Improved wots with reconfigurable security + Signature method

Abstract

The application discloses an improved WOTS with reconfigurable security + The signature method comprises the following steps: step 1, constructing an ideal one-time signature model; step 2, introducing a leakage interface, and modifying the ideal one-time signature model into an enhanced ideal one-time signature model; step 3, introducing a public key recovery mechanism, and extending the enhanced ideal one-time signature model into an improved ideal one-time signature model; step 4, based on the improved ideal one-time signature model, adjusting the WOTS + one-time signature construction; and step 5, establishing the consistency between the WOTS + one-time signature construction and the improved ideal one-time signature model. By introducing the leakage interface, the ideal one-time signature model can reflect the structural information leakage generated by multiple signatures, thereby eliminating the inconsistency in the ability between the existing ideal one-time signature model and the actual construction, and enabling the ideal one-time signature model to more accurately describe the real behavior based on the hash chain signature structure.

Description

Technical Field

[0001] This invention belongs to the field of information security and cryptography technology, and relates to an improved WOTS with reconfigurable security. + Signature method. Background Technology

[0002] One-Time Signature (OTS) is a signature scheme developed by SPHINCS. + The basic building blocks of a signature system are used to implement the signing and verification operations for a single message. However, the existing ideal model for one-time signatures has limited functionality, only including key generation, signature generation, and signature verification interfaces. (SPHINCS) + In multi-layered signature structures, the verification process often requires recovering the corresponding public key value from the signature information in order to continue verifying the upper layers. Existing ideal models typically do not support the operation of recovering the public key from the signature, making them difficult to directly use for analyzing SPHINCS. + Reconfigurable security of signature systems.

[0003] Furthermore, the ideal model for one-time signatures abstracts the signing process using an "atomic interface," implicitly assuming that the signing operation introduces no information loss. In actual construction, the security of one-time signatures strictly relies on the premise of "single use." When the same private key is used to sign multiple different messages, the signing process is no longer lossless. That is, attackers can use multiple signatures corresponding to different messages to construct message combinations that satisfy specific relationships, thereby forging new valid signatures without possessing the complete private key. Existing ideal models do not characterize this "information leakage caused by multiple signatures," leading to an asymmetry in security capabilities between the ideal world and the real world. In indistinguishability analysis, this asymmetry can be directly exploited by attackers. For example, attackers can initiate multiple signature queries and construct related inputs to gain additional capabilities in the real world, while the ideal world cannot simulate this behavior, causing the simulator to fail. This solution effectively solves this problem. Summary of the Invention

[0004] In order to overcome the shortcomings of at least one prior art, this invention proposes a reconfigurable security enhancement method for hash signature schemes. By coordinating the modification of the ideal signature model and its specific construction, the actual signature system is equivalent to the ideal signature primitive in the sense of indistinguishability.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: an improved WOTS with reconfigurable safety. + The signature method includes the following steps: Step 1: Construct an ideal one-time signature model; Step 2: Introduce a leaked interface to modify the ideal one-time signature model into an enhanced ideal one-time signature model; Step 3: Introduce a public key recovery mechanism to extend the enhanced ideal one-time signature model into an improved ideal one-time signature model; Step 4: Adjust WOTS based on the improved ideal one-time signature model. + One-time signature construction; Step 5: Create WOTS + Consistency between one-time signature construction and improved ideal one-time signature model.

[0006] Furthermore, the leakage interface is used to describe information leakage caused by multiple signatures.

[0007] Furthermore, the enhanced ideal one-time signature model reflects the changes in capability resulting from multiple signatures under the same key.

[0008] Furthermore, the public key recovery mechanism extends the signature verification interface of the enhanced ideal one-time signature model into a recovery interface.

[0009] Furthermore, the recovery interface outputs the signature validity determination result and recovers the corresponding public key value based on the input message and signature, so as to depict the actual calculation process in the hash chain signature structure.

[0010] Furthermore, the improved ideal one-time signature model characterizes the information leakage caused by multiple signatures and the state recovery capability during the verification process, so that the ideal function is consistent with the real structure in terms of expressive ability.

