Collaborative signature method and device

Abstract

Embodiments of the present application provide a two-party collaborative signature method and device, the method comprising: sampling multiple signature attempt instances corresponding to random masks from a hypersphere in parallel. Generating a corresponding temporary response for each random mask based on each random mask. And performing a hypersphere norm check on each temporary response to screen out candidate responses that meet the preset radius constraint. Scaling the first local component in the candidate response to obtain the first target response. Aggregate the first target response and the second target response sent by the server to obtain the global response. Based on the global response, determine the low-bit bias term and the signature prompt information. If the first global component in the global response, the low-bit bias term and the signature prompt information meet the respective corresponding norm compliance threshold, respectively, then generate the target signature corresponding to the to-be-signed message based on the global response and the signature prompt information, in order to improve the rejection sampling pass rate, and then realize the two-party efficient collaborative post-quantum signature.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a two-party collaborative signature method and device. Background Technology

[0002] To address the security threats posed by quantum computing, post-quantum cryptographic signature technology has become a research hotspot in the field of trusted security. Among them, the Module Lattice Digital Signature Algorithm (ML-DSA) has become a universally standardized post-quantum digital signature algorithm. Its security is based on the Module Learning With Errors (MLWE) problem and the Module Short Integer Solution (MSIS) problem on lattices, possessing provable post-quantum security and being widely applicable to scenarios such as electronic signatures, device authentication, and cloud security.

[0003] In practical deployments, to prevent single-point key leakage and resist attack risks, a two-party collaborative signature architecture is often adopted: the complete private key is split into two private key fragments, which are stored by the user device and the cloud server respectively. Neither party can complete the signature generation alone. Both parties must interact securely and perform joint calculations to aggregate and generate a valid signature.

[0004] However, the native ML-DSA scheme relies on the cubic infinity norm rejection sampling mechanism, which mandates that all coefficients of the response vector strictly satisfy the distribution requirements. While this sampling strategy ensures security in single-machine signature scenarios, in two-party collaborative signature scenarios, because each party independently generates local responses, the linear superposition of these local responses can easily lead to out-of-bounds errors, triggering retries and resulting in low signature efficiency. Furthermore, to support verification, a signature hint value related to the commitment needs to be transmitted. The rigid boundaries of cubic sampling introduce non-uniform rejection bias, which attackers can use to infer private key information through failure modes or hint information, posing a security risk of leaking private keys and hint information. Summary of the Invention

[0005] This application provides a two-party collaborative signature method, device, storage medium, and program product to improve the rejection sampling pass rate, thereby achieving efficient two-party collaborative post-quantum signature.

[0006] In a first aspect, embodiments of this application provide a two-party collaborative signature method, applied to a client, the method comprising: In response to a collaborative signature request for a message to be signed, random masks corresponding to multiple signature attempt instances are sampled in parallel from the hypersphere; wherein each random mask is obtained by performing different magnitude amplification transformations on the two components of the sampled original random vector; Each temporary response is generated based on a random mask, and a hypersphere norm check is performed on each temporary response to filter out candidate responses that meet a preset radius constraint. The temporary response consists of a first local component and a second local component, and the first local component is obtained by performing inverse compression on the first sub-component of the random mask. Amplification transformation is performed on the first local component of the candidate response to obtain the first target response; The server receives a second target response and aggregates the first target response and the second target response to obtain a global response. The second target response is obtained by the server performing the same amplitude amplification transformation on the first local component of its locally generated server candidate response. Based on the global response, the low-order deviation item and signature prompt information are determined; If the first global component in the global response, the low-order deviation term, and the signature hint information each satisfy their respective norm compliance thresholds, then a target signature corresponding to the message to be signed is generated based on the global response and the signature hint information.

[0007] Secondly, embodiments of this application provide a two-party collaborative signature device applied to a client, the device comprising: The sampling module is used to respond to a collaborative signature request for a message to be signed by sampling random masks corresponding to multiple signature attempt instances from the hypersphere in parallel; wherein each random mask is obtained by performing different amplitude amplification transformations on the two components of the original random vector obtained by sampling. The filtering module is used to generate a corresponding temporary response based on each random mask, and perform hypersphere norm verification on each temporary response to filter out candidate responses that meet the preset radius constraints; the temporary response is composed of a first local component and a second local component, and the first local component is obtained by performing inverse compression on the first sub-component of the random mask; The transformation module is used to perform an amplitude amplification transformation on the first local component in the candidate response to obtain the first target response; The aggregation module is used to receive the second target response sent by the server, aggregate the first target response and the second target response to obtain a global response; the second target response is obtained by the server performing the same amplitude amplification transformation on the first local component of its locally generated server candidate response. The determination module is used to determine the low-order deviation item and signature prompt information based on the global response; The generation module is used to generate a target signature corresponding to the message to be signed based on the global response and the signature prompt information if the first global component in the global response, the low-order deviation term, and the signature prompt information respectively satisfy their respective norm compliance thresholds.

[0008] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and a communication interface; wherein, the memory stores a computer program, and when the computer program is executed by the processor, the processor can at least implement the two-party collaborative signature method as described in the first aspect.

[0009] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor of an electronic device, enables the processor to at least implement the two-party collaborative signature method as described in the first aspect.

[0010] Fifthly, embodiments of this application provide a computer program product, including: a computer program or instructions, which, when executed by a processor of an electronic device, enable the processor to at least implement the two-party collaborative signature method as described in the first aspect.

[0011] Sixthly, embodiments of this application provide a two-party collaborative signature method applied to a server, the method comprising: It receives collaborative signature requests for messages to be signed from clients and samples random masks corresponding to multiple signature attempt instances from the hypersphere in parallel; wherein each random mask is obtained by performing different amplitude amplification transformations on the two components of the sampled original random vector; Each temporary response is generated based on a random mask, and a hypersphere norm check is performed on each temporary response to filter out candidate responses that meet the preset radius constraint. The temporary response consists of a first local component and a second local component, and the first local component is obtained by performing inverse compression on the first sub-component of the random mask. The first local component in the candidate response is subjected to amplitude amplification transformation to obtain the second target response; The second target response is broadcast so that the client aggregates its locally generated first target response and the second target response generated by the server to obtain a global response, and determines the low-order deviation item and signature hint information based on the global response; if the first global component, the low-order deviation item and the signature hint information in the global response satisfy their respective norm compliance thresholds, then the target signature corresponding to the message to be signed is generated based on the global response and the signature hint information. The first target response is obtained by the client performing an amplitude amplification transformation on the first local vector in the client candidate response generated locally by the client. The client candidate response is obtained by the same operation as the candidate response generated locally by the server.

[0012] Seventhly, embodiments of this application provide a two-party collaborative signature device applied on a server side, the device comprising: The receiving module is used to receive collaborative signature requests for messages to be signed sent by clients, and to sample random masks corresponding to multiple signature attempt instances from the hypersphere in parallel; wherein, each random mask is obtained by performing different amplitude amplification transformations on the two components of the sampled original random vector; The filtering module is used to generate a corresponding temporary response based on each random mask, and perform hypersphere norm verification on each temporary response to filter out candidate responses that meet the preset radius constraints; the temporary response is composed of a first local component and a second local component, and the first local component is obtained by performing inverse compression on the first sub-component of the random mask; The transformation module is used to perform amplitude amplification transformation on the first local component in the candidate response to obtain the second target response; The broadcast module is used to broadcast the second target response so that the client aggregates its locally generated first target response and the second target response generated by the server to obtain a global response, and determines the low-order deviation item and signature hint information based on the global response; if the first global component, the low-order deviation item and the signature hint information in the global response satisfy their respective norm compliance thresholds, then the target signature corresponding to the message to be signed is generated based on the global response and the signature hint information. The first target response is obtained by the client performing an amplitude amplification transformation on the first local vector in the client candidate response generated locally by the client. The client candidate response is obtained by the same operation as the candidate response generated locally by the server.

[0013] Eighthly, this application provides an electronic device for use in a verification terminal, comprising: a memory, a processor, and a communication interface; wherein, the memory stores executable code, and when the executable code is executed by the processor, the processor can at least implement the two-party collaborative signature method as described in the sixth aspect.

[0014] In a ninth aspect, embodiments of this application provide a non-transitory machine-readable storage medium storing executable code, which, when executed by a processor of an electronic device, enables the processor to at least implement the two-party collaborative signature method as described in the sixth aspect.

[0015] In a tenth aspect, embodiments of this application provide a computer program product, including: a computer program or instructions that, when executed by a processor of an electronic device, enable the processor to at least implement the two-party collaborative signature method as described in the sixth aspect.

[0016] The two-party collaborative signature scheme provided in this application embodiment can be applied to the client to collaboratively generate the post-quantum signature corresponding to the message to be signed with the server. This not only improves signature security but also increases the rejection sampling pass rate, thereby achieving efficient two-party collaborative post-quantum signature.

[0017] In practice, firstly, in response to a collaborative signature request for a message to be signed, different signature attempt instances are executed in parallel to quickly filter out those that meet the rejection sampling requirements from multiple signature attempt instances. Each instance independently generates a unique random mask and temporary response, and the original random vector, random mask, and temporary response for each signature attempt instance are bound together in a one-to-one correspondence.

[0018] Specifically, multiple random masks corresponding to signature attempt instances are sampled in parallel from the hypersphere. Each random mask is obtained by performing different amplitude amplification transformations on each component of the sampled original random vector. Then, a corresponding temporary response is generated based on each random mask. Each temporary response consists of a first local component and a second local component, where the first local component is obtained by performing inverse compression on the first sub-component of its corresponding random mask. Hypersphere norm verification is performed on each temporary response to filter out candidate responses that meet a preset radius constraint. Next, the first local component in the candidate response is scaled to obtain a first target response. Simultaneously, the server performs the same operations to generate server-side candidate responses and performs the same amplitude amplification transformation on the first local component in the server-side candidate responses to obtain a second target response. The second target response sent by the server is received, and the first and second target responses are aggregated to obtain a global response. Based on the global response, the low-order deviation term and signature hint information are determined. Finally, norm checks are performed on the first global component, the low-order deviation term, and the signature hint information in the global response. If the first global component, the low-order deviation term, and the signature hint information in the global response meet their respective norm compliance thresholds, then the target signature corresponding to the message to be signed is generated based on the global response and the signature hint information.

