CN116260587A - Quantum-resistant signature authentication method based on hash signature and having small size - Google Patents

Abstract

The invention discloses a signature authentication method which is quantum resistant, hash-based and small in size, and relates to the technical field of data communication information security; the technology is a method for carrying out digital signature on a large-scale public data stream continuously transmitted from a sender to a receiver under the application background that the large-scale public data stream continuously propagates between two communication parties. And designing a specific signature method to generate an authentication identifier for the data stream by utilizing a hash-based signature technology, and checking the data stream and the authentication identifier by a receiver. If the verification is passed, judging that the sender equipment is the equipment to be interacted, and the data information is correct; if the verification is not passed, the interaction with the sender equipment fails, and the authenticity of the sender identity and the integrity of the sent data are protected; compared with the XMS signature algorithm, the signature compression rate is 0.828 to 0.017 in a specific parameter interval, so that the signature size obtained by the technology can be reduced by hundreds of times under specific parameters.

Description

Quantum-resistant signature authentication method based on hash signature and having small size

Technical Field

The invention relates to the technical field of data communication information security, in particular to a signature authentication method which is quantum resistant, hash-based and small in size.

Background

In the application background of continuous transmission of two parties of communication, in order to ensure the authenticity of the identity of the parties in communication and the integrity of data (not tampered), the identity authentication of data sources and the integrity authentication of data are always typical requirements in data communication. The digital signature algorithm is an asymmetric cryptographic technology for carrying out message source identity authentication and message integrity authentication in the communication field, the traditional digital signature scheme based on the mathematical theory difficult assumption is the most mainstream algorithm used in the application field, but with the development of quantum computation, the defects of the traditional digital signature scheme based on the mathematical theory difficult assumption are gradually revealed, if the digital signature scheme does not have the characteristic of resisting quantum attack, the security assumption is complex, the theoretical basis is immature, and the digital signature scheme cannot resist multi-objective attack and has low security.

As one of five-major quantum cryptography algorithms, hash-based signature technology has received increasing attention in recent years and is widely used in the fields of message source identity authentication and message integrity authentication. Compared with a digital signature scheme based on the calculation difficulty number theory problem, the hash-based signature has the characteristics of quantum attack resistance, non-counterfeitability of a signature algorithm, basic security assumption based on a hash function, high efficiency, easiness in implementation and the like. However, the existing hash signature technology has the problem that the total cost of key generation, signature generation and verification is too high because of the design of combining One-time signature (One-time signature) or less-time signature (Few-time signature) with a hash tree, and the problem that the signature size is large occurs.

Disclosure of Invention

In order to solve the problems of large size, high key generation, high total cost of signature generation and verification of the existing hash signature, the invention aims to provide an anti-quantum hash signature-based authentication method for carrying out identity authentication and data integrity authentication of a data source on a large-scale data stream under the application background of continuous transmission of two communication parties.

The invention aims to achieve the aim, and the aim is achieved by the following technical scheme:

the technology has the functions that:

(1) Identity authentication of the data source to ensure authenticity of the identity of the party in the communication;

(2) Integrity of the data is verified to ensure that the data transmitted in the communication is not tampered with.

The application scene of the technology is characterized in that:

(1) The large-scale public data stream is continuously transmitted between the two communication parties;

(2) There are identity authentication and data integrity authentication requirements in applications.

A signature authentication method which is quantum resistant, hash-based and small in size is a signature method for carrying out identity authentication and data integrity authentication of a data source on a large-scale data stream under the application background of continuous transmission of two communication parties; for clarity, some terms will now be defined as follows:

Complete transmission: uninterrupted message transmission between signer and verifier, which is a time interval;

signer: i.e. sender, verifier: namely the receiving party;

signing key: the signature key is a private key and is used in a signature stage to generate an authentication identifier;

authentication key: the verification key is a public key;

x: the number of complete transmissions that a public key can verify;

signature period: a time interval for signing using a set of stamps;

s: the number of signable messages in a signature cycle;

fragments: compressing a plurality of messages into a time interval of a message digest through a batch digest sub-algorithm;

the signature authentication method comprises the following steps:

s1: time-sequentially dividing a complete transmission between a sender and a receiver into a plurality of fragments, and setting a 32-bit fragment tag IDX for each fragment _smt The value of the product is 0, and 1 is added in sequence; the data communication of the fragments starts with a start identifier SRT; then, based on the block size or transmission time, the data stream in the segment is divided into a plurality of data blocks, the data blocks are represented by m, and each data block m is assigned a tag IDX _msg And after attaching to each data block, its value starts from 0, adds 1 in turn, and each segment ENDs with an END identifier END; index parameter IDX for each data block _pkt ＝IDX _smt ||IDX _msg ；

S2: a key generation algorithm Gen, which comprises two steps S2.1 of private key generation sub-algorithm SKGEN and S2.2 of public key generation sub-algorithm PKGEN in sequence

The key generation algorithm Gen generates a signature key and a verification key for a sender by using a forward secure pseudo-random function, and provides a key for constructing a non-counterfeitable forward secure signature scheme;

the algorithm comprises a private key generation sub-algorithm SKGEN and a public key generation sub-algorithm PKGEN;

s2.1 private Key Generation sub-Algorithm SKGEN

Private key generation sub-algorithm from initial state SEED _fws Initially, the seed key seed of the j-1 th period is used _j-1 To generate a seed key seed for the j-th period _j Then, use seed _j Involving t SEALs in generation cycle j _i,j Private key SK of (1.ltoreq.i.ltoreq.t) _periodj J=1, 2, …, x+l, wherein the values of x and t are all the power of 2; the generation algorithm is as follows:

input: pseudo-random function

Q：＝{q _k :k×(0，1) ⁿ →(0，1) ⁿ |k∈(0，1) ⁿ }；

n is a security parameter, and the value of n depends on the security level set in the application of the algorithm;

SEED for generating private key _fws : random selectionFrom (0, 1) ⁿ Is uniformly distributed;

and (3) treatment:

seed ₀ ＝SEED _fws

and (3) outputting: SK (SK) _periodj ，j＝1，2，…，x+l；

Wherein the first x private keys SK _{period j} J=1, 2, …, x, which is used as the first signing key, the latter l private keys, SK at the beginning of each complete transmission _{period j} J=x+1, x+2, …, x+l, used as a subsequent signing key, used in sequence in the complete transmission; the assignment of x is random, as when x=10, l=10, the first 10 private keys SK _{period j} J=1, 2, …,8,9, 10 is used as the first signature key at the beginning of each complete transmission, the last 10 private keys SK _{period j} J=11, 12, …,18, 19, 20 is used as a subsequent signing key, used in sequence in the complete transmission;

s2.2 public Key Generation sub-Algorithm PKGEN

Step S2.1 after generating the private key, the public key generation sub-algorithm PKGEN is based on the adjustable hash function to SK _{period j} J=1, 2, …, x+l, as input, using the hash tree to generate the corresponding public key; specifically:

first, use sk _{period j} J=x+1, x+2, …, x+l as input to the pseudo-random function F to generate PK _{period j} ，j＝1，2，…，x+l；

