A method, system, device and computer medium for HAETAE signature

Abstract

The application discloses an HAETAE signature method, system, device and computer medium, relates to the field of cryptographic technology, is applied to a cryptographic chip, acquires a target message to be signed; a secret vector is acquired, and the secret vector is split into at least two random shares; the target message is processed to generate a challenge vector; each random share is respectively subjected to a point multiplication in a number theory transform domain with the challenge vector to obtain a point multiplication result; each point multiplication result is respectively accumulated to a corresponding accumulator; a random refresh factor is generated; the random refresh factor is applied to mask refresh each accumulator, so that the values in each accumulator are randomized; the values in each accumulator are combined to obtain a combination result, and the random refresh factors are mutually offset in the combination process; inverse number theory transformation is performed on the combination result to obtain a multiplication result of the challenge vector and the secret vector; and the multiplication result is processed to generate a signature result of the target message. While ensuring security, the correctness of the signature result is ensured.

Description

Technical Field

[0001] This application relates to the field of cryptography, and more specifically, to a HAETAE signature method, system, device, and computer medium. Background Technology

[0002] HAETAE (Hyperball bimodal digital signature scheme) is a lattice-based post-quantum digital signature scheme. Based on the Fiat-Shamir with Aborts paradigm, it employs bimodal hypersphere sampling technology to achieve smaller signature and key sizes while maintaining security comparable to Dilithium. The HAETAE algorithm is typically deployed in hardware cryptographic systems such as cryptographic chips, smart cards, cryptographic coprocessors, SoC cryptographic chips, and cryptographic machines.

[0003] In the actual operating environment of these cryptographic systems, attackers can use side-channel attacks such as Differential Power Analysis (DPA), Simple Power Analysis (SPA), timing attacks, electromagnetic radiation attacks, and fault analysis to compromise the signature generation process and obtain secret information. Although masking protection schemes exist for lattice-based signature algorithms such as Dilithium, these schemes cannot be directly applied to the HAETAE algorithm.

[0004] In conclusion, how to use HAETAE to securely sign messages is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a HAETAE signature method, which can, to some extent, solve the technical problem of how to securely sign messages using HAETAE. This application also provides a HAETAE signature system, an electronic device, and a computer-readable storage medium.

[0006] To achieve the above objectives, this application provides the following technical solution: A HAETAE signature method, applied to cryptographic chips, includes: Retrieve the target message to be signed; Obtain the secret vector and split the secret vector into at least two random shares; The target message is processed to generate a challenge vector; Each of the random shares is multiplied by the challenge vector in the number theory transformation domain to obtain the dot product result. Each dot product result is accumulated into its corresponding accumulator; Generate a random refresh factor; The random refresh factor is applied to refresh each accumulator with a mask, thereby randomizing the values ​​in each accumulator. The values ​​in each accumulator are combined to obtain the combined result, and the random refresh factors cancel each other out during the merging process; Perform an inverse number theory transformation on the merged result to obtain the product of the challenge vector and the secret vector; The product result is processed to generate the signature result of the target message.

[0007] Preferably, the secret vector includes a first coefficient, a first classified portion, and a second classified portion; the step of splitting the secret vector into at least two random shares includes: The multiple polynomials in the first classified portion and the multiple polynomials in the second classified portion are each split into at least two random shares; The number of polynomials contained in the first and second classified parts is positively correlated with the security level.

[0008] Preferably, the step of splitting the plurality of polynomials in the first classified portion and the plurality of polynomials in the second classified portion into at least two random shares includes: The multiple polynomials in the first classified portion are split into a first share and a second share, such that the first share and the second share are added modulo q to equal the first classified portion, where q is the modulus. The multiple polynomials in the second classified portion are split into third and fourth shares, such that the third and fourth shares are added modulo q to equal the second classified portion. The first share, the second share, the third share, and the fourth share are used as random shares.

[0009] Preferably, the generation of the random refresh factor includes: Uniform random sampling is performed on an integer ring modulo q to generate a random refresh factor with a length equal to the ring dimension, and the random refresh factors add up to zero modulo 2q.

[0010] Preferably, the accumulator includes a first accumulator and a second accumulator, and the step of applying the random refresh factor to perform a mask refresh on each accumulator includes: For the first value stored in the first accumulator, generate a first sum of the first value and the random refresh factor, and apply modulo 2q to the first sum to obtain the mask refresh result of the first accumulator; For the second value stored in the second accumulator, generate a first difference between the second value and the random refresh factor, and apply modulo 2q to the first difference to obtain the mask refresh result of the second accumulator; Where 2q is the modulus of the public key matrix.

[0011] Preferably, the process of processing the target message to generate the challenge vector includes: During the hypersphere uniform sampling phase, all coefficients are sampled from the cube to obtain the sampled values; Based on a preset symmetrical interval, a corresponding random blinding factor is generated for each sampled value; Based on the sum of the sampled values ​​and the corresponding random blinding factors, blinded sampled values ​​are generated; The true norm is generated based on the cumulative sum of the squares of the sampled values; A blinding norm is generated based on the sum of the squares of the blinded sampled values ​​to blend the power consumption trajectory of the cryptographic chip. The true norm is compared with a preset norm threshold to determine whether the sampled value is valid.

[0012] Preferably, the process of processing the product result to generate the signature result of the target message includes: Set the maximum number of iterations during the signature phase loop; Unconditionally execute the maximum number of signature attempts, and record the success status of each signature attempt in the mask storage array; After the loop ends, the first valid signature attempt result is selected from the mask storage array using a constant-time algorithm as the signature output; The execution time of the constant-time algorithm does not depend on the position of the valid values ​​in the mask storage array.

[0013] A HAETAE signature system, applied to cryptographic chips, includes: The message retrieval module is used to retrieve the target message to be signed; A vector processing module is used to obtain a secret vector and split the secret vector into at least two random shares; The message processing module is used to process the target message and generate a challenge vector; The dot product module is used to perform a number-theoretic transformation domain dot product between each of the random shares and the challenge vector to obtain the dot product result; The accumulation module is used to accumulate the results of each dot product to the corresponding accumulator; The refresh factor generation module is used to generate random refresh factors; The mask refresh module is used to apply the random refresh factor to refresh the mask of each accumulator, thereby randomizing the values ​​in each accumulator. The merging module is used to merge the values ​​in each accumulator to obtain the merged result, and the random refresh factors cancel each other out during the merging process; The product module is used to perform an inverse number theory transformation on the merged result to obtain the product of the challenge vector and the secret vector; The product processing module is used to process the product result and generate the signature result of the target message.

