Post-quantum signature method, post-quantum signature verification method and related apparatuses

Abstract

A post-quantum signature method, a post-quantum signature verification method, and related apparatuses. OTS signature data and LMS signature data can be generated by using a Chinese hash algorithm, and the LMS signature data can resist quantum attacks and meet Chinese encryption requirements. The post-quantum signature method comprises: selecting an OTS private key from an LMS private key; then, generating OTS signature data on the basis of a Chinese hash algorithm, the OTS private key, a first reference random number, and a message, generating a hash tree on the basis of the LMS private key, generating an LMS public key on the basis of a root node of the hash tree, determining, in the hash tree, a brother node set on the basis of a target leaf node corresponding to the OTS private key, and generating LMS signature data on the basis of the serial number of the OTS private key, the OTS signature data, an LMS feature value, and the brother node set; and sending the LMS public key, the LMS signature data, and the message to a signature verification apparatus.

Description

A post-quantum signature method, a post-quantum signature verification method and related devices This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office on September 26, 2023, with application number 202311267538.4 and invention name “A post-quantum signature method, a post-quantum signature verification method and related devices”, the entire contents of which are incorporated by reference in this application. Technical Field The embodiments of the present application relate to the field of cryptography, and in particular to a post-quantum signature method, a post-quantum signature verification method, and related devices. Background Art The Leighton Micali signature (LMS) algorithm is a post-quantum signature algorithm. At present, there is a LMS signature verification method that is roughly as follows: the signature device generates a one-time signature (OTS) private key based on a random number, and generates a one-time signature public key and a Layton Micali LMS public key based on a hash chain. The message is signed according to the OTS private key, the node value of the authentication path is determined according to the OTS private key, and the node value of the authentication path, the signature data, and the public key are sent to the signature verification device. The signature verification device uses the SHA256 algorithm to hash the signature data. When the calculated hash value is the same as the public key, the signature data is determined to be legal, otherwise the signature data is determined to be illegal. However, the SHA256 algorithm is a US cryptographic algorithm and does not meet the encryption requirements of China's critical information infrastructure. Summary of the invention The embodiments of the present application provide a post-quantum signature method, a post-quantum signature verification method, a signature device, and a signature verification device, which can generate OTS signature data using the Chinese hash algorithm, and generate LMS signature data using the OTS signature data. The LMS signature data can resist quantum attacks and meet the encryption requirements of China's critical information infrastructure. The first aspect provides a post-quantum signature method, the method comprising: generating an LMS private key and generating a 2 hAfter selecting a private key from the private keys as the one-time signature OTS private key, generate OTS signature data according to the Chinese hash algorithm, OTS private key, the first reference random number and the message, generate a hash tree with a height of h according to the LMS private key, and then generate the LMS public key according to the LMS eigenvalue corresponding to h, the OTS eigenvalue, the second reference random number and the root node of the hash tree, determine the target leaf node corresponding to the OTS private key and the ancestor node set of the target leaf node in the hash tree; determine the brother node set according to the target leaf node and the ancestor node set of the target leaf node, generate LMS signature data according to the serial number of the OTS private key, OTS signature data, LMS eigenvalue and the brother node set, and then send the LMS public key, LMS signature data and the message to the signature verification device. Wherein, the brother node set includes the brother node of the target leaf node and the brother node of each ancestor node in the ancestor node set, and the ancestor node set includes all ancestor nodes after removing the root node in the hash tree. In another possible implementation, the Chinese hash algorithm includes but is not limited to SM3. In one possible implementation, the message includes a firmware boot image file. In another possible implementation, the message includes a firmware upgrade image file. According to this implementation, OTS signature data can be generated according to the Chinese hash algorithm. The hash result based on the Chinese hash algorithm cannot be used to infer the original data. Therefore, after using the OTS signature data to generate the LMS signature data, the OTS signature data and the LMS signature data can resist quantum attacks, and the Chinese hash algorithm used to generate the LMS signature data meets the encryption requirements of China's critical information infrastructure. In one possible implementation, generating the LMS private key includes: h The random number sequence number is selected one by one from the random number sequence numbers; a combination number sequence corresponding to the random number sequence number is generated according to the selected random number sequence number and p random number numbers, and each combination number in the combination number sequence is hashed using the Chinese hash algorithm to obtain a random number sequence corresponding to the random number sequence number; the OTS characteristic value, the second reference random number, the random number sequence number and the random number sequence corresponding to the random number sequence number are combined into a private key corresponding to the random number sequence number; all private keys are combined into an LMS private key according to the random number sequence number. Among them, each combination number in the combination number sequence is obtained by combining the second reference random number, the selected random number sequence number, the random number number, the preset value 0xff and the random number seed. In the process of generating random numbers, the combination number is hashed into a random number according to the Chinese hash algorithm, thereby providing a random number generation method that meets the encryption requirements of China's key facilities. In another possible implementation, a pseudo-random algorithm is used to generate p*2 h random number, p*2 h The random numbers are divided into 2h A random number sequence of the same length is used to form the OTS characteristic value, the second reference random number, the random number sequence number and the random number sequence corresponding to the random number sequence number into a private key corresponding to the random number sequence number; all private keys are combined into an LMS private key according to the random number sequence number. In another possible implementation, the post-quantum signature method of the present application further includes: obtaining an OTS characteristic value from an OTS private key, The invention relates to a method for generating a data sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the iteration number and the target random number sequence; generating a data sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the iteration number and the target random number sequence; forming a second number to be processed by forming the second reference random number, the serial number of the OTS private key, the first constant and the data sequence; hashing the second number to be processed into a K value using the Chinese hash algorithm; forming an OTS public key by forming an OTS characteristic value, a second reference random number, the serial number of the OTS private key and the K value; and sending the OTS public key, the OTS signature data and the message to the signature verification device. In this way, an OTS public key generated based on the Chinese hash algorithm is provided, and the OTS public key meets the encryption requirements of China's key facilities. In another possible implementation, generating OTS signature data according to the Chinese hash algorithm, the OTS private key, the first reference random number and the message includes: extracting the OTS characteristic value, the second reference random number and the target random number sequence from the OTS private key; composing the first to-be-processed number with the second reference random number, the serial number of the OTS private key, the second constant, the first reference random number and the message; hashing the first to-be-processed number into a to-be-processed hash value using the Chinese hash algorithm; generating a signature parameter value sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the to-be-processed hash value and the target random number sequence; composing the OTS characteristic value, the first reference random number and the signature parameter value sequence into the OTS signature data. This provides a specific method for generating OTS signature data according to the Chinese hash algorithm, so that the OTS signature data can resist quantum attacks. In another possible implementation, generating a hash tree according to the LMS private key includes: extracting 2 h A random number sequence, and then according to the second reference random number, the sequence number of the OTS private key and 2 h Random number sequence generation 2 h data sequence, from 2 hThe data sequence to be processed is selected one by one from the data sequences, and then the second reference random number, the hash tree node number corresponding to the data sequence to be processed, the third constant and the data sequence to be processed are combined into the combination number corresponding to the data sequence to be processed; the combination number corresponding to the data sequence to be processed is hashed into a leaf node using the Chinese hash algorithm; the non-leaf node of the upper layer is calculated according to the leaf node with a brother relationship; the non-leaf node of the upper layer is calculated according to the non-leaf node with a brother relationship, until the root node is calculated. This provides a method for generating an LMS hash tree according to the Chinese hash algorithm, and an LMS public key can be generated according to the root node of the LMS hash tree, so that the LMS public key can meet the encryption requirements of China's key facilities. In another possible implementation, an OTS characteristic value, a second reference random number, a serial number of the OTS private key, and a target random number sequence are obtained from the OTS private key; a target data sequence is generated according to the second reference random number, the serial number of the OTS private key, the random number number, the iteration number, and the target random number sequence included in the OTS private key; the second reference random number, the serial number of the OTS private key, the first constant, and the target data sequence form a second number to be processed; the second number to be processed is hashed into a K value using a Chinese hash algorithm; the OTS characteristic value, the second reference random number, the serial number of the OTS private key, and the K value form an OTS public key; and the OTS public key, the OTS signature data, and the message are sent to a signature verification device. This provides a method for generating an OTS public key using a Chinese hash algorithm, so that the OTS public key meets the encryption requirements of China's key facilities. The second aspect provides a post-quantum signature verification method, which includes: receiving an LMS public key, LMS signature data and a message sent by a signature device; obtaining a second reference random number and a root node from the LMS public key, obtaining OTS signature data, a serial number and a brother node set of an OTS private key from the LMS signature data, obtaining a first reference random number and a signature parameter value sequence from the OTS signature data, and determining a data sequence to be combined according to the second reference random number, the serial number of the OTS private key, a first constant, the first reference random number, the message and the signature parameter value sequence; combining the second reference random number, the serial number of