CN114640463A

CN114640463A - Digital signature method, computer equipment and medium

Info

Publication number: CN114640463A
Application number: CN202210182974.0A
Authority: CN
Inventors: 林汉玲; 李飞鹏; 李敏; 王晓峰
Original assignee: Shenzhen University
Current assignee: Shenzhen University
Priority date: 2022-02-25
Filing date: 2022-02-25
Publication date: 2022-06-17
Anticipated expiration: 2042-02-25
Also published as: WO2023159849A1; CN114640463B

Abstract

The embodiment of the application is applicable to the technical field of information security, and provides a digital signature method, computer equipment and a medium, wherein the method comprises the following steps: determining a first subgroup and a second subgroup from established braid groups, wherein the index of the braid group is an integer greater than or equal to 6, and multiplication of elements of the first subgroup and the second subgroup is not exchangeable; selecting a first element from the first subgroup as a private key, and performing conjugate operation on the private key and the braid group to obtain a first conjugate value; generating a public key based on the braid group and the first conjugate value; when a second conjugate value sent by a verifier is received, calculating a digital signature of the information to be signed according to the second conjugate value and the private key, wherein the second conjugate value is calculated by the verifier according to the public key; and sending the digital signature to the verifier. The method for digital signature can resist quantum computing attack and has higher safety.

Description

Digital signature method, computer device and medium

Technical Field

The present application relates to the field of information security technologies, and in particular, to a digital signature method, a computer device, and a medium.

Background

The digital signature can be used for ensuring the integrity of information transmission, carrying out identity verification of a sender and preventing repudiation in transactions, and is widely applied to the field of information security.

The existing digital signature method is based on a classical public key cryptographic algorithm to guarantee the security. The security of the classical public key cryptographic algorithm depends on the high computational difficulty of factorization and discrete logarithm. But quantum computing systems will perform factorization of large integers and discrete logarithm computations in polynomial time, and Google and IBM have stated that quantum computing systems of their designs are implemented or are being implemented, respectively. This means that the public key cryptographic protocol established based on RSA, ECC, E1Gamal will no longer be secure. Therefore, a digital signature algorithm that is resistant to quantum computation is needed.

Disclosure of Invention

In view of this, embodiments of the present application provide a digital signature method, so as to solve the problem that a digital signature based on the existing public key cryptography cannot resist quantum computing attack.

A first aspect of an embodiment of the present application provides a digital signature method, which is applied to a signer, and the method includes:

determining a first subgroup and a second subgroup from established braid groups, wherein the index of the braid group is an integer greater than or equal to 6, and multiplication of elements of the first subgroup and the second subgroup is not exchangeable;

selecting any element from the first subgroup as a private key, and performing conjugate operation on the private key and the braid group to obtain a first conjugate value;

generating a public key based on the braid group and the first conjugate value;

when a second conjugate value sent by a verifier is received, calculating a digital signature of the information to be signed according to the second conjugate value and the private key, wherein the second conjugate value is calculated by the verifier according to the public key;

and sending the digital signature to the verifier.

A second aspect of the embodiments of the present application provides a digital signature method, which is applied to a verifier, and the method includes:

calculating a second conjugate value according to a public key of the signer, wherein the public key comprises a first conjugate value;

sending the second conjugate value to the signer, wherein the second conjugate value is used for the signer to calculate a digital signature of the information to be signed;

upon receiving the digital signature from the signer, verifying the digital signature according to the second conjugate value and the first conjugate value.

A third aspect of the embodiments of the present application provides a digital signature apparatus, applied to a signer, the apparatus including:

a subgroup determining module, configured to determine a first subgroup and a second subgroup from an established braid group, where an index of the braid group is an integer greater than or equal to 6, and multiplications of elements of the first subgroup and the second subgroup are not exchangeable;

the conjugate operation module is used for selecting any element from the first subgroup as a private key and performing conjugate operation on the private key and the braid group to obtain a first conjugate value;

a public key generation module, configured to generate a public key based on the braid group and the first conjugate value;

the digital signature module is used for calculating a digital signature of the information to be signed according to a second conjugate value and the private key when the second conjugate value sent by the verifier is received, wherein the second conjugate value is calculated by the verifier according to the public key;

and the sending module is used for sending the digital signature to the verifier.

A fourth aspect of the embodiments of the present application provides a digital signature method, which is applied to a verifier, where the apparatus includes:

the calculation module is used for calculating a second conjugate value according to a public key of the signer, wherein the public key comprises a first conjugate value;

the sending module is used for sending the second conjugate value to the signing party, and the second conjugate value is used for the signing party to calculate a digital signature of the information to be signed;

and the verification module is used for verifying the digital signature according to the second conjugate value and the first conjugate value when the digital signature from the signer is received.

A fifth aspect of embodiments of the present application provides a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor implementing the method according to the first or second aspect when executing the computer program.

