Signature generation method and device, computer device and storage medium

Abstract

This application relates to a signature generation method, apparatus, computer device, and storage medium. The method includes: obtaining a target trapdoor base and a public key for signing data to be signed; determining a target vector that meets preset conditions based on the data to be signed, as the signature base data of the data to be signed; the preset condition is that the product of the target vector and the public key is the same as the data to be signed; hashing the concatenation result of the target trapdoor base and the invertible linear transformation parameters corresponding to the target trapdoor base to obtain a signature identifier for the data to be signed; concatenating the signature base data and the signature identifier to obtain a target signature for the data to be signed; wherein the target trapdoor bases are different for different data to be signed; the result matrix obtained by multiplying the target trapdoor base and the public key is a zero matrix under a predetermined modulus operation. This method can improve the security of signature generation.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a signature generation method, apparatus, computer device, and storage medium. Background Technology

[0002] With the rapid development of quantum computing technology, especially the fundamental threat posed by Shor's and Grover's algorithms to traditional public-key cryptosystems (such as RSA, ECC, and Diffie-Hellman), building post-quantum cryptosystems resistant to quantum computer attacks has become an urgent need in the global information security field. CRYSTALS-Dilithium (digital signatures) and Kyber (key encapsulation), based on lattice cryptography, are widely recognized as the most promising candidates for post-quantum cryptography due to their security being reducible to the well-known difficult problem of the shortest vector problem (SVP) on a lattice, relatively high computational efficiency, and moderate key size. As a core primitive in public key infrastructure (PKI), code signing, electronic contracts, and blockchain transactions, the resistance to quantum transformation of digital signatures directly relates to the survival of the trust system in the future digital society.

[0003] In traditional technologies, one-time or limited signature schemes based on fixed trapdoor bases rely on the same fixed trapdoor base (i.e., the private key) for preimage sampling each time a signature is made. However, as the number of signatures increases, the signature length and verification failure rate gradually rise due to the cumulative effect of Gaussian sampling errors and the degradation of trapdoor base orthogonality. Furthermore, if the private key is partially leaked during the signing process due to side-channel attacks or fault injection attacks, all historical and future signatures of the entire system face irreversible security risks. Summary of the Invention

[0004] Therefore, it is necessary to provide a signature generation method, apparatus, computer device, and storage medium that can improve the security of signature generation in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a signature generation method, including:

[0006] Obtain the target trapdoor base and public key used to sign the data to be signed;

[0007] Based on the data to be signed, a target vector that meets the preset conditions is determined and used as the basic data for signing the data to be signed; the preset condition is that the product between the target vector and the public key is the same as the data to be signed.

[0008] The concatenation result of the target trapdoor basis and the corresponding invertible linear transformation parameters is hashed to obtain the signature identifier of the data to be signed.

[0009] The signature base data and signature identifier are concatenated to obtain the target signature of the data to be signed.

[0010] The target trapdoor basis is different for different data to be signed; the result matrix obtained by multiplying the target trapdoor basis with the public key is a zero matrix under the operation of a predetermined modulus.

[0011] In one embodiment, a vector that meets preset conditions is determined as the basic signature data for the data to be signed, including:

[0012] The data to be signed is hashed to obtain the encoded data to be signed;

[0013] Using the encoding of the data to be signed as the sampling target value, the target trapdoor basis is sampled to obtain the target vector that satisfies the modular equation constraint between the public key and the encoding of the data to be signed, which serves as the basic data for signing the data to be signed.

[0014] The modular equation constraint is that the result obtained by taking the remainder of the product between the target vector and the public key is equal to the encoding of the data to be signed.

[0015] In one embodiment, the signature base data and the signature identifier are concatenated to obtain the target signature of the data to be signed, including:

[0016] The signature base data is perturbed to obtain the perturbed signature base data;

[0017] The perturbed signature base data and signature identifier are concatenated to obtain the target signature of the data to be signed.

[0018] In one embodiment, obtaining the target trapdoor base and public key for signing the data to be signed includes:

[0019] Obtain the public key of the signer;

[0020] Select trapdoor bases from the preset trapdoor base pool whose result matrix after multiplication with the public key is a zero matrix under a predetermined modulus, and use them as target trapdoor bases for signing the data to be signed.

[0021] In one embodiment, the method for determining the preset trapdoor base pool includes:

[0022] Based on the security strength level of the signer and the preset total number of signatures, determine the signer's first private key;

[0023] The concatenation result of the public key and the first private key is subjected to trapdoor derivation processing to obtain at least one trapdoor base;

[0024] Construct the trap foundation pool according to each trap foundation.

[0025] In one embodiment, the method further includes:

[0026] If the number of trapdoor bases in the trapdoor base pool is less than a preset threshold, obtain a preset number of signature replenishment attempts.

[0027] The signer's second private key is determined based on the security strength level and the preset number of signature replenishments;

[0028] The concatenation result of the public key and the second private key is subjected to trapdoor derivation processing to obtain at least one supplementary trapdoor base;

[0029] Add supplementary trap foundations to the trap foundation pool.

[0030] Secondly, this application also provides a signature generation apparatus, comprising:

[0031] The acquisition module is used to obtain the target trapdoor base and public key used to sign the data to be signed.

[0032] The determination module is used to determine the target vector that meets the preset conditions based on the data to be signed, and use it as the basic data for signing the data to be signed; the preset condition is that the product between the target vector and the public key is the same as the data to be signed.

[0033] The hash module is used to hash the concatenation result of the target trapdoor basis and the corresponding invertible linear transformation parameters to obtain the signature identifier of the data to be signed.

[0034] The generation module is used to concatenate the basic signature data and the signature identifier to obtain the target signature of the data to be signed.

[0035] The target trapdoor basis is different for different data to be signed; the result matrix obtained by multiplying the target trapdoor basis with the public key is a zero matrix under the operation of a predetermined modulus.

[0036] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0037] Obtain the target trapdoor base and public key used to sign the data to be signed;

[0038] Based on the data to be signed, a target vector that meets the preset conditions is determined and used as the basic data for signing the data to be signed; the preset condition is that the product between the target vector and the public key is the same as the data to be signed.

[0039] The concatenation result of the target trapdoor basis and the corresponding invertible linear transformation parameters is hashed to obtain the signature identifier of the data to be signed.

[0040] The signature base data and signature identifier are concatenated to obtain the target signature of the data to be signed.

[0041] The target trapdoor basis is different for different data to be signed; the result matrix obtained by multiplying the target trapdoor basis with the public key is a zero matrix under the operation of a predetermined modulus.

[0042] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0043] Obtain the target trapdoor base and public key used to sign the data to be signed;

[0044] Based on the data to be signed, a target vector that meets the preset conditions is determined and used as the basic data for signing the data to be signed; the preset condition is that the product between the target vector and the public key is the same as the data to be signed.

[0045] The concatenation result of the target trapdoor basis and the corresponding invertible linear transformation parameters is hashed to obtain the signature identifier of the data to be signed.

[0046] The signature base data and signature identifier are concatenated to obtain the target signature of the data to be signed.

[0047] The target trapdoor basis is different for different data to be signed; the result matrix obtained by multiplying the target trapdoor basis with the public key is a zero matrix under the operation of a predetermined modulus.

[0048] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0049] Obtain the target trapdoor base and public key used to sign the data to be signed;

[0050] Based on the data to be signed, a target vector that meets the preset conditions is determined and used as the basic data for signing the data to be signed; the preset condition is that the product between the target vector and the public key is the same as the data to be signed.

[0051] The concatenation result of the target trapdoor basis and the corresponding invertible linear transformation parameters is hashed to obtain the signature identifier of the data to be signed.

[0052] The signature base data and signature identifier are concatenated to obtain the target signature of the data to be signed.

[0053] The target trapdoor basis is different for different data to be signed; the result matrix obtained by multiplying the target trapdoor basis with the public key is a zero matrix under the operation of a predetermined modulus.