[0011] Furthermore, the improved ideal one-time signature model defines SK, PK, , and These are the private key space, public key space, message space, random number space, and signature space, respectively, sk, pk, m, , These are the private key, public key, message, signature, and random number, respectively; define f as a leak function. Define the injective set of all elements from SK to PK. For all from arrive The set of functions, and for each Its induced flow from SK to The mapping is injective, and the public key can recover an ideal one-time signature. By from The function is defined by randomly sampling a pair of functions (g, h) and a leaking function f, and provides the following four interfaces to the outside world: Key generation algorithm :enter ,return ; ·Signature Algorithm :enter , , Returns h(sk, m, r); Public key recovery algorithm :enter , It must exist. , , making , returns g(sk); Leakage Algorithm :enter , (m0 and m1 are messages,) (forging messages for the target) ( For signing, perform the following operations: like Then let r from Random sampling in the middle, return If pk = g(sk), otherwise return 0.

[0012] Furthermore, the WOTS + The structural modifications to one-time signature construction include random preprocessing of the key, introduction of random permutations into the public key structure, and introduction of a message-based ideal cryptographic mapping into the signature result.

[0013] Furthermore, the WOTS + The adjustment objects for constructing a one-time signature include the interface to be leaked, the key generation method, the public key generation method, the signature generation method, and the signature verification method. Key generation method: The initial key is mapped to the starting point of a hash chain in vector form through a random oracle, thus unifying the generation method of each hash chain; Public key generation method: The public key is output after the endpoints of each hash chain are processed as a whole, so that the public key can be used as the whole structure; Signature generation method: The input message is preprocessed and parsed into a representation sequence. After obtaining the intermediate signature by performing hash chain iteration based on the representation sequence, a transformation related to the message is introduced to bind the signature result to the message. Signature verification method: Based on the public key recovery mechanism, the intermediate signature is first recovered by performing an inverse transformation on the signature according to the message, and then the corresponding public key is recovered by completing the hash chain operation, and the signature verification is completed accordingly, so that the verification process is consistent with the public key recovery process; Leaked interface handling: When an attacker obtains multiple legitimate signatures that meet specific association conditions, it allows for the iterative synthesis of forged signatures through a random oracle.

[0014] Furthermore, based on the improved ideal one-time signature model, WOTS is adjusted. + Methods for constructing one-time signatures include Step 41: Adjust the key generation method: Map the initial key to the starting point of the hash chain in vector form through a random oracle, and unify the generation method of each hash chain; Step 42: Adjust the key generation method: Process the endpoints of each hash chain as a whole before outputting the public key, so that the public key can be used as the whole structure; Step 43: Adjust the signature generation method: After obtaining the intermediate signature by performing hash chain iteration based on the message, introduce a transformation related to the message to bind the signature result to the message; Step 44: Constructing the public key recovery and verification process: In the verification phase, first, perform an inverse transformation on the signature based on the message to recover the intermediate signature, then recover the corresponding public key by completing the hash chain operation, and complete the signature verification accordingly, so that the verification process is consistent with the public key recovery process; Step 45: Characterize the information evolution under multiple signatures: When the same key is used to sign multiple messages, the relationship between different signatures is described through the iterative relationship of the hash chain, so that the system can reflect the process of information being gradually exposed and be consistent with the behavior described by the corrupt interface.

[0015] In summary, the advantages of this invention are: This invention provides a security enhancement method for signature schemes based on hash chain structure. By modifying the public key generation, signature generation and verification interfaces, the security and structural consistency of the signature system in complex protocol environments are improved.

[0016] This invention addresses the problem of information leakage caused by multiple signatures in existing ideal one-time signature models. By introducing a corruption interface, this invention enables the ideal one-time signature model to reflect the structured information leakage caused by multiple signatures, thereby eliminating the inconsistency between existing ideal one-time signature models and actual constructions. This improvement allows the ideal one-time signature model to more accurately describe the real behavior based on hash chain signature structures.

[0017] This invention introduces a public key recovery mechanism into the ideal one-time signature model, enabling the verification process not only to determine the validity of the signature but also to recover the corresponding public key from the signature. This mechanism is consistent with the calculation process in actual hash signature structures, allowing the ideal one-time signature model to support the transfer of intermediate states in multi-layer signature structures, thereby providing a unified interface for the security analysis of complex signature systems.

[0018] This invention relates to WOTS + The construction has been systematically modified. Through improvements and adjustments to the ideal one-time signature model, this one-time signature scheme can support indistinguishability analysis under a random oracle model, providing a foundation for its application within a reconfigurable security framework. Compared to signature schemes that only meet traditional unforgeability requirements, this invention is applicable to more complex cryptographic system environments. Attached Figure Description

[0019] Figure 1 The public key of this invention can recover the ideal one-time signature oSig PR Schematic diagram.