A sixth aspect of embodiments of the present application provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the method of the first or second aspect.

A seventh aspect of embodiments of the present application provides a computer program product, which, when run on a computer device, causes the computer device to perform the method of the first or second aspect.

Compared with the prior art, the embodiment of the application has the following advantages:

in the embodiment of the application, a signing party determines a first subgroup and a second subgroup from an established braid group; then, selecting an element from the first subgroup as a private key of a signer, and performing conjugate operation on the private key and the braid group to obtain a first conjugate value; generating a public key based on the braid group and the first conjugate value; the verifying party can obtain the public key of the signing party, so that a second conjugate value is obtained through calculation based on the public key, and the second conjugate value is sent to the signing party; when the signer receives the second conjugate value sent by the verifier, the signer can calculate the digital signature with the signature information according to the second conjugate value and the private key; the digital signature is then sent to a verifier, who can verify the digital signature. In the scheme in this embodiment, the first subgroup and the second subgroup are two Mihailova subgroups of the braid group, multiplication of elements of the two subgroups is not exchangeable, and since the member problem of the Mihailova subgroups is not solved, the private key of the signer is attacked by an algorithm, so that the digital signature method in the present application can resist quantum computation attack.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings used in the embodiments or the description of the prior art will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the application, and that for a person skilled in the art, other drawings can be derived from them without inventive effort.

Fig. 1 is a schematic flowchart illustrating steps of a digital signature method according to an embodiment of the present application;

FIG. 2 is a flow chart illustrating steps of another digital signature method provided by an embodiment of the present application;

fig. 3 is a schematic diagram of a digital signature apparatus provided in an embodiment of the present application;

FIG. 4 is a schematic diagram of another digital signature device provided in the embodiments of the present application;

fig. 5 is a schematic diagram of a computer device according to an embodiment of the present application.

Detailed Description

In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular system structures, techniques, etc. in order to provide a thorough understanding of the embodiments of the present application. It will be apparent, however, to one skilled in the art that the present application may be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary detail.

It will be understood that the terms "comprises" and/or "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

It should also be understood that the term "and/or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

As used in this specification and the appended claims, the term "if" may be interpreted contextually as "when", "upon" or "in response to" determining "or" in response to detecting ". Similarly, the phrase "if it is determined" or "if a [ described condition or event ] is detected" may be interpreted contextually to mean "upon determining" or "in response to determining" or "upon detecting [ described condition or event ]" or "in response to detecting [ described condition or event ]".

Furthermore, in the description of the present application and the appended claims, the terms "first," "second," "third," and the like are used for distinguishing between descriptions and not necessarily for describing or implying relative importance.

Reference throughout this specification to "one embodiment" or "some embodiments," or the like, means that a particular feature, structure, or characteristic described in connection with the embodiment is included in one or more embodiments of the present application. Thus, appearances of the phrases "in one embodiment," "in some embodiments," "in other embodiments," or the like, in various places throughout this specification are not necessarily all referring to the same embodiment, but rather "one or more but not all embodiments" unless specifically stated otherwise. The terms "comprising," "including," "having," and variations thereof mean "including, but not limited to," unless expressly specified otherwise.

The technical solution of the present application will be described below by way of specific examples.

Referring to fig. 1, a schematic diagram illustrating a flow of steps of a digital signature method provided in an embodiment of the present application, applied to a signer, may specifically include the following steps:

s101, determining a first subgroup and a second subgroup from established braid groups, wherein the index of the braid group is an integer greater than or equal to 6, and multiplication of elements of the first subgroup and the second subgroup is not exchangeable.

Specifically, braid group B may be established first_nBraid group B_nThe defined group is presented by:

B_n＝<σ₁，σ₂，…，σ_n-1|σ_iσ_j＝σ_jσ_i，|i-j|≥2，σ_iσ_i+1σ_i＝σ_i+1σ_iσ_i+1，1≤i≤n-2>

the elements of the braid group are all in a set { sigma₁，σ₂，…，σ_n-1A word representation in a formal form representing uniqueness of the element is provided. Braid group B_nHas the following properties: in B_nRepresentative B on the generated element set_nThe words of the elements of (a) have a calculable unique regular form; the product and inversion operations based on the regular form of the group are computationally feasible.