[0054] The aforementioned signature generation method, apparatus, computer equipment, and storage medium, by assigning different target trapdoor bases to different data to be signed and combining this with the algebraic constraint that the multiplication of the public key and the target trapdoor base under modular arithmetic results in a zero matrix, achieve fine-grained key isolation and session-level signature independence. This effectively avoids the accumulation of security risks and the spread of key leakage caused by the reuse of a single trapdoor base. Simultaneously, by introducing invertible linear transformation parameters to participate in hash generation of signature identifiers, not only is a unique and verifiable session identity assigned to each signature, enhancing the signature's resistance to replay attacks and source auditability, but the signature generation process also eliminates the need for centralized state management, reducing system synchronization overhead. The entire method, while ensuring high security, simplifies the construction and verification process of the signature's underlying data, improves the efficiency and accuracy of signature generation, and provides reliable technical support for large-scale, high-concurrency post-quantum signature applications. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 This is an application environment diagram of a signature generation method provided in this embodiment;

[0057] Figure 2 This is a flowchart illustrating the first signature generation method provided in this embodiment;

[0058] Figure 3 This is a flowchart illustrating the steps for determining a target trapdoor base in this embodiment;

[0059] Figure 4 This is a structural block diagram of a signature generation device provided in this embodiment;

[0060] Figure 5 This is an internal structural diagram of a computer device provided in this embodiment. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0062] The signature generation method provided in this application embodiment can be applied to, for example, Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. The computer device acquires the target trapdoor base and public key used to sign the data to be signed; based on the data to be signed, it determines a target vector that meets preset conditions as the signature base data for the data to be signed; the preset condition is that the product between the target vector and the public key is the same as the data to be signed; the concatenation result of the target trapdoor base and the corresponding invertible linear transformation parameters is hashed to obtain the signature identifier of the data to be signed; the signature base data and the signature identifier are concatenated to obtain the target signature of the data to be signed; wherein, the target trapdoor bases are different for different data to be signed; the result matrix obtained by multiplying the target trapdoor base and the public key is a zero matrix under a predetermined modulus operation. The computer equipment can be either a terminal or a server; the terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented using a standalone server or a server cluster composed of multiple servers.

[0063] In one exemplary embodiment, such as Figure 2 As shown, a signature generation method is provided, which can be applied to... Figure 1 Taking a computer device as an example, the explanation includes the following steps S201 to S204. Wherein:

[0064] S201 Obtain the target trapdoor base and public key used to sign the data to be signed.

[0065] The data to be signed refers to the original information that needs to be protected for integrity and authenticated by the signer through a digital signature mechanism. It takes the form of a binary data stream of arbitrary length and, in practical applications, can manifest as financial transaction instructions, electronic contract documents, identity authentication request messages, or blockchain transaction data—content that needs to be ensured to be tamper-proof and genuinely generated by the claimant. The public key is a matrix of parameters publicly disclosed by the signer. It is generated during system initialization using a specific algorithm based on security strength level parameters and the system's public parameter set, and is presented as a uniformly randomly distributed integer matrix. This public key is used by the recipient or verifier to verify the legality and correctness of the signature. Any third party holding this public key can verify the validity of the signature generated by the corresponding private key holder. The target trapdoor base refers to the private trapdoor matrix selected by the signer from a preset trapdoor base pool and used specifically to sign the current data to be signed. The trapdoor base and the public key meet specific algebraic constraints in mathematics, that is, the result matrix obtained by multiplying the two by a predetermined modulus is a zero matrix. Furthermore, the target trapdoor bases selected for different data to be signed are different from each other, thereby ensuring that the trapdoor base used in each signing operation has session-level uniqueness and independence.

[0066] In some embodiments, when obtaining the target trapdoor base and public key for signing the data to be signed, the signing terminal first reads the signer's public key from the local secure storage medium. This public key is a fixed public parameter generated and persistently stored during the system initialization phase. Subsequently, the signing terminal locates the currently available trapdoor base entry from the preset trapdoor base pool based on the currently maintained session sequence number pointer, and extracts the session trapdoor base and its corresponding invertible linear transformation parameters stored in the entry. The signing terminal performs matrix multiplication with the extracted session trapdoor base and the read public key at a predetermined modulus, and verifies whether the product result is a zero matrix. If the product result is a zero matrix, it confirms that the session trapdoor base satisfies the preset algebraic constraint condition and uses it as the target trapdoor base. If the product result is not a zero matrix, the signing terminal iterates through the subsequent entries in the trapdoor base pool, performing the same modular multiplication verification one by one, until the first available trapdoor base that satisfies the zero matrix constraint is found. After successfully selecting the target trapdoor base, the signing terminal increments the current session sequence number pointer by one and marks the used trapdoor base entry as used.

[0067] S202 determines the target vector that meets the preset conditions based on the data to be signed, and uses it as the basic data for signing the data to be signed.

[0068] The preset condition is that the product of the target vector and the public key is the same as the data to be signed. This preset condition refers to the mathematical constraint that the product of the target vector and the public key, when modulo a predetermined modulus, is identical to the data to be signed. This condition serves as the core criterion for vector selection during signature generation, ensuring that the selected vector and the public key satisfy a specific algebraic consistency, thereby guaranteeing that the signature constructed based on this vector can pass the verification. The target vector is an integer vector obtained through sampling or computation that satisfies the above preset condition. Its dimension matches the column dimension of the public key, and the values ​​of each component of the vector are constrained by a preset norm constraint to ensure its length is sufficiently short. The signature base data refers to the final determined target vector itself, serving as one of the main components used to construct the complete signature in the subsequent signature synthesis process. It carries the modular equation coupling relationship between the data to be signed and the public key.

[0069] In some optional embodiments, the signing terminal first inputs the data to be signed into a collision-resistant hash function specified in the system's public parameter set for hashing, obtaining a fixed-length message digest value as the encoding of the data to be signed; then, the signing terminal sets the message digest value as the mean center or target point of Gaussian sampling, and uses the target trapdoor basis used in the current session as the input of the sampling auxiliary structure, calling an efficient preimage sampler to execute the preimage sampling process; the sampler performs discrete Gaussian conditional sampling dimension by dimension from the highest dimension to the lowest dimension, updating the current residual vector after each dimension sampling is completed, until all dimensions are sampled, and outputs an original preimage vector; the signing terminal calculates the product of the original preimage vector and the public key at a predetermined modulus, compares the product result with the message digest value component by component, if the two are completely equal, it is determined that the original preimage vector meets the preset condition, confirms it as the target vector and outputs it as the basic data for signing; if the product result is inconsistent with the message digest value, the current preimage vector is discarded, and sampling is performed again with the same or updated target point, repeating the above process until a target vector that passes the modulus equation verification is generated, or the preset maximum number of retries is reached and sampling failure is reported.

[0070] In some optional embodiments, the data to be signed is hashed to obtain the data encoding to be signed; the data encoding to be signed is used as the sampling target value, and the target trapdoor basis is sampled to obtain the target vector that satisfies the modular equation constraint between the public key and the data encoding to be signed, which serves as the signature basis data of the data to be signed; wherein, the modular equation constraint is that the result obtained by taking the remainder of the product between the target vector and the public key is equal to the data encoding to be signed.

[0071] The data to be signed is encoded as follows: The data to be signed is a fixed-length digest value output after hashing the original data into a collision-resistant hash function specified in the system's public parameter set. This digest value serves as a concise digital representation of the original message and replaces the original message in subsequent mathematical operations during the signature generation process. This ensures a high probability of uniqueness for different messages corresponding to different codes and unifies the data format used in modular equation calculations. The target sampling value is the mean center or target point parameter that the data to be signed acts as in the discrete Gaussian sampling process. The preimage sampler performs conditional probability distribution sampling around this value, ensuring that the final output preimage vector statistically clusters around this target value, thus establishing a definite algebraic relationship between the sampling result and the data to be signed. The modular equation constraint is the mathematical relationship that the result obtained after performing modulo modulo remainder processing on the product of the target vector and the public key is equal to the data to be signed. This constraint serves as the sole criterion for determining the validity of the sampled target vector, ensuring that the final output signature data can pass the modular equation verification based on the public key by the verifier.

[0072] For example, when performing hash processing on the data to be signed and sampling with the resulting encoding as the sampling target value, the signing end first inputs the original data to be signed into the anti-collision hash function specified in the system's common parameter set, performs the hash operation, and outputs a fixed-length digest value as the encoding of the data to be signed; then, the signing end sets this encoding of the data to be signed as the sampling target value and inputs it along with the currently selected target trapdoor basis into the efficient preimage sampler; the sampler first performs lattice basis orthogonalization decomposition on the target trapdoor basis and pre-calculates the conditional variance parameter of conditional sampling in each dimension, outputs the sampling auxiliary data structure, and simultaneously constructs a target point vector centered on the sampling target value; then, the sampler successively performs a... Discrete Gaussian sampling is performed. After sampling in each dimension, the sampled value is stored in the corresponding position and the current residual vector is updated immediately. After sampling in all dimensions, the original preimage vector is output. The signature terminal calculates the product of the original preimage vector and the public key at a predetermined modulus, and performs modulo processing on the product result and compares it with the encoded data to be signed on a component-by-component basis. If the two are completely equal, the original preimage vector is determined to satisfy the modulo equation constraint, and it is confirmed as the target vector and output as the basic data for signature. If the two are not equal, the current preimage vector is discarded, and the dimension-by-dimensional sampling process is re-executed with the same sampling target value. The above process is repeated until a target vector that passes the modulo equation verification is generated, or the sampling failure is reported after reaching the preset maximum number of retries.