[0020] Figure 2 This is a diagram showing the relationship between the variables and the algorithm of this invention.

[0021] Figure 3 This is a schematic diagram illustrating the instantiation of primitives in this invention.

[0022] Figure 4 This is a code illustration of the present invention. Figure 1 .

[0023] Figure 5 This is a code illustration of the present invention. Figure 2 .

[0024] Figure 6 This is a code illustration of the present invention. Figure 3 .

[0025] Figure 7 This is a code illustration of the present invention. Figure 4 .

[0026] Figure 8 This is a code illustration of the present invention. Figure 5 . Detailed Implementation

[0027] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features described therein can be combined with each other.

[0028] Example: like Figures 1-8 As shown, an improved WOTS with reconfigurable security. + The signature method includes the following steps: Step 1: Construct an ideal one-time signature model: An ideal one-time signature model is established, which includes interfaces for key generation, signature generation, and signature verification. This model is used to describe the basic behavior of a signature system. Based on existing work, the model provides three basic interfaces for key generation, signature generation, and signature verification to describe the functional characteristics of a signature system in an ideal environment.

[0029] Step 2: Introduce a leaked interface to modify the ideal one-time signature model into an enhanced ideal one-time signature model; The corruption interface is used to describe the information leakage caused by multiple signatures. This step introduces a corruption interface on the basis of the ideal one-time signature model built in step 1, and extends it into an enhanced ideal one-time signature model. This enhances the ideal one-time signature model so that it can reflect the capability changes caused by the reuse of private keys in the real construction and the ability to synchronize real attacks in the ideal world. This allows the model to reflect the capability changes caused by multiple signatures under the same key, thereby avoiding inconsistencies between the ideal model and the actual construction.

[0030] When an attacker obtains multiple signatures that satisfy specific association conditions, the corrupt interface allows the ideal one-time signature model to synchronously provide forgery capabilities consistent with the real world, thereby eliminating the capability discrepancy between the two.

[0031] By introducing a leaked interface, the enhanced ideal one-time signature model maintains consistent behavior with the real construct when dealing with attacks involving multiple signatures and their relationships, thus ensuring the simulator remains consistent throughout the interaction. This improvement provides the necessary foundation for subsequent indistinguishability proofs, enabling security analysis of complex signature systems based on one-time signature components.

[0032] Step 3: Introduce a public key recovery mechanism to extend the enhanced ideal one-time signature model into an improved ideal one-time signature model; Considering the practical needs of multi-layer hash signature structures, this scheme requires further extension of the ideal one-time signature model. Therefore, this step extends the verification process in the ideal model, transforming the signature verification interface into a recovery interface. This interface not only outputs the signature validity determination result but also recovers the corresponding public key value based on the input message and signature, thus characterizing the actual computation process in the hash chain signature structure. This recovery process is considered part of the ideal functionality and is required to maintain consistency with the signature generation process; that is, any valid signature should be able to recover its corresponding public key value during verification. In other words, this scheme enables the signature result to uniquely identify the corresponding public key, thereby supporting recursive calls and consistency simulation in hierarchical signature structures.

[0033] This application introduces a public key recovery mechanism to enable the ideal one-time signature model to accurately reflect the information flow in the hash chain signature structure, thereby ensuring that the intermediate states passed between layers through signatures can be consistently characterized in the ideal world during subsequent construction.

[0034] The ideal one-time signature model, after being extended by introducing a leakage interface and a public key recovery mechanism, becomes the improved ideal one-time signature model. The improved ideal one-time signature model describes the information leakage caused by multiple signatures and the state recovery capability during the verification process, so that the ideal function is consistent with the real construction in terms of expressive ability, and provides a complete foundation for establishing an indistinguishable relationship between the specific construction and the ideal one-time signature model.

[0035] The improved ideal one-time signature model defines SK, PK, , and These are the private key space, public key space, message space, random number space, and signature space, respectively. sk, pk, m, , These are the private key, public key, message, signature, and random number, respectively; define f as a leak function. Define the injective set of all elements from SK to PK. For all from arrive The set of functions, and for each Its induced flow from SK to The mapping is injective. The public key can recover an ideal one-time signature. By from The function is defined by uniformly and randomly sampling a pair of functions (g, h) and a leakage function f, and provides the following four interfaces to the outside world: Key generation algorithm :enter , returns g(sk); ·Signature Algorithm :enter , , Returns h(sk, m, r); Public key recovery algorithm :enter , It must exist. , , making , returns g(sk); Leakage Algorithm :enter , (m0 and m1 are messages,) (forging messages for the target) ( For signing, perform the following operations: ·like Then let r from Random sampling in the middle, return ,in Otherwise, return 0.

