2 This is a flowchart of a hybrid signature verification method based on post-quantum and national cryptographic algorithms provided in Embodiment 2 of this application;

[0047] Figure 3 This is a schematic diagram of the structure of a hybrid signature generation system based on post-quantum and national cryptographic algorithms provided in Embodiment 3 of this application;

[0048] Figure 4 This is a schematic diagram of the structure of a hybrid signature verification system based on post-quantum and national cryptographic algorithms provided in Embodiment 4 of this application. Detailed Implementation

[0049] To make the technical solution of this application clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The terms "first," "second," etc., in the claims and specification of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate. This is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of units is not necessarily limited to those units, but may include other units not explicitly listed or inherent to these processes, methods, products, or apparatuses.

[0050] Example 1

[0051] like Figure 1 As shown, this embodiment provides a hybrid signature generation method based on post-quantum and national cryptographic algorithms, applied to the signing end. The method includes the following steps:

[0052] S110. Obtain a digital certificate. In the main public key information field of the digital certificate, set one of the national cryptographic signature public key and the post-quantum signature public key, and set the other in the custom non-critical extension item.

[0053] The signing end first obtains a digital certificate. This digital certificate conforms to the X.509 standard, and its SubjectPublicKeyInfo field contains either a national cryptographic signature public key or a post-quantum signature public key. The digital certificate also contains a custom extension, which is marked as a non-critical extension.

[0054] In one specific implementation, this embodiment sets the national cryptographic signature public key (such as the SM2 public key) in the main public key information field and the post-quantum signature public key (such as the ML-DSA public key) in the custom extension field. Of course, in other implementations, the post-quantum signature public key can also be set in the main public key information field, while the national cryptographic signature public key can be set in the custom extension field; both methods are within the protection scope of this application.

[0055] Specifically, when registering with a Certificate Authority (CA), a user submits both a Chinese cryptographic signature public key (such as an SM2 public key) and a post-quantum signature public key (such as an ML-DSA public key). The CA constructs an X.509 digital certificate based on these two public keys: the Chinese cryptographic signature public key is placed in the certificate's main public key information field, and the post-quantum signature public key is encoded using ASN.1 and written into a custom extension item. The "critical" flag of this extension item is set to "non-critical." The meaning of a non-critical extension is that even if the verification end cannot parse or process this extension item, it does not affect the basic validity of the certificate, thus ensuring backward compatibility with traditional systems that only support Chinese cryptographic algorithms. Furthermore, if support for other PQC algorithms (such as FALCON and SPHINCS+) is required later, only a new extension item OID needs to be defined, without affecting the existing structure.

[0056] In this embodiment, the custom non-critical extension uses object identifier (OID) 1.3.6.1.4.1.666.1, and the extension content is an ASN.1 encoded post-quantum signature public key. In other words, the post-quantum signature public key, in ASN.1 encoded form, is embedded in the digital certificate by the custom extension and marked as a non-critical extension to ensure proper use in older systems that do not support this extension.

[0057] After the certificate is constructed, the CA uses its own SM2 private key to digitally sign the digital certificate to ensure its authenticity and integrity. This signing operation conforms to the Chinese national cryptographic certificate specifications, thus ensuring that the certificate can be parsed and verified in a nationally compliant environment.

[0058] By binding two different types of signature public keys (national cryptographic signature public key and post-quantum signature public key) to the same digital certificate, the problem of identity credential fragmentation caused by the existing dual certificate mode is solved. At the same time, non-critical extension features are used to take into account system compatibility, and the trustworthiness of the certificate is guaranteed by CA signature.

[0059] S120. Obtain the message to be signed and calculate the first hash value of the message to be signed according to the national cryptographic hash algorithm;

[0060] The signing terminal obtains the message M to be signed, which is binary data of arbitrary length. Then, it calls the pre-configured national cryptographic hash algorithm to perform a hash operation on the message M, generating a fixed-length hash value, which is denoted as the first hash value.

[0061] In this embodiment, the national cryptographic hash algorithm uses the SM3 cryptographic hash algorithm. The input of the SM3 algorithm is a message of arbitrary length, and the output is a 256-bit (32-byte) hash value. Specifically, the signing terminal inputs the message M to be signed into the SM3 algorithm to calculate H1 = SM3(M), where H1 is 32 bytes in length.