[0019] In the above scheme, when the client collaborates with the server to perform signature processing, the client generates multiple signature attempt instances in parallel. For each signature attempt instance, the client performs differential amplitude processing on each component of its original random vector to generate a random mask, and only performs reverse compression on the first sub-component of the random mask to construct a temporary response. This can effectively suppress the deterministic information introduced by the challenge and private key, making the overall distribution of the temporary response closer to pure noise, and making it easier to pass the local hypersphere rejection sampling verification. This not only avoids discarding valid instances that can be compliant after aggregation due to excessive local screening, ensuring the efficiency of signature generation, but also allows each participant to independently complete the verification and screening locally without exchanging any sensitive intermediate data when screening and verifying candidate responses. Only the target responses that pass the verification are retained for subsequent signature aggregation, so as to filter out a large number of non-compliant samples in advance and avoid sending invalid intermediate results into subsequent aggregation or triggering multiple rounds of retries. Thus, efficient collaborative signing between the two parties is achieved. In other words, by employing an unbalanced hypersphere rejection sampling strategy, the two components of the random mask are differentiated to generate a temporary response. This is then combined with hypersphere norm verification to filter out candidate responses that pass the verification. This effectively improves the rejection sampling pass rate, thereby increasing signature generation efficiency. Furthermore, the client and server use a completely unified amplitude amplification transformation to process the first local component. The aggregation of the target responses from both ends can offset the numerical deviation caused by the scaling transformation, ensuring the global response conforms to the standard signature numerical constraints. This effectively reduces the probability of signature failure due to the aggregated global response exceeding numerical limits. By configuring independent norm thresholds for the aggregated global first component, the low-order deviation term, and the signature hint information, precise compliance verification is achieved, ensuring the final generated signature fully complies with standard security protocols. This balances the efficiency and reliability of collaborative signing between the two parties. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A schematic diagram of a two-party collaborative signature system provided in this application embodiment; Figure 2 A schematic diagram illustrating a two-party collaborative signature method provided in an embodiment of this application; Figure 3 A flowchart for generating a temporary response is provided as an embodiment of this application; Figure 4 A flowchart of another two-party collaborative signature method provided in this application embodiment; Figure 5 A schematic diagram of a two-party collaborative signature device provided in this application embodiment; Figure 6 To and Figure 5 A schematic diagram of the electronic device corresponding to the two-party collaborative signature device provided in the embodiment shown. Figure 7 A schematic diagram of another two-party collaborative signature device provided in this application embodiment; Figure 8 To and Figure 7 The illustrated embodiment provides a schematic diagram of the electronic device corresponding to the two-party collaborative signature device. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] It should be noted that, in the cases involving user information in the embodiments of this application, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of related data must comply with relevant laws, regulations, and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse. In addition, the various models involved in this application (including but not limited to language models or large models) comply with relevant laws and standards.

[0024] Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0025] Classical public-key cryptosystems based on large integer factorization and discrete logarithm problems (such as RSA and ECC) will face serious threats in the era of quantum computing. To address the security threats posed by quantum computing, post-quantum cryptographic signature technologies have become a research hotspot in the field of trusted security. Among these, signature schemes based on lattice-hard problems have become the mainstream approach due to their advantages such as small key size, high computational efficiency, and rigorous security specifications.

[0026] Currently, the post-quantum signature scheme ML-DSA (based on Dilithium) adopts the Fiat-Shamir transform framework and combines rejection sampling technology to eliminate signature distribution bias. It can achieve compact security proofs under the standard model and achieve a good balance between signature length, verification efficiency and security. It has been officially included in the NIST post-quantum cryptography standard.

[0027] However, in many practical applications, signing keys need to be jointly managed by multiple parties, which necessitates the support of threshold signature schemes. Threshold signatures are an important primitive in cryptography, allowing multiple parties to jointly manage signing keys and collaboratively generate signatures. They are widely used in distributed identity authentication, key escrow, and blockchain consensus mechanisms. In particular, two-party threshold signatures are the most basic and widely used form of threshold signature. However, this scheme employs a centralized private key management model, with the complete private key held by a single party. The signing process is indivisible, making it difficult to support decentralized applications such as multi-party joint signatures.

[0028] Furthermore, the native ML-DSA scheme relies on the cubic infinity norm rejection sampling mechanism, which mandates that all coefficients of the response vector strictly satisfy the distribution requirements. While this sampling strategy ensures security in single-machine signature scenarios, in two-party collaborative signature scenarios, because each party independently generates local responses, the linear superposition of these local responses can easily lead to out-of-bounds errors, triggering retries and resulting in low signature efficiency. Moreover, to support verification, a signature hint value related to the commitment needs to be transmitted. The rigid boundaries of cubic sampling introduce non-uniform rejection bias, which attackers can use to infer private key fragmentation information through failure modes or hint information, posing a security risk of leaking private key fragments and hint information.

[0029] To address the aforementioned technical issues, this application provides a solution. The basic idea is as follows: the client and server collaborate to complete the quantum signature. During the local signature stage, the client and server employ an unbalanced hypersphere rejection sampling strategy. By performing differential amplitude processing on the original random vector to generate a random mask, only the first sub-component of the random mask is subjected to inverse compression to construct a temporary response. By relying on the differential processing of the two types of components of the random mask combined with hypersphere norm verification, the strict verification constraints of the local single end are relaxed, making it easier for the local temporary response to pass the sampling verification, significantly improving the local rejection sampling pass rate. At the same time, valid samples that can be compliant after aggregation are retained, avoiding the premature removal of valid instances locally. Furthermore, during the aggregation signature stage on both the client and server sides, the client and server use a unified amplitude amplification transformation rule to perform scale compensation on the first local component in the candidate response that has passed the verification. This ensures that the scale transformation deviation is offset after the target responses from both ends are aggregated, avoiding numerical out-of-bounds issues caused by collaborative superposition and reducing the probability of global response exceeding limits. At the same time, independent norm thresholds are configured for the first global component, low-bit deviation term, and signature hint information obtained from the aggregation, and layered precise verification is performed. This not only improves the rejection sampling pass rate and thus improves the signature generation efficiency, but also eliminates the non-uniform rejection bias caused by traditional cube sampling, preventing attackers from inferring private key fragmentation through signature failure mode or hint information, and ensuring the security of private key fragmentation and signature hint information.

[0030] Furthermore, during collaborative signature processing, the client and server execute multiple independent signature attempt instances in parallel. This parallel multi-attempt mechanism replaces the traditional single-attempt retry mode, significantly reducing the number of protocol restarts caused by single sampling failures, thereby greatly improving the overall efficiency and response speed of collaborative signature between the two parties.

[0031] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0032] Figure 1 This is a schematic diagram of a two-party collaborative signature system provided in an embodiment of this application. Figure 1 As shown, the two-party collaborative signature system includes a client and a server.

[0033] The client can be any device capable of initiating a collaborative signature request and participating in the collaborative signature generation process. Specifically, the client can be a mobile phone, PC, tablet, application, etc. It can also be any device capable of providing computing services, such as a cluster server, a regular server, or a cloud server.

[0034] The server can be any device capable of collaborating with the client to generate a signature. Specifically, the server can be a mobile phone, PC, tablet, application, etc. It can also be any device capable of providing computing services, such as a cluster server, a regular server, or a cloud server. Furthermore, both the server and client are equipped with the collaborative signing device described in this application to collaboratively execute the corresponding signature generation operation.

[0035] In an optional embodiment, the two-party collaborative signature system may further include a verification terminal. The verification terminal is primarily used to receive and verify the validity of the final generated target signature. The verification terminal can be an independent third-party server, blockchain node, smart contract, application backend system, or a verification module integrated into the client / server. Its core function is to execute the standard ML-DSA signature verification algorithm on the received target signature based on publicly available system parameters and a verification public key.

[0036] In practical applications, when a client wants to digitally sign a piece of data (such as a transaction instruction, identity certificate, software update package, etc.) to prove its origin and integrity, the user can trigger a collaborative signature request for the message to be signed. Utilizing the two-party collaborative signature device located on the client, during the local signature stage, candidate responses that pass the hypersphere norm check are selected, and amplitude amplification transformation is performed only on the first local component of the candidate responses to obtain the first target response. In the aggregate signature stage, the second target response sent by the server is received, and the first and second target responses are aggregated to obtain the global response. This second target response is obtained by the server performing the same operation as the client, applying the same amplitude amplification transformation to the first local component of the server's candidate responses. Next, based on the global response, the low-order deviation term and signature hint information are determined. The first global component, low-order deviation term, and signature hint information in the global response are each subjected to their respective norm checks. If the first global component, low-order deviation term, and signature hint information in the global response each meet their respective norm compliance thresholds, it is determined that the client and server have achieved collaborative signing, generating the target signature corresponding to the message to be signed based on the global response and signature hint information.

[0037] Simultaneously, the server can also perform the aforementioned aggregated signature operation. After the client generates the first target response, it broadcasts this response. Upon receiving the broadcast first target response, the server aggregates the first and second target responses to obtain a global response. Based on the global response, it determines the low-order deviation term and signature hint information. It then performs norm checks on the first global component, the low-order deviation term, and the signature hint information in the global response. If these parameters meet their respective norm compliance thresholds, it is determined that the client and server have collaborated on signing, generating the target signature for the message to be signed based on the global response and the signature hint information.

[0038] Additionally, after generating the target signature for the message to be signed, the target signature can be sent to the corresponding verification terminal. Upon receiving the target signature and the message to be signed, the verification terminal uses its locally deployed signature verification device to perform the corresponding standard ML-DSA signature verification operation to confirm that: the target signature is mathematically valid, conforms to the security protocol of lattice-based signatures, and that the signature matches the claimed message to be signed and has not been tampered with. If the verification passes, it indicates that the source of the message to be signed is authentic, the content is complete, and it can be trusted by the system or user for further processing; if the verification fails, the target signature and related operations are rejected.

[0039] The following describes the specific implementation process of the client and server performing signature processing locally to perform reverse compression processing on candidate responses that have passed the hypersphere norm verification, obtain the target response, and broadcast their respective target responses. The client then performs signature aggregation processing to generate the target signature corresponding to the message to be signed.

[0040] In practice, firstly, in response to the collaborative signature request for the message to be signed, the client initiates multiple parallel signature attempt instances to quickly filter out those that meet the rejection sampling requirements. Each instance independently generates a unique random mask and temporary response, with each instance's original random vector, random mask, first commitment value, challenge value, and temporary response bound together in a one-to-one correspondence. That is, when generating the target signature for the message to be signed, the client does not perform a single signature attempt, but instead initiates multiple independent signature attempt instances in parallel to improve the overall signature success rate.

[0041] For each signature attempt instance, the following operation is performed: a random mask corresponding to each signature attempt instance is sampled from the hypersphere. The random mask is obtained by performing different amplitude amplification transformations on the two components of the sampled original random vector. For example, if the random mask consists of two sub-components, a first sub-component and a second sub-component, the corresponding random mask can be generated by performing an amplitude amplification transformation only on the first sub-component of the random mask while keeping the second sub-component unchanged—that is, by employing a differential amplification transformation.