[0014] An electronic device, comprising: Memory, used to store computer programs; A processor for implementing the steps of any of the above-described HAETAE signature methods when executing the computer program.

[0015] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the above-described HAETAE signature methods.

[0016] This application provides a HAETAE signature method applied to a cryptographic chip, which involves: obtaining a target message to be signed; obtaining a secret vector and splitting the secret vector into at least two random shares; processing the target message to generate a challenge vector; performing a number-theoretic dot product on each random share and the challenge vector to obtain the dot product result; accumulating each dot product result into the corresponding accumulator; generating a random refresh factor; applying the random refresh factor to perform a mask refresh on each accumulator to randomize the values ​​in each accumulator; merging the values ​​in each accumulator to obtain a merged result, wherein the random refresh factors cancel each other out during the merging process; performing an inverse number-theoretic transformation on the merged result to obtain the product of the challenge vector and the secret vector; and processing the product result to generate the signature result of the target message. In this application, when the cryptographic chip performs polynomial multiplication for HAETAE signatures, the secret vector is split into random shares, each of which is then multiplied by the challenge vector in the NTT field and accumulated to its corresponding accumulator. This ensures that the value stored in any single accumulator is only related to one random share, and the random share itself does not carry any information about the original secret. A random refresh factor is introduced just before merging to perform a mask refresh on each accumulator, re-randomizing each accumulator before merging. Even if an attacker monitors the power consumption trajectory of the accumulators through differential power analysis, they will only obtain the randomized data. There is no statistical correlation between the accumulator and the original secret; furthermore, the random refresh factor cancels out during the merging process, without affecting the correctness of the final product result. Thus, when the cryptographic chip executes HAETAE signatures, the accumulator, as an intermediate node, never leaks valid information, achieving protection against first-order and even higher-order differential power analysis attacks. Moreover, the security protection mechanism is transparent to the algorithm function, introducing no computational errors and requiring no additional correction operations. This ensures both security and the correctness of the signature result, improving the side-channel security of the HAETAE algorithm in cryptographic chip implementations. The HAETAE signature system, electronic device, and computer-readable storage medium provided in this application also solve the corresponding technical problems. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1 A flowchart of a HAETAE signature method provided in this application embodiment; Figure 2 A schematic diagram of the structure of a HAETAE signature system provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application; Figure 4 This is another structural schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] To facilitate understanding of the technical solution of this application, the relevant technical terms involved in this application will be explained first.

[0021] HAETAE Algorithm: HAETAE (Hyperball bimodal Al modul E rejecTion signAturescheme) is a modal lattice-based post-quantum digital signature scheme. This algorithm employs the Fiat-Shamir with Aborts paradigm, using bimodal hyperball sampling technology to generate and verify signatures. It provides three security levels: 128 bits, 192 bits, and 256 bits, corresponding to L2, L3, and L5 security levels, respectively.

[0022] Cryptographic chips: These are integrated circuit chips that incorporate cryptographic computation functions, including but not limited to smart card chips, Secure Elements (SE), Trusted Platform Modules (TPM), cryptographic coprocessors, and cryptographic acceleration units in System-on-a-Chip (SoC). Cryptographic chips typically include hardware resources such as processors, memory, number theory transformation circuits, and random number generators.

[0023] Secret vector: In the HAETAE algorithm, the secret vector s = (1, s...) gen e gen )∈R q {1+ -1+k} , where R q For a polynomial ring modulo q, s and k are dimension parameters related to the security level. gen and e gen To obtain from a specific distribution S η The secret polynomial vector s is extracted from the original vector. The first coefficient of the secret vector s is 1; it is a public constant and does not contain any secret information. gen and e genIt contains all the confidential information that needs to be protected.

[0024] Number-theoretic Transformation (NTT): NTT is a transformation technique used to accelerate polynomial multiplication. In the HAETAE algorithm, performing polynomial multiplication in the NTT domain significantly reduces computational complexity. NTT transforms the polynomial from the coefficient domain to the frequency domain, performs dot product operations in the frequency domain, and then returns it to the coefficient domain via the inverse number-theoretic transformation (INTT). The core operation of NTT is the butterfly operation, which accelerates multiplication by decomposing the polynomial into smaller subproblems.

[0025] Challenge Vector: In the HAETAE signature generation process, the challenge vector c is a τ-sparse vector drawn from a specific distribution, with components of -1, 0, or +1. The generation of the challenge vector depends on the hash value of the message to be signed, ensuring message dependency in the signature process.

[0026] Side-channel attacks: Side-channel attacks refer to a class of attack methods in which attackers exploit physical information (such as power consumption, electromagnetic radiation, and runtime) leaked during the operation of cryptographic devices to obtain secret information. Differential power analysis (DPA) is one of the most common, recovering the secret key by statistically analyzing a large number of power consumption trajectories. Simple power analysis (SPA) obtains information by analyzing the characteristics of a single power consumption trajectory. Timing attacks infer secret information by measuring the time differences of cryptographic operations under different inputs.

[0027] Masking: Masking is a classic side-channel protection technique. Its core idea is to split sensitive data into multiple random shares, ensuring that each share does not carry any information about the original data. Even if an attacker obtains information from a particular share, they cannot recover the original data. The effectiveness of masking is based on the fact that in CMOS circuits, power consumption is related to the value of the data being processed, and randomized data disrupts the statistical correlation between power consumption and the original secret.

[0028] Mask Refresh: During the calculation of a masking scheme, the accumulated result of multiple shares may gradually reveal information related to the original data. Mask refresh refers to introducing a new random factor at a specific time to re-randomize the shares, thereby eliminating the information leakage accumulated during the accumulation process. The key to the refresh operation is that the refresh factor must be completely eliminated in subsequent calculations and must not affect the correctness of the final result.

[0029] Please see Figure 1 , Figure 1 A flowchart of a HAETAE signature method provided in an embodiment of this application.

[0030] This application provides a HAETAE signature method applied to a cryptographic chip, which may include the following steps: Step S101: Obtain the target message to be signed.

[0031] In practical applications, when performing a digital signature operation, the cryptographic chip first obtains the target message M to be signed. The target message can be digital data of any length. In practical applications, the target message can be communication data, transaction data, identity authentication data, or other information that requires digital signature protection. The cryptographic chip can receive the target message from an external device through a communication interface, or it can read pre-stored message data from its internal memory.

[0032] Step S102: Obtain the secret vector and split the secret vector into at least two random shares.