[0062] It should be noted that this invention is not limited to the SM3 algorithm; any hash algorithm conforming to the national cryptographic standard can be applied. By mapping the original message to a fixed-length hash value, the influence of message length on subsequent signature operations can be eliminated, and the uniqueness of the message mapping can be guaranteed, laying the foundation for subsequent parallel block signatures.

[0063] S130. Divide the first hash value into a first subset and a second subset according to a preset grouping rule;

[0064] In order to use two different signature algorithms for subsequent signing, the first hash value H1 needs to be divided into two equal-length subsets. This embodiment adopts a preset grouping rule based on the parity of bit index.

[0065] Furthermore, the preset grouping rule is as follows: the 256 bits of the first hash value are divided according to the parity of the bit index. Bits with odd indexes form the first subset, and bits with even indexes form the second subset, with each subset consisting of 128 bits.

[0066] For example, the 256 bits of the first hash value H1 are numbered from 0 to 255 according to their bit indices, where index 0 corresponds to the most significant bit (i.e., the 1st bit) and index 255 corresponds to the least significant bit (i.e., the 256th bit). Then, bits with odd indices (index values ​​1, 3, 5, ..., 255) are extracted to form a first subset A, and bits with all even indices (index values ​​0, 2, 4, 6, ..., 254) are extracted to form a second subset B. Each subset A and subset B contains 128 bits.

[0067] Let the bit sequence of the first hash value H1 be represented as H1 = b0b1b2...b 255 Where b0 is the most significant bit (index 0), b 255 If the least significant bit (bit 256) is used, then:

[0068] The first subset A = b1b3b5... b 255 (Total 128 bits, consisting of odd-indexed bits);

[0069] The second subset B = b0b2b4... b 254 (Total 128 bits, consisting of even-numbered index bits).

[0070] It should be noted that the terms "odd index" and "even index" in this embodiment are clear and unambiguous mathematical definitions. The signing and verification ends must use the same index numbering rules and parity partitioning rules to ensure correct reconstruction during verification. Other grouping rules that can evenly divide the hash value into two subsets (e.g., partitioning by front and back halves) are also applicable to this application, as long as the signing and verification ends agree on them in advance.

[0071] S140. Use the private key corresponding to the public key for the national cryptographic signature to perform a signature operation on one subset of the first subset and the second subset to generate a national cryptographic signature value; use the private key corresponding to the public key for the post-quantum signature to perform a signature operation on the other subset to generate a post-quantum signature value.

[0072] The signing end obtains the national cryptographic signature private key corresponding to the national cryptographic signature public key and the post-quantum signature private key corresponding to the post-quantum signature public key from secure storage (such as a hardware security module HSM or a trusted execution environment TEE).

[0073] According to a preset signature correspondence rule, the signing end determines which subset (first subset A) and second subset (second subset B) the Chinese cryptographic signature private key should sign, and then uses the post-quantum signature private key to sign the other subset. In this embodiment, the preset rule is that the Chinese cryptographic signature private key is used to sign the first subset, and the post-quantum signature private key is used to sign the second subset. It should be noted that in other embodiments, the opposite correspondence can also be used, that is, the Chinese cryptographic signature private key is used to sign the second subset B, and the post-quantum signature private key is used to sign the first subset A, as long as the signing end and the verification end agree on the same rule.

[0074] Specifically, the signing end calls a Chinese cryptographic signature algorithm engine (such as the SM2 algorithm) to perform a signature operation on the first subset A using the Chinese cryptographic signature private key, generating the Chinese cryptographic signature value Sig_SM2. Simultaneously, the signing end calls a post-quantum signature algorithm engine to perform a signature operation on the second subset B using the post-quantum signature private key, generating the post-quantum signature value Sig_PQC. To improve signing efficiency, these two signature operations are executed in parallel.

[0075] In this embodiment, two subsets of the first hash value of the original message are signed by two different types of signing private keys, realizing dual-track parallel signing of the same data, which lays the foundation for subsequent atomicity verification.

[0076] S150. Encapsulate the national cryptographic signature value and the post-quantum signature value into a composite signature object and output it.

[0077] After obtaining the national cryptographic signature value Sig_SM2 and the post-quantum signature value Sig_PQC, the signing end encapsulates the two into a composite signature object according to the preset encoding rules, which serves as the final output of the entire signature generation method.