Then, SEED is generated with public key _auth And tag HIDX _m,n As input to the pseudo-random function R, each iteration step is generatedThe required KEY and MSK;

next, with each PK _{period j} Is used as a leaf node of a hash tree, generates a root node of the hash tree by utilizing an adjustable hash function th, and sequentially generates PKs _j ，j＝1，2，…，x+l；

Finally, use PK _j J=1, 2, …, x is the hash tree HT _r oo _t According to KEY and MSK required for generating each iteration and PK generation _j Step j=1, 2, …, x+l, constructing hash tree HT _root Root node PK of (1) _root Root node PK _root Namely a public key;

the specific treatment process comprises the following steps:

input: a security parameter n;

pseudo-random function

Pseudo-random function

R：＝{rSEED:IDX→KEY||MSK|SEED∈(0，1) ⁿ }；

Adjustable hash function

SEED generated by public key _auth : randomly selected from (0, 1) ⁿ Is uniformly distributed;

label HIDX _m，n Sequence: consists of the sequence number of the complete transmission, the position of the corresponding level of nodes in the authentication tree, where m=0, 1..logt-1, n=0, 1..2 ^m -1; respectively representing the layer number of corresponding nodes from top to bottom in the authentication tree and the position number from left to right in each layer, wherein the m and n counts are respectively from 0, and are sequentially added with 1; the nodes at each level comprise a root node and a leaf node, and N is used as follows _m，n To represent;

and (3) treatment:

(1) the following procedure calculates PK _j ，j＝1，2，…，x+l；

a.

For each j e 1,2,..,

b. the KEY and mask required for each iteration step are generated using a pseudo-random function R, denoted below by the KEY and MSK with subscripts, respectively:

/>

m＝0，1，...logt-2，n＝0，1，...，2 ^m -1；

c. calculating the root node N of the hash tree _0，0 : the value of m is logt-1, logt-2, 0,

for each m described above, calculate:

wherein n takes the values 0,2,4 in that order ^m -2；

PK _j ＝N _0，0 ；

(2) The following procedure calculates PK _root ：

a.N _logx，0 ，N _logx，1 ，...N _logx，x-1 ＝PK ₁ ，PK ₂ ，...，PK _x

b. Generating KEY and MSK required by each iteration by using a pseudo-random function R:

r(SEED _auth ，HIDX _m，n )＝KEY _m，n ||MSK _m，n ，

m＝0，1，2，...logx-2，n＝0，1，2，...，2 ^m -1；

c. Calculating the root node N of the hash tree _0，0 : the values of m are log x-1, log x-2, 0,

for each m described above, calculate:

wherein n takes the values 0,2,4 in that order ^m -2；

PK _root ＝N _0，0 ；

S3: the signature algorithm Sig comprises two steps S3.1 of batch digest sub-algorithm BDA and S3.2 of signature sub-algorithm:

s3.1 batch summary sub-algorithm BDA

The batch summary sub-algorithm comprises the following specific steps:

the batch digest sub-algorithm inputs the data processed in the S1 stage in the unit of a segment, and indexes parameters m of all data blocks in each segment ₁ ，IDX _pkt，1 ，m ₂ ，IDX _pkt，2 ，…，m _j ，IDX _pkt，j Generating batch digest values BDS of all data blocks in each segment by using a pseudo-random function P and a hash function family T; all batch digest values in a complete transmission are chronologically recorded as BDS ₁ ，BDS ₂ …; the batch summarization of data in a segment is as follows:

input: a security parameter n;

all data blocks m in one transmission segment ₁ ，...，m _j ；

Pseudo-random function p= { P _SEED ：(0，1) ⁶⁴ ×(0，1)) ^* ×(0，1) ⁿ →(0，1) ⁿ |SEED∈(0，1) ⁿ }；

Hash function family T: = { t _KEY :(0，1) ⁿ ×(0，1) ⁿ →(0，1) ⁿ |KEY∈(0，1) ⁿ }；

And (3) treatment:

t ⁰ (IDX，SEED _dg ，m)＝p(SEED _dg ，IDX _smt，j ||{0} ³² )＝IV _prd，j

p(SEED _dg ，IDX _pkt，i ，m _i )＝MD _i ||KEY _i

i＝1，2，...，j；

and (3) outputting: bds=t ^j (IDX，SEED _dg ，m)；

S3.2 signature sub-algorithm

Input: a security parameter n;

pseudo-random function F ₁ ：{0，1} ⁿ ×{0，1} ²ⁿ →{0，1} ⁿ ；

Hash function H ₁ ：{0，1} ⁿ ×{0，1} ²ⁿ →{0，1} ⁿ ；

Hash function family

Private key sequence: SK (SK) _periodj ，j＝1，2，…，x+l；

All batch digest values in a complete transmission are recorded chronologically as BDS ₁ ，BDS ₂ ，…；

And (3) treatment: first, the batch digest value BDS is added to the database ₁ ，BDS ₂ … are sequentially re-divided according to signature periods, and the batch digest value to be processed in the jth period is expressed as BDS _i，j ，i∈1，2，…，s；

When i=1, 2, …, s-1,

calculation of

RDM _i，j ＝F ₁ (SK，BDS _i，j )，

DGT _i，j ＝H ₁ (RDM _i，j ，BDS _i，j )；

When i=s,

calculation of

RDM _s，j ＝F ₁ (SK，BDS _s，j ||pk _j+1 )

DGT _s，j ＝H ₁ (RDM _s，j ，BDS _s，j ||pk _j+1 )

Wherein RDM _i，j And DGT _i，j Is an intermediate parameter, and does not need to define the specific meaning represented by the intermediate parameter;

next, for each DGT _i，j The identity verification is carried out by i epsilon 1,2 and …, and the specific steps are as follows:

from a private key sequence SK _{period j} Select k SEAL _jp Wherein p=1, 2, …, k, i.ltoreq.j _p T is less than or equal to, and the following conditions are satisfied:

wherein the first signing key in each complete transmission is in turn selected from SK _{period j} J=1, 2, …, x, the subsequent keys being sequentially selected from SK _{period j} ，j＝x+1，x+2，…，x+l；

Finally, in order to reduce the signature size of a complete transmission, the appropriate q values are chosen such that, in the case of t, k and s being determined,

2 ^q +(logt-q+1)*s*k

taking a minimum value;

the final signature is:

when j+.1:

when i=1, the number of the cells,

when i=2, 3 …, s,

where i represents the signature sequence over a period,

represents->

Verification path of public key from the logt layer to the q layer, 1.ltoreq.j _p T, p=1, 2..k, i.e. in the public key generation algorithm PKGEN, +.>

When the hash tree is used for calculating the root node, all the side nodes from the lowt layer to the q layer pass through, wherein the side nodes refer to other node values except the hash value in the next layer when the upper-level node is calculated; / >