Braid group B_nContaining a compound of formula II and F₂×F₂Isomorphic subgroups L_iI.e. from σ_i ²，σ_i+1 ²，σ_i+3 ²，σ_i+4 ²Two direct product isomorphic subgroups of free groups of rank 2 are generated:

L_i＝<σ_i ²，σ_i+1 ²，σ_i+3 ²，σ_i+4 ²>，i＝1，2，..，n-5

then, a finite presentation group H whose word problem is not solved is generated by two elements, and L is constructed_iA Mihaivova subgroup M_i(see reference [3 ]]). The lower part is M_i56 generators:

σ_i ²σ_i+3 ²，σ_i+1 ²σ_i+4 ²，S_ij，T_ij，j＝1，2，…，27

and 27S_1jIs (hold all sigma)₁Is changed to sigma_i，σ₂Is changed to sigma_i+1To obtain allS_ij(ii) a All sigma₁Is changed to sigma_i+3，σ₂Is changed to sigma_i+4To obtain all T_ij):

All mihaivova subgroups M_iThe problem of membership of (i ═ 1, 2., n-5) is not solvable.

The first subgroup and the second subgroup are two Mihailova subgroups P and Q of the braid group, and multiplication of elements in the first subgroup and the second subgroup is not exchangeable.

S102, selecting any element from the first subgroup as a private key, and performing conjugate operation on the private key and the braid group to obtain a first conjugate value.

Specifically, the signer may select an element from the first subgroup as the private key x, and then perform a conjugate operation on the private key and the braid group to obtain a first conjugate value.

Specifically, the calculation formula of the first conjugate value is: a is₁＝xσ₁x^-1，a₂＝xσ₂x^-1，…，a_n-1＝xσ_n-1x^-1，(a₁，a₂，…，a_n-1) Wherein 1, 2, … and n1 are a plurality of generating elements of the braid group; x is a private key; a1, a2, …, an-1 is the first conjugate value, and n is the index.

S103, generating a public key based on the braid group and the first conjugate value.

To make the braids group B_nAn index n, a second subgroup Q and a first conjugate value a₁，a₂，…，a_n-1AsThe public key of the signer, which can be obtained by the verifier.

In a possible implementation manner, the public key further includes a collision resistant hash function.

And S104, when a second conjugate value sent by a verifier is received, calculating a digital signature of the information to be signed according to the second conjugate value and the private key, wherein the second conjugate value is calculated by the verifier according to the public key.

The verifying party can obtain the public key of the signing party and then calculate to obtain a second conjugate value according to the public key of the signing party; the verifier may then send the second conjugate value to the signer.

And when the signer receives the second conjugate value sent by the verifier, the digital signature with the signature information can be calculated according to the second conjugate value and the private key.

Specifically, the signer may replace the occurrence decibels of all the generator elements in the private key with the first public responsibility, and then calculate the product of the private key and the first conjugate value; calculating an intermediate value using the private key and the reciprocal; and encrypting the information to be signed based on the intermediate value. The anti-collision hash function can be used for encryption, has irreversibility, and can ensure the safety of the digital signature in the data communication process.

Specifically, the calculation formula of the digital signature may be:

K＝x(b₁，b₂，…，b_n-1)；

e＝x^-1K；

S＝H(m||e)；

wherein, b₁，b₂，…，b_n-1Is the second conjugate value; s is a digital signature, H is a collision-resistant hash function, m is information to be signed, n is an index, | | represents that characters m and e are connected together.

S105, sending the digital signature to the verifier.

The signer sends the digital signature obtained by calculation to the verifier, and the verifier can confirm the identity of the signer according to the digital signature.

In the embodiment of the application, a signing party adopts one element in a Mihailova subgroup as a private key, while the problem of members in the Mihailova subgroup is not solvable, and the security guarantee of the digital signature algorithm depends on the insolubility of the corresponding judgment problem, so that the digital signature algorithm in the embodiment is resistant to all known attacks including quantum quantity calculation attacks.

Referring to fig. 2, a schematic flow chart illustrating steps of another digital signature method provided in the embodiment of the present application is shown, and the method is applied to a verifier, and specifically may include the following steps:

s201, calculating a second conjugate value according to a public key of the signer, wherein the public key comprises the first conjugate value.

Specifically, the verifier may obtain a public key of the signer, where the public key may include a first conjugate value, and the first conjugate value is calculated by the signer according to the step in S102.

The public key further includes an braid group and a subgroup, where an index of the braid group is an integer greater than or equal to 6, and the subgroup is a Mihailova subgroup of the braid group, that is, the Mihailova subgroup Q in step S101.

The verifying party can select an element from the subgroup, and then the element and the braid group are adopted to carry out conjugate operation to obtain a second conjugate value. The second conjugate value may be calculated by:

b₁＝yσ₁y^-1，b₂＝yσ₂y^-1，…，b_n-1＝yσ_n-1y^-1；

wherein, b₁，b₂，…，b_n-1Is the second conjugate value; sigma₁，σ₂，…，σ_n-1A plurality of generators for braid groups; y is an element and n is an index.

S202, the second conjugate value is sent to the signing party, and the second conjugate value is used for the signing party to calculate the digital signature of the information to be signed.

Specifically, when the signer needs to be verified, the verifier may send the second conjugate value to the signer, and after receiving the second conjugate value, the signer may calculate the digital signature of the information to be signed by using the above step in S104.