[0073] S203 performs hash processing on the concatenation result of the target trapdoor basis and the corresponding invertible linear transformation parameters to obtain the signature identifier of the data to be signed.

[0074] The signature identifier is a fixed-length hash value output by concatenating the target trapdoor basis and the corresponding reversible linear transformation parameters, and then inputting the concatenation result into an anti-collision hash function for hash processing. This identifier serves as a unique marker for the current signing session and is uniquely bound to the current data to be signed and the trapdoor basis entry used. It is used by the verifier during the verification phase to reconstruct and verify the source of the trapdoor basis and the session ownership corresponding to the signature, so as to support the source audit of the signature and the defense against replay attacks.

[0075] In some embodiments, when performing hash processing on the concatenation result of the target trapdoor basis and its corresponding invertible linear transformation parameters, the signing end first extracts the target trapdoor basis matrix and the corresponding invertible linear transformation parameter matrix from the currently selected trapdoor basis entry. Then, according to a preset formatted concatenation rule, the signing end combines all elements of the target trapdoor basis and all elements of the invertible linear transformation parameters into a continuous binary byte sequence in a determined byte order and arrangement. The signing end inputs the concatenated byte sequence into the anti-collision hash function specified in the system's common parameter set, performs the hash operation, and outputs a fixed-length hash value, which is used as the signature identifier of the current data to be signed. After outputting the signature identifier, the signing end temporarily stores the identifier in the context data structure of the current signing session for subsequent signature synthesis steps.

[0076] S204 concatenates the basic signature data and the signature identifier to obtain the target signature of the data to be signed.

[0077] The target signature refers to the complete digital signature data generated by combining the basic signature data and the signature identifier according to the preset formatting concatenation rules. As the final output of the signature method, the target signature contains all the information that the verifier can use to simultaneously complete the modular equation constraint verification and the session source legitimacy verification. Its specific data structure consists of two parts: the modular equation coupling relationship carried by the basic signature data and the session uniqueness mark carried by the signature identifier.

[0078] In some optional embodiments, when performing the concatenation process of signature base data and signature identifier to obtain the target signature, the signing end first reads the generated signature base data vector and signature identifier hash value from the context data of the current signing process, respectively; then, according to the format concatenation rules preset in the system common parameter set, the signing end arranges each component of the signature base data vector into a first field in a determined byte order, arranges the signature identifier hash value into a second field in a determined byte order, and then combines the first field and the second field into a complete binary byte sequence in the order of concatenation, and outputs this byte sequence as the target signature of the current data to be signed.

[0079] In some optional embodiments, the signature base data is perturbed to obtain perturbed signature base data; the perturbed signature base data and the signature identifier are concatenated to obtain the target signature of the data to be signed. The target trapdoor basis is different for different data to be signed; the matrix obtained by multiplying the target trapdoor basis with the public key is a zero matrix under a predetermined modulus.

[0080] For example, the signing terminal first reads the generated signature base data vector from the context of the current signing process; then, the signing terminal inputs the standard deviation of the error distribution into the perturbation vector sampler, independently sampling dimension-by-dimensionally from the discrete Gaussian distribution to generate an initial error perturbation vector with the same dimension as the signature base data; the signing terminal performs component-by-component addition on this initial error perturbation vector and the signature base data vector to obtain the perturbated signature base data; then, the signing terminal reads the invertible linear transformation parameters corresponding to the target trapdoor basis from the currently selected trapdoor basis entry, and performs matrix-vector multiplication in the modulus sense on the initial error perturbation vector using these invertible linear transformation parameters as the transformation matrix. Output session binding error perturbation vector; the signing end performs component-wise addition of the session binding error perturbation vector and the signature base data vector to obtain the final perturbed signature base data; the signing end then reads the signature identifier hash value generated in the current signing process context, and arranges each component of the perturbed signature base data vector into the first field according to the formatting concatenation rules preset in the system common parameter set, arranges the signature identifier hash value into the second field according to the determined byte order, and combines the first field and the second field into a complete binary byte sequence in the order of concatenation, and uses this byte sequence as the target signature output of the current data to be signed.

[0081] In the above embodiments, by assigning different target trapdoor bases to different data to be signed, and combining the algebraic constraint that the multiplication of the public key and the target trapdoor base under modular arithmetic results in a zero matrix, fine-grained key isolation and session-level signature independence are achieved. This effectively avoids the accumulation of security risks and the spread of key leakage caused by the reuse of a single trapdoor base. At the same time, by introducing invertible linear transformation parameters to participate in hash generation of signature identifiers, not only is a unique and verifiable session identity assigned to each signature, enhancing the signature's resistance to replay attacks and source auditability, but the signature generation process also eliminates the need for centralized state management, reducing system synchronization overhead. The entire method simplifies the construction and verification process of the signature base data while ensuring high security, improves the efficiency and accuracy of signature generation, and provides reliable technical support for large-scale, high-concurrency post-quantum signature application scenarios.

[0082] Figure 3This is a flowchart illustrating the step of determining the target trapdoor base in one embodiment. This embodiment refines the steps of obtaining the target trapdoor base and public key used to sign the data to be signed in the above embodiments, including the following steps:

[0083] S301 retrieves the signer's public key.

[0084] In some embodiments, the signing terminal first reads the pre-stored public key data of the signer from a local secure storage medium or a trusted key management module. If the public key is stored in the form of a file, the signing terminal reads the public key file from a specified path and parses the matrix parameters therein according to the public key format specification predefined in the system's public parameter set. If the public key is stored in a hardware security module or a trusted execution environment, the signing terminal calls the read operation through the corresponding secure interface to obtain the data of each component of the public key matrix. After successfully reading the public key, the signing terminal temporarily stores the public key matrix in the context data structure of the current signing process for subsequent steps such as selecting a target trapdoor base from the trapdoor base pool and performing modular multiplication verification. If the public key reading fails or the format of the read public key does not conform to the preset specification, the signing terminal terminates the current signing process and returns an error message indicating that the public key acquisition failed.

[0085] S302 selects a trapdoor basis from the preset trapdoor basis pool whose result matrix after multiplication with the public key is a zero matrix under a predetermined modulus, and uses it as the target trapdoor basis for signing the data to be signed.

[0086] In some optional embodiments, the current entry to be inspected in the preset trapdoor base pool is located according to the currently maintained session sequence number pointer, and the session trapdoor base matrix stored in the entry is extracted; then, the signing end performs matrix multiplication with the extracted session trapdoor base and the acquired public key at a predetermined modulus to obtain a product matrix; the signing end checks whether each component of the product matrix is ​​zero, and if all components are zero, the product matrix is ​​determined to be a zero matrix, confirming that the current session trapdoor base meets the selection condition, and it is used as the target trapdoor base; if the product matrix... If any non-zero component exists in the matrix, the current session trapdoor basis is determined not to meet the conditions. The signing end moves the pointer to the next entry in the trapdoor basis pool, extracts the session trapdoor basis of that entry, and repeats the above modular multiplication and zero matrix determination process. The signing end traverses each entry in the trapdoor basis pool in this order until it finds the first session trapdoor basis that satisfies the modular zero matrix constraint and determines it as the target trapdoor basis. If no trapdoor basis that satisfies the conditions is found after traversing all available entries in the trapdoor basis pool, the signing end terminates the current signing process and returns an error message indicating that the trapdoor basis selection failed.

[0087] In some optional embodiments, the first private key of the signer is determined based on the security strength level of the signer and the preset total number of signatures; the concatenation result of the public key and the first private key is subjected to trapdoor derivation processing to obtain at least one trapdoor base; and a trapdoor base pool is constructed based on each trapdoor base.