Values of all nodes of the q-th layer of the hash tree;

representing hash values corresponding to all nodes in a q-th layer of the hash tree;

when j=1, the number of the groups,

the signature when i=1 is:

wherein the authentication path _pktoroot Containing logx values, using pk for the public key generation algorithm PKGEN ₁ ，pk ₂ ，…，pk _2^q Corresponding hash tree HT _root The root node as the highest level hash tree HT _root Is used for constructing the root node PK of the highest-level hash tree _root At this time, the root node PK from the lowest layer to the top layer _root All the side nodes passed through, wherein the side nodes refer to another node value except the hash value in the next layer when calculating the upper level node;

when i=2, 3, …, s,

and (3) outputting: the signature value sigma is an authentication identifier;

s4: verification algorithm Ver

When the data stream with the authentication identifier is transmitted from the sender to the receiver, the receiver verifies according to the following method:

input: a data stream and related index parameters interacted by both communication parties in a complete transmission;

signature value, wherein the signature value of the j-th period is expressed as:

when j+.1:

when i=1, the number of the cells,

when i=2, 3, …, s,

when j=1, the number of the groups,

the signature when i=1 is:

when i=2, 3, …, s,

/>

public key: SEED _dg 、SEED _auth 、PK _root :

A data stream;

And (3) treatment:

dividing the data stream according to the transmission segments, wherein the data stream in each transmission period is m ₁ ，IDX _pkt，1 ，m ₂ ，IDX _pkt，2 ，…，m _s ，IDX _pkt，s ；

Invoking batch summary sub-algorithm BDA to compute related batchesQuantity digest value, batch digest value for the jth cycle is denoted BDS _i，j ，i∈1，2，…，s；

When i=1, 2, …, s-1,

calculation of

RDM _i，j ＝F ₁ (SK，BDS _i，j )，

DGT _i，j ＝H ₁ (RDM _i，j ，BDS _i，j )；

When i=s,

calculation of

RDM _s，j ＝F ₁ (SK，BDS _s，j ||pk _j+1 )

DGT _s，j ＝H ₁ (RDM _s，j ，BDS _s，j ||pk _j+1 ).

Verification

When j noteq1, i noteq1,

input SEED _auth Index tag HIDX _m，n ，(m＝0，1，…，logx-2，n＝0，1，…，2 ^m -1) k SEAL _jp (p=1, 2, …, k), calling hash values of k nodes corresponding to the q-th layer of the PKGEN algorithm, and comparing whether the hash values of the k nodes are equal to the corresponding pk in the first signature value in the transmission period ₁ ，pk ₂ ，…，pk _2^q The method comprises the steps of carrying out a first treatment on the surface of the If equal, the signature is true;

when j noteq1, i = 1,

that is, the signature is the first signature value in a cycle and not the first signature in a complete transmission, and in addition to the verification, pk is also entered ₁ ，pk ₂ ，…，pk _2^q Invoking PKGEN algorithm to calculate the root node of the hash tree, and comparing whether the root node is equal to the corresponding public key, wherein the public key is signed by the private key of the previous period; if equal, the signature is true;

when j=1, i=1,

that is, the signature is the first signature in a complete transmission, and in addition to the verification, PK is entered _root Circumference of the bodyA period index and an identity verification path; first, the period index is checked to ensure that the signature uses an unused key pair; then, input pk _j 、path _pktoroot Invoking PKGEN algorithm to calculate slave pk _j Via path _pktoroot Whether the root node of the computed hash tree is equal to PK _root The method comprises the steps of carrying out a first treatment on the surface of the If equal, the signature is true;

and (3) outputting: the signature is true/false;

when the output of the receiving party is true, the representative data and the authentication identification pass the verification, the sending party is judged to be the equipment to be interacted, and the data information is correct; if the verification is not passed, the interaction with the sender fails, so that the authenticity of the identity of the sender and the integrity of the sent data are protected;

in summary, in the anti-quantum signature authentication method based on hash signature and having a small size, key generation and signature occur at the sender, and the sender takes data to be sent to the receiver as input: firstly, generating a signature key and a verification key pair according to a key generation algorithm Gen, wherein the signature key is a private key and is used in a signature stage to generate an authentication identifier, the verification key is a public key, a trusted third party in a system signs and generates an X.509 certificate, and the X.509 certificate is sent to a receiver by a sender and is used in a ready authentication stage; the sender prepares the data sent to the receiver for digital signature by using a private key and a signature algorithm to generate an authentication identifier; when the data flow with authentication identification is transmitted to the receiver by the sender, the receiver uses an authentication algorithm Ver to carry out authentication, if the authentication is passed, the sender is judged to be the sender to be interacted, and the data information is correct; if the verification is not passed, the interaction with the sender fails, and the authenticity of the identity of the sender and the integrity of the sent data are protected.

The existing authentication methods are mainly divided into two main categories: the mainstream class is designed based on classical cryptography; the front-end is designed based on the post quantum cryptography.

Compared with the prior art, the invention has the following advantages:

(1) Quantum security. Most of the existing mainstream authentication technologies are based on the mathematical difficult assumption in classical cryptography, and the authentication technologies do not have quantum attack resistance. The method is based on hash-based signature design of five-big-back quantum passwords, has the characteristic of natural resistance to quantum attack, and is a quantum security authentication method;

(2) The underlying security assumption is simple. Compared with the authentication technology based on other four post quantum passwords, the technology only depends on the security assumption of the bottom hash function, the security assumption is simpler, and the theoretical basis is more mature;

(3) The algorithm security is higher. Compared with other authentication technologies based on hash-based signatures, the method can resist multi-equation and multi-target attack under lower security assumption (non-collision security) by using the adjustable hash function, and has higher security;

(4) About a hundred times the size of the reduced signature. The biggest disturbance in applications of hash-based authentication techniques is that their signature size is too large. The design method of combining the one-time signature or the few signatures with the hash tree causes the problems of large signature size, overhigh total cost of key generation, signature generation and verification and the like, so that the method is limited in practical application. Compared with other authentication technologies based on hash signatures, the signature size in the authentication data of the method is reduced by hundreds to thousands of times. Compared with the current most mainstream hash-based signature algorithm XMS (ISO issued RFC8391 standard), the signature compression rate of eBiBa-256 is 0.828 to 0.017 in a specific parameter interval compared with that of XMS-256, so that the signature size obtained by the technology can be reduced by hundred times under specific parameters.

Drawings

FIG. 1 is a flow diagram of a quantum resistant, hash signature based signature authentication method with small dimensions;

FIG. 2 is a process schematic diagram of a forward secure private key generation algorithm;

FIG. 3 is a schematic diagram of a process of a public key generation algorithm based on an adjustable hash function;

FIG. 4 is a schematic process diagram of three nodes in each triangle of FIG. 3;

FIG. 5 is a process diagram of a batch digest algorithm based on an adjustable hash function; l in the figure _j For the number of messages processed by the batch digest sub-algorithm this time, the subscript of message m is its sequence number in the input of the batch digest sub-algorithm;

FIG. 6 is a schematic diagram of shortest signature path optimization in a complete transmission;

FIG. 7 is a general structural schematic diagram of a quantum resistant, hash signature based signature authentication method with small dimensions; the subscript of message m is its sequence number throughout the transmission, l _i IDX for the number of messages processed for the ith fragment _smt The second subscript of (2) indicates the sequence number of the segment in which the corresponding message is located in one period, each segment being similar in structure and therefore no longer being in the symbol IDX _pkt The differences in the representation of the fragment in which they are located;

FIG. 8 is a schematic diagram of a process for processing messages during each cycle of FIG. 7;

Fig. 9 is a schematic diagram of structural connection of wireless sensor network communication.