S203, when the digital signature from the signer is received, verifying the digital signature according to the second conjugate value and the first conjugate value.

When the verifier receives the digital signature of the signer, the verifier can calculate a verification value corresponding to the digital signature according to the second conjugate value and the first conjugate value; if the verification value is equal to the digital signature, the digital signature verification is passed. If the verification value is not equal to the digital signature, the verification fails.

Specifically, the public key may further include a hash function, and the calculation formula of the verification value may be:

K’＝y(a₁，a₂，…，a_n-1)；

e’＝(y^-1K’)^-1；

S’＝H(m||e’)；

wherein y is an element, S 'is a verification value, H is a hash function, m is information to be signed, n is an index, | | represents that characters m and e' are connected together.

The verification principle is as follows:

e＝x^-1K

＝x^-1x(b₁，b₂，…，b_n-1)

＝x^-1x(y^-1σ₁y，y^-1σ₂y，…，y^-1σ_n-1y)

＝x^-1y^-1x(σ₁，σ₂，…，σ_n-1)y

＝x^-1y^-1xy

e’＝(y^-1K’)^-1

＝(y^-1y(a₁，a₂，…，a_n-1))^-1

＝(y^-1y(x^-1σ₁x，x^-1σ₂x，…，x^-1σ_n-1x))^-1

＝(y^-1x^-1y(σ₁，σ₂，…，σ_n-1)x)^-1

＝(y^-1x^-1yx)^-1＝x^-1y^-1xy

so S '═ H (m | | e') ═ H (m | | | e) ═ S

In the embodiment of the application, a signer determines an element from one Mihailova subgroup of an braid group as a private key, and a verifier determines an element from another Mihailova subgroup of the braid group to perform conjugate operation. The private key can be verified only by being held in the hand of the signing party without being sent to the verifying party, so that the private key is prevented from being stolen in the data communication process; the security of the digital signature in the embodiment depends on the member problem in the Mihailova subgroup, which is not understood, so that the digital signature method in the embodiment can resist quantum computing attack and has higher security.

It should be noted that, the sequence numbers of the steps in the foregoing embodiments do not mean the execution sequence, and the execution sequence of each process should be determined by the function and the inherent logic of the process, and should not constitute any limitation on the implementation process of the embodiments of the present application.

For ease of understanding, the digital signature provided in the present application is presented below in a complete example.

In this embodiment, the signer and the verifier may agree in advance, so as to perform identity verification and information integrity verification by using the digital signature method in this embodiment. The digital signature method in the present embodiment may include three processes of key generation, signature and verification.

The key generation process may include:

the signature party selects a braid group B with index n being more than or equal to 6_nAs a public key, its generator is σ₁，σ₂，…，σ_n-1Simultaneously selecting an anti-collision Hash function H: B with an input byte of any length and an output byte of a fixed length of k bytes_n→{0，1}^kWhere k is a fixed natural number large enough.

Signer selection B_nAnd multiplication of elements satisfying P and Q is not exchangeable, with Q as the public key.

The signer selects an element x from the Mihailova subgroup P as its private key, which is denoted as x ═ x (σ)₁，σ₂，…，σ_n-1) And calculate a₁＝xσ₁x^-1，a₂＝xσ₂x^-1，…，a_n-1＝xσ_n-1x^-1，(a₁，a₂，…，a_n-1) As its public key; the public key of the signer is (n, B)_n，Q，H，a₁，a₂，…，a_n-1) The private key is x.

The signing process may include:

the verifier selects a public key Q published by the signer to select an element y, and the element y is marked as y (sigma)₁，σ₂，…，σ_n-1) And calculate b₁＝yσ₁y^-1，b₂＝yσ₂y^-1，…，b_n-1＝yσ_n-1y^-1And will be (b)₁，b₂，…，b_n-1) And sending the information to the signer.

Receiving (b) of the authenticating party₁，b₂，…，b_n-1) The signer compares all sigma in the private key x_iRespectively replaced by b_i(i-1, 2, …, n-1), and calculating x (b)₁，b₂，…，b_n-1) And is denoted as K. Further calculating e ═ x using the private key^-1K, and then S ═ H (m | | | e) is further calculated (where | | denotes that the characters m and e are connected together). m is the information to be signed, and the signature of the signer to m is S.

The verification process may include:

the verifier acquires the public key (a) published by the signer₁，a₂，…，a_n-1) Then all σ in y selected before_iIs replaced by a_iI is 1, …, n-1, and y (a) is calculated₁，a₂，…，a_n-1) And is denoted as K ', and e' ═ y is further calculated^-1K’)^-1Then, S ' is further calculated as H (m | | | e ') (where | | denotes that the characters m and e ' are connected together). And verifying whether S' is S, accepting the signature if the equation is true, and rejecting the signature otherwise.