[0088] For example, the security strength level parameter and the preset total number of signatures parameter are obtained from the signer; then, the signing end inputs the security strength level parameter and the preset total number of signatures parameter into the lattice dimension optimization function, and outputs the lattice row dimension parameter and lattice column dimension parameter that satisfy the security constraints and trapdoor basis degradation constraints; based on the security strength level parameter, the lattice row dimension parameter and the preset total number of signatures, the standard deviation of the discrete Gaussian error distribution is determined; based on the security strength level parameter and the modulus, at least one anti-collision hash function is selected from the preset hash function library to generate a system public parameter set; a uniform random public key matrix is ​​generated based on the system public parameter set as the system public key, and the corresponding master trapdoor basis is generated as the system master private key; the signing end obtains the preset initial value of the derived index in the system public parameter set, inputs the system public key, the system master private key and the current derived index into the trapdoor derivation algorithm, and performs a deterministic reversible transformation on the system public key based on the current derived index to generate A derived public key matrix uniquely corresponding to the current derived index is generated. Using the system master private key as the mother trapdoor base and the current derived index as the derivation seed parameter, a lattice base delegation operation is performed to generate a session trapdoor base that satisfies the lattice inclusion relationship with the derived public key matrix. Based on the linear transformation relationship between the system public key and the derived public key matrix, the invertible linear transformation parameters are solved, ensuring that the derived public key matrix is ​​always equal to the product of the system public key and the invertible linear transformation parameters. The invertible linear transformation parameters are associated with the session trapdoor base to form a formatted session trapdoor base entry. The current derived index is incremented, and the steps of generating the derived public key matrix, performing the lattice base delegation operation, solving for the invertible linear transformation parameters, and associating the formatted entry are repeated until the number of generated trapdoor base entries reaches the preset total number of signatures. All formatted session trapdoor base entries are stored consecutively in the order of generation to construct a trapdoor base pool, and the mapping relationship between the current derived index and each invertible linear transformation parameter is recorded in the mapping index table.

[0089] In some embodiments, if the number of trapdoor bases in the trapdoor base pool is less than a preset threshold, a preset number of signature replenishment attempts is obtained; the second private key of the signer is determined according to the security strength level and the preset number of signature replenishment attempts; trapdoor derivation processing is performed on the concatenation result of the public key and the second private key to obtain at least one supplementary trapdoor base; and the supplementary trapdoor base is added to the trapdoor base pool.

[0090] For example, after each trapdoor base selection or signature operation, the number of available trapdoor bases in the trapdoor base pool is checked. This available number is compared with a preset threshold. If the available number is less than the preset threshold, the signing end triggers an online reconstruction process. The signing end obtains a preset number of signature replenishments, which is dynamically determined based on system configuration or current signature load. The signing end obtains the stored security strength level parameters, inputs the security strength level parameters and the preset number of signature replenishments into the lattice dimension optimization function, and outputs the supplementary lattice row dimension parameters and supplementary lattice column dimension parameters that satisfy the security constraints and trapdoor base degradation constraints. Based on the security strength level parameters, supplementary lattice row dimension parameters, and the preset number of signature replenishments, the standard deviation of the supplementary discrete Gaussian error distribution is determined, and a supplementary system public parameter set is generated. A supplementary uniform random public key matrix is ​​generated based on this supplementary system public parameter set as the supplementary system public key, and the supplementary master trapdoor base corresponding to this supplementary system public key is generated as the signer's second private key. The signing end obtains the currently used maximum derived index, increments this index by one as the starting value of the new derived index, and inputs the supplementary system public key, the second private key, and the current derived index into the lattice. The trapdoor derivation algorithm performs a deterministic reversible transformation on the supplementary system public key based on the current derivation index, generating a supplementary derived public key matrix uniquely corresponding to the current derivation index. Using the second private key as the parent trapdoor basis and the current derivation index as the derivation seed parameter, a lattice basis delegation operation is performed to generate a supplementary session trapdoor basis that satisfies the lattice inclusion relationship with the supplementary derived public key matrix. Based on the linear transformation relationship between the supplementary system public key and the supplementary derived public key matrix, the supplementary invertible linear transformation parameters are solved, ensuring that the supplementary derived public key matrix is ​​always equal to the product of the supplementary system public key and the supplementary invertible linear transformation parameters. The supplementary... The inverse linear transformation parameters are associated with the supplementary session trapdoor base to form a formatted supplementary session trapdoor base entry. The current derived index is incremented, and the above steps of generating the supplementary derived public key matrix, the base delegation operation, solving for the supplementary invertible linear transformation parameters, and associating the formatted supplementary entry are repeated until the number of generated supplementary trapdoor base entries reaches the preset number of signature supplements. All formatted supplementary session trapdoor base entries are continuously appended to the end of the existing trapdoor base pool in the order of generation, and the mapping relationship between the newly added derived index and the corresponding supplementary invertible linear transformation parameter is appended and recorded in the mapping index table.

[0091] In the above embodiments, by dynamically selecting trapdoor bases that satisfy the modulo-zero matrix constraint with the public key from a preset trapdoor base pool as signature targets, on-demand allocation and session-level isolation of trapdoor bases are achieved. Each signature uses an independent trapdoor base that is algebraically associated with the public key but with randomized values, effectively avoiding the risk of side-channel exposure and key accumulation leakage caused by the reuse of fixed trapdoor bases, and significantly improving the anti-attack security of the system's master private key. At the same time, the pre-generation mechanism of the trapdoor base pool removes the computationally complex lattice base delegation operation from the critical path of online signature, so that the signing end only needs to perform a lightweight selection from the pool to quickly obtain the target trapdoor base, which greatly reduces the average latency of a single signature and meets the requirements of high throughput and low latency real-time signature scenarios. In addition, the unified modulo-zero matrix constraint relationship between the trapdoor bases in the pool and the public key simplifies the compatibility verification process between the public key and multiple session trapdoor bases, eliminating the need to maintain a separate public key mapping table for each trapdoor base, reducing key management complexity and storage overhead, and providing an efficient and scalable engineering solution for large-scale deployment of quantum signature systems.

[0092] In some embodiments, a system public parameter set including modulus, lattice dimension, error distribution standard deviation, and a family of collision-resistant hash functions is generated based on the security strength level parameter and the expected signature session size parameter; a uniform random public key matrix is ​​generated based on the system public parameter set as the system public key and its master trapdoor base is generated as the system master private key.

[0093] In this embodiment, the expected signature session size parameter is embedded into the generation logic of common parameters (modulus, lattice dimension, standard deviation). This ensures that a single set of system parameters can securely support a preset number of signature operations throughout its entire lifecycle, avoiding service interruptions or re-execution of the complete key generation process due to insufficient parameters, thus improving system availability in large-scale deployment scenarios. The security strength level parameter drives the selection of the lattice dimension optimization function and hash function family, providing quantifiable security criteria for the parameter generation process (e.g., the shortest vector problem in lattice-hard problems / the specific instance difficulty of the error-carrying learning problem), aligning with different post-quantum security levels (e.g., NIST Level 1 / 3 / 5), and meeting the security compliance requirements of diverse application scenarios. For example, an IoT cloud signature service requires the deployment of post-quantum digital signatures, requiring a single set of system parameters to support approximately 1 million (2... 20The system achieves approximately 1,048,576 device signature sessions, meeting NIST post-quantum security level 3 (approximately 128-bit quantum-resistant). The security level parameter is 3, and the expected signature session size is 1,048,576. The lattice dimension optimization function determines the basic row dimension as 512 based on security level 3. Then, based on the expected signature session size and the trapdoor orthogonality degradation tolerance threshold, the column dimension compensation value is calculated as 128, resulting in a final column dimension of 640 (i.e., the difference between row and column dimensions is 128, reserving sufficient redundant dimensions for repeated trapdoor derivation). While maintaining 128-bit security, and considering the expected signature session size and decoding radius constraints, q ≈ 2 is selected. 23 A prime number (approximately 8 million) is used to ensure that the worst-case cumulative error after 1 million signatures is still far less than the decoding radius. The hash function selected corresponds to level 3, and SHA-384 is chosen as the collision-resistant hash function.

[0094] In one alternative approach, generating a system common parameter set, including modulus, lattice dimension, error distribution standard deviation, and a family of collision-resistant hash functions, based on the security strength level parameter and the expected signature session size parameter, further includes:

[0095] The security strength level parameter and the expected signature session size parameter are input into the lattice dimension optimization function, and the output lattice row dimension parameter and lattice column dimension parameter satisfying the security constraint and trapdoor basis degradation constraint are obtained; the standard deviation of the discrete Gaussian error distribution is determined based on the security strength level parameter, the lattice row dimension parameter and the expected signature session size parameter.