[0033] In practical applications, the cryptographic chip reads the secret vector s required by the HAETAE algorithm from its secure storage area and splits the secret vector into at least two random shares, i.e., s = s0 + s1 + ... + s n-1 The partitioning operation, modulo q, is where q is the modulus (e.g., q = 2²³ - 1) and n is the number of random shares. In principle, this partitioning operation is based on the fundamental idea of ​​secret sharing. A secret value 'a' is partitioned into two random shares, a0 and a1, such that a = a0 + a1 (mod q). Each share is uniformly and randomly distributed over a finite field, and looking at any single share alone cannot reveal any information about the original value 'a'. During the operation of the cryptographic chip, any intermediate node can process at most one share of data at a time. Therefore, the power consumption information obtained by an attacker through a single-point power consumption probe is only related to one random share and cannot obtain the complete secret value.

[0034] Considering that in the HAETAE algorithm, the secret vector includes the first coefficient and the first confidential part s gen Second classified part e gen That is, the secret vector s = (1, s gen e gen The first coefficient is 1, which is a public constant. To prevent side-channel attacks, the cryptographic chip splits the classified part of the secret vector, excluding the first coefficient, into at least two random shares. That is, it splits multiple polynomials in the first classified part and multiple polynomials in the second classified part into at least two random shares respectively, and the number of polynomials contained in the first classified part and the second classified part is positively correlated with the security level.

[0035] Since the first coefficient of 1 is a public constant, no masking protection is required. This design utilizes the structural characteristics of the HAETAE algorithm, reducing unnecessary masking overhead. In a specific implementation, during the process of splitting multiple polynomials in the first classified part and multiple polynomials in the second classified part into at least two random shares, the multiple polynomials in the first classified part can be split into a first share and a second share, such that the sum of the first share and the second share modulo q equals the first classified part; the multiple polynomials in the second classified part can be split into a third share and a fourth share, such that the sum of the third share and the fourth share modulo q equals the second classified part; the first share, the second share, the third share, and the fourth share are used as random shares. That is, s gen Split into s gen0 and s gen1 , will e gen Split into e gen0 and e gen1 Each share satisfies the constraint that the sum of the modulo q equals the original value.

[0036] Specifically, s gen Include -1 polynomials, e gen It contains k polynomials; (k, ) represents the row and column dimensions of the public key matrix A in key pair generation. For example, its value is (2, 4) in L2, (3, 6) in L3, and (4, 7) in L5. For s gen For each polynomial in the equation, the first share s is generated by uniformly and randomly sampling from a finite field modulo q. gen0 Then calculate s gen1 =s gen -s gen0 (mod q) as the second share, similarly for e gen For each polynomial in the equation, the first share e is generated. gen0 And calculate e gen1 =e gen -e gen0 (mod q) is used as the second share. This splitting method ensures that the sum of the two shares modulo q is equal to the original value. Since each share is randomly generated, any single share exhibits a uniform random distribution and has no statistical correlation with the original value.

[0037] Step S103: Process the target message to generate a challenge vector.

[0038] In practical applications, the cryptographic chip hashes the target message M to generate a challenge vector c. Specifically, the cryptographic chip calculates μ = H(tr, M), where tr is the transaction root in the secret vector and H is the hash function. Then, μ is expanded into a random stream ρ' using an expansion function for subsequent sampling. The challenge vector c is a τ-sparse vector with components of -1, 0, or +1, where the value of τ is related to the security level (58 for L2, 80 for L3, and 128 for L5).

[0039] In an exemplary embodiment, during the processing of the target message and the generation of the challenge vector, uniform sampling is required from the hypersphere. The original sampling process is as follows: do {sample x[i] ∈ [-B_sample,B_sample] from the cube, norm2+=x[i]²; if (partial_norm2>B²) break}, while (norm2>B²). The above original sampling process has the following side-channel leakage risks: First, the early break operation when partial_norm²>B² introduces a data-related branch. Attackers can infer whether partial_norm² exceeds the threshold by analyzing whether the branch is executed, for example, by using timing differences or instruction sequence differences in the power consumption trajectory, and thus obtain information about the sampled value x[i]. Second, the use of the floating-point unit may introduce additional power consumption leakage. The power consumption characteristics of floating-point operations are significantly different from those of integer operations. Attackers can use this difference to perform side-channel analysis. Third, during the calculation of norm2, the value of the accumulator gradually increases. Attackers can infer the value of x[i] by monitoring the power consumption changes of the accumulator.

[0040] To address the aforementioned risks, this application, during the hypersphere uniform sampling phase of the cryptographic chip's signature process, samples all coefficients from the cube to obtain the sampled value. For example, the cryptographic chip's processing unit samples all coefficients from the cube without exception; that is, for (k+... The system generates N coefficients, which are unconditionally sampled without performing an early break operation. Based on a preset symmetric interval, a corresponding random blinding factor is generated for each sample value. Based on the sum of the sample value and the corresponding random blinding factor, a blinded sample value is generated. That is, the cryptographic chip's operation unit generates a random blinding factor r[i] for each sample value x[i]. r[i] is taken from a preset symmetric interval [-ε, +ε]. Then, the blinded sample value x_blind[i] = x[i] + r[i] is calculated. Based on the cumulative sum of the squares of the sample values, the real norm is generated, norm2_real = Σx[i]². Based on the cumulative sum of the squares of the blinded sample values, the blinding norm is generated, norm2_blind = Σx_blind[i]², to mix the power consumption trajectory of the cryptographic chip. The real norm is compared with the preset norm threshold B² to determine whether the sample value is valid. The result of the norm comparison determines whether the current round of sampling is accepted. This improvement eliminates data-dependent branching operations, ensuring that the cryptographic chip executes the exact same sequence of instructions regardless of the sampled value.

[0041] It should be noted that the real norm and the blinding norm can be computed in parallel. Parallel computation means that the computation of the two norms is performed simultaneously on the hardware or interleaved in time. Regardless of the implementation method, the power consumption trajectory of the cryptographic chip when performing norm computation is a mixture of real computation and blinding computation. The power consumption signal observed by the attacker contains components related to both the real norm and the blinding norm. Since the blinding norm introduces the contribution of the random blinding factor r[i], and r[i] is randomly generated, the attacker cannot separate the information of the real norm from the mixed power consumption trajectory, and therefore cannot infer the value of x[i]. In addition, the value range of the blinding factor r[i] [-ε, +ε] is a configurable parameter. The larger the value of ε, the stronger the blinding effect, but the greater the deviation between the blinding norm and the real norm, which may affect the sampling efficiency. In specific application scenarios, the value of ε needs to be balanced between security and performance.