[0042] In other words, in the specific implementation process, the original random vector can be split into two components. Thus, by processing the original random vector, the generated random mask is also split into two parts, namely, the random mask consists of the first sub-vector and the second sub-vector.

[0043] Next, a temporary response is generated based on the random mask. This temporary response consists of a first local component and a second local component, where the first local component is obtained by performing reverberation compression on the first sub-component of the random mask. A hypersphere norm check is then performed on the temporary response to determine if it meets a preset radius constraint. If the temporary response does not meet the preset radius constraint, it is discarded. If multiple signature attempt instances' corresponding temporary responses fail the hypersphere norm check, multiple parallel signature attempt instances can be restarted until a temporary response that passes the hypersphere norm check is selected. The corresponding preset radius constraint can be preset. For example, it can be set to r=252833.

[0044] If the temporary response satisfies the preset radius constraint, it is identified as a candidate response. An amplitude amplification transformation is then performed on the first local component of the candidate response to obtain the first target response. In other words, the candidate response serves as the response that meets the distribution requirements and is selected through local checksum verification, upon which subsequent processing such as signature aggregation can be performed.

[0045] Furthermore, preferably, in the embodiments of this application, the same expansion coefficient can be used to perform amplitude transformation processing on the first sub-vector in the original random vector obtained by sampling, the first sub-component of the random mask, and the first local component in the candidate response.

[0046] When the client performs different hypersphere rejection sampling to filter candidate responses, the server can simultaneously perform the same hypersphere rejection sampling and perform the same amplitude amplification transformation on the first local component of the candidate response that passes the hypersphere rejection sampling to obtain the second target response.

[0047] Specifically, when the client responds to a collaborative signature request for a message to be signed, it forwards the request to the corresponding server. Upon receiving the request, the server launches multiple signature attempt instances. The number of concurrent signature attempt instances can be pre-set in the collaborative signature protocol. In practical applications, the number of parallel instances can be flexibly configured based on the current computational load of the collaborative signature, real-time signature response latency requirements, and security level requirements. Preferably, it can be set to launch 2 or 4 concurrent signature attempt instances at a time.

[0048] For each signature attempt instance, the following operation is performed: a random mask corresponding to each signature attempt instance is sampled from the hypersphere. The random mask is obtained by performing different amplitude amplification transformations on each component of the sampled original random vector. For example, if the random mask consists of two sub-components, it can be generated by performing an amplitude amplification transformation only on the first sub-component of the random mask, while keeping the second sub-component unchanged—that is, by using a differential amplification transformation.

[0049] Next, a temporary response is generated based on the random mask. This temporary response consists of two parts: a first local component and a second local component. The first local component is obtained by performing reverberation compression on the first sub-component of the random mask. A hypersphere norm check is then performed on the temporary response to determine if it meets a preset radius constraint. If the temporary response does not meet the preset radius constraint, it is discarded. If multiple signature attempt instances' corresponding temporary responses fail the hypersphere norm check, multiple parallel signature attempt instances can be restarted until a temporary response that passes the hypersphere norm check is selected.

[0050] If the temporary response satisfies the preset radius constraint, then the temporary response is determined as a candidate response. An amplitude amplification transformation is then performed on the first local component of the candidate response to obtain the first target response. Furthermore, preferably, in this embodiment, the same expansion coefficient can be used to perform amplitude transformation processing on the first sub-vector in the sampled original random vector, the first sub-component of the random mask, and the first local component of the candidate response.

[0051] In the local signature phase, a random mask is generated by differentially processing the original random vectors from the client and server. Only the first sub-component of the random mask is subjected to inverse compression to construct a temporary response. Based on the differential processing of the two types of components in the random mask, combined with hypersphere norm verification, unbalanced hypersphere rejection sampling is performed. This broadens the verification constraints of the local single end, making it easier for local temporary responses to pass sampling verification, significantly improving the local rejection sampling pass rate. It retains valid samples that are compliant after aggregation, preventing valid signature attempt instances from being prematurely rejected locally. Simultaneously, it can also filter out temporary responses with out-of-bounds numerical distributions in advance. Furthermore, by sampling multiple signature attempt instances in parallel, the effective sample output per signature round is further increased, reducing the number of signature retries.

[0052] Once the server generates a second target response, it can broadcast this second target response. After receiving the second target response, the client aggregates the first and second target responses to obtain the global response.

[0053] In practice, in order to protect local private data, prevent the leakage of private key information, and prevent attackers from deducing private key information and signature hints based on publicly transmitted data, the server may broadcast only the first part of the second target response.

[0054] Furthermore, after the client receives the first component of the second target response from the server, it aggregates the first component of the first target response and the second component of the second target response to obtain the first global component in the global component. It then determines the first commitment value corresponding to the client, receives the second commitment value corresponding to the server, and aggregates the first and second commitment values ​​to obtain the aggregated commitment value. It also determines the corresponding challenge value. Finally, based on the aggregated commitment value, the public key matrix, the aggregated first global component, the challenge value, and the compressed public key information in the verification public key, it obtains the second global component in the global response.

[0055] After obtaining the global response, a low-order deviation term is determined based on the global response, and a signature prompt message is determined based on the low-order deviation term. In an optional embodiment, the second global component in the global response can be determined as the low-order deviation term.

[0056] Finally, the first global component, the low-order deviation term, and the signature hint information in the global response are each subjected to their corresponding norm verification. If the first global component, the low-order deviation term, and the signature hint information in the global response meet their respective norm compliance thresholds, then the target signature corresponding to the message to be signed is generated based on the global response and the signature hint information.

[0057] In order to reuse the original ML-DSA signature verification interface or be compatible with the standard ML-DSA verification system without modifying the terminal verification component, when generating the target signature, a temporary challenge corresponding to the verified signature attempt instance can be further determined. Based on the temporary challenge, the first global component, and the signature hint information, the target signature corresponding to the message to be signed is generated. This ensures that the format of the generated target signature is the same as the standard ML-DSA signature format.

[0058] In the aggregation signature stage, the client and server use a unified amplitude amplification transformation rule to scale the first local component in the candidate response. This ensures that the scale transformation deviation is offset after the local responses from both ends are aggregated, avoiding numerical out-of-bounds issues caused by collaborative superposition and reducing the probability of global response failure. At the same time, independent norm thresholds are configured for the first global component, low-bit deviation term, and signature hint information obtained from aggregation for hierarchical and precise verification. This eliminates the non-uniform rejection bias caused by traditional cube sampling and prevents attackers from inferring private key information through signature failure mode or signature hint information, thus ensuring the security of private key information and signature hint information. This can increase the probability of obtaining a valid signature in a single collaborative round, thereby improving signature generation efficiency, while taking into account the sampling stability, signature efficiency, and private key privacy security in two-party collaborative signature scenarios.

[0059] In summary, the above scheme introduces an unbalanced hypersphere rejection sampling mechanism when the client and server perform collaborative signature processing. The client and server respectively perform differential amplitude processing on different components of the original random vector obtained from local sampling to generate random masks. Furthermore, when constructing the temporary response, inverse compression is performed on the first sub-component, effectively suppressing deterministic components and making its distribution closer to pure noise. This makes the overall norm of the temporary response more likely to satisfy the hypersphere radius constraint, significantly increasing the probability of a single signature attempt passing local verification. Moreover, the client and server can independently complete verification and filtering without exchanging intermediate data, using only compliant local responses for aggregation, avoiding invalid computation and multiple retries. In addition, since the client and server use the same scaling rules, the aggregated global response can naturally offset the scaling bias and conform to the numerical requirements of the standard signature. Independent norm thresholds are configured for the first global component, the low-order bias item, and the signature hint information obtained from the aggregation to perform layered and precise verification. This prevents attackers from inferring the private key component through the signature failure mode or the signature hint information, and ensures the security of the private key component and the signature hint information. Ultimately, while ensuring the compliance and security of the signature format, the overall signature generation efficiency is significantly improved.

[0060] To facilitate understanding of the specific process of collaborative signing between the client and server, the following is an exemplary description of the collaborative signing process performed by the client and server.

[0061] Figure 2 A flowchart of a two-party collaborative signature method provided in this application embodiment is shown below. Figure 2 As shown, this method is applied to the client side, and specifically, the method may include the following steps: 201. In response to a collaborative signature request for a message to be signed, random masks corresponding to multiple signature attempt instances are sampled in parallel from the hypersphere. Each random mask is obtained by performing different amplitude amplification transformations on the two components of the sampled original random vector.

[0062] 202. Generate a temporary response for each random mask, and perform a hypersphere norm check on each temporary response to filter out candidate responses that satisfy a preset radius constraint. The temporary response consists of a first local component and a second local component, and the first local component is obtained by inversely compressing the first component of the random mask.

[0063] 203. Perform amplitude amplification transformation on the first local component in the candidate response to obtain the first target response.

[0064] 204. Receive the second target response sent by the server, and aggregate the first target response and the second target response to obtain the global response. The second target response is obtained by the server performing the same amplitude amplification transformation on the first local component of its locally generated server candidate response.

[0065] 205. Based on the global response, determine the low-order deviation item and signature prompt information.

[0066] 206. If the first global component, the low-order deviation term, and the signature hint information in the global response satisfy their respective norm compliance thresholds, then generate the target signature corresponding to the message to be signed based on the global response and the signature hint information.

[0067] In practical applications, when a client wants to digitally sign a piece of data (such as a transaction instruction, identity certificate, software update package, etc.) to prove its origin and integrity, the user can use the client to trigger a collaborative signature request for the message to be signed. The client will then perform the corresponding collaborative signature operation based on the collaborative signature request triggered by the user to generate the target signature for the message to be signed.

[0068] Before performing collaborative signing, the client can first perform corresponding key generation and distribution operations to generate a user private key for signing and a verification public key for verifying the signature. To improve the security of the user private key, in this embodiment, the user private key used for signing is split into two parts: the complete private key includes the client's private key component and the private key component of the server that collaborated with the client to generate the signature.

[0069] Specifically, a sampling seed can be generated using a secure random number generator. Then, a deterministic pseudo-random expansion function is used to generate a public key matrix based on this sampling seed. The sampling seed and public key matrix can be generated by either the server or the client, and after generation, they can be sent to the client or server via a secure channel. In practice, the sampling seed and public key matrix can also be generated by a trusted third party. Furthermore, all signature attempt instances share the same set of sampling seeds.