the OTS private key, the first constant and the data sequence to be combined; using a Chinese hash algorithm to hash the combination result into a K value to be verified; generating a root node to be verified according to the second reference random number, the serial number of the OTS private key, a third constant, the K value to be verified and the brother node set contained in the LMS signature data; when the root node to be verified is equal to the root node in the LMS public key, determining that the LMS signature data is legal; when the root node to be verified is not equal to the root node in the LMS public key, determining that the LMS signature data is illegal. This provides a method for verifying LMS signature data based on the root node of the hash tree. In a possible implementation, the post-quantum signature verification method of the present application further includes: comparing the LMS characteristic value of the LMS public key with the LMS characteristic value of the LMS signature data; when the LMS characteristic value of the LMS public key is different from the LMS characteristic value of the LMS signature data, determining that the LMS signature data is illegal data. In this way, the LMS signature data can be verified according to the LMS characteristic value, thereby providing a fast verification method. In another possible implementation, the post-quantum signature verification method of the present application further includes: comparing the OTS characteristic value of the LMS public key with the OTS characteristic value of the LMS signature data; when the OTS characteristic value of the LMS public key is different from the OTS characteristic value of the LMS signature data, determining that the LMS signature data is illegal data. In this way, the LMS signature data can be verified according to the OTS characteristic value, thereby providing another fast verification method. In another possible implementation, the post-quantum signature verification method of the present application also includes: receiving the OTS public key, OTS signature data and message sent by the signature device; extracting the second reference random number, the serial number and K value of the OTS private key from the OTS public key; extracting the first reference random number and the signature parameter value sequence from the OTS signature data; determining the data sequence to be combined according to the second reference random number, the serial number of the OTS private key, the first constant, the first reference random number, the message and the signature parameter value sequence; combining the second reference random number, the serial number of the OTS private key, the first constant and the data sequence to be combined; using the Chinese hash algorithm to hash the combination result into the K value to be verified; when the K value to be verified is different from the K value of the OTS public key, the OTS signature data is determined to be illegal data. Verifying the OTS signature data according to the K value provides a method for quickly verifying the OTS signature data. When the OTS signature data is illegal, the verification of the LMS signature data can be terminated. In another possible implementation, the post-quantum signature verification method of the present application further includes: when the length of the OTS public key is not a preset length, determining that the OTS public key is illegal data. Verifying the OTS public key according to the public key length, thereby providing a method for quickly verifying the OTS public key. When the OTS public key is illegal, the LMS signature data can be considered illegal, and the signature verification is terminated. The third aspect provides a signature device. Specifically, the signature device includes a module or unit for executing the method in the above-mentioned first aspect or any possible implementation of the first aspect, such as an LMS key module, a one-time signature key module, a one-time signature module, an LMS signature module or a sending module. A fourth aspect provides a signature verification device, which is used to execute the method in the second aspect or any possible implementation of the second aspect. Specifically, the signature verification device includes a module or unit, such as a receiving module or a verification module, for executing the method in the second aspect or any possible implementation of the second aspect. A fifth aspect provides a computing device, which includes a processor and a memory, the memory is used to store programs; the processor is used to implement the method of the first aspect or the second aspect by executing the program. The sixth aspect provides a computing device cluster, which includes at least one computing device, each computing device includes a processor and a memory, and the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster executes the method of the first aspect or the second aspect. A seventh aspect provides a computer-readable storage medium, in which instructions are stored. When the computer program instructions are executed on a computing device cluster, the computing device cluster executes the methods of the above aspects. An eighth aspect provides a computer program product comprising instructions. When the instructions are executed on a computing device cluster, the computing device cluster executes the methods of the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS FIG1 is a schematic diagram of a digital signature verification scenario in an embodiment of the present application; FIG2 is another schematic diagram of a digital signature verification scenario in an embodiment of the present application; FIG3 is a structural diagram of a signature device in an embodiment of the present application; FIG4 is a structural diagram of a signature verification device in an embodiment of the present application; FIG5 is a flow chart of a post-quantum signature method in an embodiment of the present application; FIG6 is a schematic diagram of a hash tree in an embodiment of the present application; FIG7 is a schematic diagram of a brother node set in an embodiment of the present application; FIG8 is a flow chart of a post-quantum signature verification method according to an embodiment of the present application; FIG9 is a structural diagram of a computing device in an embodiment of the present application; FIG10 is a structural diagram of a computing device in an embodiment of the present application; FIG11 is a schematic diagram of a computing device cluster in an embodiment of the present application; FIG. 12 is another schematic diagram of a computing device cluster in an embodiment of the present application. DETAILED DESCRIPTION The embodiments of the present application provide a post-quantum signature method and a post-quantum signature verification method, which are used in digital signature scenarios or key encapsulation scenarios, such as secure boot scenarios, trusted boot scenarios, remote attestation scenarios, secure upgrade scenarios, etc. Firmware is a program written into an erasable programmable read-only memory (EPROM) or an electrically erasable programmable read-only memory (EEPROM). Firmware can be considered as a device "driver" stored inside the device. Through firmware, the operating system can implement the operation of a specific machine according to the standard device driver. For example, optical drives and burners have internal firmware. Firmware can be started and upgraded through remote control. Referring to FIG1 , in a digital signature verification scenario, the signing device obtains the boot image file, signs the boot image file using the SM3-LMS algorithm, obtains the boot image file signature, and sends the boot image file signature and the boot image file to the signature verification device. The signature verification device verifies the boot image file signature. If the signature verification passes, the boot image file is legal, and the image is started according to the boot image file. If the signature verification fails, the boot image file is illegal data, and the boot image is terminated. Referring to FIG. 2 , in another digital signature verification scenario, the signing device obtains the image upgrade file, signs the image upgrade file using the SM3-LMS algorithm, obtains the image upgrade file signature, and sends the image upgrade file signature and the image upgrade file to the signature verification device. The signature verification device verifies the image upgrade file signature. If the signature verification passes, the image upgrade file is legal and is upgraded according to the image upgrade file. If the signature verification fails, the image upgrade file is illegal data and the upgrade is terminated. In this application, the Chinese hash algorithm can be but is not limited to the commercial cryptographic algorithm No. 3 (shangmi3), which is a Chinese key Secure hashing algorithms for infrastructure cryptographic standards. In order to meet the encryption requirements of China's critical infrastructure, this application provides a post-quantum signature method and a post-quantum signature verification method, which can generate OTS signature data and LMS signature data based on the Chinese hash algorithm, so that the LMS signature data can meet the encryption requirements of China's critical infrastructure and can resist quantum attacks. The following is an introduction to the signature device for implementing the post-quantum signature method of this application. Referring to Figure 3, in one embodiment, the signature device 300 of this application includes an LMS key module 301, a one-time signature key module 302, a one-time signature module 303, an LMS signature module 304 and a sending module 305. Specifically, the LMS key module 301 is used to generate an LMS private key, and to generate a hash tree with a height of h according to the LMS private key; and to generate an LMS public key according to the LMS characteristic value corresponding to h, the OTS characteristic value, the second reference random number and the root node of the hash tree. The one-time signature key module 302 is used to generate a LMS public key from the 2 hA private key is selected from the private keys as the OTS private key. The one-time signature module 303 is used to generate OTS signature data according to the Chinese hash algorithm, the OTS private key, the first reference random number and the message. The LMS signature module 304 is used to determine the target leaf node corresponding to the OTS private key and the ancestor node set of the target leaf node in the hash tree; determine the brother node set according to the target leaf node and the ancestor node set of the target leaf node, and generate LMS signature data according to the sequence number of the OTS private key, the OTS signature data, the LMS characteristic value and the brother node set. The sending module 305 is used to send the LMS public key, the LMS signature data and the message to the signature verification device. As an example of a software functional unit, the LMS key module 301 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the LMS key module 301 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code can be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code can be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple data centers with close geographical locations. Among them, usually a region can include multiple AZs. Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway. As an example of a hardware functional unit, the LMS key module 301 may include at least one computing device, such as a server, etc. Alternatively, the LMS key module 301 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The multiple computing devices included in the LMS key module 301 can be distributed in the same region or in different regions. The multiple computing devices included in the LMS key module 301 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the LMS key module 301 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs. It should be noted that, in other embodiments, the LMS key module 301 can be used to execute any step of the post-quantum signature method in the embodiment shown in Figure 5, the one-time signature key module 302 can be used to execute any step in the post-quantum signature method in the embodiment shown in Figure 5, the one-time signature module 303 can be used to execute any step in the post-quantum signature method in the embodiment shown in Figure 5, the LMS signature module 304 can be used to execute any step in the post-quantum signature method in the embodiment shown in Figure 5, and the sending module 305 can be used to execute any step in the post-quantum signature method in the embodiment shown in Figure 5. The steps that each module is responsible for implementing can be specified as needed, and the full functions of the signature device are realized by implementing different steps in the post-quantum signature method through each module. In an optional embodiment, the LMS key module 301 is specifically used to hThe method comprises the steps of: selecting random number sequence numbers one by one from the random number sequence numbers; generating a combination number sequence according to the selected random number sequence number and p random number numbers, wherein each combination number in the combination number sequence is obtained by combining a second reference random number, a selected random number sequence number, a random number number, a preset value and a random number seed; hashing each combination number in the combination number sequence using a Chinese hash algorithm to obtain a random number sequence corresponding to the random number sequence number; composing the OTS characteristic value, the second reference random number, the random number sequence number and the random number sequence corresponding to the random number sequence number into a private key corresponding to the random number sequence number; and composing all the private keys into an LMS private key according to the random number sequence number. In another optional embodiment, the one-time signature module 303 is specifically used to extract the OTS characteristic value, the second reference random number, the serial number of the OTS private key and the target random number sequence from the OTS private key; the second reference random number, the serial number of the OTS private key, the second constant, the first reference random number and the message form a first number to be processed; the first number to be processed is hashed into a hash value to be processed using the Chinese hash algorithm; a signature parameter value sequence is generated according to the second reference random number, the serial number of the OTS private key, the random number number, the hash value to be processed and the target random number sequence; the OTS characteristic value, the first reference random number and the signature parameter value sequence form OTS signature data. In another optional embodiment, the LMS key module 301 is specifically used to extract 2 from the LMS private key. h A random number sequence; based on the second reference random number, the serial number of the OTS private key and 2 h Random number sequence generation 2 h data sequence; from 2 h The method comprises the steps of: selecting a data sequence to be processed from each data sequence one by one; combining a second reference random number, a hash tree node number corresponding to the data sequence to be processed, a third constant and the data sequence to be processed into a combination number corresponding to the data sequence to be processed; using a Chinese hash algorithm to hash the combination number corresponding to the data sequence to be processed into a leaf node; calculating the non-leaf nodes of the previous layer based on the leaf nodes with a brother relationship; calculating the non-leaf nodes of the previous layer based on the non-leaf nodes with a brother relationship, until a root node is calculated. In another optional embodiment, the one-time signature key module 302 is specifically used to obtain the OTS characteristic value, the second reference random number, the serial number of the OTS private key and the target random number sequence from the OTS private key; generate a target data sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the iteration number and the target random number sequence; form the second number to be processed by the second reference random number, the serial number of the OTS private key, the first constant and the target data sequence; hash the second number to be processed into a K value using the Chinese hash algorithm; form the OTS public key by the OTS characteristic value, the second reference random number, the serial number of the OTS private key and the K value; the sending module 305 is also used to send the OTS public key, the OTS signature data and the message to the signature verification device. The following is an introduction to a signature verification device for implementing the post-quantum signature verification method of the present application. Referring to FIG. 4 , in one embodiment, the signature verification device 400 of the present application includes a receiving module 401 and a verification module 402 . Specifically, the receiving module 401 is used to receive the LMS public key, LMS signature data and message sent by the signature device; the verification module 402 is used to extract the second reference random number and root node from the LMS public key; extract the OTS signature data, the serial number of the OTS private key and the brother node set from the LMS signature data, extract the first reference random number and signature parameter value sequence from the OTS signature data, determine the data sequence to be combined according to the second reference random number, the serial number of the OTS private key, the first constant, the first reference random number, the message and the signature parameter value sequence; combine the second reference random number, the serial number of the OTS private key, the first constant and the data sequence to be combined; use the Chinese hash algorithm to hash the combination result into a K value to be verified; generate a root node to be verified according to the second reference random number, the serial number of the OTS private key, the third constant, the K value to be verified and the brother node set; when the root node to be verified is equal to the root node in the LMS public key, the LMS signature data is determined to be legal; when the root node to be verified is not equal to the root node in the LMS public key, the LMS signature data is determined to be illegal. As an example of a software functional unit, the verification module 402 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the verification module 402 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple data centers with close geographical locations. Among them, usually a region may include multiple AZs. Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway. As an example of a hardware functional unit, the verification module 402 may include at least one computing device, such as a server, etc. Alternatively, the verification module 402 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The multiple computing devices included in the verification module 402 can be distributed in the same region or in different regions. The multiple computing devices included in the verification module 402 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the verification module 402 can be distributed in the same VPC or in multiple VPCs. It can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs. It should be noted that, in other embodiments, the receiving module 401 can be used to execute any step of the post-quantum signature verification method in the embodiment shown in Figure 8. The steps that each module is responsible for implementing can be specified as needed. The full functions of the signature verification device can be realized by implementing different steps in the post-quantum signature verification method through each module. In an optional embodiment, the verification module 402 is further used to compare the LMS characteristic value of the LMS public key with the LMS characteristic value of the LMS signature data; when the LMS characteristic value of the LMS public key is different from the LMS characteristic value of the LMS signature data, the LMS signature data is determined to be illegal data. In another optional embodiment, the verification module 402 is further used to compare the OTS characteristic value of the LMS public key with the OTS characteristic value of the LMS signature data; when the OTS characteristic value of the LMS public key is different from the OTS characteristic value of the LMS signature data, the LMS signature data is determined to be illegal data. In another optional embodiment, the receiving module 401 is also used to receive the OTS public key, OTS signature data and message sent by the signature device; the verification module 402 is also used to extract the second reference random number, the serial number and K value of the OTS private key from the OTS public key, extract the first reference random number and signature parameter value sequence from the OTS signature data, determine the data sequence to be combined according to the second reference random number, the serial number of the OTS private key, the first constant, the first reference random number, the message and the signature parameter value sequence; combine the second reference random number, the serial number of the OTS private key, the first constant and the data sequence to be combined; use the Chinese hash algorithm to hash the combination result into the K value to be verified; when the K value to be verified is different from the K value of the OTS public key, the OTS signature data is determined to be illegal data. In another optional embodiment, the verification module 402 is further configured to determine that the OTS public key is illegal data when the length of the OTS public key is not a preset length. The following is an introduction to some of the terms involved in this application: Table 1 In the formulas in Table 1, the numbers are counted from left to right, starting from 0. For example, byte(0xCAFEBABE,1) extracts the 0th byte as CA, the 1st byte as FE, and so on. Table 2 Table 3 Referring to FIG. 5 , an embodiment of the post-quantum signature method in the present application includes: Step 501: Generate an LMS private key. The LMS private key includes 2 hA private key. Step 502: From the LMS private key, h Select one private key from the private keys as the OTS private key. Each private key in the LMS private key can be used for one signature. This application can select the OTS private key according to the number of signatures. For example, the first private key is selected as the OTS private key for the first signature, the second private key is selected as the OTS private key for the second signature, and so on. Other methods can also be used to select the number of private keys as the OTS private key, which is not limited in this application. Step 503: Generate OTS signature data according to the Chinese hash algorithm, the OTS private key, the first reference random number and the message. Step 504: Generate a hash tree with a height of h according to the LMS private key. Optionally, step 504 includes: extracting 2 from the LMS private key h A random number sequence, and then according to the second reference random number, the sequence number of the OTS private key and 2 h Random number sequence generation 2 h data sequence, from 2 h The method comprises the following steps: selecting a data sequence to be processed from the data sequences one by one, and then combining the second reference random number, the hash tree node number corresponding to the data sequence to be processed, the third constant and the data sequence to be processed into a combination number corresponding to the data sequence to be processed; using the Chinese hash algorithm to hash the combination number corresponding to the data sequence to be processed into a leaf node; calculating the non-leaf nodes of the previous layer according to the leaf nodes with a brother relationship; calculating the non-leaf nodes of the previous layer according to the non-leaf nodes with a brother relationship, until the root node is calculated. In one example, the hash tree node corresponding to the hash tree node number r is T[r]. h When T[r] is a leaf node, T[r]=SM3(I||u32str(r)||0x8282||OTS_PUB_HASH[r-2 h ]).OTS_PUB_HASH[i]=y i [0]||…||y i [p-1]. When r<2 h When , T[r] is a non-leaf node, T[r] = SM3(I||u32str(r)||0x8383||T[2*r]||T[2*r+1]). h is the height of the hash tree. Step 505: Generate an LMS public key according to the LMS eigenvalue corresponding to h, the OTS eigenvalue, the second reference random number and the root node of the hash tree. LMS public key = SM3-LMSvalue||SM3-LMOTSvalue||I||T[1]. SM3-LMSvalue is the LMS eigenvalue, SM3-LMOTSvalue is the OTS eigenvalue, I is the second reference random number, and T[1] is the root node of the hash tree. The first reference random number and the second reference random number can increase data randomness, improve data security, and reduce the possibility of being guessed and restored. Step 506: Determine the target leaf node corresponding to the OTS private key and the ancestor node set of the target leaf node in the hash tree. The hash tree of the present application is also called a Merkle tree, which is a full binary tree. Referring to FIG6 , in the hash tree, the first leaf node T[8] and the second leaf node T[9] are brother nodes, and their parent node is T[4]. The third leaf node T[8] is a full binary tree.