[0036] Step 4: Adjust WOTS based on the improved ideal one-time signature model. + One-time signature construction enables specific constructions to correspond to various interfaces of the improved ideal one-time signature model in terms of interactive behavior; This step is for WOTS + One-time signature construction involves structural modifications, including random preprocessing of the key, introduction of random permutations into the public key structure, and the introduction of a message-based ideal cryptographic mapping into the signature result. This eliminates the composability defects inherent in hash chain structures, hence the name WOTS. + The adjustment objects of one-time signature construction include key generation method, public key generation method, signature generation method, and signature verification method.

[0037] Key generation method: The initial key is mapped to the starting point of the hash chain in vector form through a random oracle, thereby unifying the generation method of each hash chain.

[0038] Public key generation method: The public key is output after the endpoints of each hash chain are processed as a whole, so that the public key can be used as a whole structure and avoids the independent combination and use of different chain components.

[0039] Signature generation method: After obtaining an intermediate signature by performing hash chain iteration based on the message, a transformation related to the message is introduced to bind the signature result to the message.

[0040] Signature verification method: Based on the public key recovery mechanism, the intermediate signature is first recovered by performing an inverse transformation on the signature according to the message, and then the corresponding public key is recovered by completing the hash chain operation, and the signature verification is completed accordingly, so that the verification process is consistent with the public key recovery process.

[0041] Based on the improved ideal one-time signature model, adjust WOTS + The specific methods for constructing one-time signatures include Step 41: Adjust the key generation method: Map the initial key to the starting point of the hash chain in vector form through a random oracle, and unify the generation method of each hash chain; Step 42: Adjust the key generation method: Process the endpoints of each hash chain as a whole before outputting the public key, so that the public key can be used as the whole structure; Step 43: Adjust the signature generation method: After obtaining the intermediate signature by performing hash chain iteration based on the message, introduce a transformation related to the message to bind the signature result to the message; Step 44: Constructing the public key recovery and verification process: In the verification phase, first, perform an inverse transformation on the signature based on the message to recover the intermediate signature, then recover the corresponding public key by completing the hash chain operation, and complete the signature verification accordingly, so that the verification process is consistent with the public key recovery process; Step 45: Characterize the information evolution under multiple signatures: When the same key is used to sign multiple messages, the relationship between different signatures is described through the iterative relationship of the hash chain, so that the system can reflect the process of information being gradually exposed and be consistent with the behavior described by the corrupt interface.

[0042] This application is based on the improved ideal one-time signature model and adjusts WOTS. + The scheme for constructing a one-time signature is denoted as the improved one-time signature scheme (denoted as...). This scheme is based on the safety parameter n and the Winteritz parameter. Above. This scheme uses a hash function ( , ), random permutation P W and ideal encryption The set of arithmetic rules O W This application enhances traditional hash chain signatures. The key generation, signature generation, and public key recovery algorithms involved in this application all have runtime limitations based on the number of times the hash function is executed; the specific upper limit is determined by the Winderitz parameter. Decision. Regarding space overhead, this scheme achieves a high degree of uniformity: signature length... Private key length and public key length All are defined as Bits (where n is a security parameter, (This refers to the number of components). This parameter design ensures the predictability of the solution in terms of communication bandwidth and storage efficiency.

[0043] To establish the indistinguishability security proof of the scheme, this invention treats the underlying hash function H as a random oracle. Under this model, the mathematical definitions of the relevant spaces in this scheme are as follows: the private key space (SK) and the public key space (PK) are both defined in... On the domain; signature space Also defined as Message space Defined as .

[0044] WOTS + One-time signature construction achieves its security and functionality through an oracle component, which includes... First random oracle ( ): Input string of any length Mapped to a random bit sequence of the length of the private key space .

[0045] Second random oracle ( ): Input string of any length Mapped to a random bit sequence of message space length It is used to support random mapping during the hash chain iteration process.

[0046] Random permutation component : Defined in A random permutation function in space.

[0047] Ideal encryption machine components An ideal block cipher, whose received message space As key input, the intermediate signature space Data mapping back .