The verifier acquires the public key (a) published by the signer₁，a₂，…，a_n-1) Then all sigma in y in step (4)_iIs replaced by a_iI is 1, …, n-1, and y (a) is calculated₁，a₂，…，a_n-1) And is denoted as K ', and e' ═ y is further calculated^- ¹K’)^-1Then, S ' is further calculated as H (m | | | e ') (where | | denotes that the characters m and e ' are connected together). And verifying whether S' is S, accepting the signature if the equation is true, and rejecting the signature otherwise.

In the embodiment of the application, the platform for establishing the digital signature protocol is a braid group B with the index n being more than or equal to 6_nAnd B_nTwo Mihailova subgroups P and Q that have multiplication of elements that are not commutative, while making the subgroup membership problem of P and Q unknowable.

The subgroup member problem (membership problem or generated word problem) refers to a subgroup H of a given group G, the generated element set of which is X, and whether any element G in the group G can be represented by a word on X is judged, namely whether the G is an element in the H is judged.

If a third party tries to attack the protocol, she can only pass the public information of both parties of the protocol { sigma₁，σ₂，…，σ_n-1}，{n，B_n，Q，H，a₁，a₂，…，a_n-1}(a_i＝x^-1σ_ix, i-1, …, n-1) and { b obtained through a channel₁，b₂，…，b_n-1}(b_i＝y^-1σ_iy, i ═ 1, …, n-1) to carry out the attack. If she can get B_nS and t are such that

s^-1σ_is＝y^-1σ_iy，t^-1σ_it＝x^-1σ_ix，i＝1，2，…，n-1，

Let sCy, t ═ dx (where c and d are B)_nAn element of) then have

s^-1σ_is＝(cy)^-1σ_icy＝y^-1c^-1σ_icy＝y^-1σ_iy，i＝1，2，…，n-1

Thereby having

c^-1σ_ic＝σ_i，i＝1，2，…，n-1

I.e. c and each sigma_iThe multiplication is exchangeable. Due to B_nBy σ₁，σ₂，…，σ_n-1Is generated that c is B_nThe central element. And B_nIs centered on²Generated infinite loop subgroup<Δ²>In which

Δ＝σ₁σ₂…σ_n-1σ₁σ₂…σ_n-2…σ₁σ₂σ₃σ₁σ₂σ₁

Whereby c is<Δ²>Of (2) is used. In the same way, d is<Δ²>Of (2) is used. Due to the fact that<Δ²>Is B_nCenter of (a) and a_i ²<Δ²>，σ_i+1 ²<Δ²>，σ_i+3 ²<Δ²>And σ_i+4 ²<Δ²>Generated business group B_n/<Δ²>A subgroup of_i ²，σ_i+1 ²，σ_i+3 ²And σ_i+4 ²Generation of B_nAre isomorphic and thus also free groups of rank 2. Shop for old children (M)_i<Δ²>)/<Δ²>Is also the business group B_n/<Δ²>A subgroup of Mihailova. Therefore (M)_i<Δ²>)/<Δ²>The subgroup membership problem of (a) is also not solvable. So that an attacker can obtain B if_nS and t are such that

s^-1σ_is＝y^-1σ_iy，t^-1σ_it＝x^-1σ_it，i＝1，2，…，n-1，

Then s is cy, t is dx, c, d ∈<Δ²>Therefore in the business group B_n/<Δ²>Chinese character of S<Δ²>＝y<Δ²>And t<Δ²>＝x<Δ²>. I.e. the attacker is in the business group B_n/<Δ²>Has to find the Mihaivova subgroup (M)_i<Δ²>)/<Δ²>Middle element y<Δ²>And x<Δ²>. Due to (M)_i<Δ²>)/<Δ²>The problem of subgroup membership is not solvable, so there is no algorithm to allow an attacker to successfully obtain y<Δ²>And x<Δ²>Thus, there is also no algorithm for an attacker to successfully obtain the required s and t.

The braid group B is selected by a signature party_nThe elements of the Mihailova subgroup as key components of its private key and prove that all possible attacks are computationally infeasible, i.e. the digital signature method of the present invention is resistant to all known attacks including quantum computation attacks.

Compared with the prior art, the method has the following advantages: the safety guarantee of the established digital signature algorithm depends on the insolubility of the corresponding judgment problem, but not the calculation difficulty of the corresponding judgment problem; classical public key cryptographic algorithms are based on computational difficulties, so that the digital signature algorithm of the present invention is resistant to all known attacks including quantum computational attacks.

The digital signature method can be used for identity verification, and the digital signature method in the application is described as an example in an identity verification scene in the following:

alice sends information to Bob, and in order to prevent Oscar from pretending to be Alice sending information to Bob, the identity of Alice may be verified by Bob through the digital signature method in this embodiment.