[0078] In this embodiment, the composite signature object adopts the ASN.1 DER encoding format. Specifically, the data structure of the composite signature object is defined as follows:

[0079] HybridSignature ::= SEQUENCE {

[0080] version INTEGER DEFAULT 0, -- Version number, for future expansion.

[0081] sm2Signature OCTET STRING, --SM2 signature value, DER-encoded SM2Signature

[0082] mlDsaSignature OCTET STRING --ML-DSA signature value, DER encoded or raw bytes

[0083] }

[0084] The version field represents the version number of the composite signature object, with an initial value of 0, which is used for possible future format upgrades; the sm2Signature field is used to store the national cryptographic signature value (in this embodiment, the DER encoding of the SM2 signature value); the mlDsaSignature field is used to store the post-quantum signature value (in this embodiment, the DER encoding of the ML-DSA signature result or the original bytes).

[0085] The signing terminal encapsulates the two signature values ​​according to the ASN.1 DER encoding rules to obtain a composite signature object in binary form, and outputs it to the caller (e.g., the application layer or the verification terminal). The output composite signature object is transmitted or stored together with the original message to be signed and the digital certificate for subsequent verification.

[0086] By encapsulating the signature values ​​of two different algorithms into a unified composite object, this embodiment achieves atomic optimization management of signature results, avoiding the redundancy and fragmentation problems of needing to transmit two independent signature values ​​separately in traditional schemes.

[0087] Furthermore, in this embodiment, the Chinese cryptographic signature private key and the post-quantum signature private key are generated by the same cryptographic entity and stored in a Hardware Secure Module (HSM) or a Trusted Execution Environment (TEE). The advantages of this design are twofold: firstly, generating two key pairs by the same entity ensures the inherent correlation between the keys, facilitating unified management; secondly, storing the private key in the Hardware Secure Module (HSM) or Trusted Execution Environment (TEE) effectively prevents private key leakage, thus enhancing the security of the entire signature scheme.

[0088] Furthermore, in this embodiment, lifecycle management operations such as digital certificate revocation and renewal are all managed uniformly through the standard Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) interface. This allows the solution to seamlessly integrate with existing Public Key Infrastructure (PKI) systems, reducing the complexity of system upgrades and maintenance.

[0089] The hybrid signature generation method based on post-quantum and Chinese national cryptographic algorithms provided in this embodiment integrates Chinese national cryptographic and post-quantum public keys into a single X.509 certificate, realizing a "one certificate, two keys" single certificate management architecture. Compared with the traditional dual-certificate mode, this significantly reduces the overhead of certificate issuance, storage, updating, and transmission, simplifying KPI maintenance. Simultaneously, by parity-even segmentation of the message hash value and parallel signing using both the Chinese national cryptographic private key and the post-quantum private key, a dual-algorithm segmented signature mechanism is achieved. Since the Chinese national cryptographic algorithm is based on the elliptic curve discrete logarithm problem, and the post-quantum algorithm is based on the lattice problem, the two mathematical foundations are independent. Even if a quantum computer cracks one algorithm in the future, the other algorithm can still provide effective protection, thus achieving defense-in-depth and significantly improving the long-term security of the signature scheme. The organic combination of these two points allows this solution to smoothly introduce post-quantum capabilities while ensuring compliance with Chinese national cryptographic standards, balancing current usability and future security.

[0090] It should be understood that the hybrid signature scheme proposed in this application is not limited to the combination of Chinese cryptographic algorithms and post-quantum cryptographic algorithms, but is equally applicable to any two different types of signature algorithms (such as RSA and ECC, traditional algorithms and post-quantum algorithms, etc.).

[0091] Example 2

[0092] like Figure 2 As shown, this embodiment provides a hybrid signature verification method based on post-quantum and national cryptographic algorithms, applied at the verification end, to verify the composite signature generated according to the method described in Embodiment 1. The method includes the following steps:

[0093] S210. Obtain the digital certificate to be verified and the composite signature object to be verified. In the public key information field of the digital certificate to be verified, set one of the national cryptographic signature public key and the post-quantum signature public key, and set the other in the custom non-critical extension item.

[0094] The verification end first obtains the digital certificate to be verified and the composite signature object to be verified. The digital certificate to be verified conforms to the X.509 standard, and its SubjectPublicKeyInfo field contains either a Chinese national cryptographic signature public key or a post-quantum signature public key, and the other is set in the custom extension field of the digital certificate. This custom extension field is marked as a non-critical extension, meaning that even if the verification end cannot parse this extension field, it will not reject the certificate, thus ensuring backward compatibility.