[0070] Then, the client and server randomly sample their respective sub-private keys from the standard binomial distribution representation. The client and server exchange their corresponding sub-private keys, aggregating the two sub-private keys to obtain the complete private key. A lattice public key vector is then calculated based on the public key matrix and the complete private key. This lattice public key vector is compressed to obtain the high-order public key component. A hash operation is performed on the high-order public key component and the sampling seed to obtain the public key hash. A verification public key is generated based on the sampling seed and the high-order public key component. The client's corresponding private key component is generated based on the public key hash and the client's corresponding sub-private key. The server's corresponding private key component is generated based on the public key hash and the server's corresponding sub-private key.

[0071] For example, suppose the generated sampling seed is Expand to generate a public key matrix, i.e. .in, This refers to a deterministic pseudo-random expansion function, representing a k*l matrix where each element belongs to a ring. Then, the first sub-private key corresponding to the client is generated. ,Right now Similarly, the second sub-private key corresponding to the generated server is used. ,Right now .in, This represents a standard binomial distribution or a discrete Gaussian distribution. Furthermore, the first and second sub-private keys satisfy an additive secret sharing condition to obtain the complete private key, i.e., satisfying... S represents the complete private key. Next, based on the public key matrix, the identity matrix, and the complete private key, the lattice public key components are calculated. The public key vector is compressed to obtain the high-order public key component. Where d represents the number of decomposition bits. This represents the high-order public key component. This represents the low-order public key component. A hash operation is performed on the high-order public key component and the sampling seed to obtain the public key hash. ,Right now The generated verification public key is: Additionally, to enhance the security of the private key information held by the client and server, respective private key components can be generated based on their corresponding sub-private keys. For example, the first private key component corresponding to the client is... The second private key component corresponding to the server is .

[0072] Furthermore, the pre-generated verification public key and the corresponding first private key component of the client can be stored locally on the client, so that the corresponding verification public key, first private key component, and other information can be directly obtained from the client's local storage during subsequent collaborative signature processing. Similarly, after obtaining the verification public key and the corresponding second private key component of the server, the verification public key and the corresponding second private key component of the server can be stored on the server.

[0073] In the specific implementation, when the client receives a collaborative signature request from the user for the message to be signed, the client responds to the collaborative signature request by sampling random masks corresponding to multiple signature attempt instances from the hypersphere in parallel. That is, to improve signature generation efficiency, multiple signature attempt instances can be started simultaneously during signature processing. Each random mask is obtained by performing different amplitude amplification transformations on the two components of the sampled original random vector. For example, if the sampled original random vector consists of two sub-components, then only the first sub-component of the original random vector can be amplified, while keeping the value of the second sub-component unchanged, to obtain the corresponding random mask.

[0074] Since the process of generating the random mask is roughly the same for each signature attempt instance, we will only use the target signature attempt instance as an example to illustrate the generation process of its random mask. The target signature attempt instance can be any one of multiple signature attempt instances.

[0075] Specifically, in one optional embodiment, the random mask can be generated by sampling the original random vector corresponding to the target signature attempt instance from a preset hypersphere. The original random vector includes a first random vector and a second random vector. The first random vector is then subjected to an amplitude amplification transformation to obtain a transformed first random vector. The transformed first random vector and the second random vector are then determined as the random mask corresponding to the target signature attempt instance.

[0076] Specifically, the transformed first random vector can be determined as the first sub-component in the random mask corresponding to the target signature attempt instance, and the second random vector can be determined as the second sub-component in the random mask corresponding to the target signature attempt instance.

[0077] For example, suppose the hypersphere is predefined as... A primitive random vector is sampled from the preset hypersphere, and this primitive random vector is composed of a first random vector. Second random vector Composition, i.e., the original random vector is Then, the first random vector in the original random vector is subjected to an amplitude amplification transformation to obtain the transformed first random vector. The resulting random mask corresponding to the target signature attempt instance is: For ease of description, the transformed first random vector can be named the first sub-vector, and the second random vector can be named the second sub-vector.

[0078] That is, by using a differentiated amplitude adjustment strategy on the two types of original sub-vectors, a random mask is generated, which provides a basis for the subsequent reverse compression of the first sub-component and the unbalanced hypersphere rejection sampling. This makes the two types of components have different numerical distribution characteristics, which makes it easier to distinguish between public interactive components and local private components, and balances the sampling pass rate and the ability to protect private data.

[0079] Next, a corresponding temporary response is generated based on each random mask. The temporary response consists of a first local component and a second local component, and the first local component is obtained by performing inverse compression on the first sub-component of the random mask. In other words, the generated temporary response is also split into two parts: the first local component and the second local component.

[0080] Since each random mask consists of two parts, a first sub-component and a second sub-component, when generating a temporary response, the two independent components can be separated and processed separately. That is, only the first sub-vector used for external interaction is subjected to numerical convergence processing to obtain the first local component of the temporary response, while the second sub-vector retains its original value without compression or adjustment to obtain the second local component of the temporary response.

[0081] The following describes the specific implementation process of the temporary response for a target signature attempt instance. Specifically, the implementation of the temporary response based on the random mask generator can be as follows: First, generate the first commitment value corresponding to the target signature attempt instance based on the random mask. Second, generate a message digest based on the message to be signed and the public key hash in the private key held by the client. The public key hash is obtained by hashing the sampling seed and the high-order public key component in the verification public key. Third, determine the challenge value corresponding to the target signature attempt instance based on the first commitment value and the message digest. Fourth, generate the temporary response corresponding to the target signature attempt instance based on the challenge value, the first private key component held by the client, and the random mask corresponding to the target signature attempt instance. That is, for different signature attempt instances, each instance independently generates a different first commitment value, challenge value, and temporary response, and each instance's first commitment value, challenge value, and temporary response are bound together in a one-to-one correspondence.

[0082] The first commitment value is a pre-commitment parameter generated by hashing and lattice operations on a random mask. It is used to characterize the random basic information of this target signature attempt instance, providing a reliable benchmark for subsequent challenge value calculation and mutual verification between the two parties. The public key hash is used to characterize the binding relationship between the client's legitimate signature identity and the public and private keys, ensuring that the signature sampling seed and verification public key cannot be tampered with, and preventing malicious third parties from forging signature requests.

[0083] After generating the temporary responses for each signature attempt instance, a hypersphere norm check is performed on each temporary response to filter out candidate responses that meet the preset radius constraint. Specifically, a hypersphere norm check is performed on the temporary response corresponding to the target signature attempt instance to determine whether the temporary response is located within the target sphere. If the temporary response is located within the target sphere, the target signature attempt instance is determined to have passed the rejection sampling, and the temporary response corresponding to the target signature attempt instance is identified as a candidate response.

[0084] For example, suppose the provisional response corresponding to the target signature attempt instance is Determine whether the norm corresponding to the temporary response lies within the target sphere, i.e., determine... If the norm corresponding to the temporary response is located within the target sphere, then the temporary response is determined as a candidate response.

[0085] The process of performing hypersphere norm verification on each temporary response adapts to the vector numerical distribution characteristics formed after processing differentiated components. Compared to the rigid judgment rule of the native cubic infinite norm, the hypersphere radius constraint does not directly discard the entire sample due to small fluctuations in the numerical values ​​of a single component. This effectively improves the local sampling pass rate and retains valid samples that meet compliance requirements after aggregation by the two participating parties. At the same time, the client and server can locally remove unqualified temporary responses with severely out-of-limit values ​​in advance, avoiding invalid data from participating in cross-node interactions and subsequent aggregation operations, reducing communication overhead and redundant computation. Furthermore, the local verification limit on the overall amplitude of the temporary response can also prevent the global vector value from exceeding the limit after the linear superposition of the local responses of the two parties, causing signature failure. The smooth hypersphere constraint boundary can also eliminate the non-uniform rejection bias caused by cubic sampling, weaken the deterministic data characteristics introduced by the private key and challenge value, and prevent attackers from deducing private key information based on verification failure feedback and signature prompt information. This improves the efficiency of collaborative signature while ensuring the security of the private key and signature prompt information.

[0086] As described above, during the local signature stage, since the first local component of each temporary response is obtained by performing inverse compression on the first sub-component of the random mask, this inverse compression operation converges the high-bit component value range to the numerical boundary of the fixed hypersphere, reduces the fluctuation range of single component values, and constrains the overall vector L2 norm amplitude. This makes the generated temporary response more likely to pass the hypersphere norm check, improves the single sampling hit rate, and filters out unqualified signature attempts locally in advance.

[0087] After selecting candidate responses, an amplitude amplification transformation is performed on the first local component of the candidate responses to obtain the first target response. The candidate response includes a first local component and a second local component. Only the first local component is subjected to the amplitude amplification transformation to obtain the transformed first local component, while the value of the second local component remains unchanged. Thus, the transformed first local component is determined as the first local component of the first target response, and the original second local component is determined as the second local component of the first target response. In other words, the first target response serves as the final local response corresponding to the client, participating in subsequent signature aggregation processing.

[0088] Once the first target response is generated, it can be broadcast. Similarly, once the server generates the second target response, it can be broadcast. The second target response is obtained by performing the same amplitude amplification transformation on the first local component of its locally generated server candidate response. Specifically, the second target response can be generated using the same implementation method as the first target response, which will not be elaborated further here.

[0089] After receiving the second target response from the server, the first target response and the second target response are aggregated to obtain the global response.

[0090] However, in practical applications, since the second part of the target response is associated with sensitive private key data, it is very easy to cause privacy leakage if it is publicly transmitted. Therefore, in order to avoid the risk of private data leakage and prevent external attackers from reverse-engineering the private key information and the privacy information of the signature hint by using the transmitted data, when the client broadcasts the first target response and the server broadcasts the second target response, the client can broadcast only the first part of the first target response and the server can broadcast only the first part of the second target response.

[0091] Therefore, when generating the global response, the first component of the first target response and the first component of the second target response can be aggregated to obtain the first global component of the global response. The first commitment value corresponding to the client is determined, and the second commitment value corresponding to the server is received. The first and second commitment values ​​are then aggregated to obtain the aggregated commitment value. The corresponding challenge value is also determined. Finally, based on the aggregated commitment value, the public key matrix, the first global component of the global response, the challenge value, and the compressed public key information in the verification public key, the second global component of the global response is obtained.

[0092] In specific implementation, assuming the first target response includes transformed first target local components and second target local components, and the second target response includes transformed third target local components and fourth target local components, then an optional implementation for aggregating the first and second target responses to obtain the global response can be as follows: Receive the transformed third target local component broadcast by the server; aggregate the transformed first and third target local components to obtain the aggregated first global component; determine the first commitment value corresponding to the client; receive the second commitment value corresponding to the server; aggregate the first and second commitment values ​​to obtain the aggregated commitment value; determine its corresponding challenge value; and then, based on the aggregated commitment value, the public key matrix, the first global component of the global response, the challenge value, and the compressed public key information in the verification public key, generate the second global component. Based on the first and second global components, generate the global response.