First, Alice and Bob may achieve a digital signature protocol according to the method in this embodiment, where Alice is a signing party and Bob is a verifying party.

Alice can select a braid group B with the index n being more than or equal to 6_nAs a public key, braid group B_nHas a generator of₁，σ₂，…，σ_n-1Simultaneously selecting an anti-collision Hash function H: B with an input byte of any length and an output byte of a fixed length of k bytes_n→{0，1}^kWhere k is a fixed natural number large enough.

Alice selects B_nAnd the multiplication of elements satisfying P and Q is not exchangeable.

Alice selects an element x from the Mihailova subgroup P as its private key, which is denoted as x ═ x (σ)₁，σ₂，…，σ_n-1) And calculate a₁＝xσ₁x^-1，a₂＝xσ₂x^-1，…，a_n-1＝xσ_n-1x^-1，(a₁，a₂，…，a_n-1)。

Alice's public key is (n, B)_n，Q，H，a₁，a₂，…，a_n-1) The private key is x. Bob can publicly obtain Alice's public key.

When authentication is to be performed, Alice and Bob may agree to perform authentication using one unique identification information m of Alice.

Bob selects an element y from the public key Q published by Alice, and the element y is recorded as y (σ)₁，σ₂，…，σ_n-1) And calculate b₁＝yσ₁y^-1，b₂＝yσ₂y^-1，…，b_n-1＝yσ_n-1y^-1And will be (b)₁，b₂，…，b_n-1) And sending the data to Alice.

Receiving Bob's (b)₁，b₂，…，b_n-1) Then, Alice compares all σ in the private key x_iRespectively replaced by b_i(i-1, 2, …, n-1), and calculates x (b)₁，b₂，…，b_n-1) And is denoted as K. Further using private key to calculate e ═ x^-1K, and then further calculates S ═ H (m | | | e) (where| represents the concatenation of the characters m and e). The signature of Alice on m is S.

Alice may then send the digital signature to Bob when sending information to Bob. Bob determines whether the information originates from Alice through the digital signature, avoiding Oscar from masquerading as Alice.

After receiving the information of Alice, Bob can acquire the carried digital signature. Then all sigma in y selected before_iIs replaced by a_iI is 1, …, n-1, and y (a) is calculated₁，a₂，…，a_n-1) And is denoted as K ', and e' ═ y is further calculated^-1K’)^-1Then, S ' is further calculated as H (m | | | e ') (where | | denotes that the characters m and e ' are connected together). Bob verifies if S' is S, if the equation holds, indicating that the information is indeed from Alice, otherwise the information is not sent by Alice.

The digital signature method may also be used to ensure the integrity of information transmission, and the following example of the digital signature method in the present application in an identity verification scenario is described as follows:

in order to prevent Oscar from tampering with the information sent by Alice to Bob, the information integrity verification may be implemented by the digital signature method in this embodiment.

First, Alice and Bob may achieve a digital signature protocol according to the method in this embodiment, where Alice is a signer in this application, and Bob is a verifier in this application.

Alice from Mihaivova subgroupOne element x is selected from P as its private key, which is denoted as x ═ x (σ)₁，σ₂，…，σ_n-1) And calculate a₁＝xσ₁x^-1，a₂＝xσ₂x^-1，…，a_n-1＝xσ_n-1x^-1，(a₁，a₂，…，a_n-1)。

When Alice sends a message to Bob, it may generate an abstract m of the message by using a hash function.

Bob selects an element y from the public key Q published by Alice, and the element y is marked as y (sigma)₁，σ₂，…，σ_n-1) And calculate b₁＝yσ₁y^-1，b₂＝yσ₂y^-1，…，b_n-1＝yσ_n-1y^-1And will be (b)₁，b₂，…，b_n-1) And sending the data to Alice.

Receiving Bob's (b)₁，b₂，…，b_n-1) Then, Alice compares all σ in the private key x_iRespectively replaced by b_i(i-1, 2, …, n-1), and calculates x (b)₁，b₂，…，b_n-1) And is denoted as K. Further calculating e ═ x using the private key^-1K, and then S ═ H (m | | | e) is further calculated (where | | denotes that the characters m and e are connected together). The signature of Alice on m is S.

Alice may then send the digital signature to Bob along with the message when sending the message to Bob. Bob determines whether the message is tampered by the digital signature.

After receiving the information of Alice, Bob can acquire the carried digital signature. And then, generating the abstract m' of the message by adopting the hash function same as that of Alice. Then all sigma in y selected before_iIs replaced by a_iI is 1, …, n-1, and y (a) is calculated₁，a₂，…，a_n-1) Further calculate e ═ K', and(y^-1K’)^-1then, S ' is further calculated as H (m ' | | e ') (where | | denotes that the characters m ' and e ' are connected together). Bob verifies whether S' is S, if the equation is established, the message is not tampered, otherwise, the message is tampered.