[0042] Step S104: Perform a number-theoretic transformation domain dot product between each random share and the challenge vector to obtain the dot product result.

[0043] In practical applications, when calculating the product c·s of the challenge vector c and the secret vector s during the signature phase, the number theory transformation circuit of the cryptographic chip performs dot product operations on the challenge vector c with each of the split random shares in the number theory transformation domain. NTT domain dot product refers to multiplying two polynomials coefficient-wise in the NTT domain. The NTT transformation has the homomorphic property: NTT(a·b) = NTT(a) ⊙ NTT(b), where ⊙ represents coefficient-wise dot product. Therefore, performing dot product in the NTT domain is equivalent to performing polynomial multiplication in the coefficient domain, but the computational complexity is reduced from O(n²) to O(n log n). In the HAETAE algorithm, since all polynomial operations are performed in the NTT domain, performing dot product directly in the NTT domain avoids the frequent NTT / INTT conversion overhead.

[0044] Since the secret vector is split into multiple random shares, the challenge vector is multiplied by each share individually. Algebraically, multiplication has a distributive property over addition: c·(s0+s1)=c·s0+c·s1. Therefore, adding the results of the dot products of each share yields the correct c·s result.

[0045] Step S105: Accumulate each dot product result into the corresponding accumulator.

[0046] In practical applications, the cryptographic chip accumulates the NTT field dot product results corresponding to each random share into their respective accumulators. The accumulator is a storage unit in the cryptographic chip used to temporarily store intermediate results during the accumulation process. Since the dot product results of each share are calculated independently, they need to be stored in different accumulators.

[0047] In one specific implementation, taking two random shares as an example, a first accumulator acc0 and a second accumulator acc1 are set. The first accumulator acc0 is used to accumulate all the dot product results corresponding to the first share, and the second accumulator acc1 is used to accumulate all the dot product results corresponding to the second share. Specifically, s gen0 and e gen0 The dot product of the s vector and the challenge vector c is accumulated into acc0, and s is then... gen1 and e gen1 The dot product of the result with the challenge vector c is accumulated into acc1.

[0048] During the accumulation process, acc0 and acc1 each store the accumulation result of random shares. Since each share is randomly distributed, and acc0 and acc1 are also randomly distributed, analyzing the power consumption trajectory of either accumulator alone cannot recover the original secret information. However, as the number of accumulations increases, the values ​​in the accumulators may gradually accumulate statistical characteristics related to the original secret information, thus requiring mask refresh at appropriate times.

[0049] In an exemplary embodiment, the cryptographic chip can calculate and accumulate the NTT field dot product of each share with the challenge vector c. Specifically: for the sgen part (j=0 to...) -2): Calculate the dot product value d0 = pointwise_NTT(c[j+1], s gen0 [j]), accumulate to acc0; calculate the dot product value d1=pointwise_NTT(c[j+1],s gen1 [j]), accumulated to acc1. For e gen Part (j=0 to k-1): Calculate the dot product value d2=pointwise_NTT(c[ +j],e gen0 [j]), accumulate to acc0; calculate the dot product value d3=pointwise_NTT(c[ +j],e gen1 [j]), accumulated to acc1.

[0050] Step S106: Generate a random refresh factor.

[0051] In practical applications, after all the dot product results of the random shares have been accumulated and before the inverse number theory transformation is performed, the random number generator of the cryptographic chip generates a random refresh factor. The random refresh factor is used to re-randomize the values ​​in the accumulator.

[0052] In principle, the random refresh factor r refresh However, a random vector uniformly sampled from an integer ring modulo q has a length equal to the ring dimension N, r refresh ←$Z q 256 In other words, during the generation of the random refresh factor, a uniform random sampling can be performed on an integer ring modulo q to generate a random refresh factor with a length equal to the ring dimension, and the random refresh factors add up to zero modulo 2q; alternatively, a random vector can be uniformly sampled from an integer ring modulo 2q. The core function of the random refresh factor is to change the intermediate values ​​stored in the accumulator without altering the final calculation result, thereby disrupting the correlation between power consumption and data.

[0053] Step S107: Apply a random refresh factor to refresh the mask of each accumulator, so that the values ​​in each accumulator are randomized.

[0054] In practical applications, cryptographic chips use a random refresh factor to perform a mask refresh operation on the values ​​stored in each accumulator. The core idea of ​​the mask refresh operation is to introduce a random refresh factor to re-randomize the values ​​of each accumulator before merging, so that the values ​​in each accumulator are randomly distributed before merging.

[0055] In one specific implementation, the accumulator may include a first accumulator and a second accumulator. Correspondingly, during the mask refresh process of each accumulator using a random refresh factor, a first sum of the first value stored in the first accumulator and the random refresh factor can be generated. The remainder of the first sum is then calculated modulo 2q to obtain the mask refresh result of the first accumulator. Similarly, a first difference between the second value stored in the second accumulator and the random refresh factor is generated. The remainder of the first difference is then calculated modulo 2q to obtain the mask refresh result of the second accumulator. Here, 2q is the modulus of the public key matrix. Taking two accumulators acc0 and acc1 as an example, the mask refresh operation specifically involves adding a random refresh factor r to the first accumulator acc0. refresh Then take the remainder modulo 2q; subtract the random refresh factor r from the second accumulator acc1. refresh Then take the remainder modulo 2q. That is: acc0' = acc0 + r refresh (mod 2q), acc1'=acc1-r refresh (mod 2q). The principle behind this positive-negative pair refresh method is that when acc0 and acc1 are subsequently merged, (acc0+r) refresh )+(acc1-r refresh The random refresh factor is completely eliminated due to the cancellation of positive and negative values, and does not affect the correctness of the final result. Before merging, both acc0' and acc1' exhibit random distribution characteristics due to the introduction of the random refresh factor, making it impossible for attackers to obtain useful secret information from the accumulator's power consumption.

[0056] It should be noted that this application positions the refresh operation at a specific moment—after all shares have been accumulated and before INTT is executed—because: if the refresh is performed during the accumulation process, the unaccumulated shares will disrupt the balance of the refresh factor; if the refresh is performed after INTT, the intermediate value output by INTT already contains complete c·s information, and the non-linear nature of INTT makes it impossible to cancel out the refresh factor through simple addition or subtraction. Only within the window period when all shares have been accumulated and before INTT transformation has been performed can the refresh operation ensure both safety and correctness.