[0093] The challenge value is generated based on the message to be signed and the public key hash, which is obtained by hashing the high-order public key component and the sampling seed.

[0094] After obtaining the global response, a low-order deviation term is determined based on the global response, and the signature hint information is determined based on this low-order deviation term. The low-order deviation term refers to the second global component in the global response that retains complete low-order error details and is not publicly transmitted. It is used to characterize the subtle deviation features generated during the global response fitting process and is the core basic parameter for generating compliant signature hint information. The signature hint information refers to lightweight publicly available verification parameters generated by combining the low-order deviation term and multiple global signature parameters, used to assist in recovering intermediate commitment values ​​during the verification process.

[0095] In practical implementation, the second global component in the global response can be identified as the low-order bias term. A hint function is then used to generate a signature hint message based on this low-order bias term. Specifically, when generating the signature hint message using the hint function, the hint function can calculate the signature hint message based on the low-order bias term, the first global component of the global response vector, the high-order public key component, and the challenge value.

[0096] Finally, norm compliance threshold checks are performed on the first global component, the low-order deviation term, and the signature hint information in the global response. Specifically, before performing collaborative signature processing, the norm compliance threshold checks for the first global component, the low-order deviation term, and the signature hint information can be pre-configured. This is equivalent to applying different rejection sampling strategies to the high-order and low-order parts of the global response to improve the rejection sampling pass rate, thereby increasing signature generation efficiency. Furthermore, by configuring the norm compliance thresholds for the first global component, the low-order deviation term, and the signature hint information in a hierarchical manner, it can be ensured that the low-order part does not exceed the bounds, thus avoiding the risk of leakage through the signature hint information.

[0097] In the specific implementation process, the preset response threshold corresponding to the first global component is set as follows: Where γ1 is the range of randomness, This is the signature norm bound / short vector upper bound parameter. Set the preset deviation threshold corresponding to the low-order deviation term to... And, set the preset sparsity upper limit for the signature hint information to... ω represents the upper bound of the Hamming weight for the prompt message.

[0098] Next, it is determined whether the first global component in the global response satisfies the following conditions: its infinity norm is less than a preset response threshold; the low-order deviation term satisfies the following condition: its infinity norm does not exceed a preset deviation threshold; and the signature hint information satisfies the following condition: its Hamming weight does not exceed a preset sparsity upper limit. If the first global component satisfies the following conditions: its infinity norm is less than the preset response threshold; the low-order deviation term satisfies the following condition: its infinity norm does not exceed the preset deviation threshold; and the signature hint information satisfies the following condition: its Hamming weight does not exceed a preset sparsity upper limit, then the collaborative signing with the server is determined to be successful. Based on the temporary challenge corresponding to the target signature attempt instance, the first global component, and the signature hint information, a target signature corresponding to the message to be signed is generated.

[0099] Among them, the temporary challenge refers to the dynamic challenge parameter obtained by jointly calculating the first commitment value and the message digest. It is used to bind the random characteristics of a single signature attempt with the attributes of the message to be signed, which can ensure the uniqueness and non-reusability of each round of signature challenge. At the same time, as the core input parameter for generating the target signature, it ensures that the generated target signature is fully compatible with the standard ML-DSA signature format and verification logic.

[0100] As described above, during the signature aggregation stage, by applying a uniform expansion coefficient to the first local component of the filtered candidate response for positive amplitude restoration, and by using the same amplitude scaling component aggregation at both ends of the server and client to offset the scaling transformation, the aggregated global response is more likely to satisfy the strict infinite norm constraint, thereby significantly reducing the rejection rate caused by response exceeding the limit. Furthermore, by splitting the aggregated global response into a first global vector and a low-order deviation term, and configuring different norm thresholds for each of the first global vector, the low-order deviation term, and the signature hint information for verification, i.e., only a loose hypersphere norm verification is performed on temporary responses during the local filtering stage, while strict norm compliance verification is performed on the first global component, the low-order deviation term, and the signature hint information after global aggregation, this hierarchical rejection sampling mechanism avoids prematurely rejecting valid instances that could be accepted through global coordination locally.

[0101] In summary, in this embodiment, when the client collaborates with the server to perform signature processing, the client generates multiple signature attempt instances in parallel. For each signature attempt instance, the client performs differential amplitude processing on each component of its original random vector to generate a random mask, and only performs reverse compression on the first sub-component of the random mask to construct a temporary response. This effectively suppresses the deterministic information introduced by the challenge and private key, making the overall distribution of the temporary response closer to pure noise, and making it easier to pass the local hypersphere rejection sampling verification. This not only avoids discarding valid instances that can be aggregated due to excessive local screening, ensuring the efficiency of signature generation, but also allows each participating party to independently complete the verification and screening locally without exchanging any sensitive intermediate data when screening candidate responses that have passed the verification. Only the target responses that have passed the verification are retained for subsequent signature aggregation, so as to filter out a large number of non-compliant samples in advance and avoid sending invalid intermediate results into subsequent aggregation or triggering multiple rounds of retries. Thus, efficient collaborative signature between the two parties is achieved. In other words, by employing an unbalanced hypersphere rejection sampling strategy, the two components of the random mask are differentiated to generate a temporary response. This is then combined with hypersphere norm verification to filter out candidate responses that pass the verification. This effectively improves the rejection sampling pass rate, thereby increasing signature generation efficiency. Furthermore, the client and server use a completely unified amplitude amplification transformation to process the first local component. The aggregation of the target responses from both ends can offset the numerical deviation caused by the scaling transformation, ensuring the global response conforms to the standard signature numerical constraints. This effectively reduces the probability of signature failure due to the aggregated global response exceeding numerical limits. By configuring independent norm thresholds for the aggregated global first component, the low-order deviation term, and the signature hint information, precise compliance verification is achieved, ensuring the final generated signature fully complies with standard security protocols. This balances the efficiency and reliability of collaborative signing between the two parties.

[0102] The following provides a detailed explanation of the specific implementation process of generating a temporary response based on the random mask corresponding to the target signature attempt instance in the above embodiments.

[0103] Figure 3 A flowchart for generating a temporary response, as provided in this application embodiment, is shown below. Figure 3 As shown, the method may specifically include the following steps: 301. Generate the first commitment value corresponding to the target signature attempt instance based on the random mask corresponding to the target signature attempt instance.

[0104] 302. Generate a message digest based on the message to be signed and the public key hash in the private key held by the client. The public key hash is obtained by hashing the sampling seed and the high-order public key components in the verification public key.

[0105] 303. Based on the first commitment value and the message digest, determine the challenge value corresponding to the target signature attempt instance.

[0106] 304. Based on the challenge value, the first private key component held by the client, and the random mask corresponding to the target signature attempt instance, generate a temporary response corresponding to the target signature attempt instance.

[0107] In practical implementation, firstly, based on the random mask corresponding to the target signature attempt instance, a first commitment value corresponding to the target signature attempt instance is generated. The first commitment value refers to a pre-constructed private commitment parameter generated by the client based on the local random mask and public key parameters. This parameter is used to lock the random sample characteristics of a single signature attempt, ensuring the traceability and immutability of the signature behavior, and is the core pre-construction parameter for collaborative signature interaction verification.

[0108] Specifically, a public key matrix can be obtained first, and a first commitment value corresponding to the target signature attempt instance can be generated based on the random mask, public key matrix, and identity matrix corresponding to the target signature attempt instance. The public key matrix is ​​used to perform modular arithmetic and constrain the algebraic consistency between the temporary response and the verification public key. In an optional embodiment, a specific implementation of generating the first commitment value corresponding to the target signature attempt instance based on the random mask, public key matrix, and identity matrix can be: concatenating the public key matrix and identity matrix to obtain the concatenation result; obtaining the first product value of the concatenation result and the random mask corresponding to the target signature attempt instance; and determining the first product value as the first commitment value corresponding to the target signature attempt instance.

[0109] In other words, by constructing a commitment value through matrix concatenation and product operations, the inherent parameters of the public key can be deeply bound to local random features, ensuring that the first commitment value of each round of signature attempts is unique and avoiding signature security vulnerabilities caused by commitment value reuse.

[0110] Next, a message digest is generated based on the public key hash in the private key component held by the client and the message to be signed. The public key candidate is obtained by hashing the sampling seed and the high-order public key components of the verification public key; it is used to bind the identity of the signing public key, ensuring a one-to-one correspondence between the signing action and a legitimate public key, and preventing unauthorized entities from forging signature requests. For example, suppose the message to be signed is... The public key hash is The generated message digest is .

[0111] Then, based on the first commitment value and the message digest, the challenge value corresponding to the target signature attempt instance is determined. The challenge value is a dynamic verification vector generated by aggregating the commitment information and message characteristics of both parties. It is used to constrain the generation range of local responses, associate random signature samples with the message to be signed, prevent replay attacks and signature forgery, and adapt to the numerical constraints of hypersphere rejection sampling, ensuring that the signature result complies with post-quantum security specifications.

[0112] In one optional embodiment, a specific possible implementation of determining the challenge value may be: receiving a second commitment value corresponding to the target signature attempt instance sent by the server; aggregating the first commitment value and the second commitment value to obtain an aggregated commitment value corresponding to the target signature attempt instance; and extracting high-order bits of a preset length from the aggregated commitment value to obtain commitment compression. Based on commitment compression and message digest, generate the challenge value corresponding to the target signature attempt instance.

[0113] Among them, high-order compression of aggregated commitment values ​​can simplify the dimensions of commitment data, eliminate redundant low-order information, retain core commitment features, adapt to the vector generation rules of subsequent challenge values, and balance computational efficiency and data security.

[0114] In practical applications, to ensure the legitimacy and authenticity of the commitment exchanges between the two parties and to prevent malicious nodes from forging false commitment values ​​to interfere with the signature process, multiple commitment hashes broadcast by the server can be received before receiving the second commitment value corresponding to the target signature attempt instance sent by the server. The format of the target commitment hash is verified, and if the verification passes, the first commitment value corresponding to the target signature attempt instance is broadcast.

[0115] The multiple commitment hashes include the target commitment hash corresponding to the target signature attempt instance. The target commitment hash is obtained by hashing the second commitment value corresponding to the target signature attempt instance, the instance index of the target signature attempt instance, and the verification public key used to verify the signature. By binding the commitment value, instance index, and verification public key to generate a hash verification value, each round of parallel signature attempt instance can be accurately matched, avoiding parameter confusion when multiple instances are processed in parallel, and simultaneously realizing pre-validation of the server-side commitment data.