[0096] Based on the security strength level parameter and the modulus, at least one anti-collision hash function is selected from a pre-set hash function library; based on the modulus, the row dimension and column dimension, the error distribution standard deviation, and the anti-collision hash function family, the system common parameter set is generated;

[0097] The expected signature session size parameter is embedded into the modulus, the lattice dimension, and the error distribution standard deviation through the lattice dimension optimization function and the error distribution parameter generation function, forming associated constraints. The associated constraints are as follows: the larger the expected signature session size parameter, the larger the prime number of the modulus needs to be to ensure that the lattice space has sufficient capacity to accommodate the sublattice structures generated by multiple trapdoor basis derivations; the difference between the lattice row dimension and the lattice column dimension increases accordingly to compensate for the orthogonality loss caused by repeated delegation of trapdoor basis; the error distribution standard deviation needs to be selected as a value closer to the lower bound of its possible interval under the constraints of the cumulative noise risk model, so as to control that the total growth of the error vector norm after multiple signatures does not exceed the secure decoding radius determined by the modulus, thereby ensuring that the system's common parameter set maintains consistent quantum security for all signature sessions throughout its entire lifecycle.

[0098] In this embodiment, the difference between the row and column dimensions (i.e., dimension compensation) increases monotonically with the session size, proactively reserving orthogonality redundancy space for repeated trapdoor delegation. This quantifies the cumulative effect of the successive loss of orthogonality in the primary trapdoor base during multiple derivations, ensuring that even near the expected signature upper limit, the session trapdoor base still possesses sufficient short vector sampling quality, extending the effective lifetime of a single set of system common parameters. The error distribution standard deviation is not simply a lower bound or empirical value, but rather an optimized selection (approaching the lower bound) within the theoretical value range under the constraints of the cumulative noise risk model. While ensuring correct decoding of a single signature, the upper bound of the total growth of the error vector after multiple signatures is controlled to prevent the gradual accumulation of error noise from increasing the later signature verification failure rate, thus maintaining a consistently high verification pass rate throughout the entire lifetime. Associated constraints ensure that the same set of common parameters satisfies the same quantum security strength from the first signature to the last signature (covering the entire expected session size), preventing an imbalance where there is excessive security margin in the early stages and insufficient security margin in the later stages.

[0099] In one alternative approach, the formula for calculating the higher-order constraint satisfied by the lattice dimension compensation difference between the lattice row dimension and the lattice column dimension is:

[0100]

[0101] in, To compensate for the difference in grid dimensions; This is the post-quantum security strength adjustment coefficient; The expected maximum signature session size parameter represents the maximum number of trapdoor basis reuses supported by a single set of system common parameters; The Euclidean norm of the system master private key; For the system public key matrix corresponding Modulo integer lattice The first smallest lattice constant; The threshold value is the orthogonality degradation tolerance threshold of trapdoor bases.

[0102] In this embodiment, the maximum expected signature session size parameter can be quantitatively determined based on actual business concurrency requirements (such as daily signature volume) to determine the lattice dimension redundancy. A single set of system public parameters can securely support a preset signature session size within its lifecycle, avoiding frequent system-level re-initialization due to session trapdoor pool exhaustion. The master private key norm and orthogonality degradation tolerance threshold quantify the unavoidable lattice basis orthogonality loss during the derivation of multiple session trapdoor bases from the system's master trapdoor base. The additional dimension difference calculated using the rounding function allows for the pre-reservation of sufficient geometric degrees of freedom, ensuring that even after multiple lattice basis delegation operations, the short vector length of each session trapdoor base remains strictly controlled, preventing it from exceeding the secure decoding radius.

[0103] In one alternative approach, the formula for calculating the lower bound constraint that the optimal value of the standard deviation of the error distribution of the cumulative noise risk model satisfies is:

[0104]

[0105] in, These are the theoretical upper and lower bounds for the standard deviation of the error; The modulus of a large prime number in the system's common parameters; For lattice space secure decoding radius, ; For the system public key matrix corresponding Modulo integer lattice The first smallest lattice constant; For the i-th signature, The standard deviation is the error perturbation vector obtained by sampling from the discrete Gaussian distribution; For mathematical expectation; The expected maximum signature session size parameter represents the maximum number of trapdoor basis reuses supported by a single set of system common parameters; For row dimension parameters; Let the standard deviation of the discrete Gaussian error distribution be the variable to be optimized. It is the infinite norm of the vector.

[0106] In this embodiment, minimizing the objective function achieves a Pareto optimal balance between single-signature efficiency and the risk of noise accumulation after large-scale signatures, avoiding the need for fixed... Premature validation failure or excessive reduction in sampling efficiency due to improper value selection. Even after a preset maximum number of signature sessions, the cumulative expected value of the infinite norm of all error perturbation vectors is still strictly suppressed within the lattice space secure decoding radius. Within. Until the During the second signature, the probability of misjudgment due to noise superposition during the receiver's modular equation verification remains below the preset security threshold, fundamentally eliminating the persistent engineering problem of a sharp increase in verification failure rate after more than half of the signatures have been submitted. Constraints force... The value cannot be taken indefinitely, otherwise the accumulated noise will exceed the decoding radius; at the same time, it also prevents... Meaninglessly taking the minimum value (too small) Although it reduces single-shot noise, it leads to an extremely low acceptance rate in discrete Gaussian sampling rejection sampling, making the optimal solution... It always falls in the lower middle region of the feasible interval. All independent variables ( , , All of these are constants determined during the system's common parameter initialization phase, and are calculated offline in a single operation, without occupying any clock cycles in the online signature path. In engineering implementation, this optimization calculation can be placed within the key generation process, producing the optimal solution. It is directly embedded into the system's common parameter set, and all subsequent signature sessions only need to perform table lookups, which meets the requirements of extremely low latency in high-speed signature scenarios.

[0107] In some embodiments, a trapdoor derivation algorithm is invoked based on the system public key and the system master private key to generate a reusable trapdoor pool; the system public key is output to the signature generation module and the signature verification module; the system master private key and the reusable trapdoor pool are stored as a set of system private keys at the signature terminal; wherein, the reusable trapdoor pool includes multiple session trapdoor bases, and each session trapdoor base is associated with the system master private key through an invertible linear transformation parameter.

[0108] In this embodiment, the computationally complex lattice base delegation (trapdoor derivation) operation is completely removed from the critical path of online signature generation and moved to the offline batch preprocessing stage during initialization. During online signature generation, the signing end does not need to perform any matrix factorization or orthogonalization calculations based on the master private key; it only needs to directly read the current session trapdoor base from the pool to call the preimage sampler. This reduces the average time for a single signature from milliseconds (online derivation) to sub-milliseconds (table lookup + sampling), making it particularly suitable for high-throughput, low-latency real-time signature scenarios. Each session trapdoor base is not a simple copy of the system's master private key, but rather is algebraically related to the master private key through reversible linear transformation parameters, but exhibits completely independent pseudo-randomness in its numerical distribution. Even if a session trapdoor base is accidentally leaked due to a side-channel attack or memory corruption, the attacker cannot deduce the system's master private key from that session trapdoor base (because the reversible linear transformation parameters provide sufficient security masking). This achieves a "one signature, one key" key isolation effect; a key loss in a single session will not affect other signing sessions, improving the system's resistance to persistent penetration. Since each session trapdoor basis in the pool is associated with a unique invertible linear transformation parameter, it can serve as a mathematical source for unique session identifiers at the verification end. The verifier does not need to maintain any state table; it can reconstruct this linear transformation relationship from the signature master component and public key, thereby verifying the legitimate ownership of the signature and avoiding the additional database queries or sequential counter synchronization overhead introduced to trace session state.