[0095] S220. Extract the national cryptographic signature public key and the post-quantum signature public key from the digital certificate to be verified, and parse the national cryptographic signature value and the post-quantum signature value from the composite signature object to be verified.

[0096] Specifically, the verification end parses the TBSCertificate structure of the digital certificate to be verified, reads the subjectPublicKey bit string from the SubjectPublicKeyInfo field, and directly uses it as the first type of public key (e.g., SM2 public key). Then, it iterates through the certificate's extensions, searching for the custom extension with the object identifier (OID) 1.3.6.1.4.1.666.1. If found, it extracts the extnValue octet and decodes it according to the ASN.1 encoding rules to obtain the second type of public key (e.g., ML-DSA public key). In this way, the verification end obtains the national cryptographic signature public key and the post-quantum signature public key.

[0097] Simultaneously, the verification end parses the composite signature object to be verified: this composite signature object uses ASN.1 DER encoding, and its structure is defined as SEQUENCE type, containing three fields: version (INTEGER), sm2Signature (OCTET STRING), and mlDsaSignature (OCTET STRING). The verification end decodes the entire composite signature object according to DER rules, reads the octet of the sm2Signature field as the national cryptographic signature value, and reads the octet of the mlDsaSignature field as the post-quantum signature value.

[0098] S230. Obtain the message to be verified and calculate the second hash value of the message to be verified according to the national cryptographic hash algorithm;

[0099] The verification end first obtains the message to be verified, which is the same message data corresponding to the original message to be signed by the signing end (usually provided by the signing end along with the digital certificate and composite signature object). Then, it performs a hash operation on this message using the same national cryptographic hash algorithm (such as the SM3 algorithm) as the signing end, calculating a fixed-length hash value, denoted as the second hash value H2. In this embodiment, the length of the second hash value is also 256 bits (32 bytes), consistent with the length of the first hash value from the signing end. This step ensures that the verification end and the signing end perform subsequent segmentation and verification based on the same message hash value, thereby accurately determining whether the message has been tampered with during transmission.

[0100] S240. Divide the second hash value into a third subset and a fourth subset according to the same preset grouping rules as the signature end;

[0101] To correspond with the signing process at the signing end, the verification end uses the same preset grouping rule as the signing end to divide H2. In this embodiment, the grouping rule is based on the parity of bit indices: the 256 bits of H2 are numbered from 0 to 255 (index 0 corresponds to the most significant bit, and index 255 corresponds to the least significant bit). Then, bits with all odd indices (index values ​​1, 3, 5, ..., 255) are extracted to form a third subset C, and bits with all even indices (index values ​​0, 2, 4, ..., 254) are extracted to form a fourth subset D. Each of the third subset C and the fourth subset D contains 128 bits.

[0102] Let the bit sequence of the second hash value H2 be represented as H2 = q0q1q2...q 255 Where q0 is the most significant bit (index 0), q 255 If the least significant bit (bit 256) is used, then:

[0103] The third subset C = q1q3q5... q 255 (Total 128 bits, consisting of odd-indexed bits);

[0104] The fourth subset D = q0q2q4... q 254 (Total 128 bits, consisting of even-numbered index bits).

[0105] It should be noted that the indexing and parity rules used by the verification end must be completely consistent with those used by the signature end to ensure that the third and fourth subsets obtained from the segmentation correspond mathematically to the first and second subsets of the signature end, respectively. If the message to be verified has not been tampered with, then C=A (first subset) and D=B (second subset) should be true, thus providing a correct comparison benchmark for subsequent signature verification.

[0106] S250. Use the extracted national cryptographic signature public key to verify the validity of the national cryptographic signature value for one subset of the third subset and the fourth subset, and use the extracted post-quantum signature public key to verify the validity of the post-quantum signature value for the other subset.

[0107] In this embodiment, the verification end adopts a corresponding relationship with the preset rules of the signing end, that is, the national cryptographic signature public key is used to verify the validity of the national cryptographic signature value for the third subset C, and the post-quantum signature public key is used to verify the validity of the post-quantum signature value for the fourth subset D.