[0116] One possible implementation for generating the challenge value corresponding to the target signature attempt instance based on commitment compression and the message digest is as follows: A hash operation is performed on the concatenation result of the message digest and commitment compression to obtain a temporary challenge corresponding to the target signature attempt instance. A sampler is then used to convert the bit string corresponding to the temporary challenge into an integer vector with a fixed Euclidean norm, which serves as the challenge value corresponding to the target signature attempt instance. The integer vector resides on a hypersphere centered at the origin with a preset radius. This method maps unordered hash bit strings to a regular hypersphere vector space, perfectly adapting to the hypersphere rejection sampling mechanism of this scheme, ensuring a uniform distribution of the generated challenge value, further improving the subsequent rejection sampling pass rate, and simultaneously avoiding the security flaws of the original cube sampling.

[0117] The step-by-step commitment interaction, hash verification, and hyperspherical challenge value generation mechanism enables secure and reliable interaction between the two signing nodes, effectively solving the problems of commitment forgery, parameter disorder, and low sampling pass rate in traditional collaborative signatures. At the same time, it hides private parameters throughout the process, avoiding private key fragmentation and leakage of sensitive intermediate data. While improving the efficiency of collaborative signatures, it fully guarantees the security, compliance, and stability of ML-DSA two-party collaborative signatures.

[0118] Finally, based on the challenge value, the first private key component held by the client, and the random mask corresponding to the target signature attempt instance, a temporary response corresponding to the target signature attempt instance is generated.

[0119] The random mask corresponding to the target signature attempt instance includes a transformed first random vector and a second random vector. One possible implementation for generating the temporary response corresponding to the target signature attempt instance is as follows: obtain the second product of the challenge value and the first private key component held by the client; split the second product into a first intermediate component and a second intermediate component; divide the first intermediate component by a preset expansion coefficient and superimpose the transformed first random vector to obtain a first local component; add the second random vector to the second intermediate component to obtain a second local component; and generate the temporary response corresponding to the target signature attempt instance based on the first and second local components.

[0120] Continuing with the example above, let's assume the random mask is... Obtain the second product of the challenge value and the first private key component held by the client. The second product value is split into a first intermediate component and a second intermediate component; the first intermediate component is divided by a preset expansion coefficient and superimposed with the transformed first random vector to obtain the first local component. The second random vector is added to the second intermediate component to obtain the second local component. Based on the first and second local components, a temporary response corresponding to the target signature attempt instance is generated, i.e. .

[0121] After a provisional response is generated, a norm sphere check is performed on the provisional response corresponding to the target signature attempt instance to determine whether the provisional response is within the target sphere. If the provisional response is within the target sphere, the target signature attempt instance has passed rejection sampling, and the provisional response corresponding to the target signature attempt instance is identified as a candidate response.

[0122] As described above, by employing differentiated amplitude processing for the two types of components of the random mask and combining this with hypersphere norm verification to achieve unbalanced rejection sampling, the rigid cubic sampling mechanism of the native ML-DSA is abandoned. This effectively relaxes the local single-end sampling constraint, significantly improving the rejection sampling pass rate in two-party collaborative signature scenarios and reducing the number of signature retries and invalid computation overhead. Simultaneously, by adopting an interaction strategy that only transmits the first local component externally and retains the private second local component locally, attackers are prevented from using publicly available interaction data to reverse-engineer private key fragments and hint information. This avoids the risks of private key leakage and signature hint information leakage inherent in traditional collaborative signatures. Furthermore, by using a unified scale transformation at both ends to offset aggregated numerical deviations, global response vector failure is avoided. Ultimately, while ensuring compatibility with the standard ML-DSA signature format and post-quantum security specifications, the sampling pass rate, signature generation efficiency, and privacy security of private keys and hints in two-party collaborative signatures are simultaneously improved.

[0123] The following explanation will focus on the collaborative signature operation performed by the server from the server's perspective.

[0124] Figure 4 A flowchart of another two-party collaborative signature method provided in the embodiments of this application is shown below. Figure 4 As shown, this method is applied to the server side, and specifically, the method may include the following steps: 401. Receive a collaborative signature request from the client for a message to be signed, and sample multiple random masks corresponding to signature attempt instances from the hypersphere in parallel. Each random mask is obtained by performing different amplitude amplification transformations on each component of the sampled original random vector.

[0125] 402. Generate a temporary response for each random mask, and perform a hypersphere norm check on each temporary response to filter out candidate responses that satisfy a preset radius constraint. The first local component of the temporary response is obtained by performing inverse compression on the first sub-component of the random mask.

[0126] 403. Perform amplitude amplification transformation on the first local component in the candidate response to obtain the second target response.

[0127] 404. Broadcast the second target response so that the client can aggregate its locally generated first target response and the server-generated second target response to obtain a global response. Based on the global response, determine the low-order deviation item and the signature hint information. If the first global component, the low-order deviation item and the signature hint information in the global response satisfy their respective norm compliance thresholds, then generate the target signature corresponding to the message to be signed based on the global response and the signature hint information.

[0128] When the server receives a collaborative signature request for a message to be signed from the client, it initiates multiple signature attempt instances in parallel. Random masks corresponding to these signature attempt instances are sampled from the hypersphere in parallel. Each random mask is obtained by performing different amplitude amplification transformations on each component of the sampled original random vector. A temporary response is generated based on each random mask, and a hypersphere norm check is performed on each temporary response to filter out candidate responses that meet a preset radius constraint. The first local component of the temporary response is obtained by performing inverse compression on the first sub-component of the random mask. An amplitude amplification transformation is performed on the first local component of the candidate response to obtain the second target response. The second target response is then broadcast. The specific operation process for each signature attempt instance is roughly the same; refer to the client-side execution process described above, and it will not be repeated here.

[0129] After receiving the second target response, the client aggregates its locally generated first target response and the server-generated second target response to obtain a global response. Based on the global response, the client determines the low-order deviation item and the signature hint information. If the first global component, the low-order deviation item, and the signature hint information in the global response satisfy their respective norm compliance thresholds, the client generates the target signature corresponding to the message to be signed based on the global response and the signature hint information.

[0130] In summary, in this embodiment, when the server and client collaboratively perform signature processing, multiple signature attempt instances are generated in parallel. For each signature attempt instance, the magnitude of each component of its original random vector is differentiated to generate a random mask. Only the first sub-component of the random mask is reverse-compressed to construct a temporary response. This effectively suppresses the deterministic information introduced by the challenge and private key, making the overall distribution of the temporary response closer to pure noise. This makes it easier to pass the local hypersphere rejection sampling verification. This not only avoids discarding valid instances that are compliant after aggregation due to excessive local screening, ensuring the efficiency of signature generation, but also allows each participant to independently complete the verification and screening locally without exchanging any sensitive intermediate data when screening candidate responses that have passed the verification. Only the target responses that have passed the verification are retained for subsequent signature aggregation, thus filtering out a large number of non-compliant samples in advance and avoiding sending invalid intermediate results into subsequent aggregation or triggering multiple rounds of retries. In other words, efficient collaborative signature between the two parties is achieved. In other words, by employing an unbalanced hypersphere rejection sampling strategy, the two components of the random mask are differentiated to generate a temporary response. This is then combined with hypersphere norm verification to filter out candidate responses that pass the verification. This effectively improves the rejection sampling pass rate, thereby increasing signature generation efficiency. Furthermore, the client and server use a completely unified amplitude amplification transformation to process the first local component. The aggregation of the target responses from both ends can offset the numerical deviation caused by the scaling transformation, ensuring the global response conforms to the standard signature numerical constraints. This effectively reduces the probability of signature failure due to the aggregated global response exceeding numerical limits. By configuring independent norm thresholds for the aggregated global first component, the low-order deviation term, and the signature hint information, precise compliance verification is achieved, ensuring the final generated signature fully complies with standard security protocols. This balances the efficiency and reliability of collaborative signing between the two parties.

[0131] To facilitate understanding of the above two-party collaborative signature scheme, the process will be illustrated below with a specific application scenario. In practice: The embodiments of this application use the following parameters: polynomial ring R, modulus q=8380417, ring dimension n=256, public key matrix dimensions k=4, l=4, Power2Round decomposition bit d=13, randomness range γ1=131072, commitment high-bit boundary γ2=95232, challenge sparsity τ=60, upper bound of Hamming weight of hint information ω=80, number of parallel instances K=2, and unbalanced expansion factor ν=3.

[0132] Before performing collaborative signing, the corresponding verification key must be generated first.

[0133] Specifically, for example, suppose the generated sampling seed is Expand to generate a public key matrix, i.e. .in, This refers to a deterministic pseudo-random expansion function, representing a k*l matrix where each element belongs to a ring. Then, the first sub-private key corresponding to the client is generated. ,Right now Similarly, the second sub-private key corresponding to the generated server is used. ,Right now .in, This represents a standard binomial distribution or a discrete Gaussian distribution. And it satisfies... S represents the complete private key. Next, based on the public key matrix, the identity matrix, and the complete private key, the lattice public key components are calculated. The public key vector is compressed to obtain the high-order public key component. Where d represents the number of bits in the factorization. This represents the high-order public key component. This represents the low-order public key component. A hash operation is performed on the high-order public key component and the sampling seed to obtain the public key hash. ,Right now The generated verification public key is: The first private key component corresponding to the client is The second private key component corresponding to the server is .

[0134] After the client receives the user's collaborative signature request for the message to be signed, the client and server... Through three rounds of interaction, the target signature corresponding to the message to be signed is generated collaboratively. Here, i=0 represents the client, and i=1 represents the server. Specifically, in the first round of interaction, the client and server execute the commitment phase in parallel to generate the first commitment value for the client and the second commitment value for the server, and then generate the hash corresponding to each commitment value.

[0135] For each parallel instance in, Perform the following operations: Sampling original random vectors Its satisfaction Let r be the radius of the hypersphere, r = 252833. Calculate the commitment value. Calculate the commitment hash Saved status Broadcast the commitment hashes corresponding to multiple signature attempt instances. .

[0136] In the second round of interaction, the client and server reveal their respective commitment values.

[0137] Specifically, receiving from the other party Verify the other party's commitment hash format, and if the format is correct, broadcast its own commitment value. And save. .

[0138] In the third round of interaction, the client collaboratively calculates the global response and executes the corresponding rejection sampling.

[0139] The client and server respectively perform the following operations to generate a global response. Specifically, this involves obtaining the other party's commitment value. And verify the commitment value, for .