[0109] For example, a securities trading system needs to deploy a post-quantum signature scheme. Its business constraints are: approximately 200,000 signatures need to be continuously generated during daily trading hours, and the generation latency of each signature must not exceed 2 milliseconds to ensure the real-time performance of transaction matching instructions. If a trapdoor pool is not pre-generated during the initialization phase, the system must perform a complete lattice base delegation based on the master private key for each transaction signature (involving hundreds of matrix multiplications and Gram-Schmidt orthogonalization). Actual testing shows that the average time for a single online derivation is 4.5 milliseconds, far exceeding the 2-millisecond business limit, and causing instruction queuing and backlog under high concurrency. This application pre-calls the trapdoor derivation algorithm within the initialization window (lasting approximately 5 seconds) before the daily market opening to generate 240,000 session trapdoor bases (including a 20% security margin). Each session trapdoor base is generated using reversible linear transformation parameters different from the master private key. When the 1000th transaction message arrives, the signature generation module directly locates the 1000th entry in the pool based on the session sequence number pointer, instantly reading its corresponding session trapdoor basis and reversible linear transformation parameters. The preimage sampler skips the time-consuming trapdoor derivation step and directly performs sampling using the session trapdoor basis, drastically reducing the single signature latency to 0.8 milliseconds, fully meeting business requirements. If an attacker successfully steals the 1000th session trapdoor basis through the memory-side channel and attempts to recover the system's master private key, since the 1000th session trapdoor basis is delegated from the derived public key, the attacker, without knowing the reversible linear transformation parameters, reverse-engineering the master private key is equivalent to solving an extended SIS (short integer solution) problem with random perturbations on a lattice, the difficulty of which is completely consistent with the original system's quantum security level. Therefore, the loss of a single session trapdoor basis is strictly limited to the scope of that session, and the security of the remaining 239,000 entries in the system and the absolute security of the system's master private key remain unaffected.

[0110] In one alternative approach, generating a reusable trapdoor pool by invoking a trapdoor derivation algorithm based on the system public key and the system master private key further includes:

[0111] The system public key, the system master private key, and the current derived index are input into the trapdoor derivation algorithm. A deterministic reversible transformation is performed on the system public key according to the current derived index to generate a derived public key matrix that uniquely corresponds to the current derived index. Using the system master private key as the parent trapdoor basis and the current derived index as the derivation seed parameter, a lattice basis delegation operation is performed to generate a session trapdoor basis that satisfies the lattice inclusion relationship with the derived public key matrix.

[0112] Based on the linear transformation relationship between the system public key and the derived public key matrix, solve for the invertible linear transformation parameters, such that the derived public key matrix is ​​always equal to the product of the system public key and the invertible linear transformation parameters; then combine the invertible linear transformation parameters with the session trapdoor basis to form a session trapdoor basis entry.

[0113] The session trapdoor base is associated with the invertible linear transformation parameter to form a formatted session trapdoor base entry; the formatted session trapdoor base entry is appended and stored in the reusable trapdoor base pool, and the mapping relationship between the current derived index and the invertible linear transformation parameter is recorded in the mapping index table.

[0114] In this embodiment, a deterministic reversible transformation (rather than a random transformation) uniquely bound to the current derived index is applied to the system public key, ensuring that each derived public key matrix is ​​entirely determined by that index. This guarantees that the verification end can reconstruct the corresponding derived public key matrix using the index (or a session-unique identifier derived from it) without storing any session state. The same index will never generate a second different derived public key, fundamentally eliminating the risk of session public key collisions and replay confusion. Using the system master private key as the parent trapdoor base, session trapdoor bases are generated through lattice base delegation operations. These session trapdoor bases inherit the lattice inclusion relationship with the derived public key matrix while possessing an independent randomization structure. This ensures that the master private key is only briefly used during initialization pool filling and online reconstruction, and the regular signature process does not touch the master private key at all, significantly reducing the exposure surface of the master key and the side-channel attack window. Simultaneously, the short vector length of each session trapdoor base is strictly controlled within the theoretically guaranteed range of lattice base delegation, preventing excessive expansion due to increasing derivation levels. Because entries in the pool are appended sequentially in strictly ascending order of derived indexes, and the mapping index table records the mapping relationship between indexes and offset addresses, when online reconstruction is triggered, newly added session trapdoor base entries only need to be appended from the current maximum index, and the mapping table expands synchronously. Throughout the process, no existing data needs to be moved, and no indexes need to be rearranged, achieving lock-free and uninterrupted dynamic pool expansion.

[0115] In some embodiments, a message digest value is calculated based on the original message to be signed and the anti-collision hash function in the system public parameter set, and the message digest value is output to the signature generation module; the message digest value, the system public key, and the current session trapdoor base in the system private key set are received; an efficient preimage sampler is invoked based on the current session trapdoor base to calculate a short vector that satisfies the modular equation constraint between the system public key and the message digest value as the signature basis vector.

[0116] In this embodiment, the message digest value, system public key, and current session trapdoor base are all locally ready data (the digest is calculated in real time by hashing, and the public key and trapdoor base are pre-stored in memory). The entire process requires no network interaction, database query, or external random number source (the trapdoor base has built-in randomness), is not limited by I / O bottlenecks, and can stably meet the latency requirements of low-latency signature scenarios. The preimage sampler solves for a short vector that satisfies the modular equation between the system public key and the message digest value. The solution process depends on the structure of the current session trapdoor base. The sampler has pre-computed the orthogonalization decomposition and conditional variance based on the trapdoor base. Therefore, during online calls, it can directly and quickly perform dimension-by-dimensional conditional sampling, completely moving the preparation cost of the trapdoor base to the pool filling stage. The online stage only requires sequential calculation, achieving extreme lightweighting of the computational hot path.

[0117] In an alternative approach, invoking an efficient preimage sampler based on the current session trapdoor basis to compute a short vector satisfying the modular equation constraint between the system public key and the message digest value as the signature basis vector further includes:

[0118] The current session trapdoor basis and error distribution standard deviation are input into the preimage sampler initialization function. The current session trapdoor basis is decomposed into lattice basis orthogonalization and the conditional variance parameter of each dimension of conditional sampling is pre-calculated. The sampling auxiliary data structure is output. The system public key and message digest value are input into the target point calculation submodule of the preimage sampler initialization function. The target point vector is output.

[0119] The sampling auxiliary data structure and the target point vector are input into the sampling submodule of the preimage sampler. The target point vector is used as the mean center of the discrete Gaussian distribution. The pre-calculated one-dimensional conditional variance in the sampling auxiliary data structure is used as the sampling parameter. One-dimensional discrete Gaussian sampling is performed successively from the highest dimension to the lowest dimension. After each sampling, the current residual vector is updated immediately and the sampled value is stored in the corresponding dimension. After all dimensions are sampled, the preimage vector is output.

[0120] If the Euclidean norm of the preimage vector is less than or equal to the upper bound of the preset norm pre-extracted from the system's common parameter set, the preimage vector is determined to be a valid signature base vector. Otherwise, the current preimage vector is discarded and a new target point vector is regenerated until a valid signature base vector that passes the norm verification is generated or the preset maximum number of retries is reached. The valid signature base vector is then output as the signature base vector to the signature principal component calculation module.

[0121] In this embodiment, by performing a one-time lattice basis orthogonalization decomposition on the current session trapdoor basis before sampling, the variance parameter of each dimension of conditional sampling is pre-calculated, thus minimizing the most time-consuming matrix decomposition operation (complexity O(n)) during the sampling process. 3 )) and dimension-by-dimensional sampling operations (complexity O(n 2The online signature path performs only lightweight lookup-based conditional sampling, drastically reducing the arithmetic operations required for a single preimage generation. The residual is updated immediately after each dimension is sampled, ensuring that the mean of subsequent dimensions is calculated based on the latest residual, eliminating the need to wait for all dimensions to be sampled before batch correction. The storage requirements for intermediate data are compressed to retain only the current residual vector and a progressively filled preimage array, resulting in minimal memory usage (approximately O(n)). Furthermore, the data access pattern is sequential and highly cache-friendly, avoiding cache misses caused by random access.

[0122] In some embodiments, the signature principal component is calculated by sampling the error perturbation vector from the error distribution; the session unique identifier is calculated using the current session trapdoor base and its corresponding invertible linear transformation parameters; the session unique identifier and the signature principal component are formatted and concatenated to form a complete digital signature; the reusable trapdoor base pool is updated; wherein, the current session trapdoor base is marked as used, and the session sequence number pointer is incremented to point to the next available trapdoor base.

[0123] In this embodiment, by superimposing independently sampled error perturbation vectors on the signature base vector, the main component of the output signature exhibits a pseudo-random distribution in numerical terms, masking the statistical characteristics of the underlying private trapdoor base and preimage sampler. Even if an attacker intercepts a large number of historical signature samples, they cannot deduce the system master private key or the current session trapdoor base through differential analysis or mean statistics, significantly improving the signature end's resistance to side-channel leakage. The session unique identifier calculated using the current session trapdoor base and its reversible linear transformation parameters does not rely on an additional centralized counter or external timestamp. This allows the verification end to verify whether the signature truly originates from a legitimate and unused session trapdoor base in the pool by reconstructing the mapping relationship without obtaining the trapdoor base, thereby effectively defending against replay attacks and illegal derived signatures. The used trapdoor base is marked as used and the sequence number pointer is incremented, so that the signature generation module can always obtain the next valid trapdoor base in O(1) time complexity without traversal or search. This ensures that the same trapdoor base is not reused in multi-threaded or high-concurrency signature scenarios, and that the signature order is strictly incremental, thus providing assurance for auditability and non-repudiation.