[0048] WOTS + A one-time signature is constructed as follows: Key generation algorithm (KG): During the initialization phase, the system receives a private key seed sk and uses a random oracle. Map it to An extended private key sequence consisting of n random strings. For each component in the sequence Using oracles implement The next iteration of the hash operation derives the intermediate public key sequence. By randomly permuting P W The concatenated intermediate public key is transformed as a whole to generate the final public key pk.

[0049] • Message preprocessing algorithm (MsgPreProcessing): First, the input message m is preprocessed. The message preprocessing algorithm parses message m into a message of length m. with Given a sequence with a base of , calculate the corresponding checksum (csum), and finally integrate them into a sequence of length . The message represents sequence b.

[0050] • Signature algorithm (SIGN): Generating intermediate signatures At that time, the system, based on the indication of message sequence b, uses a random oracle. For the corresponding extended private key component implement This is a hash iteration. To strengthen the logical binding between the signature and the message and to meet the security constraints of the ideal one-time signature model, this scheme does not directly output the intermediate signature, but instead utilizes ideal encryption. Use message m as the key to sign the intermediate message. Encryption is performed to generate the final signature. .

[0051] • Recovery algorithm (RECOVER): The verifier receives the message m and the signature. Then, the inverse transform of the ideal encryption machine is called first. Extract the intermediate signature from message m After calculating sequence b using the same message preprocessing logic, the verifier verifies... Each component in the process performs the remaining operations. Multiple hash iterations are performed to reconstruct the intermediate public key sequence. Finally, a random permutation P is applied. W The candidate public key pk is recovered, and the legitimacy of the signature is determined by comparing the candidate value with the pre-stored public key.

[0052] • Leakage Algorithm (CORRUPT): When the attacker holds a target message and When a valid signature is obtained, the algorithm calls the message preprocessing algorithm to calculate the corresponding message sequences b0 and b1. If the target is a forged message... Each component All of them have known signature nodes (i.e. If so, the process is allowed to proceed. Further iterations are used to synthesize forged signatures.

[0053] The parameters and their descriptions for this application are shown in Table 1.

[0054] Table 1 This application is based on the above WOTS + One-time signature construction scheme, providing such Figure 3-8 The examples shown are specific instances of the primitives and their corresponding code examples.

[0055] To further verify WOTS + To verify the security and functionality of one-time signature construction, this application introduces different values ​​for verification, as detailed in Experiment 1 and Experiment 2.

[0056] Experimental Example 1: In this experimental example, the parameters n=32 and w=16 were selected. Private key sk=0x00010203, message m=0x12345678 A public key pk is generated using the KeyGen algorithm. The signature σ is generated using the Sign algorithm. The Recover verification result is True. This indicates that the signature is valid.

[0057] Experiment Example 2 In this experimental example, the parameters n=32 and w=16 were selected. Private key sk = 0x00010203, message m0 = 0x12345678, m1 = 0x87654321 m* = 0x1f34567f, σ0 = 6f1ed0028c7dd92245c48cce2b7e1516a87ff679a2f3e71d5f93f9831d9c6c, Regarding the message Its base-w represents the corresponding component that is not less than m0 or m1 in each component, therefore it can be derived from... and Derive a new valid signature And the verification was successful.

[0058] Step 5: Create WOTS + Consistency between one-time signature construction and improved ideal one-time signature model.

[0059] Specifically, for WOTS + The one-time signature construction completes the construction of the simulator, thus proving that the discriminator cannot distinguish WOTS. + One-time signature construction and improved ideal one-time signature model.

[0060] Through steps 2-4, make WOTS + Under the condition of multiple signatures and gradual exposure of information, the overall behavior of the one-time signature construction can be consistent with the improved ideal one-time signature model, thus providing a basis for subsequent indistinguishability analysis.

[0061] Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort should fall within the scope of protection of the present invention.

Claims

1. Improved WOTS with reconfigurable security + The signature method is characterized by: Includes the following steps: Step 1: Construct an ideal one-time signature model; Step 2: Introduce a leaked interface to modify the ideal one-time signature model into an enhanced ideal one-time signature model; Step 3: Introduce a public key recovery mechanism to extend the enhanced ideal one-time signature model into an improved ideal one-time signature model; Step 4: Adjust WOTS based on improved model of ideal one-time signature + One-time signature construction; Step 5: Establishing WOTS + Consistency between one-time signature construction and improved ideal one-time signature model.

2. The improved WOTS with reconfigurable safety according to claim 1 + The signature method is characterized by: The leakage interface is used to describe information leakage caused by multiple signatures.