Referring to fig. 3, a schematic diagram of a digital signature apparatus provided in the embodiment of the present application is shown, and is applied to a signer, and specifically, the digital signature apparatus may include a subgroup determining module 31, a conjugate operation module 32, a public key generating module 33, a digital signature module 34, and a sending module 35, where:

a subgroup determining module 31, configured to determine a first subgroup and a second subgroup from an established braid group, where an index of the braid group is an integer greater than or equal to 6, and multiplication of elements of the first subgroup and the second subgroup is not exchangeable;

a conjugate operation module 32, configured to select any element from the first sub-group as a private key, and perform a conjugate operation on the private key and the braid group to obtain a first conjugate value;

a public key generating module 33, configured to generate a public key based on the braid group and the first conjugate value;

the digital signature module 34 is configured to, when receiving a second conjugate value sent by a verifier, calculate a digital signature of information to be signed according to the second conjugate value and the private key, where the second conjugate value is calculated by the verifier according to the public key;

a sending module 35, configured to send the digital signature to the verifier.

In a possible implementation manner, the conjugate operation module 32 performs a conjugate operation on the private key and the braid group by using the following formula to obtain a first conjugate value:

a₁＝xσ₁x^-1，a₂＝xσ₂x^-1，…，a_n-1＝xσ_n-1x^-1；

wherein σ₁，σ₂，…，σ_n-1A plurality of generators for the braid population; x is the private key; a is₁，a₂，…，a_n-1Is the first conjugate value, n is the exponent.

In one possible implementation, the public key includes a hash function, and the digital signature module 34 calculates a digital signature of the information to be signed by using the following formula:

K＝x(b₁，b₂，…，b_n-1)；

e＝x^-1K；

S＝H(m||e)；

wherein, b₁，b₂，…，b_n-1Is the second conjugate value; s is the digital signature, H is the hash function, m is the information to be signed, n is the index, | | represents that the characters m and e are connected together.

Referring to fig. 4, a schematic diagram of another digital signature apparatus provided in the embodiment of the present application is shown, and is applied to a verifier, and specifically, the digital signature apparatus may include a calculating module 41, a sending module 42, and a verifying module 43, where:

a calculating module 41, configured to calculate a second conjugate value according to a public key of the signer, where the public key includes the first conjugate value;

a sending module 42, configured to send the second conjugate value to the signer, where the second conjugate value is used for the signer to calculate a digital signature of the information to be signed;

a verification module 43, configured to verify the digital signature according to the second conjugate value and the first conjugate value when the digital signature from the signer is received.

In a possible implementation manner, the calculating module 41 includes:

the obtaining submodule is used for obtaining a public key of a signer, the public key further comprises a braid group and a subgroup, and the index of the braid group is an integer greater than or equal to 6;

a selection submodule for selecting any element from the subgroups;

and the calculation sub-module is used for performing conjugate operation on the element and the braid group to obtain the second conjugate value.

In a possible implementation manner, the calculating submodule performs a conjugate operation on the element and the braid group by using the following formula to obtain a second conjugate value:

b₁＝yσ₁y^-1，b₂＝yσ₂y^-1，…，b_n-1＝yσ_n-1y^-1；

wherein, b₁，b₂，…，b_n-1Is the second conjugate value; sigma₁，σ₂，…，σ_n-1A plurality of generators for the braid population; y is the element and n is the index.

In one possible implementation, the verification module 43 includes:

a verification value operator module, configured to calculate a verification value corresponding to the digital signature according to the second conjugate value and the first conjugate value;

and the judgment submodule is used for passing the verification of the digital signature if the verification value is equal to the digital signature.

In a possible implementation manner, the public key further includes a hash function, and the verification value operator module calculates the verification value corresponding to the digital signature by using the following formula:

K’＝y(a₁，a₂，…，a_n-1)；

e’＝(y^-1K’)^-1；

S’＝H(m||e’)；

wherein y is the element, S 'is the verification value, H is the hash function, m is the information to be signed, n is the index, and | represents that the characters m and e' are connected together.

For the apparatus embodiment, since it is substantially similar to the method embodiment, it is described relatively simply, and reference may be made to the description of the method embodiment section for relevant points.

Fig. 5 is a schematic structural diagram of a computer device according to an embodiment of the present application. As shown in fig. 5, the computer device 5 of this embodiment includes: at least one processor 50 (only one shown in fig. 5), a memory 51, and a computer program 52 stored in the memory 51 and executable on the at least one processor 50, the processor 50 implementing the steps in any of the various method embodiments described above when executing the computer program 52.

The computer device 5 may be a desktop computer, a notebook, a palm computer, a cloud server, or other computing devices. The computer device may include, but is not limited to, a processor 50, a memory 51. Those skilled in the art will appreciate that fig. 5 is merely an example of the computer device 5, and does not constitute a limitation of the computer device 5, and may include more or less components than those shown, or may combine some components, or different components, and may further include input and output devices, network access devices, and the like, for example.