Detailed Description

The present invention is directed to a signature authentication method based on hash signatures with small size, which is quantum resistant, and is further described below with reference to specific embodiments.

Example 1

A signature authentication method which is quantum resistant, hash-based and small in size is a signature method for carrying out identity authentication and data integrity authentication of a data source on a large-scale data stream under the application background of continuous transmission of two communication parties; as shown in fig. 1:

for clarity, some terms will now be defined as follows:

complete transmission: uninterrupted message transmission between signer and verifier, which is a time interval;

signer: i.e. sender, verifier: namely the receiving party;

signing key: the signature key is a private key and is used in a signature stage to generate an authentication identifier;

authentication key: the verification key is a public key;

x: the number of complete transmissions that a public key can verify;

signature period: a time interval for signing using a set of stamps;

s: the number of signable messages in a signature cycle;

fragments: compressing a plurality of messages into a time interval of a message digest through a batch digest sub-algorithm;

The signature authentication method comprises the following steps:

s1: time-sequentially dividing a complete transmission between a sender and a receiver into a plurality of fragments, and setting a 32-bit fragment tag IDX for each fragment _smt The value of the product is 0, and 1 is added in sequence; the data communication of the fragments starts with a start identifier SRT; then, based on the block size or transmission time, the data stream in the segment is divided into a plurality of data blocks, the data blocks are represented by m, and each data block m is assigned a tag IDX _msg And after attaching to each data block, its value starts from 0, adds 1 in turn, and each segment ENDs with an END identifier END; index parameter IDX for each data block _pkt ＝IDX _smt ||IDX _msg ；

S2: a key generation algorithm Gen, which comprises two steps S2.1 of private key generation sub-algorithm SKGEN and S2.2 of public key generation sub-algorithm PKGEN in sequence

The key generation algorithm Gen generates a signature key and a verification key for a sender by using a forward secure pseudo-random function, and provides a key for constructing a non-counterfeitable forward secure signature scheme;

the algorithm comprises a private key generation sub-algorithm SKGEN and a public key generation sub-algorithm PKGEN;

s2.1 private Key Generation sub-Algorithm SKGEN

As shown in fig. 2, the private key generation sub-algorithm starts from an initial state SEED _fws Initially, the seed key seed of the j-1 th period is used _j-1 To generate a seed key seed for the j-th period _j Then, use seed _j Involving t SEALs in generation cycle j _i,j Private key SK of (1.ltoreq.i.ltoreq.t) _{period j} J=1, 2, …, x+l, wherein the values of x and t are all the power of 2; the generation algorithm is as follows: input: pseudo-random function

Q：＝{q _k ：k×{0，1) ⁿ →(0，1) ⁿ |k∈(0，1) ⁿ )；

n is a security parameter, and the value of n depends on the security level set in the application of the algorithm;

SEED for generating private key _fws : randomly selected from (0, 1) ⁿ Is uniformly distributed;

and (3) treatment:

seed ₀ ＝SEED _fws

/>

j＝1，2，…，x+l.

and (3) outputting: SK (SK) _{period j} ，j＝1，2，…，x+l；

Wherein the first x private keys SK _{period j} J=1, 2, …, x, which is used as the first signing key, the latter l private keys, SK at the beginning of each complete transmission _{period j} J=x+1, x+2, …, x+l, used as a subsequent signing key, used in sequence in the complete transmission; the assignment of x is random, as when x=10, l=10, the first 10 private keys SK _{period j} J=1, 2, …,8,9, 10 is used as the first signature key at the beginning of each complete transmission, the last 10 private keys SK _{period j} J=11, 12, …,18, 19, 20 is used as a subsequent signing key, used in sequence in the complete transmission;

s2.2 public Key Generation sub-Algorithm PKGEN

Step S2.1 after generating the private key, the public key generation sub-algorithm PKGEN is based on the adjustable hash function to SK _{period j} J=1, 2, …, x+l, as input, using the hash tree to generate the corresponding public key; as shown in fig. 3 and 4, specifically: first, use sk _{period j} J=x+1, x+2, …, x+l is generated as input to the pseudo-random function FPK _{period j} ，j＝1，2，…，x+l；

Then, SEED is generated with public key _auth And tag HIDX _m,n As input of pseudo random function R, generating KEY and MSK needed by each iteration;

next, with each PK _{period j} Is used as a leaf node of a hash tree, generates a root node of the hash tree by utilizing an adjustable hash function th, and sequentially generates PKs _j ，j＝1，2，…，x+l；

Finally, use PK _j J=1, 2, …, x is the hash tree HT _root According to KEY and MSK required for generating each iteration and PK generation _j Step j=1, 2, …, x+l, constructing hash tree HT _root Root node PK of (1) _root Root node PK _root Namely a public key;

the specific treatment process comprises the following steps:

input: a security parameter n;

pseudo-random function

Pseudo-random function

R：＝{r _SEED :IDX→KEY||MSK|SEED∈(0,1) ⁿ }；

Adjustable hash function

th：＝((0，1) ⁿ ×(0，1) ⁴ⁿ →(0，1) ⁿ }；

SEED generated by public key _auth : randomly selected from (0, 1) ⁿ Is uniformly distributed;

label HIDX _m,n Sequence: consists of the sequence number of the complete transmission, the position of the corresponding level of nodes in the authentication tree, where m=0, 1..logt-1, n=0, 1..2 ^m -1; respectively representing the layer number of corresponding nodes from top to bottom in the authentication tree and the position number from left to right in each layer, wherein the m and n counts are respectively from 0, and are sequentially added with 1; the nodes at each level comprise a root node and a leaf node, and N is used as follows _m,n To represent;

and (3) treatment:

(1) the following procedure calculates PK _j ，j＝1，2，…，x+l；

a.