[0057] It should also be noted that the mask refresh operation works as follows: Before the refresh, acc0 stores the sum of all first-share dot product results, and acc1 stores the sum of all second-share dot product results. Although acc0 and acc1 are each randomly distributed, at the instant before merging, both accumulators simultaneously store the sum of the two complete shares. If an attacker can simultaneously monitor the power consumption of acc0 and acc1 or analyze their joint distribution through second-order DPA, it is still possible to recover the original secret information. The refresh operation adds a positive random refresh factor to acc0 and a negative random refresh factor to acc1, so that the values ​​in both accumulators are re-randomized before merging. After the refresh, acc0' and acc1' both exhibit a uniform random distribution and no longer have any statistical correlation with the original secret information. Furthermore, the paired design of the positive and negative refresh factors ensures the lossless nature of the refresh operation. When acc0' and acc1' are merged, acc0' + acc1' = acc0 + acc1, and the refresh factors completely cancel each other out during the arithmetic addition process, without introducing any calculation error. For scenarios involving higher-order masks (n≥3), the above scheme can be extended accordingly. For example, suppose the secret vector is split into n shares s0, s1, ..., s2. n-1 Set n accumulators acc0, acc1, ..., acc n-1 A random number generator generates n random refresh factors r0, r1, ..., r n-1 , satisfying Σr i =0 (mod 2q), the mask refresh operations are acc i =acc i +r i (mod 2q) Since the sum of refresh factors is zero, all refresh factors completely cancel each other out during merging.

[0058] Step S108: Merge the values ​​in each accumulator to obtain the merged result, and the random refresh factors cancel each other out during the merging process.

[0059] In practical applications, the cryptographic chip adds and merges the values ​​in each accumulator after the refresh, obtaining the merged result. During the merging process, since the random refresh factors on each accumulator satisfy the condition of positive and negative pairing, the random refresh factors completely cancel each other out during the addition process. The merged result is equal to the sum of the original values ​​of each accumulator, which is the correct NTT field value of c·s.

[0060] Step S109: Perform an inverse number theory transformation on the merged result to obtain the product of the challenge vector and the secret vector.

[0061] In practical applications, the number theory transformation circuit of the cryptographic chip can perform an inverse number theory transformation (INTT) on the merged result, transforming the merged result from the NTT domain back to the coefficient domain, obtaining the product c·s of the challenge vector c and the secret vector s. INTT is the inverse transformation of NTT, satisfying: INTT(NTT(a))=a. Since NTT is a linear transformation, INTT also has the linear property: INTT(a+b)=INTT(a)+INTT(b). Therefore, the result obtained by performing INTT on the merged result is equal to the sum of the INTTs of the dot product of each share, which is the correct c·s result.

[0062] Step S110: Process the product result to generate the signature result of the target message.

[0063] In practical applications, the cryptographic chip uses the product result c·s to generate the final signature. Specifically, the cryptographic chip calculates z = y + (-1). b c·s, where y is a random vector obtained from hypersphere sampling, b is the bimodal flip bit, and z is the signature response. Then, norm checking and hint value calculation are performed, finally outputting the signature (c, z1). low z1 high ,h),z1 low This represents the lower bits of the compressed z-vector, z1 high The high-order bits of the compressed z-vector are represented by , and h represents the hint vector, used to assist in recovering necessary information from the compressed z-vector during verification. The signature result can be output to an external device via the cryptographic chip's communication interface or stored in internal memory for subsequent verification.

[0064] In an exemplary embodiment, the HAETAE signature process employs a variable-length loop of rejection and retries. The original loop process is as follows: do {sample y, calculate z=y+(-1)} b c·s,if (‖z‖2≥B') abort;if (‖2z-y‖2≥k²) abort}while (abort); The above variable-length loop is at risk of timing attacks: the number of times the loop executes depends on the norm of the secret vector s and the random sampled value y. When the norm of s is large, z=y+(-1). b The norm of ·c·s also tends to be large, which increases the failure probability of the first rejection check (‖z‖2≥B'). Similarly, the failure probability of the second rejection check is also related to the values ​​of s and y. By measuring the execution time of the signature process, attackers can statistically determine the distribution of the number of loops and thus infer information about s.

[0065] To address the aforementioned risks, this application provides the following constant-time loop control scheme. During the processing of the product result to generate the signature result of the target message, a maximum number of iterations (MAX_ITER) is set during the signature phase loop. The maximum number of signature attempts is executed unconditionally, and the success status of each attempt is recorded in the mask storage array. Specifically, for iter=0 to MAX_ITER-1, a complete round of signature attempts is executed, including hypersphere sampling y, generation of the double-peak flip bit b, calculation of z, two rejection checks, and calculation of the hint value. The success or failure of this round of attempts is recorded in the mask storage array of the cryptographic chip. If all checks pass, valid_mask[iter]=1; if not, valid_mask[iter]=0. After the loop ends, a constant-time algorithm selects the first valid signature attempt result from the mask storage array as the signature output. The execution time of the constant-time algorithm does not depend on the position of the valid value in the mask storage array. Specifically, regardless of the position of the first valid value in the valid_mask array, the algorithm executes the same number of operations. In this way, regardless of the value of the secret vector s, the total time for the cryptographic chip to execute the signature process is constant, equal to the sum of the fixed times of MAX_ITER attempts. An attacker cannot obtain any information about the secret information by measuring the execution time.

[0066] This application provides a HAETAE signature method applied to a cryptographic chip, which involves: obtaining a target message to be signed; obtaining a secret vector and splitting the secret vector into at least two random shares; processing the target message to generate a challenge vector; performing a number-theoretic dot product on each random share and the challenge vector to obtain the dot product result; accumulating each dot product result into the corresponding accumulator; generating a random refresh factor; applying the random refresh factor to perform a mask refresh on each accumulator to randomize the values ​​in each accumulator; merging the values ​​in each accumulator to obtain a merged result, wherein the random refresh factors cancel each other out during the merging process; performing an inverse number-theoretic transformation on the merged result to obtain the product of the challenge vector and the secret vector; and processing the product result to generate the signature result of the target message. In this application, when the cryptographic chip performs polynomial multiplication for HAETAE signatures, the secret vector is split into random shares, each of which is then multiplied by the challenge vector in the NTT field and accumulated to its corresponding accumulator. This ensures that the value stored in any single accumulator is only related to one random share, and the random share itself does not carry any information about the original secret. A random refresh factor is introduced just before merging to perform a mask refresh on each accumulator, re-randomizing each accumulator before merging. Even if an attacker monitors the power consumption trajectory of the accumulators through differential power analysis, they will only obtain the randomized data. There is no statistical correlation between the accumulator and the original secret; furthermore, the random refresh factor cancels out during the merging process and does not affect the correctness of the final product result. Thus, when the cryptographic chip performs HAETAE signature, the intermediate node of the accumulator never leaks valid information, achieving protection against first-order and even higher-order differential power analysis attacks. Moreover, the security protection mechanism is transparent to the algorithm function, neither introducing any calculation error nor requiring additional correction operations. While ensuring security, it also ensures the correctness of the signature result, improving the side-channel security of the HAETAE algorithm in the cryptographic chip implementation.