[0010] and the fourth leaf node T

[0011] are sibling nodes, their parent node is T[5], and the fifth leaf node is T

[0012] and the sixth leaf node T

[0013] are sibling nodes, their parent node is T[6], and the seventh leaf node is T

[0014] and the eighth leaf node T

[0015] are sibling nodes, and their parent node is T[7]. T[4] and T[5] are sibling nodes, and their parent node is T[2]. T[6] and T[7] are sibling nodes, and their parent node is T[3]. T[2] and T[3] are sibling nodes, and their parent node is T[1], and T[1] is the root node. Step 507: Determine a brother node set according to the target leaf node and the ancestor node set of the target leaf node. The sibling node set includes the sibling nodes of the target leaf node and the sibling nodes of each ancestor node in the ancestor node set, and the ancestor node set includes all ancestor nodes after removing the root node in the hash tree. In one example, the sibling node set is recorded as path[0], path[1], path[2], ..., path[h-1]. path[0] is the sibling node of the target leaf node, path[1] is the sibling node of the parent node of the target leaf node, and so on. Path[h-1] is the sibling node of the topmost ancestor node of the target leaf node in the ancestor node group. For example, the fifth leaf node T

[0012] is the target leaf node, then the ancestor nodes of T

[0012] include T[6] and T[3], and the sibling node set (path[0], path[1], path[2]) = (T