For each j e 1,2,..,

b. the KEY and mask required for each iteration step are generated using a pseudo-random function R, denoted below by the KEY and MSK with subscripts, respectively:

r(SEED _auth ，HIDX _m，n )＝KEY _m， n||MSK _m，n ，

m＝0，1，...logt-2，n＝0，1，...，2 ^m -1；

c. calculating the root node N of the hash tree _0，0 : the value of m is logt-1, logt-2, 0,

for each m described above, calculate:

wherein n takes the values 0,2,4 in that order ^m -2；

PK _j ＝N _0，0 ；

(2) The following procedure calculates PK _root ：

a.N _logx，0 ，N _logx，1 ，...N _logx，x-1 ＝PK ₁ ，PK ₂ ，...，PK _x

b. Generating KEY and MSK required by each iteration by using a pseudo-random function R:

r(SEED _auth ，HIDX _m，n )＝KEY _m，n ||MSK _m，n ，

m＝0，1，2，...logx-2，n＝0，1，2，...，2 ^m -1；

c. calculating the root node N of the hash tree _0，0 : the values of m are log x-1, log x-2, 0,

for each m described above, calculate:

wherein n takes the values 0,2,4 in that order ^m -2；

PK _root ＝N _0，0 ；

S3: the signature algorithm Sig comprises two steps S3.1 of batch digest sub-algorithm BDA and S3.2 of signature sub-algorithm:

s3.1 batch summary sub-algorithm BDA

The batch summary sub-algorithm comprises the following specific steps:

the batch digest sub-algorithm inputs the data processed in the S1 stage in the unit of a segment, and indexes parameters m of all data blocks in each segment ₁ ，IDX _pkt，1 ，m ₂ ，IDX _pkt，2 ，…，m _j ，IDX _pkt，j Generating batch digest values BDS of all data blocks in each segment by using a pseudo-random function P and a hash function family T; all batch digest values in a complete transmission are chronologically recorded as BDS ₁ ，BDS ₂ …; as shown in fig. 5, the batch summarization process for data in one segment is as follows:

input: a security parameter n;

all data blocks m in one transmission segment ₁ ，...，m _j ；

Pseudo-random function P: = { p _SEED ：(0，1) ⁶⁴ ×(0，1) ^* ×(0，1) ⁿ →(0，1) ⁿ |SEED∈(0，1) ⁿ }；

Hash function family T: = { t _KEY :(0，1) ⁿ ×(0，1) ⁿ →(0，1) ⁿ |KEY∈(0，1) ⁿ }；

And (3) treatment:

t ⁰ (IDX，SEED _dg ，m)＝p(SEED _dg ，IDX _smt，j ||{0} ³² )＝IV _prd，j

p(SEED _dg ，IDX _pkt，i ，m _i )＝MD _i ||KEY _i

i＝1，2，...，j；

and (3) outputting: bds=t ^j (IDX，SEED _dg ，m)；

S3.2 signature sub-algorithm

The signature sub-algorithm comprises the following steps:

input: a security parameter n;

pseudo-random function F ₁ ：{0，1} ⁿ ×{0，1} ²ⁿ →{0，1} ⁿ ；

Hash function H ₁ ：{0，1} ⁿ ×{0，1} ²ⁿ →{0，1} ⁿ ；

Hash function family

Private key sequence: SK (SK) _periodj ，j＝1，2，…，x+l；

All batch digest values in a complete transmission are recorded chronologically as BDS ₁ ，BDS ₂ ，…；

And (3) treatment: first, the batch digest value BDS is added to the database ₁ ，BDS ₂ … are sequentially re-divided according to signature periods, and the batch digest value to be processed in the jth period is expressed as BDS _i，j ，i∈1，2，…，s；

When i=1, 2, …, s-1,

calculation of

RDM _i，j ＝F ₁ (SK，BDS _i，j )，

DGT _i，j ＝H ₁ (RDM _i，j ，BDS _i，j )；

When i=s,

calculation of

RDM _s，j ＝F ₁ (SK，BDS _s，j ||pk _j+1 )

DGT _s，j ＝H ₁ (RDM _s，j ，BDS _s，j ||pk _j+1 )

Next, for each DGT _i，j The identity verification is carried out by i epsilon 1,2 and …, and the specific steps are as follows:

from a private key sequence SK _{period j} Select k SEAL _jp Wherein p=1, 2, …, k, i.ltoreq.j _p T is less than or equal to, and the following conditions are satisfied:

wherein the first signing key in each complete transmission is in turn selected from SK _{period j} J=1, 2, …, x, the subsequent keys being sequentially selected from SK _{period j} ，j＝x+1，x+2，…，x+l；

Finally, in order to reduce the signature size of a complete transmission, the appropriate q values are chosen such that, in the case of t, k and s being determined,

2 ^q Ten (logt-q+1) S k

Take the minimum value as shown in fig. 6;

the final signature is:

when j+.1:

when i=1, the number of the cells,

/>

when i=2, 3 …, s,

where i represents the signature sequence over a period,

representative of/>

Verification path of public key from the logt layer to the q layer, 1.ltoreq.j _p T, p=1, 2..k, i.e. in the public key generation algorithm PKGEN, +.>

When the hash tree is used for calculating the root node, all the side nodes from the lowt layer to the q layer pass through, wherein the side nodes refer to other node values except the hash value in the next layer when the upper-level node is calculated; />

Values of all nodes of the q-th layer of the hash tree; />

Representing hash values corresponding to all nodes in a q-th layer of the hash tree;

when j=1, the number of the groups,

the signature when i=1 is:

wherein the authentication path _pktoroot Containing logx values, using pk for the public key generation algorithm PKGEN ₁ ，pk ₂ ，…，pk _2^q Corresponding hash tree HT _root The root node as the highest level hash tree HT _root Is used for constructing the root node PK of the highest-level hash tree _root At this time, the root node PK from the lowest layer to the top layer _root All the side nodes passed through, wherein the side nodes refer to another node value except the hash value in the next layer when calculating the upper level node;

When i=2, 3, …, s,

and (3) outputting: the signature value sigma is an authentication identifier;

s4: verification algorithm Ver

When the data stream with the authentication identifier is transmitted from the sender to the receiver, the receiver verifies according to the following method:

input: a data stream and related index parameters interacted by both communication parties in a complete transmission;

signature value, wherein the signature value of the j-th period is expressed as:

when j+.1:

when i=1, the number of the cells,

when i=2, 3, …, s,

when j=1, the number of the groups,

the signature when i=1 is:

when i=2, 3, …, s,

public key: SEED _dg 、SEED _auth 、PK _root ；

A data stream;

and (3) treatment:

dividing the data stream according to the transmission segments, wherein the data stream in each transmission period is m ₁ ，IDX _pkt，1 ，m ₂ ，IDX _pkt，2 ，…，m _s ，IDX _pkt，s ；

Invoking batch summary sub-computationsThe method BDA calculates the related batch digest value, and the batch digest value of the jth cycle is expressed as BDS _i，j ，i∈1，2，…，s；

When i=1, 2, …, s-1,

calculation of

RDM _i，j ＝F ₁ (SK，BDS _i，j )，

DGT _i，j ＝H ₁ (RDM _i，j ，BDS _i，j )；

When i=s,

calculation of

RDM _s，j ＝F ₁ (SK,BDS _s，j ||pk _j+1 )

DGT _s，j ＝H ₁ (RDM _sj ，BDS _s，j ||pk _j+1 ).