[0067] To facilitate understanding of the present application, the HAETAE signature method provided in this application will be described in detail below using a specific message signature scenario. This embodiment takes a scenario where a cryptographic chip is deployed in an industrial IoT edge device as an example. This edge device needs to periodically send sensor data with digital signatures to a cloud server to ensure the reliability and integrity of the data source. For ease of understanding, this embodiment uses HAETAE's L2 security level (corresponding to 128-bit security strength) as a benchmark. However, those skilled in the art should understand that this method is also applicable to other security levels such as L3 and L5. The relevant parameters of the HAETAE algorithm at the L2 security level are shown in Table 1.

[0068] Table 1. Relevant parameters of the HAETAE algorithm under L2 security level.

[0069] All polynomials lie in the polynomial ring R modulo q. q =Z q [X] / (X N +1), where X N +1=X 256 +1 is an irreducible polynomial. All operations in the NTT field are performed on the ring of integers modulo q. Dot multiplication is the coefficient-wise multiplication of two NTT field polynomials.

[0070] Based on this, during the signing process, the cryptographic chip receives the target message M to be signed from the sensor data acquisition unit through its communication interface. The target message M is 64 bytes long and includes sensor ID (4 bytes), timestamp (8 bytes), temperature data (4 bytes), pressure data (4 bytes), and device status information (44 bytes). The processor of the cryptographic chip executes the hash operation unit to calculate μ=H(tr||M), where H is the SHAKE-256 extended output function, and tr is the transaction root stored in the cryptographic chip's security register, a 32-byte random value inherited from the key generation stage; The cryptographic chip stores μ in its working memory and inputs μ into an extensible output function to generate a random stream ρ' of sufficient length for all subsequent random sampling operations; The secure processor of the cryptographic chip reads the complete secret vector s required for the HAETAE signature from a one-time programmable memory or a memory area protected by physically cloning-resistant functions. The structure of the secret vector s is: s = (1, s... gen [0],s gen [1],s gen [2],e gen [0],e gen [1]), in the L2 configuration of this embodiment, -1=3, k=2, therefore s contains 1 initial coefficient and 3 s. gen polynomial and 2e gen The polynomial has a total of 6 components, each of which is a ring R. q A polynomial over q, having N=256 coefficients, each of which is an integer modulo q; The vector processing module of the cryptographic chip performs a splitting operation on the classified part: for s gen Part, for each polynomial s gen [j] (j=0,1,2) is split into two random shares s. gen0 [j] and s gen1 [j]: For e gen Part, for each polynomial e gen[j] (j=0,1), is also split into two random shares; after the split is completed, the cryptographic chip will put all the first shares ( sgen0 [0..2] and e gen0 [0..1]) are stored in storage area C, and all second shares (s) are stored in storage area C. gen1 [0..2] and e gen1 [0..1]) is stored in storage area D. The two storage areas are physically isolated and have independent data buses to prevent attackers from reading data in both areas simultaneously through probes. The cryptographic chip performs hypersphere uniform sampling during the signature loop, sampling a random vector y from the hypersphere. The structure of y is the same as s, containing one leading coefficient and multiple polynomial components; for each coefficient in each component of y (totaling (k+...),... (N = 6 × 256 = 1536 coefficients). The operation unit of the cryptographic chip uniformly and randomly samples from the symmetric interval [-B_sample, B_sample], where B_sample is the preset half-side length of the cube. The operation unit unconditionally samples 1536 coefficients sequentially. Regardless of whether some norms have exceeded the threshold, it continues to complete the sampling of all coefficients. All sampled values ​​x[i] (i = 0, 1, ..., 1535) are temporarily stored in the sampling register array. The operation unit of the cryptographic chip includes two parallel multiply-accumulate units (MAC) for simultaneously calculating the real norm and the blinded norm. After all 1536 coefficients have been processed, the operation unit compares the real norm norm2_real with the norm threshold B². If norm2_real ≤ B², the sampling is valid. If norm2_real > B², the sampling in this round is invalid, the signature attempt in this round fails, and the loop continues. Provided the sampling is valid (norm2_real ≤ B²), the cryptographic chip further calculates w = A·y (mod 2q), where A is the public key matrix with a size of k×(1+ -1+k)=2×6, each element is R 2q polynomials over; The cryptographic chip extracts the high-order bits (HighBits) and low-order significant bits (LSBs) of w, combines them with μ, and inputs them into a hash function to generate a challenge vector c, c = SampleBinaryChallenge_τ(HighBits(w)||LSB(w)||μ). The SampleBinaryChallenge_τ function outputs a τ-sparse challenge vector c∈{-1,0,+1}. The number of non-zero elements is exactly τ, and the position of the non-zero elements is determined by the hash output; The cryptographic chip is equipped with two accumulator registers: a first accumulator acc0 and a second accumulator acc1. Each random share is multiplied by the challenge vector in the number theory domain to obtain the dot product. The dot product results are accumulated into their respective accumulators. A random refresh factor is generated. The random refresh factor is applied to each accumulator to perform a mask refresh, randomizing the values ​​in each accumulator. The values ​​in each accumulator are merged to obtain a merged result, and the random refresh factors cancel each other out during the merging process. An inverse number theory transformation is performed on the merged result to obtain the product of the challenge vector and the secret vector. The cryptographic chip generates a double-peaked flip bit b←{0,1} (uniformly random sampling), and calculates z=y+(-1). b After calculating cs, the cryptographic chip calculates the L2 norm square of z, ‖z‖2², and compares it with the threshold B'². If ‖z‖2²≥B'², the signature for this round is rejected, and the valid flag is set to invalid. The cryptographic chip calculates the hint value h, where h = HighBits(A·round(y)) - HighBits(A·round(z) - q·c j ), where j is the NTT field constant vector, round is the rounding function, HighBits is the operation to extract the high bits, and if the infinity norm of h, ‖h‖∞, exceeds the preset threshold, then the signature in this round is rejected; The cryptographic chip is set to a maximum number of iterations MAX_ITER=100. The control unit of the cryptographic chip unconditionally performs 100 signature attempts. The success status of each attempt is recorded in the mask storage array valid_mask[iter] (1 indicates success, 0 indicates failure). After the loop ends, the control unit selects the signature result corresponding to the first valid value position from valid_mask as the output using a constant-time algorithm. After finding the first valid signature attempt, the cryptographic chip organizes the signature result as: Signature=(c,z1) low ,z1 high ,h), where z1 low and z1 high It is a compressed representation of z, taking the low-order and high-order parts of z respectively to reduce the signature size, and h is the hint value; The cryptographic chip sends the signature result along with the original message M to the cloud verification server via a communication interface. After receiving (M, Signature), the server uses HAETAE's verification algorithm to verify the signature, confirming the integrity of the message and the authenticity of its source.