[0140] Calculate global parameters. Specifically, calculate the message digest. For each signature attempt instance, compute its corresponding aggregated commitment value. And extract the high-order bits of a preset length from the aggregated commitment value to obtain commitment compression. Select a successful instance, i.e., find This ensures that subsequent verification passes. Calculate the temporary challenge. and challenge value .

[0141] Perform unbalanced hypersphere rejection sampling to filter out the target response.

[0142] Specifically, obtain the second product value of the challenge value and the first private key component held by the client. A random mask can be written as: ,in, Calculate the temporary response. ,like If the result is not found, the verification fails; otherwise, the target response is output. Finally, only the first local component of the target response is broadcast. If all K instances fail, the protocol restarts the collaborative signature mechanism.

[0143] The client and server perform signature aggregation to generate a global response.

[0144] Specifically, the index of the verified signature instance used for recovery. Calculate the aggregated commitment And extract the corresponding commitment compression The corresponding temporary commitment and commitment value Aggregate the responses to obtain the global response, i.e., the first global component is... The second global component is Calculate the low-level deviation Calculate signature hint information Perform a global rejection check on it. .

[0145] like If the result is not found, the collaborative signature will fail; otherwise, the target signature will be generated. .

[0146] After generating the target signature corresponding to the message to be signed, the standard ML-DSA verification algorithm is used to verify it.

[0147] Specifically, calculate the common matrix. Calculate message digest Calculate the commitment value and commitment to compression And perform a global check on it; if... If the result is positive, the collaborative signature verification passes; otherwise, the verification fails.

[0148] In summary, this embodiment employs a distributed signature key generation system, where keys are generated independently on both the client and server sides. Even if the client leaks the key, a successful signature forgery will not be possible. Furthermore, it eliminates the need to modify the MLDSA verification algorithm, utilizing imbalanced rejection sampling and hypersphere rejection sampling mechanisms to effectively protect the security of the post-quantum signature hint value and improve signature efficiency.

[0149] The following describes in detail one or more embodiments of a two-party collaborative signature apparatus according to this application. Those skilled in the art will understand that these apparatuses can be configured using commercially available hardware components through the steps taught in this solution.

[0150] Figure 5 This application provides a schematic diagram of the structure of a two-party collaborative signature device, as shown in the embodiments. Figure 5 As shown, applied to the client, specifically, the device includes: sampling module 11, filtering module 12, transformation module 13, aggregation module 14, determination module 15, and generation module 16.

[0151] The sampling module 11 is used to sample random masks corresponding to multiple signature attempt instances from the hypersphere in parallel in response to a collaborative signature request for a message to be signed; each random mask is obtained by performing different amplitude amplification transformations on the two components of the original random vector obtained by sampling.

[0152] The filtering module 12 is used to generate a corresponding temporary response based on each random mask, and to perform hypersphere norm verification on each temporary response to filter out candidate responses that meet the preset radius constraints; the temporary response consists of a first local component and a second local component, and the first local component is obtained by performing inverse compression on the first sub-component of the random mask.

[0153] Transformation module 13 is used to perform amplitude amplification transformation on the first local component in the candidate response to obtain the first target response.

[0154] The aggregation module 14 is used to receive the second target response sent by the server, aggregate the first target response and the second target response to obtain a global response; the second target response is obtained by the server performing the same amplitude amplification transformation on the first local component of its locally generated server candidate response.

[0155] The determination module 15 is used to determine the low-order deviation item and signature prompt information based on the global response.

[0156] The generation module 16 is used to generate a target signature corresponding to the message to be signed based on the global response and the signature prompt information if the first global component in the global response, the low-order deviation term, and the signature prompt information respectively satisfy their respective norm compliance thresholds.

[0157] Optionally, the sampling module 11 is specifically configured to: sample the original random vector corresponding to the target signature attempt instance from a preset hypersphere for the target signature attempt instance, the original random vector including a first random vector and a second random vector; the target signature attempt instance is any one of the plurality of signature attempt instances; perform amplitude amplification transformation on the first random vector to obtain a transformed first random vector; determine the transformed first random vector as the first sub-component in the random mask corresponding to the target signature attempt instance, and determine the second random vector as the second sub-component in the random mask corresponding to the target signature attempt instance.

[0158] Optionally, the filtering module 12 is specifically configured to: generate a first commitment value corresponding to the target signature attempt instance based on the random mask corresponding to the target signature attempt instance; generate a message digest based on the message to be signed and the public key hash in the private key component held by the client; the public key hash is obtained by hashing the sampling seed and the high-order public key component in the verification public key used to verify the signature; wherein the sampling seed is issued by the server or generated by the client through local secure random sampling, and all signature attempt instances share the same set of sampling seeds; determine the challenge value corresponding to the target signature attempt instance based on the first commitment value and the message digest; and generate a temporary response corresponding to the target signature attempt instance based on the challenge value, the first private key component held by the client, and the random mask corresponding to the target signature attempt instance.

[0159] Optionally, the filtering module 12 is specifically used to: obtain a public key matrix; the public key matrix is ​​used to perform modular arithmetic and constrain the algebraic consistency between the temporary response and the verification public key; and generate a first commitment value corresponding to the target signature attempt instance based on the random mask corresponding to the target signature attempt instance, the public key matrix, and the identity matrix.

[0160] Optionally, the filtering module 12 is specifically used to: concatenate the public key matrix and the identity matrix to obtain a concatenation result; obtain the first product value of the concatenation result and the random mask corresponding to the target signature attempt instance; and determine the first product value as the first commitment value corresponding to the target signature attempt instance.

[0161] Optionally, the filtering module 12 is specifically configured to: receive a second commitment value corresponding to the target signature attempt instance sent by the server; aggregate the first commitment value and the second commitment value to obtain an aggregated commitment value corresponding to the target signature attempt instance; extract high-order information of a preset length from the aggregated commitment value to obtain commitment compression; and generate a challenge value corresponding to the target signature attempt instance based on the commitment compression and the message digest.

[0162] Optionally, the filtering module 12 is further configured to: receive multiple commitment hashes broadcast by the server; the multiple commitment hashes include a target commitment hash corresponding to the target signature attempt instance; the target commitment hash is obtained by hashing the second commitment value corresponding to the target signature attempt instance, the instance index of the target signature attempt instance, and the verification public key used to verify the signature; verify the format of the target commitment hash, and if the verification is successful, broadcast the first commitment value corresponding to the target signature attempt instance.

[0163] Optionally, the filtering module 12 is specifically used to: perform a hash operation on the concatenation result of the message digest and the commitment compression to obtain a temporary challenge corresponding to the target signature attempt instance; and convert the bit string corresponding to the temporary challenge into an integer vector with a fixed Euclidean norm through a sampler, as the challenge value corresponding to the target signature attempt instance; wherein the integer vector is located on a hypersphere centered at the origin and bounded by a preset radius.

[0164] Optionally, the random mask corresponding to the target signature attempt instance includes a transformed first random vector and a second random vector; the filtering module 12 is specifically used to: obtain the second product value of the challenge value and the first private key component held by the client; split the second product value into a first intermediate component and a second intermediate component; divide the first intermediate component by a preset expansion coefficient and superimpose the transformed first random vector to obtain a first local component; perform an addition operation between the second random vector and the second intermediate component to obtain a second local component; and generate a temporary response corresponding to the target signature attempt instance based on the first local component and the second local component.

[0165] Optionally, the filtering module 12 is specifically used to: perform norm sphere verification on the temporary response corresponding to the target signature attempt instance to determine whether the temporary response corresponding to the target signature attempt instance is located within the target sphere; if the temporary response corresponding to the target signature attempt instance is located within the target sphere, then it is determined that the target signature attempt instance has passed the rejection sampling, and the temporary response corresponding to the target signature attempt instance is determined as a candidate response.

[0166] Optionally, the first target response includes a transformed first target local component and a second target local component, and the second target response includes a transformed third target local component and a fourth target local component; the aggregation module 14 is specifically used to: receive the transformed third target local component broadcast by the server; aggregate the transformed first target local component and the transformed third target local component to obtain an aggregated first global component; generate a second global component based on the aggregated commitment value corresponding to the target signature attempt instance, the public key matrix, the aggregated first global component, the challenge value corresponding to the target signature attempt instance, and the compressed public key information in the verification public key; and generate a global response based on the first global component and the second global component.

[0167] Optionally, the determining module 15 is specifically used to: determine the second global component in the global response as a low-order deviation term; and generate signature prompt information based on the low-order deviation term using a prompt function.

[0168] Optionally, the generation module 16 is specifically used to: determine whether the first global component in the global response satisfies that its infinity norm is less than a preset response threshold, whether the low-order deviation term satisfies that its infinity norm does not exceed a preset deviation threshold, and whether the signature prompt information satisfies that its Hamming weight does not exceed a preset sparsity upper limit; if the first global component satisfies that its infinity norm is less than the preset response threshold, the low-order deviation term satisfies that its infinity norm does not exceed the preset deviation threshold, and the signature prompt information satisfies that its Hamming weight does not exceed a preset sparsity upper limit, then it is determined that the collaborative signing with the server is successful; based on the temporary challenge corresponding to the target signature attempt instance, the first global component, and the signature prompt information, a target signature corresponding to the message to be signed is generated.

[0169] Figure 5 The device shown can perform the steps corresponding to the client in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0170] In one possible design, the above Figure 5 The structure of the two-party collaborative signature device shown can be implemented as an electronic device, such as... Figure 6 As shown, the electronic device may include: a memory 21, a processor 22, and a communication interface 23. The memory 21 stores a computer program, which, when executed by the processor 22, enables the processor 22 to at least implement the two-party collaborative signature method executed by the client as provided in the foregoing embodiments.

[0171] The aforementioned memory 21 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0172] Figure 7 This is a schematic diagram of another two-party collaborative signature device provided in an embodiment of this application, applied to the server side, such as... Figure 7 As shown, the device includes: a receiving module 31, a filtering module 32, a transformation module 33, and a broadcasting module 34.

[0173] The receiving module 31 is used to receive the collaborative signature request for the message to be signed sent by the client, and to sample multiple random masks corresponding to signature attempt instances from the hypersphere in parallel; each random mask is obtained by performing different amplitude amplification transformations on each component of the sampled original random vector.

[0174] The filtering module 32 is used to generate a corresponding temporary response based on each random mask, and perform hypersphere norm verification on each temporary response to filter out candidate responses that meet the preset radius constraints; the first local component of the temporary response is obtained by performing inverse compression on the first sub-component of the random mask.

[0175] The transformation module 33 is used to perform amplitude amplification transformation on the first local component in the candidate response to obtain the second target response.