[0108] Specifically, the verification end calls a national cryptographic signature verification algorithm (such as the SM2 verification algorithm), inputting the extracted national cryptographic signature public key, the national cryptographic signature value Sig_SM2, and a third subset C, to verify whether Sig_SM2 is a valid signature for C. If the verification passes, it means that the national cryptographic signature value matches the subset; otherwise, the signature value is invalid.

[0109] Simultaneously, the verification end calls a post-quantum signature verification algorithm (such as the ML-DSA verification algorithm), inputting the extracted post-quantum signature public key, the post-quantum signature value Sig_PQC, and the fourth subset D, to verify whether Sig_PQC is a valid signature for D.

[0110] It should be noted that the correspondence used in this embodiment is that the national cryptographic signature value corresponds to the third subset, and the post-quantum signature value corresponds to the fourth subset. In other implementations agreed upon by the signing and verification ends, the correspondence of the national cryptographic signature value corresponding to the fourth subset and the post-quantum signature value corresponding to the third subset can also be used. In this case, the verification end only needs to adjust the subset correspondence during verification. Regardless of which correspondence is used, as long as the signing and verification ends remain consistent, correct verification can be achieved.

[0111] Through this verification step, the verifier can independently determine whether the two signature values ​​match their respective subsets, thus providing a basis for the final determination of the overall signature validity.

[0112] S260. The overall signature is deemed valid only if both the national cryptographic signature value and the post-quantum signature value are verified as valid.

[0113] After the verification end performs dual signature verification, it makes a final judgment based on the verification results: the overall signature is considered valid only if both the national cryptographic signature value and the subsequent quantum signature value are verified successfully; if either signature value fails to be verified, the overall signature is deemed invalid and a verification failure message is returned.

[0114] In one specific implementation, the method further includes a degradation compatibility step:

[0115] If the verification end does not support parsing custom extensions, the post-quantum signature public key and post-quantum signature value are ignored. Only the national cryptographic signature public key is used to verify the validity of the national cryptographic signature value for the third subset. If the verification passes, the signature is deemed valid.

[0116] For traditional verification systems that only support Chinese national cryptographic algorithms (i.e., systems that cannot parse the ML-DSA custom extension in the certificate), this embodiment provides a downgraded compatibility mode. In this mode, when the traditional verification terminal obtains the certificate in step S210, the custom extension is marked as non-critical, so the system ignores the extension and only recognizes the Chinese national cryptographic signature public key in the subject public key information field. Accordingly, in step S250, the traditional verification terminal only uses the Chinese national cryptographic signature public key to verify the validity of the Chinese national cryptographic signature value for a subset (such as the third subset C), without verifying the post-quantum signature value. If the Chinese national cryptographic signature verification passes, the traditional system in downgraded mode can determine that the signature is valid.

[0117] The verification end only determines the overall signature to be valid when both the national cryptographic signature value and the post-quantum signature value are verified to be valid, thus achieving atomic verification and eliminating the security vulnerability of "partial validity". At the same time, for traditional verification systems that only support national cryptographic algorithms, since the post-quantum public key extension item in the certificate is marked as non-critical, such systems can ignore the extension item and only verify the national cryptographic signature value to pass (downgrade mode). Therefore, the certificate issued in Example 1 can continue to be used without any modification, realizing a smooth transition between old and new systems and cross-generational reuse of the same certificate. This not only ensures the quantum security enhancement of the upgraded system, but also guarantees the business continuity of the un-upgraded system, providing a feasible path for the gradual deployment of post-quantum cryptography technology.

[0118] Example 3

[0119] like Figure 3 As shown, this embodiment provides a hybrid signature generation system based on post-quantum and national cryptographic algorithms, including:

[0120] The certificate acquisition module 110 is used to acquire a digital certificate. The public key information field of the digital certificate is set with either the national cryptographic signature public key or the post-quantum signature public key, and the other is set in the custom non-critical extension field.

[0121] The message processing module 120 is used to obtain the message to be signed and calculate the first hash value of the message to be signed according to the national cryptographic hash algorithm.

[0122] The segmentation module 130 is used to divide the first hash value into a first subset and a second subset according to a preset grouping rule;

[0123] The signature module 140 is used to perform a signature operation on one subset of the first subset and the second subset using the national cryptographic signature private key corresponding to the national cryptographic signature public key, and generate a national cryptographic signature value; and to perform a signature operation on the other subset using the post-quantum signature private key corresponding to the post-quantum signature public key, and generate a post-quantum signature value.