[0071] It should be noted that the overall process of the HAETAE signature algorithm is as follows: During key pair generation: KG.1、(Agen )←$ R q k×( -1) ,(s gen ,e gen )←$ S η η k That is, the matrix A is generated randomly. gen ∈R q k×( -1) R is a multinomial ring, and the random distribution S η Extracting secret vectors s gen ( -1 polynomials) and error vector e gen (k polynomials), where η represents the secret vector sampling bound; KG.2, Calculate the intermediate value b=A gen ·s gen +e gen ; KG.3, Construct the public key matrix A = [-2b + q] j|2A gen |2I k ] mod 2q, j is the NTT field constant vector; KG.4, Construct the secret vector s=(1,s) gen ,e gen )∈R q k×( -1) Store in the NTT domain; KG.5, if N(s)>γ²n→rej, that is, if the norm N(s)>γ²n, restart to prevent s from being too large, where γ represents the norm constraint parameter of the secret vector; KG.6, output key pair sk=(A,s,t0…),pk=A,t0 represents auxiliary parameters in the key; The signing process is as follows: SG.1, μ=H(tr,M); SG.2, ρ'=Expand(μ), which means expanding μ into a random stream for subsequent sampling; SG.3, for each sign, that is, entering the loop; SG.4, b←$ {0,1}, i.e., the double-peak inversion position; SG.5. Perform uniform sampling on a hypersphere, y=(y1,y2)←U(B_{(1 / N)R,k+ }(B)), where B represents the sampling radius of the hypersphere; SG.6. Round to the nearest integer, y = round(y); SG.7, NTT field multiplication, w = A·y mod 2q; SG.8. Take the most significant and least significant bits of w, construct μ for hashing, and output the τ-sparse challenge c∈{-1,0,+1}. , c=SampleBinaryChallenge_τ(HighBits‖LSB‖μ); SG.9, Challenge the dot product of vectors and the secret vector, cs = c·s; SG.10. Same formula, z=y+(-1) b ·cs; SG.11, First rejection (variable length): if ||z||2≥B'→abort, where B' represents the signature response norm threshold; SG.12, Second rejection (including boundary checks for hint values): if ‖2z-y‖2≥k²→abort; SG.13, hint structure, h=HighBits(A·round(y))-HighBits(A·round(z)-q c j ); SG.14. Find the first non-rejection round and return (c, z1) low ,z1 high ,h).

[0072] Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of a HAETAE signature system provided in an embodiment of this application.

[0073] This application provides a HAETAE signature system, applied to a cryptographic chip, which may include: Message acquisition module 101 is used to acquire the target message to be signed; Vector processing module 102 is used to obtain a secret vector and split the secret vector into at least two random shares; The message processing module 103 is used to process the target message and generate a challenge vector; The dot product module 104 is used to perform a number-theoretic transformation domain dot product of each random share with the challenge vector to obtain the dot product result. The accumulation module 105 is used to accumulate the results of each dot product to the corresponding accumulator; The refresh factor generation module 106 is used to generate a random refresh factor; The mask refresh module 107 is used to apply a random refresh factor to refresh the mask of each accumulator, so that the value in each accumulator is randomized. The merging module 108 is used to merge the values ​​in each accumulator to obtain the merged result, and the random refresh factors cancel each other out during the merging process; Product module 109 is used to perform inverse number theory transformation on the merged result to obtain the product of the challenge vector and the secret vector; The product processing module 110 is used to process the product result and generate the signature result of the target message.

[0074] This application provides a HAETAE signature system applied to a cryptographic chip. The secret vector includes a first coefficient, a first confidential part, and a second confidential part. The vector processing module is used to: split multiple polynomials in the first confidential part and multiple polynomials in the second confidential part into at least two random shares respectively; wherein, the number of polynomials contained in the first confidential part and the second confidential part is positively correlated with the security level.

[0075] This application provides a HAETAE signature system applied to a cryptographic chip. The vector processing module is used to: split multiple polynomials in the first confidential part into a first share and a second share, such that the sum of the first share and the second share modulo q equals the first confidential part, where q is the modulus; split multiple polynomials in the second confidential part into a third share and a fourth share, such that the sum of the third share and the fourth share modulo q equals the second confidential part; and use the first share, the second share, the third share, and the fourth share as random shares.

[0076] This application provides a HAETAE signature system applied to a cryptographic chip. The refresh factor generation module is used to: uniformly and randomly sample an integer ring modulo q to generate a random refresh factor with a length equal to the ring dimension. The random refresh factors are added together modulo 2q to equal zero.

[0077] This application provides a HAETAE signature system applied to a cryptographic chip. The accumulator includes a first accumulator and a second accumulator. The mask refresh module is used to: generate a first sum of the first value and a random refresh factor for the first value stored in the first accumulator, and apply modulo 2q to the first sum to obtain the mask refresh result of the first accumulator; generate a first difference between the second value and the random refresh factor for the second value stored in the second accumulator, and apply modulo 2q to the first difference to obtain the mask refresh result of the second accumulator; wherein 2q is the modulus of the public key matrix.

[0078] This application provides a HAETAE signature system applied to a cryptographic chip. The message processing module processes the target message and generates a challenge vector. During the hypersphere uniform sampling phase, all coefficients are sampled from a cube to obtain sampled values. Based on a preset symmetric interval, a corresponding random blinding factor is generated for each sampled value. A blinded sampled value is generated based on the sum of the sampled value and the corresponding random blinding factor. A true norm is generated based on the cumulative sum of the squares of the sampled values. A blinded norm is generated based on the cumulative sum of the squares of the blinded sampled values ​​to mix the power consumption trajectory of the cryptographic chip. The true norm is compared with a preset norm threshold to determine whether the sampled value is valid.