[0176] The broadcast module 34 is used to broadcast the second target response so that the client aggregates its locally generated first target response and the second target response generated by the server to obtain a global response, and determines the low-order deviation item and signature hint information based on the global response; if the first global component, the low-order deviation item and the signature hint information in the global response satisfy their respective norm compliance thresholds, then the target signature corresponding to the message to be signed is generated based on the global response and the signature hint information.

[0177] The first target response is obtained by the client performing an amplitude amplification transformation on the first local vector in its locally generated client candidate response.

[0178] Figure 7 The device shown can perform the steps described in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0179] In one possible design, the above Figure 7 The structure of the two-party collaborative signature device shown can be implemented as an electronic device, such as... Figure 8 As shown, the electronic device may include: a memory 41, a processor 42, and a communication interface 43. The memory 41 stores executable code, which, when executed by the processor 42, enables the processor 42 to at least implement the two-party collaborative signature method executed by the server as provided in the foregoing embodiments.

[0180] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement the steps in the above-described method embodiments. The computer-readable storage medium includes volatile or non-volatile components, or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium.

[0181] Accordingly, this application also provides a computer program product, which includes a computer program or instructions that, when executed by a processor, cause the processor to implement the steps in the above method embodiments. It should be understood that each step or combination of steps in the above method flow can be implemented by the computer program or instructions. Furthermore, these computer programs or instructions can be applied to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device, enabling the processor of the general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to function as an apparatus for implementing the corresponding functions in the above method embodiments.

[0182] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0183] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of a necessary general-purpose hardware platform, or by a combination of hardware and software. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a computer product. This application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0184] Finally, it should be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0185] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A two-party collaborative signature method, characterized in that, Applied to a client, the method includes: In response to a collaborative signature request for a message to be signed, random masks corresponding to multiple signature attempt instances are sampled in parallel from the hypersphere; wherein each random mask is obtained by performing different magnitude amplification transformations on the two components of the sampled original random vector; Each temporary response is generated based on a random mask, and a hypersphere norm check is performed on each temporary response to filter out candidate responses that meet a preset radius constraint. The temporary response consists of a first local component and a second local component, and the first local component is obtained by performing inverse compression on the first sub-component of the random mask. Amplification transformation is performed on the first local component of the candidate response to obtain the first target response; The server receives a second target response and aggregates the first target response and the second target response to obtain a global response. The second target response is obtained by the server performing the same amplitude amplification transformation on the first local component of its locally generated server candidate response. Based on the global response, the low-order deviation item and signature prompt information are determined; If the first global component in the global response, the low-order deviation term, and the signature hint information each satisfy their respective norm compliance thresholds, then a target signature corresponding to the message to be signed is generated based on the global response and the signature hint information.

2. The method according to claim 1, characterized in that, The parallel sampling of random masks corresponding to multiple signature attempt instances from the hypersphere includes: For a target signature attempt instance, an original random vector corresponding to the target signature attempt instance is sampled from a preset hypersphere. The original random vector includes a first random vector and a second random vector. The target signature attempt instance is any one of the plurality of signature attempt instances. The first random vector is subjected to amplitude amplification transformation to obtain the transformed first random vector; The transformed first random vector is determined as the first sub-component in the random mask corresponding to the target signature attempt instance; The second random vector is determined as the second sub-component in the random mask corresponding to the target signature attempt instance.

3. The method according to claim 2, characterized in that, The process of generating a temporary response based on each random mask includes: Generate a first commitment value corresponding to the target signature attempt instance based on the random mask corresponding to the target signature attempt instance; A message digest is generated based on the message to be signed and the public key hash in the private key component held by the client; the public key hash is obtained by hashing the sampling seed and the high-order public key component in the verification public key used to verify the signature; wherein, the sampling seed is issued by the server or generated by the client through secure random sampling locally, and all signature attempt instances share the same set of sampling seeds; Based on the first commitment value and the message digest, determine the challenge value corresponding to the target signature attempt instance; Based on the challenge value, the first private key component held by the client, and the random mask corresponding to the target signature attempt instance, a temporary response corresponding to the target signature attempt instance is generated.

4. The method according to claim 3, characterized in that, The step of generating a first commitment value corresponding to the target signature attempt instance based on the random mask corresponding to the target signature attempt instance includes: Obtain the public key matrix; the public key matrix is ​​used to perform modular arithmetic and constrain the algebraic consistency between the temporary response and the verification public key; Based on the random mask corresponding to the target signature attempt instance, the public key matrix, and the identity matrix, a first commitment value corresponding to the target signature attempt instance is generated.

5. The method according to claim 4, characterized in that, The step of generating a first commitment value corresponding to the target signature attempt instance based on the random mask corresponding to the target signature attempt instance, the public key matrix, and the identity matrix includes: The public key matrix and the identity matrix are concatenated to obtain the concatenation result. Obtain the first product value of the concatenation result and the random mask corresponding to the target signature attempt instance; The first product value is determined as the first commitment value corresponding to the target signature attempt instance.

6. The method according to claim 3, characterized in that, The step of determining the challenge value corresponding to the target signature attempt instance based on the first commitment value and the message digest includes: Receive the second commitment value corresponding to the target signature attempt instance sent by the server; The first commitment value and the second commitment value are aggregated to obtain the aggregated commitment value corresponding to the target signature attempt instance; The high-order information of a preset length is extracted from the aggregated commitment value to obtain commitment compression; Based on the commitment compression and the message digest, a challenge value corresponding to the target signature attempt instance is generated.

7. The method according to claim 6, characterized in that, Before receiving the second commitment value corresponding to the target signature attempt instance sent by the server, the method further includes: Receive multiple commitment hashes broadcast by the server; the multiple commitment hashes include the target commitment hash corresponding to the target signature attempt instance; the target commitment hash is obtained by hashing the second commitment value corresponding to the target signature attempt instance, the instance index of the target signature attempt instance, and the verification public key used to verify the signature; The format of the target commitment hash is verified. If the verification is successful, the first commitment value corresponding to the target signature attempt instance is broadcast.

8. The method according to claim 6, characterized in that, The step of generating the challenge value corresponding to the target signature attempt instance based on the commitment compression and the message digest includes: A hash operation is performed on the concatenation result of the message digest and the commitment compression to obtain the temporary challenge corresponding to the target signature attempt instance; The sampler converts the bit string corresponding to the temporary challenge into an integer vector with a fixed Euclidean norm, which serves as the challenge value corresponding to the target signature attempt instance; wherein the integer vector is located on a hypersphere centered at the origin and bounded by a preset radius.

9. The method according to claim 8, characterized in that, The random mask corresponding to the target signature attempt instance includes the transformed first random vector and the second random vector; The step of generating a temporary response corresponding to the target signature attempt instance based on the challenge value, the first private key component held by the client, and the random mask corresponding to the target signature attempt instance includes: Obtain the second product of the challenge value and the first private key component held by the client; The second product value is split into a first intermediate component and a second intermediate component; Divide the first intermediate component by a preset expansion coefficient and superimpose the transformed first random vector to obtain the first local component; The second random vector is added to the second intermediate component to obtain the second local component; Based on the first local component and the second local component, a temporary response corresponding to the target signature attempt instance is generated.

10. The method according to claim 9, characterized in that, The step of performing a hypersphere norm check on each temporary response to filter out candidate responses that satisfy a preset radius constraint includes: Perform norm sphere verification on the temporary response corresponding to the target signature attempt instance to determine whether the temporary response corresponding to the target signature attempt instance is located within the target sphere; If the temporary response corresponding to the target signature attempt instance is located within the target sphere, then the target signature attempt instance has been rejected and the temporary response corresponding to the target signature attempt instance is determined as a candidate response.

11. The method according to claim 10, characterized in that, The first target response includes a transformed first target local component and a second target local component, and the second target response includes a transformed third target local component and a fourth target local component; The second target response sent by the receiving server is aggregated with the first target response and the second target response to obtain a global response, including: Receive the transformed third target local component broadcast by the server; The transformed first target local component and the transformed third target local component are aggregated to obtain the aggregated first global component; Based on the aggregated commitment value corresponding to the target signature attempt instance, the public key matrix, the aggregated first global component, the challenge value corresponding to the target signature attempt instance, and the compressed public key information in the verification public key, a second global component is generated; A global response is generated based on the first global component and the second global component.

12. The method according to claim 11, characterized in that, The step of determining the low-order deviation item and signature hint information based on the global response includes: The second global component in the global response is identified as the low-order deviation term. Using the prompt function, a signature prompt message is generated based on the low-order deviation term.

13. The method according to claim 12, characterized in that, If the first global component in the global response, the low-order deviation term, and the signature hint information each satisfy their respective norm compliance thresholds, then a target signature corresponding to the message to be signed is generated based on the global response and the signature hint information, including: Determine whether the first global component in the global response satisfies that its infinite norm is less than a preset response threshold, whether the low-bit deviation term satisfies that its infinite norm does not exceed a preset deviation threshold, and whether the signature prompt information satisfies that its Hamming weight does not exceed a preset sparsity upper limit. If the first global component satisfies that its infinity norm is less than a preset response threshold, the low-order deviation term satisfies that its infinity norm does not exceed a preset deviation threshold, and the signature prompt information satisfies that its Hamming weight does not exceed a preset sparsity upper limit, then it is determined that the collaborative signature with the server is successful. Based on the temporary challenge corresponding to the target signature attempt instance, the first global component, and the signature hint information, a target signature corresponding to the message to be signed is generated.

14. A two-party collaborative signature method, characterized in that, Applied to the server side, the method includes: It receives collaborative signature requests for messages to be signed from clients and samples random masks corresponding to multiple signature attempt instances from the hypersphere in parallel; each random mask is obtained by performing different amplitude amplification transformations on the two components of the sampled original random vector. Each temporary response is generated based on a random mask, and a hypersphere norm check is performed on each temporary response to filter out candidate responses that meet a preset radius constraint. The temporary response consists of a first local component and a second local component, and the first local component is obtained by performing inverse compression on the first sub-component of the random mask. The first local component in the candidate response is subjected to amplitude amplification transformation to obtain the second target response; The second target response is broadcast so that the client aggregates its locally generated first target response and the server-generated second target response to obtain a global response. Based on the global response, a low-order deviation item and a signature hint information are determined. If the first global component, the low-order deviation item, and the signature hint information in the global response each satisfy their respective norm compliance thresholds, a target signature corresponding to the message to be signed is generated based on the global response and the signature hint information. The first target response is obtained by the client performing amplitude amplification transformation on the first local component of the locally generated client candidate response. The client candidate response is obtained by the same operation as the locally generated candidate response of the server.

15. An electronic device, characterized in that, include: The system includes a memory, a processor, and a communication interface; wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the two-party collaborative signature method as described in any one of claims 1 to 14.

Images