The Processor 50 may be a Central Processing Unit (CPU), and the Processor 50 may be other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other Programmable logic device, discrete Gate or transistor logic device, discrete hardware components, and the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 51 may in some embodiments be an internal storage unit of the computer device 5, such as a hard disk or a memory of the computer device 5. The memory 51 may also be an external storage device of the computer device 5 in other embodiments, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like, which are provided on the computer device 5. Further, the memory 51 may also include both an internal storage unit and an external storage device of the computer device 5. The memory 51 is used for storing an operating system, an application program, a BootLoader (BootLoader), data, and other programs, such as program codes of the computer program. The memory 51 may also be used to temporarily store data that has been output or is to be output.

The embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored, and when the computer program is executed by a processor, the computer program implements the steps in the above-mentioned method embodiments.

The embodiments of the present application provide a computer program product, which when executed on a computer device, enables the computer device to implement the steps in the above method embodiments.

The functions implemented by the computer device may be stored in a computer-readable storage medium if implemented in the form of software functional units and sold or used as a stand-alone product. Based on such understanding, all or part of the processes in the methods of the embodiments described above may be implemented by instructing relevant hardware by a computer program, which may be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the embodiments of the methods described above may be implemented. Wherein the computer program comprises computer program code, which may be in the form of source code, object code, an executable file or some intermediate form, etc. The computer readable medium may include at least: any entity or device capable of carrying computer program code to an apparatus/computer device, recording medium, computer Memory, Read-Only Memory (ROM), Random-Access Memory (RAM), electrical carrier wave signals, telecommunications signals, and software distribution medium. Such as a usb-disk, a removable hard disk, a magnetic or optical disk, etc. In certain jurisdictions, computer-readable media may not be an electrical carrier signal or a telecommunications signal in accordance with legislative and patent practice.

In the above embodiments, the descriptions of the respective embodiments have respective emphasis, and reference may be made to the related descriptions of other embodiments for parts that are not described or illustrated in a certain embodiment.

Those of ordinary skill in the art will appreciate that the various illustrative method steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus/computer device and method may be implemented in other ways. For example, the above-described apparatus/computer device embodiments are merely illustrative, and for example, the division of the modules is only one logical division, and there may be other divisions when actually implemented, for example, multiple sub-modules may be combined or integrated into another module, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The above-mentioned embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same. Although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; such modifications and substitutions do not substantially depart from the spirit and scope of the embodiments of the present application and are intended to be included within the scope of the present application.

Claims

1. A digital signature method, applied to a signer, the method comprising:

generating a public key based on the braid group and the first conjugate value;

and sending the digital signature to the verifier.

2. The method of claim 1, wherein the private key and the braid group are conjugated using the following equation to obtain a first conjugate value:

a₁＝xσ₁x^-1，a₂＝xσ₂x^-1，…，a_n-1＝xσ_n-1x^-1；

3. The method according to claim 1 or 2, wherein the public key comprises a hash function, and the digital signature of the information to be signed is calculated from the second conjugate value and the private key using the following formula:

K＝x(b₁，b₂，…，b_n-1)；

e＝x^-1K；

S＝H(m||e)；

4. A digital signature method, applied to a verifier, the method comprising:

5. The method of claim 4, wherein said calculating the second conjugate value from the public key of the signer comprises:

obtaining a public key of a signer, wherein the public key further comprises a braid group and a subgroup, and the index of the braid group is an integer greater than or equal to 6;

selecting any element from the subgroup;

and performing conjugate operation on the element and the braid group to obtain the second conjugate value.

6. A method according to claim 5, wherein the element and the group of braids are conjugated to obtain a second conjugate value using the formula:

b₁＝yσ₁y^-1，b₂＝yσ₂y^-1，…，b_n-1＝yσ_n-1y^-1；

7. The method of any of claims 5 or 6, wherein the verifying the digital signature based on the second conjugate value and the first conjugate value comprises:

calculating a verification value corresponding to the digital signature according to the second conjugate value and the first conjugate value;

and if the verification value is equal to the digital signature, the digital signature passes the verification.

8. The method of claim 7, wherein the public key further comprises a hash function, and wherein the verification value corresponding to the digital signature is calculated according to the second conjugate value and the first conjugate value by using the following formula:

K’＝y(a₁，a₂，…，a_n-1)；

e’＝(y^-1K’)^-1；

S’＝H(m||e’)；

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the digital signature method as recited in any one of claims 1-4 or 5-8 when executing the computer program.

10. A computer-readable storage medium, in which a computer program is stored, which, when being executed by a processor, implements the digital signature method according to any one of claims 1 to 4 or 5 to 8.