[0124] In one alternative approach, calculating the signature principal component from the error perturbation vector sampled from the error distribution further includes:

[0125] The error distribution standard deviation is input into the perturbation vector sampler for independent dimension-by-dimensional sampling, and the output is an initial error perturbation vector with the same dimension as the signature base vector;

[0126] Using the invertible linear transformation parameters as the transformation matrix, perform matrix-vector multiplication in the modulus sense on the initial error perturbation vector to output the session binding error perturbation vector;

[0127] The signature base vector and the session binding error perturbation vector are input together into the signature main component synthesis module to perform component-by-component addition and output the signature main component.

[0128] In this embodiment, by introducing the reversible linear transformation parameter into the perturbation vector calculation process, even if different sessions use the same statistically distributed initial error perturbation vector, they will fall into different derived public key subspaces after linear transformation mapping. This fundamentally severs the linear correlation between noise components in each signature master component, resisting "noise accumulation" side-channel analysis where attackers use a large number of historical signatures for average denoising to recover the signature base vector or trapdoor basis statistical characteristics. The reversible linear transformation parameter has a bounded operator norm (determined by its maximum singular value). By pre-associating and verifying the upper bound of this norm in the trapdoor basis entry of the session, it ensures that the Euclidean norm of the session-bound error perturbation vector is strictly limited within a preset threshold. This ensures that the overall error growth of the signature master component synthesized by component-by-component addition maintains a deterministic safety margin within the decoding radius, avoiding the possibility of the legitimate signature being mistakenly judged as invalid by the verification end due to excessive random fluctuations in the perturbation norm.

[0129] In some embodiments, based on the complete digital signature to be verified, the original message to be signed, the system public key, and the system public parameter set, it is verified whether the signature master component satisfies the modular equation constraint between the system public key and the verification message digest value; and it is verified whether the session unique identifier matches the trapdoor basis information reconstructed from the system public key and the signature master component.

[0130] In this embodiment, the verification end only needs to hold the system public key and the system public parameter set, and does not need to access the system master private key or any session trapdoor base information. The matching and verification of the session unique identifier is essentially reconstructing the implicit trapdoor base index information through the algebraic relationship between the public key and the signature master component, rather than directly comparing the trapdoor base itself. This allows the verification end to be a completely public third-party node, without having to assume the security responsibility of private key safekeeping, reducing deployment costs and key management complexity. The verification end does not need to maintain a reusable trapdoor base pool or any session trapdoor base identifier mapping database. The matching and verification of the session unique identifier is calculated in real time based entirely on the public key and the signature master component, without introducing additional storage overhead on the verification end, which facilitates horizontal scaling and load balancing deployment. By reconstructing the verification, the verification end can detect whether two different signature master components correspond to the same session identifier (i.e., the attack feature of identifier reuse), thereby effectively identifying and rejecting replay signatures, without relying on vulnerable external states such as timestamps or monotonic counters. The modular equation constraint verification is placed before the session identifier verification, taking advantage of the relatively small computational cost of modular equation operations and the fact that it does not require the reconstruction of trapdoor base information. For a large number of invalid or forged signatures, the first layer of verification can quickly reject them, avoiding the need to perform more complex trapdoor basis reconstruction operations, thus improving verification throughput and reducing resource consumption under denial-of-service attacks.

[0131] In one alternative approach, verifying whether the signature principal component satisfies the modular equation constraint between the system public key and the verification message digest value, based on the complete digital signature to be verified, the original message to be signed, the system public key, and the system public parameter set, further includes:

[0132] Input the original message to be signed into the anti-collision hash function specified in the system's public parameter set, and output the verification message digest value;

[0133] Perform a modular multiplication operation between the system public key and the signature master component, and output the first verification value; perform a modular multiplication operation between the derived public key matrix and the signature master component, and output the second verification value;

[0134] Calculate the tolerance error threshold vector based on the standard deviation and tolerance parameters, and calculate the first difference vector between the first verification quantity and the verification message digest value;

[0135] Check whether each component of the first difference vector does not exceed the corresponding component of the allowable error threshold vector. If any component exceeds the threshold, the modular equation constraint is deemed to have failed. If all components pass, calculate the second difference vector, which is the difference between the second verification quantity and the verification message digest value. If all components pass, the modular equation constraint is deemed to have been met.

[0136] In this embodiment, not only is the signature master component verified to satisfy the modular equation constraint under the system public key (first verification quantity), but it is also verified to satisfy the modular equation constraint under the derived public key reconstructed from the session unique identifier (second verification quantity). This allows the verification end to implicitly confirm that the signature master component indeed originates from a legitimate session trapdoor basis entry, rather than a short vector constructed out of thin air, without accessing any private trapdoor basis information, thus eliminating the need for additional protocol interaction rounds. The tolerance error threshold vector is set independently for each component. The threshold is calculated based on the standard deviation of the error distribution and a preset tolerance parameter (usually several times the standard deviation), allowing each component to deviate from the precise value within the preset tolerance range, thereby avoiding misjudgment as invalid due to minor noise fluctuations in the legitimate signature. At the same time, the component-independent threshold setting is more refined than the uniform norm threshold, enabling differentiated tolerance for different dimensions of actual error distribution characteristics, thus improving the verification pass rate. Placing the component check of the first difference vector before the second difference vector reduces computational overhead because the calculation of the first verification quantity only relies on the system public key and does not involve the reconstruction calculation of the derived public key. For a large number of invalid signatures (especially randomly forged signatures), the first layer of verification can quickly intercept and terminate the verification, avoiding the more complex reconstruction of derived public keys and the calculation of the second verification quantity. In high-throughput verification scenarios, this can significantly reduce the average verification latency. The tolerance parameter in the tolerance threshold vector is publicly set as part of the system's public parameter set. During the deployment phase, this parameter can be flexibly adjusted according to the noise level and security requirements of the actual application scenario. For high-security scenarios, a tighter tolerance can be used to reduce the probability of false acceptance, while for high-availability scenarios (such as high-frequency IoT signatures), a looser tolerance can be used to improve the signature success rate.

[0137] In some embodiments, when the number of available trapdoor bases in the reusable trapdoor base pool is lower than a preset security threshold, an online reconstruction process is triggered; wherein, a new set of session trapdoor bases is generated in batches according to the system master private key and a new session sequence number starting value, and the new set of session trapdoor bases is added to the reusable trapdoor base pool, so that subsequent signing operations can be continuously supported without re-executing the key generation process and without interrupting the ongoing signing session.

[0138] In this embodiment, online reconstruction immediately triggers batch generation in the background when the pool availability falls below a threshold. New session trapdoor bases are added to the end of the pool in real time, without interruption or blocking of the main signing process. This ensures the signing service has 24 / 7 uninterrupted operation, making it particularly suitable for scenarios with high availability requirements such as financial transactions, blockchain block generation, and V2X (vehicle-to-everything) networks. Traditional solutions typically require pausing all signing services and re-executing the complete key generation and pool filling process when the trapdoor base pool is exhausted, during which all pending signature requests must queue or fail. The reconstruction process fully reuses the initial system master private key and system public parameters. New session trapdoor bases are derived from the same parent trapdoor base using a trapdoor derivation algorithm, eliminating the need to regenerate the system public key or redistribute it to all verification endpoints. This ensures the master private key is generated and used only once during the initialization phase, and subsequent online reconstructions do not involve new key generation operations. This fundamentally reduces the frequency of private keys residing in and being manipulated in memory, lowering the risk window for private keys to be stolen by side-channel attacks or memory sniffing.