[0013] , T[7], T[2]), as shown in Figure 7. Step 508: Generate LMS signature data according to the serial number of the OTS private key, the OTS signature data, the LMS characteristic value and the brother node set. In one example, the format of the LMS signature data is shown in Table 4: Table 4 The OTS private key is the qth private key in the LMS private key, and q is the sequence number of the OTS private key. q is an integer, and the specific value can be selected according to actual conditions, and this application does not limit it. Step 509: Send the LMS public key, LMS signature data and message to the signature verification device. In this embodiment, OTS signature data can be generated according to the Chinese hash algorithm. The hash result based on the Chinese hash algorithm cannot be used to infer the original data. Therefore, after using the OTS signature data to generate the LMS signature data, the OTS signature data and the LMS signature data can resist quantum attacks, and the Chinese hash algorithm used to generate the LMS signature data meets the encryption requirements of China's critical information infrastructure. Secondly, when the message of the present application is a firmware upgrade image file, the security of the firmware upgrade can be improved. When the message of the present application is a firmware startup image file, the security of the firmware startup can be improved. The message of the present application is not limited to firmware startup image files and firmware upgrade image files, so the post-quantum signature method of the present application can also sign other types of data. In an optional embodiment, step 501 includes: h The method comprises the following steps: selecting random number sequence numbers one by one from the random number sequence numbers; generating a combination number sequence according to the selected random number sequence number and p random number numbers, and hashing each combination number in the combination number sequence using the Chinese hash algorithm to obtain a random number sequence corresponding to the random number sequence number; composing the OTS characteristic value, the second reference random number, the random number sequence number and the random number sequence corresponding to the random number sequence number into a private key corresponding to the random number sequence number; and composing all the private keys into an LMS private key according to the random number sequence number. The corresponding relationship between OTS characteristic value and p can be found in Table 2, and p and OTS characteristic value can be set according to actual conditions. Each combination number in the combination number sequence is obtained by combining the second reference random number, the selected random number sequence number, the random number number, the preset value and the random number seed. For example, when the selected random number sequence is q, N q [i]=I||u32str(q)||u16str(i)||u8str(0xff)||SEED. N q[i] represents the number of combinations corresponding to q and i. Where, I represents the 16-byte second reference random number, u32str(q) represents the 4-byte random number sequence number, u16str(i) represents the 2-byte random number sequence number, u8str(0xff) represents the 1-byte preset value, and SEED represents the random number seed. Use the commercial encryption algorithm N q [i] Hash is x q [i],x q [i] represents the i-th random number in the q-th random number sequence. q [i] = SM3(N q [i]). LMS private key includes 2 h The private keys are: In another optional embodiment, step 501 includes: generating p*2 using a pseudo-random algorithm h random number, p*2 h The random numbers are divided into 2 h A random number sequence of the same length is generated, and the OTS characteristic value, the second reference random number, the random number sequence number and the random number sequence corresponding to the random number sequence number are combined into a private key corresponding to the random number sequence number; all private keys are combined into an LMS private key according to the random number sequence number. This provides another method for generating LMS private keys and improves the flexibility of the implementation of the solution. The present application can also generate an OTS public key. In another optional embodiment, the post-quantum signature method of the present application also includes: obtaining the OTS characteristic value, the second reference random number, the serial number of the OTS private key and the target random number sequence from the OTS private key; generating a target data sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the iteration number and the target random number sequence; forming the second number to be processed by combining the second reference random number, the serial number of the OTS private key, the first constant and the target data sequence; hashing the second number to be processed into a K value using the Chinese hash algorithm; forming the OTS public key by combining the OTS characteristic value, the second reference random number, the serial number of the OTS private key and the K value; combining the OTS public key, the OTS signature number The data and message are sent to the signature verification device. In another optional embodiment, step 503 includes: extracting the OTS characteristic value, the second reference random number and the target random number sequence from the OTS private key; combining the second reference random number, the serial number of the OTS private key, the second constant, the first reference random number and the message into a first number to be processed; using the Chinese hash algorithm to hash the first number to be processed into a hash value to be processed; generating a signature parameter value sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the hash value to be processed and the target random number sequence; combining the OTS characteristic value, the first reference random number and the signature parameter value sequence into OTS signature data. In this embodiment, the hash value Q to be processed satisfies the following formula: Q=SM3(I||u32str(q)||0x8181||C||message). Wherein, I is the second reference random number, u32str(q) is the serial number of the 4-byte OTS private key, 0x8181 is the second constant, C is the first reference random number, and message is the message. Optionally, generating a signature parameter value sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the hash value to be processed, and the target random number sequence includes: Step 5030: Set i=0. Step 5031: determine a to be the i-th character string of length w selected from the number of combinations consisting of the hash value to be processed and the check value of the hash value to be processed; Step 5032: Set the temporary variable value to the i-th random number of the target random number sequence, and set the iteration number to 0; Step 5033: Combine the second reference random number, the serial number of the OTS private key, i, the iteration number and the temporary variable value; Step 5034: Use the Chinese hash algorithm to hash the combined result of step 5033, and update the temporary variable value to the hash result obtained in step 5034; Step 5035: Update the iteration number to the iteration number plus 1; Step 5036: Determine whether the iteration number is less than a. If the iteration number is less than a, execute step 5033. If the iteration number is equal to a, execute step 5037. Step 5037: Determine that the i-th data in the signature parameter value sequence is the temporary variable value outputted in step 5034; Step 5038: Update i to i+1; Step 5039: Determine whether i is less than p. If i is less than p, execute step 5031; if i is equal to p, stop. This provides a specific method for generating a signature parameter value sequence, which executes a hash algorithm based on the OTS private key, so that the OTS private key cannot be deduced based on the OTS signature data, thereby ensuring the security of the OTS private key. In addition to using a double loop method to generate a signature parameter value sequence, p random numbers of a random number sequence can also be hashed in parallel to increase the speed of generating a signature parameter value sequence, thereby increasing the speed of generating OTS signature data. It should be understood that the iteration number and the initial value of i can be set according to actual conditions, and this application does not limit it. The following is an introduction to the code for generating OTS signature data. In this code, 0x8181 is the second constant, Q is the hash value to be processed, Cksm(Q) is the check value of Q, tmp is the temporary variable value, x[i] is the i-th random number in the random number sequence, y[i] is the i-th data in the signature parameter value sequence, SM3-LMOTSsig is the OTS signature data, and C is the first reference random number. In an example, the format of the OTS signature data is shown in Table 5: Table 5 Among them, the check value of Q is Cksm(Q), and the code for generating Cksm(Q) includes: Optionally, generating a target data sequence according to the second reference random number, the sequence number of the OTS private key, the random number number, the iteration number, and the target random number sequence includes: Step A: Set i to 0 and select the i-th random number from the target random number sequence; Step B: Set the temporary variable value to the i-th random number and set the iteration number to 0; Step C: Combine the second reference random number, the serial number of the OTS private key, i, the iteration number and the temporary variable value; Step D: Hash the combined result of step C using the Chinese hash algorithm; Step E: Update the temporary variable value to the hash result obtained in step D; Step F: Update the iteration number to the iteration number plus 1; Step G: Determine whether the iteration number is less than 2 w -1, if the iteration number is less than 2 w -1, then execute step C. If the iteration number is equal to 2 w -1, then execute step H; Step H: determine the i-th data in the target data sequence; Step I: Update i to i+1; Step J: Determine whether i is less than p. If i is less than p, execute step B. If i is equal to p, stop. This provides a specific method for generating a target data sequence, which performs 2 w -1 hash algorithm, so that the OTS private key cannot be deduced from the OTS public key, so the security of the OTS private key can be guaranteed. In addition to using the double loop method to generate the data sequence, the p random numbers of the random number sequence can also be hashed in parallel to speed up the generation of the data sequence and thus increase the speed of generating the OTS public key. It should be understood that the iteration number and the initial value of i can be set according to the actual situation, and this application does not limit it. The following is an introduction to the code for generating the OTS public key. The following is an introduction to the method for verifying the LMS signature. Referring to FIG8 , an embodiment of the post-quantum signature verification method in this application includes: Step 801: Receive the LMS public key, LMS signature data and message sent by the signature device, where the LMS public key includes a second reference random number and a root node. Step 802: Extract the OTS signature data, the serial number of the OTS private key and the brother node set from the LMS signature data. Step 803: Extract a first reference random number and a signature parameter value sequence from the OTS signature data. Step 804: determine a data sequence to be combined according to the second reference random number, the serial number of the OTS private key, the first constant, the first reference random number, the message, and the signature parameter value sequence. Step 805: Combine the second reference random number, the serial number of the OTS private key, the first constant and the data sequence to be combined. Step 806: Use the Chinese hash algorithm to hash the combined result into a K value to be verified. Step 807: Generate a root node to be verified according to the second reference random number, the serial number of the OTS private key, the third constant, the K value to be verified, and the brother node set. Step 808, determine whether the root node to be verified is equal to the root node in the LMS public key. If so, determine that the LMS signature data is legal; if not, determine that the LMS signature data is illegal. In this embodiment, the OTS signature data and the LMS signature data are combined for verification, which can resist quantum attacks. The Chinese hash algorithm is used for decryption during the signature verification process, which meets the encryption requirements of China's critical infrastructure. In an optional embodiment, step 804 includes: Step 8040: Hash the combination of the second reference random number, the serial number of the OTS private key, the second constant, the first reference random number and the message. Step 8041: Set