[0079] This application provides a HAETAE signature system applied to a cryptographic chip. During the process of a product processing module processing the product result to generate a signature result for the target message, a maximum number of iterations is set during the signature phase loop. The maximum number of signature attempts is executed unconditionally, and the success status of each attempt is recorded in a mask storage array. After the loop ends, a constant-time algorithm selects the first valid signature attempt result from the mask storage array as the signature output. The execution time of the constant-time algorithm does not depend on the position of the valid value in the mask storage array.

[0080] This application also provides an electronic device and a computer-readable storage medium, both of which have the corresponding effects of the HAETAE signature method provided in the embodiments of this application. Please refer to... Figure 3 , Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0081] An electronic device provided in this application includes a memory 201 and a processor 202. The memory 201 stores a computer program, and the processor 202 executes the computer program to implement the steps of the HAETAE signature method as described in any of the above embodiments.

[0082] Please see Figure 4Another electronic device provided in this application embodiment may further include: an input port 203 connected to the processor 202 for transmitting commands input from the outside to the processor 202; a display unit 204 connected to the processor 202 for displaying the processing results of the processor 202 to the outside; and a communication module 205 connected to the processor 202 for enabling communication between the electronic device and the outside. The display unit 204 may be a display panel, a laser scanning display, etc.; the communication method adopted by the communication module 205 includes, but is not limited to, Mobile High-Definition Link (MHL), Universal Serial Bus (USB), High-Definition Multimedia Interface (HDMI), wireless connection: Wireless Fidelity (WiFi), Bluetooth communication technology, Bluetooth Low Energy communication technology, and communication technology based on IEEE 802.11s.

[0083] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the HAETAE signature method described in any of the above embodiments.

[0084] The computer-readable storage media involved in this application include random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs (compact disc read-only memory), or any other form of storage media known in the art.

[0085] This application provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the HAETAE signature method as described in any of the above embodiments.

[0086] For descriptions of relevant parts of the HAETAE signature system, electronic device, and computer-readable storage medium provided in the embodiments of this application, please refer to the detailed descriptions of the corresponding parts in the HAETAE signature method provided in the embodiments of this application, which will not be repeated here. Furthermore, parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of corresponding technical solutions in the prior art have not been described in detail to avoid excessive elaboration.

[0087] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0088] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A HAETAE signature method, characterized in that, Applied to cryptographic chips, including: Retrieve the target message to be signed; Obtain the secret vector and split the secret vector into at least two random shares; The target message is processed to generate a challenge vector; Each of the random shares is multiplied by the challenge vector in the number theory transformation domain to obtain the dot product result. Each dot product result is accumulated into its corresponding accumulator; Generate a random refresh factor; The random refresh factor is applied to refresh each accumulator with a mask, thereby randomizing the values ​​in each accumulator. The values ​​in each accumulator are combined to obtain the combined result, and the random refresh factors cancel each other out during the merging process; Perform an inverse number theory transformation on the merged result to obtain the product of the challenge vector and the secret vector; The product result is processed to generate the signature result of the target message.

2. The method according to claim 1, characterized in that, The secret vector includes a first coefficient, a first classified portion, and a second classified portion; splitting the secret vector into at least two random shares includes: The multiple polynomials in the first classified portion and the multiple polynomials in the second classified portion are each split into at least two random shares; The number of polynomials contained in the first and second classified parts is positively correlated with the security level.

3. The method according to claim 2, characterized in that, The step of splitting the multiple polynomials in the first classified portion and the multiple polynomials in the second classified portion into at least two random shares includes: The multiple polynomials in the first classified portion are split into a first share and a second share, such that the first share and the second share are added modulo q to equal the first classified portion, where q is the modulus. The multiple polynomials in the second classified portion are split into third and fourth shares, such that the third and fourth shares are added modulo q to equal the second classified portion. The first share, the second share, the third share, and the fourth share are used as random shares.

4. The method according to claim 3, characterized in that, The generation of the random refresh factor includes: Uniform random sampling is performed on an integer ring modulo q to generate a random refresh factor with a length equal to the ring dimension, and the random refresh factors add up to zero modulo 2q.

5. The method according to claim 4, characterized in that, The accumulator includes a first accumulator and a second accumulator. The application of the random refresh factor to perform a mask refresh on each accumulator includes: For the first value stored in the first accumulator, generate a first sum of the first value and the random refresh factor, and apply modulo 2q to the first sum to obtain the mask refresh result of the first accumulator; For the second value stored in the second accumulator, generate a first difference between the second value and the random refresh factor, and apply modulo 2q to the first difference to obtain the mask refresh result of the second accumulator; Where 2q is the modulus of the public key matrix.

6. The method according to claim 1, characterized in that, The process of processing the target message to generate the challenge vector includes: During the hypersphere uniform sampling phase, all coefficients are sampled from the cube to obtain the sampled values; Based on a preset symmetrical interval, a corresponding random blinding factor is generated for each sampled value; Based on the sum of the sampled values ​​and the corresponding random blinding factors, blinded sampled values ​​are generated; The true norm is generated based on the cumulative sum of the squares of the sampled values; A blinding norm is generated based on the sum of the squares of the blinded sampled values ​​to blend the power consumption trajectory of the cryptographic chip. The true norm is compared with a preset norm threshold to determine whether the sampled value is valid.

7. The method according to claim 1, characterized in that, The process of processing the product result to generate the signature result of the target message includes: Set the maximum number of iterations during the signature phase loop; Unconditionally execute the maximum number of signature attempts, and record the success status of each signature attempt in the mask storage array; After the loop ends, the first valid signature attempt result is selected from the mask storage array using a constant-time algorithm as the signature output; The execution time of the constant-time algorithm does not depend on the position of the valid values ​​in the mask storage array.

8. A HAETAE signature system, characterized in that, Applied to cryptographic chips, including: The message retrieval module is used to retrieve the target message to be signed; A vector processing module is used to obtain a secret vector and split the secret vector into at least two random shares; The message processing module is used to process the target message and generate a challenge vector; The dot product module is used to perform a number-theoretic transformation domain dot product between each of the random shares and the challenge vector to obtain the dot product result; The accumulation module is used to accumulate the results of each dot product to the corresponding accumulator; The refresh factor generation module is used to generate random refresh factors; The mask refresh module is used to apply the random refresh factor to refresh the mask of each accumulator, thereby randomizing the values ​​in each accumulator. The merging module is used to merge the values ​​in each accumulator to obtain the merged result, and the random refresh factors cancel each other out during the merging process; The product module is used to perform an inverse number theory transformation on the merged result to obtain the product of the challenge vector and the secret vector; The product processing module is used to process the product result and generate the signature result of the target message.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the HAETAE signature method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the HAETAE signature method as described in any one of claims 1 to 7.

Images