[0139] According to the scheme provided by the present invention, a system public parameter set including modulus, lattice dimension, error distribution standard deviation, and anti-collision hash function family is generated based on security strength level parameters and expected signature session size parameters; a uniform random public key matrix is ​​generated as the system public key and its master trapdoor base is generated as the system master private key based on the system public key and the system master private key; a trapdoor derivation algorithm is invoked based on the system public key and the system master private key to generate a reusable trapdoor base pool; the system public key is output to the signature generation module and the signature verification module, and the system master private key and the reusable trapdoor base pool are stored as a system private key set at the signature terminal; wherein... The reusable trapdoor pool includes multiple session trapdoor bases, each associated with the system master private key through an invertible linear transformation parameter; a message digest value is calculated based on the original message to be signed and the collision-resistant hash function in the system public parameter set, and the message digest value is output to the signature generation module; the message digest value, the system public key, and the current session trapdoor base in the system private key set are received; an efficient preimage sampler is invoked based on the current session trapdoor base to calculate a short vector that satisfies the modular equation constraint between the system public key and the message digest value as the signature base vector; from the error analysis... The signature principal component is calculated using the sampling error perturbation vector in the code. A unique session identifier is calculated using the current session trapdoor base and its corresponding invertible linear transformation parameters. The session unique identifier and the signature principal component are then formatted and concatenated to form a complete digital signature. The reusable trapdoor base pool is updated. Specifically, the current session trapdoor base is marked as used, and the session sequence number pointer is incremented to point to the next available trapdoor base. Based on the complete digital signature to be verified, the original message to be signed, the system public key, and the system public parameter set, the signature principal component is verified to ensure that the system public key and the original message are compatible. The invention verifies the modular equation constraints between message digest values; and verifies whether the session unique identifier matches the trapdoor base information reconstructed from the system public key and the signature master component. When the number of available trapdoor bases in the reusable trapdoor base pool is lower than a preset security threshold, an online reconstruction process is triggered. Specifically, a new set of session trapdoor bases is generated in batches based on the system master private key and a new session sequence number starting value, and this new set of session trapdoor bases is appended to the reusable trapdoor base pool. This allows for continuous support of subsequent signature operations without re-executing the key generation process or interrupting ongoing signature sessions. This invention decouples trapdoor derivation from online signatures by constructing a reusable trapdoor base pool and a session-level trapdoor base isolation method, reducing signature latency by 1-2 orders of magnitude. It also achieves fine-grained key isolation, ensuring that leakage of a single session trapdoor base does not affect the system master private key or other session security. Furthermore, it resists trapdoor base replay attacks and supports signature source auditing, and can infinitely expand signature capacity without service interruption, providing a highly available solution for large-scale post-quantum signature deployments.

[0140] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0141] Based on the same inventive concept, this application also provides a signature generation apparatus for implementing the signature generation method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more signature generation apparatus embodiments provided below can be found in the limitations of the signature generation method described above, and will not be repeated here.

[0142] In one exemplary embodiment, such as Figure 4 As shown, a signature generation apparatus is provided, including: an acquisition module 401, a determination module 402, a hash module 403, and a generation module 404, wherein:

[0143] Module 401 is used to obtain the target trapdoor base and public key used to sign the data to be signed.

[0144] The determining module 402 is used to determine a target vector that meets preset conditions based on the data to be signed, and use it as the basic data for signing the data to be signed; the preset condition is that the product between the target vector and the public key is the same as the data to be signed.

[0145] The hash module 403 is used to perform hash processing on the concatenation result of the target trapdoor basis and the invertible linear transformation parameters corresponding to the target trapdoor basis to obtain the signature identifier of the data to be signed.

[0146] The generation module 404 is used to concatenate the signature base data and the signature identifier to obtain the target signature of the data to be signed;

[0147] The target trapdoor basis is different for different data to be signed; the result matrix obtained by multiplying the target trapdoor basis with the public key is a zero matrix under the operation of a predetermined modulus.

[0148] In some embodiments, the determining module is further configured to perform hash processing on the data to be signed to obtain the encoding of the data to be signed; using the encoding of the data to be signed as the sampling target value, perform sampling processing on the target trapdoor basis to obtain a target vector that satisfies the modular equation constraint between the public key and the encoding of the data to be signed, and use it as the signature basis data of the data to be signed; wherein, the modular equation constraint is that the result obtained after taking the remainder of the product between the target vector and the public key is equal to the encoding of the data to be signed.

[0149] In some embodiments, the generation module is further configured to perturb the signature base data to obtain perturbed signature base data; and to concatenate the perturbed signature base data and the signature identifier to obtain the target signature of the data to be signed.

[0150] In some embodiments, the acquisition module is further configured to acquire the public key of the signer; and select from a preset trapdoor base pool a trapdoor base whose result matrix after multiplication with the public key is a zero matrix under a predetermined modulus, as the target trapdoor base for signing the data to be signed.

[0151] In some embodiments, the acquisition module is further configured to determine the first private key of the signer based on the security strength level of the signer and the preset total number of signatures; perform trapdoor derivation processing on the concatenation result of the public key and the first private key to obtain at least one trapdoor base; and construct a trapdoor base pool based on each trapdoor base.

[0152] In some embodiments, the acquisition module is further configured to: acquire a preset number of signature replenishment attempts when the number of trapdoor bases in the trapdoor base pool is less than a preset number threshold; determine the second private key of the signer based on the security strength level and the preset number of signature replenishment attempts; perform trapdoor derivation processing on the concatenation result of the public key and the second private key to obtain at least one supplementary trapdoor base; and add the supplementary trapdoor base to the trapdoor base pool.

[0153] Each module in the aforementioned signature generation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0154] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a signature generation method.

[0155] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0156] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0157] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0158] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0159] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0160] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0161] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A signature generation method, characterized in that, The method includes: Obtain the target trapdoor base and public key used to sign the data to be signed; Based on the data to be signed, a target vector that meets a preset condition is determined and used as the basic signature data for the data to be signed; the preset condition is that the product between the target vector and the public key is the same as the data to be signed. The concatenation result of the target trapdoor basis and the invertible linear transformation parameter corresponding to the target trapdoor basis is hashed to obtain the signature identifier of the data to be signed; The signature base data and the signature identifier are concatenated to obtain the target signature of the data to be signed. The target trapdoor bases for different data to be signed are different; the result matrix obtained by multiplying the target trapdoor base with the public key is a zero matrix under the operation of a predetermined modulus.

2. The method according to claim 1, characterized in that, The vector that satisfies the preset conditions is used as the basic signature data for the data to be signed, including: The data to be signed is hashed to obtain the data encoding to be signed; Using the data encoding to be signed as the sampling target value, the target trapdoor basis is sampled to obtain a target vector that satisfies the modular equation constraint between the public key and the data encoding to be signed, which serves as the signature basis data of the data to be signed. The modular equation constraint is that the result obtained by taking the remainder of the product between the target vector and the public key is equal to the encoding of the data to be signed.

3. The method according to claim 1, characterized in that, The process of concatenating the signature base data and the signature identifier to obtain the target signature of the data to be signed includes: The signature base data is perturbed to obtain the perturbed signature base data; The perturbed signature base data and the signature identifier are concatenated to obtain the target signature of the data to be signed.

4. The method according to claim 1, characterized in that, The step of obtaining the target trapdoor base and public key used to sign the data to be signed includes: Obtain the public key of the signer; Select from the preset trapdoor base pool the trapdoor bases whose result matrix after multiplication with the public key is a zero matrix under a predetermined modulus, and use them as the target trapdoor bases for signing the data to be signed.

5. The method according to claim 4, characterized in that, The method for determining the preset trapdoor base pool includes: The first private key of the signer is determined based on the security strength level of the signer and the preset total number of signatures. The concatenation result of the public key and the first private key is subjected to trapdoor derivation processing to obtain at least one trapdoor base; Construct a trap foundation pool based on each of the trap foundations described.

6. The method according to claim 5, characterized in that, The method further includes: If the number of trapdoor bases in the trapdoor base pool is less than a preset number threshold, a preset number of signature replenishment attempts will be obtained. The second private key of the signer is determined based on the security strength level and the preset number of signature replenishments; The concatenation result of the public key and the second private key is subjected to trapdoor derivation processing to obtain at least one supplementary trapdoor base; Add the supplementary trap base to the trap base pool.

7. A signature generation device, characterized in that, The device includes: The acquisition module is used to obtain the target trapdoor base and public key used to sign the data to be signed. The determining module is used to determine a target vector that meets a preset condition based on the data to be signed, and use it as the basic signing data of the data to be signed; the preset condition is that the product between the target vector and the public key is the same as the data to be signed; The hash module is used to perform hash processing on the concatenation result of the target trapdoor basis and the invertible linear transformation parameters corresponding to the target trapdoor basis to obtain the signature identifier of the data to be signed; The generation module is used to concatenate the basic signature data and the signature identifier to obtain the target signature of the data to be signed; The target trapdoor bases for different data to be signed are different; the result matrix obtained by multiplying the target trapdoor base with the public key is a zero matrix under the operation of a predetermined modulus.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images