3. The improved WOTS with reconfigurable security according to claim 1 + The signature method is characterized by: The enhanced ideal one-time signature model reflects the changes in capabilities resulting from multiple signatures under the same key.

4. The improved WOTS with reconfigurable security according to claim 1 + The signature method is characterized by: The public key recovery mechanism extends the signature verification interface of the enhanced ideal one-time signature model into a recovery interface.

5. The improved WOTS with reconfigurable safety according to claim 4 + The signature method is characterized by: The recovery interface outputs the signature validity determination result and recovers the corresponding public key value based on the input message and signature, so as to depict the actual calculation process in the hash chain signature structure.

6. The improved WOTS with reconfigurable security according to claim 1 + The signature method is characterized by: The improved ideal one-time signature model characterizes the information leakage caused by multiple signatures and the state recovery capability during the verification process, so that the ideal function is consistent with the real structure in terms of expressive ability.

7. The improved WOTS with reconfigurable safety according to claim 1 + The signature method is characterized by: The improved ideal one-time signature model defines SK, PK, , and These are the private key space, public key space, message space, random number space, and signature space, respectively, sk, pk, m, , These are the private key, public key, message, signature, and random number, respectively; define f as a leak function. Define the injective set of all elements from SK to PK. For all from SK× arrive The set of functions, and for each m∈ Its induced flow from SK to The mapping is injective, and the public key can recover an ideal one-time signature. By from The function is defined by randomly sampling a pair of functions (g, h) and a leaking function f, and provides the following four interfaces to the outside world: Key generation algorithm : Input sk∈SK, return g(sk); ·Signature Algorithm :enter , , Returns h(sk, m, r); Public key recovery algorithm :enter , It must exist. , , making , returns g(sk); Leakage Algorithm :enter m0, m1, (m0 and m1 are messages,) (forging messages for the target), σ0, (σ0, σ1 are signatures), perform the following operations: like Then let r from Random sampling in the middle, return If pk = g(sk), otherwise return 0.

8. The improved WOTS with reconfigurable security according to claim 1 + The signature method is characterized by: The WOTS + Structural modifications of the one-time signature construction, including random pre-processing of the key, introduction of a random permutation to the public key structure, and introduction of a message-based ideal cryptographic mapping to the signature result.

9. The improved WOTS with reconfigurable security according to claim 1 + The signature method is characterized by: The WOTS + Adjustment objects of the one-time signature construction include a leakage interface, a key generation method, a public key generation method, a signature generation method, and a signature verification method. Key generation method: The initial key is mapped to the starting point of a hash chain in vector form through a random oracle, thus unifying the generation method of each hash chain; Public key generation method: The public key is output after the endpoints of each hash chain are processed as a whole, so that the public key can be used as the whole structure; Signature generation method: The input message is preprocessed and parsed into a representation sequence. After obtaining an intermediate signature by performing hash chain iteration based on the representation sequence, a transformation related to the message is introduced to bind the signature result to the message. Signature verification method: Based on the public key recovery mechanism, the intermediate signature is first recovered by performing an inverse transformation on the signature according to the message, and then the corresponding public key is recovered by completing the hash chain operation, and the signature verification is completed accordingly, so that the verification process is consistent with the public key recovery process; Leaked interface handling: When an attacker obtains multiple legitimate signatures that meet specific association conditions, it allows for the iterative synthesis of forged signatures through a random oracle.

10. The improved WOTS with reconfigurable safety according to claim 1 + The signature method is characterized by: Based on the improved ideal one-time signature model, adjust WOTS + Methods for constructing one-time signatures include Step 41: Adjust the key generation method: Map the initial key to the starting point of the hash chain in vector form through a random oracle, and unify the generation method of each hash chain; Step 42: Adjust the key generation method: Process the endpoints of each hash chain as a whole before outputting the public key, so that the public key can be used as the whole structure; Step 43: Adjust the signature generation method: After obtaining the intermediate signature by performing hash chain iteration based on the message, introduce a transformation related to the message to bind the signature result to the message; Step 44: Constructing the public key recovery and verification process: In the verification phase, first, perform an inverse transformation on the signature based on the message to recover the intermediate signature, then recover the corresponding public key by completing the hash chain operation, and complete the signature verification accordingly, so that the verification process is consistent with the public key recovery process; Step 45: Characterize the information evolution under multiple signatures: When the same key is used to sign multiple messages, the relationship between different signatures is described through the iterative relationship of the hash chain, so that the system can reflect the process of information being gradually exposed and be consistent with the behavior described by the corrupt interface.

Images