[0124] Encapsulation module 150 is used to encapsulate the national cryptographic signature value and the post-quantum signature value into a composite signature object and output it.

[0125] This embodiment is used to implement the method provided in Embodiment 1 above, and has the corresponding beneficial effects of the method. Technical details not described in detail in this embodiment can be found in the method provided in Embodiment 1 above.

[0126] Example 4

[0127] like Figure 4 As shown, this embodiment provides a hybrid signature verification system based on post-quantum and national cryptographic algorithms, including:

[0128] The input acquisition module 210 is used to acquire the digital certificate to be verified and the composite signature object to be verified. The public key information field of the digital certificate to be verified is set with either the national cryptographic signature public key or the post-quantum signature public key, and the other is set in the custom non-critical extension item.

[0129] The parsing module 220 is used to extract the national cryptographic signature public key and the post-quantum signature public key from the digital certificate to be verified, and to parse the national cryptographic signature value and the post-quantum signature value from the composite signature object to be verified.

[0130] The message processing module 230 is used to obtain the message to be verified and calculate the second hash value of the message to be verified according to the national cryptographic hash algorithm.

[0131] The segmentation module 240 is used to divide the second hash value into a third subset and a fourth subset according to the same preset grouping rules as the signature end;

[0132] Verification module 250 is used to verify the validity of the national cryptographic signature value for one subset of the third subset and the fourth subset using the extracted national cryptographic signature public key, and to verify the validity of the post-quantum signature value for another subset using the extracted post-quantum signature public key;

[0133] The determination module 260 is used to determine the overall signature is valid only when both the national cryptographic signature value and the post-quantum signature value are verified to be valid.

[0134] This embodiment is used to implement the method provided in Embodiment 2 above, and has the corresponding beneficial effects of the method. Technical details not described in detail in this embodiment can be found in the method provided in Embodiment 2 above.

[0135] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A hybrid signature generation method based on post-quantum and national cryptographic algorithms, characterized in that, When applied to the signing end, the method includes the following steps: Obtain a digital certificate, wherein the public key information field of the digital certificate is set with either a national cryptographic signature public key or a post-quantum signature public key, and the other is set in the custom non-critical extension item; Obtain the message to be signed, and calculate the first hash value of the message to be signed according to the national cryptographic hash algorithm; The first hash value is divided into a first subset and a second subset according to a preset grouping rule; Using the private key corresponding to the public key for national cryptographic signature, a signature operation is performed on one subset of the first subset and the second subset to generate a national cryptographic signature value; using the private key corresponding to the public key for post-quantum signature, a signature operation is performed on the other subset to generate a post-quantum signature value; The national cryptographic signature value and the post-quantum signature value are encapsulated into a composite signature object and output.

2. The hybrid signature generation method based on post-quantum and national cryptographic algorithms according to claim 1, characterized in that, The custom non-critical extension uses object identifier 1.3.6.1.4.1.666.1, and the extension content is the post-quantum signature public key encoded in ASN.

1.

3. The hybrid signature generation method based on post-quantum and national cryptographic algorithms according to claim 1, characterized in that, The preset grouping rule is as follows: the 256 bits of the first hash value are divided according to the parity of the bit index. Bits with odd indexes form the first subset, and bits with even indexes form the second subset. Each subset is 128 bits.

4. The hybrid signature generation method based on post-quantum and national cryptographic algorithms according to claim 1, characterized in that, The national cryptographic hash algorithm is the SM3 cryptographic hash algorithm, and the first hash value is 32 bytes; the national cryptographic signature public key is the SM2 elliptic curve public key, and the national cryptographic signature private key is the SM2 elliptic curve private key; the post-quantum signature public key is the ML-DSA public key, and the post-quantum signature private key is the ML-DSA private key.

5. The hybrid signature generation method based on post-quantum and national cryptographic algorithms according to claim 1, characterized in that, The national cryptographic signature private key is used to sign the first subset; the post-quantum signature private key is used to sign the second subset.

6. The hybrid signature generation method based on post-quantum and national cryptographic algorithms according to claim 1, characterized in that, The generation of the national cryptographic signature value and the generation of the post-quantum signature value are performed in parallel.