i=0. Step 8042: Determine a as the i-th character string of length w selected from the number of combinations consisting of the hash result output in step 8040 and the check value of the hash result. Step 8043: Set the temporary variable value to the i-th data in the data sequence, and set the iteration number to a. Step 8044: Combine the second reference random number, the serial number of the OTS private key, i, the iteration number and the temporary variable value. Step 8045: Use the Chinese hash algorithm to hash the combined result of step 8043, and update the temporary variable value to the hash result obtained in step 8045. Step 8046: Update the iteration number to the iteration number plus 1. Step 8047: Determine whether the iteration number is less than 2 w -1, if the iteration number is less than 2 w -1, then execute step 8044. If the iteration number is equal to 2 w -1, execute step 8048. Step 8048: Determine that the i-th data in the data sequence to be combined is the temporary variable value outputted in step 8045. Step 8049: Update i to i+1, and determine whether i is less than p. If i is less than p, execute step 8042; if i is equal to p, stop. This provides a specific method for generating a sequence of data to be combined, which performs 2 w -1-a times hash algorithm, so that the K value to be verified can be obtained. In addition to using the double loop method to generate the target data sequence, the p random numbers of the data sequence can also be hashed in parallel to increase the speed of generating the target data sequence, thereby increasing the speed of generating the K value to be verified. It should be understood that the iteration number and the initial value of i can be set according to actual conditions, and this application does not limit it. In one example, the code for generating the K value to be verified includes: In this code, Q is the hash value to be processed, Cksm(Q) is the check value of Q, tmp is the temporary variable value, and y[i] is the signature parameter value sequence , z[i] is the i-th data of the data sequence to be combined, I is the second reference random number, C is the first reference random number. HK is the K value to be verified, 0x8080 is the first constant, and 0x8181 is the second constant. The signature device performs a hash operation on the target random number sequence to obtain a signature parameter value sequence, and the signature verification device performs 2 hash operations on the signature parameter value sequence. w-1-a hashes, thus completing 2 w -1 hash. In an optional embodiment, step 807 includes: Step 8070: Set the node number to 2 h +q; Step 8071: Combine the second reference random number, the node number, the third constant and the K value to be verified, and hash the combination number obtained in step 8071 using the Chinese hash algorithm; Step 8072: Set the temporary variable value to the hash value output in step 8071, and set i to 0; Step 8073: Determine whether the node number is greater than 1, if so, execute step 8073, if not, execute step 8077; Step 8074: When the node number is an odd number, the second reference random number, half of the node number, the fourth constant, the i-th sibling node and the temporary variable value are combined in order, the combination number obtained in step 8074 is hashed using the Chinese hash algorithm, and the temporary variable value is updated to the hash value obtained in step 8074; Step 8075: When the node number is an even number, the second reference random number, half of the node number, the fourth constant, the temporary variable value and the i-th brother node are combined in order, the combination number obtained in step 8075 is hashed using the Chinese hash algorithm, and the temporary variable value is updated to the hash value obtained in step 8075; Step 8076: Update the node number to half of the node number, and update i to i+1; Step 8077: Determine that the root node to be verified is the temporary variable value obtained by the last calculation. The method calculates the root node to be verified of the hash tree according to the OTS signature data and the LMS signature data. It should be understood that the initial value of i can be set according to actual conditions, and this application does not limit it. In one example, the code for generating the root node to be verified includes: In the code, node_num is the node number, 0x8282 is the third constant, 0x8383 is the fourth constant, path[i] is the i-th sibling node in the sibling node set, and HT is the root node to be verified. In the present application, the first constant, the second constant, the third constant, the fourth constant and the preset data can be adjusted according to actual conditions, and the present application does not limit them. The present application can also determine and verify whether the LMS signature data is legal based on the LMS characteristic value and the OTS characteristic value. In an optional embodiment, the post-quantum signature verification method of the present application also includes: comparing the LMS characteristic value of the LMS public key with the LMS characteristic value of the LMS signature data; when the LMS characteristic value of the LMS public key is different from the LMS characteristic value of the LMS signature data, determining that the LMS signature data is illegal data. In another optional embodiment, the post-quantum signature verification method of the present application also includes: comparing the OTS characteristic value of the LMS public key with the OTS characteristic value of the LMS signature data; when the OTS characteristic value of the LMS public key is different from the OTS characteristic value of the LMS signature data, determining that the LMS signature data is illegal data. The present application can also verify whether the OTS signature data or the OTS public key is legitimate. In another optional embodiment, before step 801, The post-quantum signature verification method of the present application also includes: receiving the OTS public key, OTS signature data and message sent by the signature device, extracting the second reference random number, the serial number and K value of the OTS private key from the OTS public key, and extracting the first reference random number and signature parameter value sequence from the OTS signature data; determining the data sequence to be combined according to the second reference random number, the serial number of the OTS private key, the first constant, the first reference random number, the message and the signature parameter value sequence; combining the second reference random number, the serial number of the OTS private key, the first constant and the data sequence to be combined; using the Chinese hash algorithm to hash the combination result into the K value to be verified; when the K value to be verified is different from the K value of the OTS public key, the OTS signature data is determined to be illegal data. In this way, the OTS signature data can be verified according to the OTS public key, which improves the flexibility of signature verification. When the OTS signature data is illegal data, the embodiment shown in Figure 8 may not be executed. In another optional embodiment, when the length of the OTS public key is not a preset length, the OTS public key is determined to be illegal data. In this embodiment, the preset length can be set according to actual conditions. In the embodiment shown in FIG5 , the preset length is 56 bytes. When the length of the OTS public key is not 56 bytes, the OTS public key sent by the terminal is determined to be illegal data. When the length of the OTS public key is the preset length and the K value to be verified is the same as the K value of the OTS public key, the OTS public key is determined to be legal data. The present application also provides a computing device 900. As shown in FIG9 , the computing device 900 includes: a bus 902, a processor 904, a memory 906, and a communication interface 908. The processor 904, the memory 906, and the communication interface 908 communicate with each other through the bus 902. The computing device 900 may be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 900. The bus 902 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, FIG. 9 is represented by only one line, but does not mean that there is only one bus or one type of bus. The bus 904 may include a path for transmitting information between various components of the computing device 900 (e.g., the memory 906, the processor 904, and the communication interface 908). The processor 904 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP). The memory 906 may include a volatile memory, such as a random access memory (RAM). The processor 904 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD). The memory 906 stores executable program code. In an optional embodiment, the processor 904 executes the executable program code to respectively implement the functions of the aforementioned LMS key module, LMS signature module, one-time signature key module, and one-time signature module, thereby implementing the post-quantum signature method. Referring to FIG. 10, in another optional embodiment, the processor 904 executes the executable program code to implement the aforementioned verification module function, thereby implementing the post-quantum signature verification method. That is, the memory 906 stores instructions for executing the post-quantum signature method or the post-quantum signature verification method. The communication interface 908 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 900 and other devices or communication networks. The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone. As shown in Fig. 11, the computing device cluster includes at least one computing device 900. The memory 906 in one or more computing devices 900 in the computing device cluster may store the same instructions for executing the post-quantum signature method. In some possible implementations, the memory 906 of one or more computing devices 900 in the computing device cluster may also store partial instructions for executing the post-quantum signature method or the post-quantum signature verification method. In other words, the combination of one or more computing devices 900 can jointly execute instructions for executing the post-quantum signature method. It should be noted that the memory 906 in different computing devices 900 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the computing devices. That is, the instructions stored in the memory 906 in different computing devices 900 can implement the functions of one or more modules in the LMS key module, the one-time signature key module, the LMS signature module and the one-time signature module. In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network. The network may be a wide area network or a local area network, etc. FIG. 12 shows a possible implementation. As shown in FIG. 12, two computing devices 900A and 900B are connected via a network. Specifically, they are connected to the network via the communication interface in each computing device. In this possible implementation, the memory 906 in the computing device 900A stores instructions for executing the functions of the LMS key module and the one-time signature key module. At the same time, the memory 906 in the computing device 900B stores instructions for executing the functions of the LMS signature module and the one-time signature module. The embodiment of the present application also provides a computer program product including instructions. The computer program product may be a software or program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes a post-quantum signature method or a post-quantum signature verification method. The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computer or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computer to execute a post-quantum signature method or a post-quantum verification method. The present application also provides a chip system, which includes a processor and a memory coupled to each other. The memory is used to store computer programs or instructions, and the processor is used to execute the computer programs or instructions stored in the memory, so that the chip system executes the steps performed by the signature device or the signature verification device in the above embodiment. Optionally, the memory is a memory in the chip, such as a register, a cache, etc., and the memory can also be a memory located outside the chip, such as a read-only memory or other types of static storage devices that can store static information and instructions, a random access memory, etc. The processor mentioned in any of the above places can be a general-purpose central processing unit, a microprocessor, a dedicated integrated circuit, or one or more integrated circuits for implementing the above-mentioned post-quantum signature method or post-quantum signature verification method. Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here. In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application. In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