Verification

When j noteq1, i noteq1,

input SEED _auth Index tag HIDX _m,n ,(m＝0，1，…，logx-2，n＝0，1，…，2 ^m -1) k SEAL _jp (p=1, 2, …, k), calling hash values of k nodes corresponding to the q-th layer of the PKGEN algorithm, and comparing whether the hash values of the k nodes are equal to the corresponding pk in the first signature value in the transmission period ₁ ，pk ₂ ，…，pk _2^q The method comprises the steps of carrying out a first treatment on the surface of the If equal, the signature is true;

When j noteq1, i = 1,

that is, the signature is the first signature value in a cycle and not the first signature in a complete transmission, and in addition to the verification, pk is also entered ₁ ，pk ₂ ，…，pk _2^q Invoking PKGEN algorithm to calculate the root node of the hash tree, and comparing whether the root node is equal to the corresponding public key, wherein the public key is signed by the private key of the previous period; if equal, the signature is true;

when j=1, i=1,

that is, the signature is the first signature in a complete transmission, and in addition to the verification, PK is entered _root A period index, an identity verification path; first, the period index is checked to ensure that the signature uses an unused key pair; then, input pk _j 、path _pktoroot Invoking PKGEN algorithm to calculate slave pk _j Via path _pktoroot Whether the root node of the computed hash tree is equal to PK _root The method comprises the steps of carrying out a first treatment on the surface of the If equal, the signature is true;

and (3) outputting: the signature is true/false;

when the output of the receiving party is true, the representative data and the authentication identification pass the verification, the sending party is judged to be the equipment to be interacted, and the data information is correct; if the verification is not passed, the interaction with the sender fails, so that the authenticity of the identity of the sender and the integrity of the sent data are protected;

FIG. 7 is a schematic diagram of the overall structure of a quantum-resistant, hash-signature-based signature authentication method with small dimensions; the text and the above in the first row corresponds to steps S2 and S4 from top to bottom, and the text and the below in the second row corresponds to steps S1 and S3 as shown in fig. 7 and 8.

In summary, in the anti-quantum signature authentication method based on hash signature and having a small size, key generation and signature occur at the sender, and the sender takes data to be sent to the receiver as input: firstly, generating a signature key and a verification key pair according to a key generation algorithm Gen, wherein the signature key is a private key and is used in a signature stage to generate an authentication identifier, the verification key is a public key, a trusted third party in a system signs and generates an X.509 certificate, and the X.509 certificate is sent to a receiver by a sender and is used in a ready authentication stage; the sender prepares the data sent to the receiver for digital signature by using a private key and a signature algorithm to generate an authentication identifier; when the data flow with authentication identification is transmitted to the receiver by the sender, the receiver uses an authentication algorithm Ver to carry out authentication, if the authentication is passed, the sender is judged to be the sender to be interacted, and the data information is correct; if the verification is not passed, the interaction with the sender fails, and the authenticity of the identity of the sender and the integrity of the sent data are protected.

The anti-quantum signature-based signature authentication method with small size is a method for carrying out digital signature on a large-scale public data stream continuously transmitted from a sender to a receiver under the application background that the large-scale public data stream continuously propagates between two communication parties. And designing a specific signature method to generate an authentication identifier for the data stream by utilizing a hash-based signature technology, and checking the data stream and the authentication identifier by a receiver. If the verification is passed, judging that the sender equipment is the equipment to be interacted, and the data information is correct; if the verification is not passed, the interaction with the sender equipment fails, and the authenticity of the sender identity and the integrity of the sent data are protected.

The signature authentication method which is quantum resistant, hash-based and small in size can be used for Wireless Sensor Network (WSN) communication authentication and Internet of vehicles communication security authentication.

The Wireless Sensor Network (WSN) is one of the core technologies of the Internet of things, has wide application prospect due to the advantages of low construction and transmission cost, strong platform adaptability, easy expansion, portability and the like, and is widely applied to a plurality of fields such as mobile electronic transaction, national defense military, smart city and the like, and the connection relation of the Wireless Sensor Network (WSN) is shown in fig. 9, but the wireless sensor network is easy to suffer from various active and passive attacks such as impersonation of message source identity, falsification of data, unauthorized access of messages, message replay and the like due to the openness of wireless communication and the functional limitation of sensor nodes. Specific scenes of information interaction between the base station and the nodes through the wireless network are aimed at. The base station is used as a main information sending and processing port for collecting and processing large-scale information and sending the information to the node. The nodes are distributed on terminals of the wireless sensor network and serve as main information receiving ports for receiving data from the base station. The base station transmits a large-scale continuous data stream to the sensor, which can verify the authenticity of the identity of the base station, as well as the integrity of the data stream transmitted by the base station.

In the communication between the base station and the terminal node, the base station continuously transmits large-scale data to the terminal node. The base station is used as a sender, the method of the invention is used for providing the terminal node with the indication of the authenticity of the identity of the base station and the integrity of the sent data, and the terminal node completes the corresponding verification. The data processing pressure is mainly concentrated on the base station, and the terminal node can complete the verification process only by having the hash function computing capability, so that the method is applicable to terminal equipment with multiple limited functions, and has higher flexibility and practicability.

In the same way, in the internet of vehicles communication security authentication, terminal devices such as a vehicle-mounted sensor and the like need to receive a large-scale continuous transmission control signal from a central server, and in order to prevent the signal from being tampered, identity authentication and integrity authentication on the central server are needed. The central server is used as a sender to show the terminal node with the method of the invention, and the terminal node verifies that the identity of the central server and the transmission data are not tampered. The protection of the identity authenticity and the transmission data integrity of the central server by the vehicle-mounted sensor terminal equipment is realized.

Compared with the current most mainstream hash-based signature algorithm XMS (ISO issued RFC8391 standard), in a specific parameter interval, the signature compression ratio of eBiBa-256 is 0.828 to 0.017 compared with that of XMS-256, and therefore the signature size obtained by the technology can be reduced by hundred times under specific parameters.

The anti-quantum signature authentication method based on the hash signature and having a small size can be also used for other network communication security authentication, and the same or similar effects can be obtained.

Claims (1)

1. A signature authentication method which is quantum resistant, hash-based and has a small size is characterized in that: the method is a signature method for carrying out identity authentication and data integrity authentication of a data source on a large-scale data stream under the application background of continuous transmission of both communication parties;

for clarity, some terms will now be defined as follows:

complete transmission: uninterrupted message transmission between signer and verifier, which is a time interval;

signer: i.e. sender, verifier: namely the receiving party;

signing key: the signature key is a private key and is used in a signature stage to generate an authentication identifier;

authentication key: the verification key is a public key;

x: the number of complete transmissions that a public key can verify;

signature period: a time interval for signing using a set of stamps;

s: the number of signable messages in a signature cycle;

fragments: compressing a plurality of messages into a time interval of a message digest through a batch digest sub-algorithm;

The signature authentication method comprises the following steps:

s1: time-sequentially dividing a complete transmission between a sender and a receiver into a plurality of fragments, and setting a 32-bit fragment tag IDX for each fragment _smt The value of the product is 0, and 1 is added in sequence; the data communication of the fragments starts with a start identifier SRT; then, based on the block size or transmission time, the data stream in the segment is divided into a plurality of data blocks, the data blocks are represented by m, and each data block m is assigned a tag IDX _msg And after attaching to each data block, its value starts from 0, adds 1 in turn, and each segment ENDs with an END identifier END; index parameter IDX for each data block _pkt ＝IDX _smt ||IDX _msg ；