7. The hybrid signature generation method based on post-quantum and national cryptographic algorithms according to claim 1, characterized in that, The composite signature object uses ASN.1 DER encoding, and its data structure includes a version number field, an octet field for storing the national cryptographic signature value, and an octet field for storing the post-quantum signature value.

8. The hybrid signature generation method based on post-quantum and national cryptographic algorithms according to claim 1, characterized in that, The national cryptographic signature private key and the post-quantum signature private key are generated by the same cryptographic entity and stored in a hardware security module or a trusted execution environment.

9. A hybrid signature verification method based on post-quantum and national cryptographic algorithms, characterized in that, When applied to the verification end, the method includes the following steps: Obtain the digital certificate to be verified and the composite signature object to be verified. In the public key information field of the digital certificate to be verified, set one of the national cryptographic signature public key and the post-quantum signature public key, and set the other in the custom non-critical extension item. Extract the national cryptographic signature public key and the post-quantum signature public key from the digital certificate to be verified, and parse the national cryptographic signature value and the post-quantum signature value from the composite signature object to be verified; Obtain the message to be verified, and calculate the second hash value of the message to be verified according to the national cryptographic hash algorithm; The second hash value is divided into a third subset and a fourth subset according to the same preset grouping rules as the signature end; The extracted national cryptographic signature public key is used to verify the validity of the national cryptographic signature value for one subset of the third subset and the fourth subset, and the extracted post-quantum signature public key is used to verify the validity of the post-quantum signature value for the other subset; The overall signature is deemed valid only if both the national cryptographic signature value and the post-quantum signature value are verified as valid.

10. A hybrid signature verification method based on post-quantum and national cryptographic algorithms according to claim 9, characterized in that, The national cryptographic signature value is used to verify the third subset; the post-quantum signature value is used to verify the fourth subset.

11. The hybrid signature verification method based on post-quantum and national cryptographic algorithms according to claim 9, characterized in that, The verification of the national cryptographic signature value and the verification of the post-quantum signature value are performed in parallel.

12. The hybrid signature verification method based on post-quantum and national cryptographic algorithms according to claim 9, characterized in that, It also includes downgrade compatibility steps: If the verification terminal does not support parsing the custom extension item, the post-quantum signature public key and the post-quantum signature value are ignored, and only the national cryptographic signature public key is used to verify the validity of the national cryptographic signature value for the third subset. If the verification passes, the signature is determined to be valid.

13. A hybrid signature generation system based on post-quantum and national cryptographic algorithms, characterized in that, include: The certificate acquisition module is used to acquire digital certificates. The public key information field of the digital certificate is set with either a national cryptographic signature public key or a post-quantum signature public key, and the other is set in the custom non-critical extension item. The message processing module is used to obtain the message to be signed and calculate the first hash value of the message to be signed according to the national cryptographic hash algorithm. The segmentation module is used to divide the first hash value into a first subset and a second subset according to a preset grouping rule; The signature module is used to perform a signature operation on one subset of the first subset and the second subset using the national cryptographic signature private key corresponding to the national cryptographic signature public key, and generate a national cryptographic signature value; Using the post-quantum signature private key corresponding to the post-quantum signature public key, a signature operation is performed on another subset to generate a post-quantum signature value; The encapsulation module is used to encapsulate the national cryptographic signature value and the post-quantum signature value into a composite signature object and output it.

14. A hybrid signature verification system based on post-quantum and national cryptographic algorithms, characterized in that, include: The input acquisition module is used to acquire the digital certificate to be verified and the composite signature object to be verified. The public key information field of the digital certificate to be verified is set with either the national cryptographic signature public key or the post-quantum signature public key, and the other is set in the custom non-critical extension item. The parsing module is used to extract the national cryptographic signature public key and the post-quantum signature public key from the digital certificate to be verified, and to parse the national cryptographic signature value and the post-quantum signature value from the composite signature object to be verified. The message processing module is used to obtain the message to be verified and calculate the second hash value of the message to be verified according to the national cryptographic hash algorithm. The segmentation module is used to divide the second hash value into a third subset and a fourth subset according to the same preset grouping rules as the signature end; The verification module is used to verify the validity of the national cryptographic signature value for one subset of the third subset and the fourth subset using the extracted national cryptographic signature public key, and to verify the validity of the post-quantum signature value for another subset using the extracted post-quantum signature public key; The determination module is used to determine the overall signature is valid only when both the national cryptographic signature value and the post-quantum signature value are verified to be valid.

Images