Claims

1. A post-quantum signature method, characterized in that: include: Generate Leighton Micali signature LMS private key; The private key from the LMS includes 2 h Select one private key from the private keys as the one-time signature OTS private key; Generate OTS signature data according to the Chinese hash algorithm, the OTS private key, the first reference random number and the message; Generate a hash tree with a height of h according to the LMS private key; Generate an LMS public key according to the LMS characteristic value corresponding to h, the OTS characteristic value, the second reference random number and the root node of the hash tree; Determine the target leaf node corresponding to the OTS private key and the ancestor node set of the target leaf node in the hash tree; Determine a sibling node set according to the target leaf node and the ancestor node set of the target leaf node, the sibling node set includes the sibling nodes of the target leaf node and the sibling nodes of each ancestor node in the ancestor node set, and the ancestor node set includes all ancestor nodes after removing the root node in the hash tree; Generate LMS signature data according to the serial number of the OTS private key, the OTS signature data, the LMS characteristic value and the brother node set; The LMS public key, the LMS signature data and the message are sent to the signature verification device.

2. The method according to claim 1, characterized in that The generating of the LMS private key comprises: From 2 h Select random number sequence numbers one by one from the random number sequence numbers; Generate a combination number sequence according to the selected random number sequence number and p random number numbers, wherein each combination number in the combination number sequence is obtained by combining the second reference random number, the selected random number sequence number, the random number number, a preset value and a random number seed; Using the Chinese hash algorithm to hash each combination number in the combination number sequence to obtain a random number sequence corresponding to the random number sequence number; The OTS characteristic value, the second reference random number, the random number sequence number and the random number sequence corresponding to the random number sequence number form a private key corresponding to the random number sequence number; All private keys are numbered according to the random number sequence to form the LMS private key.

3. The method according to claim 1, characterized in that The generating of OTS signature data according to the Chinese hash algorithm, the OTS private key, the first reference random number and the message comprises: Extracting an OTS characteristic value, a second reference random number, a sequence number of the OTS private key, and a target random number sequence from the OTS private key; The second reference random number, the serial number of the OTS private key, the second constant, the first reference random number and the message form a first number to be processed; Using the Chinese hash algorithm to hash the first pending number into a pending hash value; Generate a signature parameter value sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the to-be-processed hash value and the target random number sequence; The OTS characteristic value, the first reference random number and the signature parameter value sequence are combined into OTS signature data.

4. The method according to claim 1, characterized in that: Generating a hash tree according to the LMS private key includes: Extract 2 from the LMS private key h A sequence of random numbers; According to the second reference random number, the serial number of the OTS private key and the 2 h Random number sequence generation 2 h data series; From 2 h Select the data sequences to be processed one by one from the data sequences; Combine the second reference random number, the hash tree node number corresponding to the data sequence to be processed, the third constant and the data sequence to be processed into a combination number corresponding to the data sequence to be processed; Use the Chinese hash algorithm to hash the combination number corresponding to the data sequence to be processed into a leaf node; Calculate the non-leaf nodes of the previous layer based on the leaf nodes with sibling relationships; The non-leaf nodes of the previous layer are calculated based on the non-leaf nodes with sibling relationships until the root node is calculated.

5. The method according to claim 1, characterized in that The method further comprises: Obtaining an OTS characteristic value, a second reference random number, a serial number of the OTS private key, and a target random number sequence from the OTS private key; Generate a target data sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the iteration number and the target random number sequence; The second reference random number, the serial number of the OTS private key, the first constant and the target data sequence form a second number to be processed; Using the Chinese hash algorithm to hash the second pending number into a K value; The OTS characteristic value, the second reference random number, the sequence number of the OTS private key and the K value form an OTS public key; The OTS public key, the OTS signature data and the message are sent to the signature verification device.

6. The method according to any one of claims 1 to 5, characterized in that The Chinese hash algorithm is a commercial cryptographic algorithm 3.

7. The method according to any one of claims 1 to 5, characterized in that The message includes at least one of a firmware upgrade image file and a firmware startup image file.

8. A post-quantum signature verification method, characterized in that: include: Receive the Leighton Micali signature LMS public key, LMS signature data and message sent by the signature device, wherein the LMS public key includes a second reference random number and a root node, the LMS signature data includes a one-time signature OTS signature data, a sequence number of an OTS private key and a brother node set, and the OTS signature data includes a first reference random number and a signature parameter value sequence; Determine a data sequence to be combined according to the second reference random number, the serial number of the OTS private key, the first constant, the first reference random number, the message, and the signature parameter value sequence; Combine the second reference random number, the serial number of the OTS private key, the first constant and the sequence of data to be combined; Use the Chinese hash algorithm to hash the combined result into the K value to be verified; Generate a root node to be verified according to the second reference random number, the serial number of the OTS private key, the third constant, the K value to be verified and the brother node set; When the root node to be verified is equal to the root node in the LMS public key, it is determined that the LMS signature data is legal; When the root node to be verified is not equal to the root node in the LMS public key, it is determined that the LMS signature data is illegal.

9. The method according to claim 8, characterized in that The LMS public key and the LMS signature data also include an LMS characteristic value, and the method further includes: Comparing the LMS characteristic value of the LMS public key with the LMS characteristic value of the LMS signature data; When the LMS characteristic value of the LMS public key is different from the LMS characteristic value of the LMS signature data, the LMS signature data is determined to be illegal data.

10. The method according to claim 8, characterized in that The LMS public key and the LMS signature data also include an OTS feature value, and the method further includes: Compare the OTS characteristic value of the LMS public key with the OTS characteristic value of the LMS signature data; When the OTS characteristic value of the LMS public key is different from the OTS characteristic value of the LMS signature data, the LMS signature data is determined to be illegal data.