S2: a key generation algorithm Gen, which comprises two steps S2.1 of private key generation sub-algorithm SKGEN and S2.2 of public key generation sub-algorithm PKGEN in sequence

The key generation algorithm Gen generates a signature key and a verification key for a sender by using a forward secure pseudo-random function, and provides a key for constructing a non-counterfeitable forward secure signature scheme;

the algorithm comprises a private key generation sub-algorithm SKGEN and a public key generation sub-algorithm PKGEN;

s2.1 private Key Generation sub-Algorithm SKGEN

Private key generation sub-algorithm from initial state SEED _fws Initially, the seed key seed of the j-1 th period is used _j-1 To generate a seed key seed for the j-th period _j Then, use seed _j Involving t SEALs in generation cycle j _i,j Private key SK of (1.ltoreq.i.ltoreq.t) _periodj J=1, 2, …, x+l, wherein the values of x and t are all the power of 2; the generation algorithm is as follows:

input: pseudo-random function

Q：＝{q _k ：k×(0，1) ⁿ →{0，1) ⁿ |k∈(0，1) ⁿ }；

n is a security parameter, and the value of n depends on the security level set in the application of the algorithm;

SEED for generating private key _fws : randomly selected from (0, 1) ⁿ Is uniformly distributed;

and (3) treatment:

seed ₀ ＝SEED _fws

j＝1，2，...，x+l.

and (3) outputting: SK (SK) _periodj ，j＝1，2，…，x+l；

Wherein the first x private keys SK _periodj J=1, 2, …, x, which is used as the first signing key, the latter l private keys, SK at the beginning of each complete transmission _periodj J=x+1, x+2, …, x+l, used as a subsequent signing key, used in sequence in the complete transmission; the assignment of x is random, as when x=10, l=10, the first 10 private keys SK _periodj J=1, 2, …,8,9, 10 is used as the first signature key at the beginning of each complete transmission, the last 10 private keys SK _periodj J=11, 12, …,18, 19, 20 is used as a subsequent signing key, used in sequence in the complete transmission;

s2.2 public Key Generation sub-Algorithm PKGEN

Step S2.1 after generating the private key, the public key generation sub-algorithm PKGEN is based on the adjustable hash function to SK _periodj J=1, 2, …, x+l, as input, using the hash tree to generate the corresponding public key; specifically:

first, use sk _periodj J=x+1, x+2, …, x+l as input to the pseudo-random function F to generate PK _periodj ，j＝1，2，…，x+l；

Then, SEED is generated with public key _auth And tag HIDX _m，n As input of pseudo random function R, generating KEY and MSK needed by each iteration;

next, with each PK _periodj Is used as a leaf node of a hash tree, generates a root node of the hash tree by utilizing an adjustable hash function th, and sequentially generates PKs _j ，j＝1，2，…，x+l；

Finally, use PK _j J=1, 2, …, x is the hash tree HT _root According to KEY and MSK required for generating each iteration and PK generation _j Step j=1, 2, …, x+l, constructing hash tree HT _root Root node PK of (1) _root Root node PK _root Namely a public key;

the specific treatment process comprises the following steps:

input: a security parameter n;

pseudo-random function

Pseudo-random function

R：＝{r _SEED ：IDX→KEY||MSK|SEED∈(0，1) ⁿ }；

Adjustable hash function

th：＝{(0，1) ⁿ ×(0，1) ⁴ⁿ →(0，1) ⁿ }；

SEED generated by public key _auth : randomly selected from (0, 1) ⁿ Is uniformly distributed;

label (Label)HIDX _m，n Sequence: consists of the sequence number of the complete transmission, the position of the corresponding level of nodes in the authentication tree, where m=0, 1..logt-1, n=0, 1..2 ^m -1; respectively representing the layer number of corresponding nodes from top to bottom in the authentication tree and the position number from left to right in each layer, wherein the m and n counts are respectively from 0, and are sequentially added with 1; the nodes at each level comprise a root node and a leaf node, and N is used as follows _m，n To represent;

and (3) treatment:

(1) the following procedure calculates PK _j ，j＝1，2，…，x+l；

a.

For each j e 1,2,..,

/>

b. the KEY and mask required for each iteration step are generated using a pseudo-random function R, denoted below by the KEY and MSK with subscripts, respectively:

r(SEED _auth ，HIDX _m，n )＝KEY _m，n ||MSK _m，n ，

m＝0，1，...logt-2，n＝0，1，...，2 ^m -1；

c. calculating the root node N of the hash tree _0，0 : the value of m is logt-1, logt-2, 0,

for each m described above, calculate:

wherein, the value of n is 0,2,4 in turn,...，2 ^m -2；

PK _j ＝N _0，0 ；

(2) the following procedure calculates PK _root ：

a.N _logx，0 ，N _logx，1 ，...N _logx，x-1 ＝PK ₁ ，PK ₂ ，...，PK _x

b. Generating KEY and MSK required by each iteration by using a pseudo-random function R:

r(SEED _auth ，HIDX _m，n )＝KEY _m，n ||MSK _m，n ，

m＝0，1，2，...logx-2，n＝0，1，2，...，2 ^m -1；

c. calculating the root node N of the hash tree _0，0 : the values of m are log x-1, log x-2, 0,

for each m described above, calculate:

wherein n takes the values 0,2,4 in that order ^m -2；

PK _root ＝N _0，0 ；

S3: the signature algorithm Sig comprises two steps S3.1 of batch digest sub-algorithm BDA and S3.2 of signature sub-algorithm:

s3.1 batch summary sub-algorithm BDA

The batch summary sub-algorithm comprises the following specific steps:

the batch digest sub-algorithm inputs the data processed in the S1 stage in the unit of a segment, and indexes parameters m of all data blocks in each segment ₁ ，IDX _pkt，1 ，m ₂ ，IDX _pkt，2 ，…，m _j ，IDX _pkt，j Generating batch digest values BDS of all data blocks in each segment by using a pseudo-random function P and a hash function family T; all batch digest values in a complete transmission are chronologically recorded as BDS ₁ ，BDS ₂ …; data in a segmentThe batch summarization process is as follows:

input: a security parameter n;

all data blocks m in one transmission segment ₁ ，...，m _j ；

Pseudo-random function P: = { p _SEED ：(0，1) ⁶⁴ ×(0，1) ^* ×(0，1) ⁿ →(0，1) ⁿ |SEED∈(0，1) ⁿ }；

Hash function family T: = { t _KEY ：(0，1) ⁿ ×(0，1) ⁿ →(0，1) ⁿ |KEY∈(0，1) ⁿ }；

And (3) treatment:

t ⁰ (IDX，SEED _dg ，m)＝p(SEED _dg ，IDX _smt，j ||{0} ³² )＝IV _prd，j

p(SEED _dg ，IDX _pkt，i ，m _i )＝MD _i ||KEY _i

i＝1，2，...，j；

and (3) outputting: bds=t ^j (IDX，SEED _dg，m )；

S3.2 signature sub-algorithm

Input: a security parameter n;

pseudo-random function F ₁ ：{0，1} ⁿ ×{0，1} ²ⁿ →{0，1} ⁿ ；

Hash function H ₁ ：{0，1} ⁿ ×{0，1} ²ⁿ →{0，1} ⁿ ；

Hash function family

Private key sequence: SK (SK) _periodj ，j＝1，2，…，x+l；

All batch digest values in a complete transmission are recorded chronologically as BDS ₁ ，BDS ₂ ，…；

And (3) treatment: first, the batch digest value BDS is added to the database ₁ ，BDS ₂ … are sequentially re-divided according to signature periods, and the batch digest value to be processed in the jth period is expressed as BDS _i，j ，i∈1，2，…，s；

When i=1, 2, …, s-1,

calculation of

RDM _i，j ＝F ₁ (SK，BDS _i，j )，

DGT _i，j ＝H ₁ (RDM _i，j ，BDS _i，j )；

When i=s,

calculation of

RDM _s，j ＝F ₁ (SK，BDS _s，j ||pk _j+1 )

DGT _s，j ＝H ₁ (RDM _s，j ，BDS _s，j ||pk _j+1 )

Next, for each DGT _i，j The identity verification is carried out by i epsilon 1,2 and …, and the specific steps are as follows:

from a private key sequence SK _periodj Select k SEAL _jp Wherein p=1, 2, …, k, i.ltoreq.j _p T is less than or equal to, and the following conditions are satisfied:

wherein the first signing key in each complete transmission is in turn selected from SK _periodj J=1, 2, …, x, the subsequent keys being sequentially selected from SK _periodj ，j＝x+1，x+2，…，x+l；

Finally, in order to reduce the signature size of a complete transmission, the appropriate q-value is chosen such that t, k and s are defined, 2 ^q +(logt-q+1)*s*k

Taking a minimum value;

the final signature is:

When j+.1:

when i=1, the number of the cells,

when i=2, 3 …, s,

where i represents the signature sequence over a period,

represents->

Verification path of public key from the logt layer to the q layer, 1.ltoreq.j _p T, p=1, 2..k, i.e. in the public key generation algorithm PKGEN, +.>

When the hash tree is used for calculating the root node, all the side nodes from the lowt layer to the q layer pass through, wherein the side nodes refer to other node values except the hash value in the next layer when the upper-level node is calculated; />

Values of all nodes of the q-th layer of the hash tree; />

Representing hash values corresponding to all nodes in a q-th layer of the hash tree;

when j=1, the number of the groups,

the signature when i=1 is:

wherein the method comprises the steps ofAuthentication path _pktoroot Containing logx values, using pk for the public key generation algorithm PKGEN ₁ ，pk ₂ ，…，pk _2^q Corresponding hash tree HT _root The root node as the highest level hash tree HT _root Is used for constructing the root node PK of the highest-level hash tree _root At this time, the root node PK from the lowest layer to the top layer _root All the side nodes passed through, wherein the side nodes refer to another node value except the hash value in the next layer when calculating the upper level node;

when i=2, 3, …, s,

and (3) outputting: the signature value sigma is an authentication identifier;

S4: verification algorithm Ver

When the data stream with the authentication identifier is transmitted from the sender to the receiver, the receiver verifies according to the following method:

input: a data stream and related index parameters interacted by both communication parties in a complete transmission;

signature value, wherein the signature value of the j-th period is expressed as:

when j+.1:

when i=1, the number of the cells,

when i=2, 3, …, s,

when j=1, the number of the groups,

the signature when i=1 is:

when i=2, 3, …, s,

public key: SEED _dg 、SEED _auth 、PK _root ；

A data stream;

and (3) treatment:

dividing the data stream according to the transmission segments, wherein the data stream in each transmission period is m ₁ ，IDX _pkt，1 ，m ₂ ，IDX _pkt，2 ，…，m _s ，IDX _pkt，s ；

Invoking the batch digest sub-algorithm BDA to calculate an associated batch digest value, the batch digest value for the jth cycle being denoted BDS _i，j ，i∈1，2，…，s；

When i=1, 2, …, s-1,

calculation of

RDM _i，j ＝F ₁ (SK，BDS _i，j )，

DGT _i，j ＝H ₁ (RDM _i，j ，BDS _i，j )；

When i=s,

calculation of

RDM _s，j ＝F ₁ (SK，BDS _s，j ||pk _j+1 )

DGT _s，j ＝H ₁ (RDM _s，j ，BDS _s，j ||pk _j+1 ).

Verification

When j noteq1, i noteq1,

input SEED _auth Index tag HIDX _m，n ，(m＝0，1，…，logx-2，n＝0，1，…，2 ^m -1) k SEAL _jp (p=1, 2, …, k), calling hash values of k nodes corresponding to the q-th layer of the PKGEN algorithm, and comparing whether the hash values of the k nodes are equal to the corresponding pk in the first signature value in the transmission period ₁ ，pk ₂ ，…，pk _2^q The method comprises the steps of carrying out a first treatment on the surface of the If equal, the signature is true;

when j noteq1, i = 1,

that is, the signature is the first signature value in a cycle and not the first signature in a complete transmission, and in addition to the verification, pk is also entered ₁ ，pk ₂ ，…，pk _2^q Invoking PKGEN algorithm to calculate the root node of the hash tree, and comparing whether the root node is equal to the corresponding public key, wherein the public key is signed by the private key of the previous period; if equal, the signature is true;

when j=1, i=1,

that is, the signature is the first signature in a complete transmission, and in addition to the verification, PK is entered _root A period index, an identity verification path; first, the period index is checked to ensure that the signature uses an unused key pair; then, input pk _j 、path _pktoroot Invoking PKGEN algorithm to calculate slave pk _j Via path _pktoroot Whether the root node of the computed hash tree is equal to PK _root The method comprises the steps of carrying out a first treatment on the surface of the If equal, the signature is true;

and (3) outputting: the signature is true/false;

when the output of the receiving party is true, the representative data and the authentication identification pass the verification, the sending party is judged to be the equipment to be interacted, and the data information is correct; if the verification is not passed, the interaction with the sender fails, so that the authenticity of the identity of the sender and the integrity of the sent data are protected;

in summary, in the anti-quantum signature authentication method based on hash signature and having a small size, key generation and signature occur at the sender, and the sender takes data to be sent to the receiver as input: firstly, generating a signature key and a verification key pair according to a key generation algorithm Gen, wherein the signature key is a private key and is used in a signature stage to generate an authentication identifier, the verification key is a public key, a trusted third party in a system signs and generates an X.509 certificate, and the X.509 certificate is sent to a receiver by a sender and is used in a ready authentication stage; the sender prepares the data sent to the receiver for digital signature by using a private key and a signature algorithm to generate an authentication identifier; when the data flow with authentication identification is transmitted to the receiver by the sender, the receiver uses an authentication algorithm Ver to carry out authentication, if the authentication is passed, the sender is judged to be the sender to be interacted, and the data information is correct; if the verification is not passed, the interaction with the sender fails, and the authenticity of the identity of the sender and the integrity of the sent data are protected.

Images