11. The method according to any one of claims 8 to 10, characterized in that The method further comprises: Receive the OTS public key, OTS signature data and the message sent by the signature device, the OTS public key includes the second reference random number, the sequence number and K value of the OTS private key, and the OTS signature data includes the first reference random number and the signature parameter value sequence; Determine the data sequence to be combined according to the second reference random number, the serial number of the OTS private key, the first constant, the first reference random number, the message, and the signature parameter value sequence; Combine the second reference random number, the serial number of the OTS private key, the first constant and the sequence of data to be combined; Use the Chinese hash algorithm to hash the combined result into the K value to be verified; When the K value to be verified is different from the K value of the OTS public key, it is determined that the OTS signature data is illegal data.

12. The method according to claim 11, characterized in that The method further comprises: When the length of the OTS public key is not a preset length, it is determined that the OTS public key is illegal data.

13. A signature device, characterized in that: include: Leighton Micali Signature LMS Key Module, used to generate LMS private keys; One-time signing key module for private keys from the LMS including 2 h Select one private key from the private keys as the one-time signature OTS private key; A one-time signature module, used to generate OTS signature data according to the Chinese hash algorithm, the OTS private key, the first reference random number and the message; The LMS key module is also used to generate a hash tree with a height of h according to the LMS private key; according to the LMS feature corresponding to h value, the OTS characteristic value, the second reference random number and the root node of the hash tree to generate an LMS public key; The LMS signature module is further used to determine the target leaf node corresponding to the OTS private key and the ancestor node set of the target leaf node in the hash tree; determine the brother node set according to the target leaf node and the ancestor node set of the target leaf node, the brother node set includes the brother nodes of the target leaf node and the brother nodes of each ancestor node in the ancestor node set, and the ancestor node set includes all ancestor nodes after removing the root node in the hash tree; generate LMS signature data according to the serial number of the OTS private key, the OTS signature data, the LMS feature value and the brother node set; The sending module is used to send the LMS public key, the LMS signature data and the message to the signature verification device.

14. The signature device according to claim 13, characterized in that: The LMS key module is specifically used to h Select random number sequence numbers one by one from the random number sequence numbers; generate a combination number sequence according to the selected random number sequence number and the p random number numbers, each combination number in the combination number sequence is obtained by combining the second reference random number, the selected random number sequence number, the random number number, the preset value and the random number seed; Use the Chinese hash algorithm to hash each combination number in the combination number sequence to obtain a random number sequence corresponding to the random number sequence number; combine the OTS characteristic value, the second reference random number, the random number sequence number and the random number sequence corresponding to the random number sequence number into a private key corresponding to the random number sequence number; and combine all private keys into an LMS private key according to the random number sequence number.

15. The signature device according to claim 13, characterized in that: The one-time signature module is specifically used to extract the OTS characteristic value, the second reference random number, the serial number of the OTS private key and the target random number sequence from the OTS private key; the second reference random number, the serial number of the OTS private key, the second constant, the first reference random number and the message form a first number to be processed; and the first number to be processed is hashed into a hash value to be processed using the Chinese hash algorithm; Generate a signature parameter value sequence according to the second reference random number, the serial number of the OTS private key, the random number number, the hash value to be processed and the target random number sequence; and combine the OTS characteristic value, the first reference random number and the signature parameter value sequence into OTS signature data.

16. The signature device according to claim 13, characterized in that: The LMS key module is specifically used to extract 2 from the LMS private key h A random number sequence; according to the second reference random number, the serial number of the OTS private key and the 2 h Random number sequence generation 2 h data sequence; from 2 h Select a data sequence to be processed from the data sequences one by one; combine the second reference random number, the hash tree node number corresponding to the data sequence to be processed, the third constant and the data sequence to be processed into a combination number corresponding to the data sequence to be processed; use the Chinese hash algorithm to hash the combination number corresponding to the data sequence to be processed into a leaf node; calculate the non-leaf node of the upper layer according to the leaf nodes with a sibling relationship; The non-leaf nodes of the previous layer are calculated based on the non-leaf nodes with sibling relationships until the root node is calculated.

17. The signature device according to claim 13, characterized in that: The one-time signature key module is also used to obtain an OTS characteristic value, a second reference random number, a serial number of the OTS private key, and a target random number sequence from the OTS private key; generate a target data sequence according to the second reference random number, the serial number of the OTS private key, a random number number, an iteration number, and the target random number sequence; form a second to-be-processed number with the second reference random number, the serial number of the OTS private key, a first constant, and the target data sequence; hash the second to-be-processed number into a K value using a Chinese hash algorithm; form an OTS public key with the OTS characteristic value, the second reference random number, the serial number of the OTS private key, and the K value; The sending module is further used to send the OTS public key, the OTS signature data and the message to the signature verification device.

18. The signature device according to any one of claims 13 to 17, characterized in that: The Chinese hash algorithm is a commercial cryptographic algorithm 3.

19. The signature device according to any one of claims 13 to 17, characterized in that: The message includes at least one of a firmware upgrade image file and a firmware startup image file.

20. A signature verification device, characterized in that: include: A receiving module, used to receive the Leighton Micali signature LMS public key, LMS signature data and message sent by the signature device, wherein the LMS public key includes a second reference random number, the LMS signature data includes a one-time signature OTS signature data, a sequence number of an OTS private key and a brother node set, and the OTS signature data includes a first reference random number and a signature parameter value sequence; A verification module, configured to determine a data sequence to be combined according to the second reference random number, the serial number of the OTS private key, the first constant, the first reference random number, the message, and the signature parameter value sequence; combine the second reference random number, the serial number of the OTS private key, the first constant, and the data sequence to be combined; and hash the combination result into a K value to be verified using a Chinese hash algorithm; Generate a root node to be verified according to the second reference random number, the serial number of the OTS private key, a third constant, the K value to be verified, and the brother node set; When the root node to be verified is equal to the root node in the LMS public key, the LMS signature data is determined to be legal; when the root node to be verified is not equal to the When the root node in the LMS public key is found, it is determined that the LMS signature data is illegal.

21. The signature verification device according to claim 20, characterized in that: The verification module is also used to compare the LMS characteristic value of the LMS public key with the LMS characteristic value of the LMS signature data; when the LMS characteristic value of the LMS public key is different from the LMS characteristic value of the LMS signature data, the LMS signature data is determined to be illegal data.

22. The signature verification device according to claim 20, characterized in that: The verification module is also used to compare the OTS characteristic value of the LMS public key with the OTS characteristic value of the LMS signature data; when the OTS characteristic value of the LMS public key is different from the OTS characteristic value of the LMS signature data, the LMS signature data is determined to be illegal data.

23. The signature verification device according to any one of claims 20 to 22, characterized in that: The receiving module is further used to receive the OTS public key, OTS signature data and the message sent by the signature device, the OTS public key includes the second reference random number, the sequence number and K value of the OTS private key, and the OTS signature data includes the first reference random number and the signature parameter value sequence; The verification module is also used to determine the data sequence to be combined based on the second reference random number, the serial number of the OTS private key, the first constant, the first reference random number, the message and the signature parameter value sequence; combine the second reference random number, the serial number of the OTS private key, the first constant and the data sequence to be combined; use the Chinese hash algorithm to hash the combination result into a K value to be verified; when the K value to be verified is different from the K value of the OTS public key, the OTS signature data is determined to be illegal data.

24. The signature verification device according to claim 23, characterized in that: The verification module is further configured to determine that the OTS public key is illegal data when the length of the OTS public key is not a preset length.

25. A computing device cluster, characterized in that: The method comprises at least one computing device, each computing device comprises a processor and a memory, the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 12.

26. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 12.

27. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 12.

Images