WO2023159849A1 - Digital signature methods, computer device and medium - Google Patents

Abstract

The embodiments of the present application belong to the technical field of information security, and provide digital signature methods, a computer device and a medium. The method comprises: determining a first subgroup and a second subgroup from an established braid group, an index of the braid group being an integer greater than or equal to 6, and multiplication of elements of the first subgroup and the second subgroup being not commutative; selecting from the first subgroup a first element as a private key, and performing conjugate operation on the private key and the braid group to obtain a first conjugate value; generating a public key on the basis of the braid group and the first conjugate value; when a second conjugate value sent by a verifier is received, calculating a digital signature of information to be signed according to the second conjugate value and the private key, the second conjugate value being calculated by the verifier according to the public key; and sending the digital signature to the verifier. Digital signatures using the above method are resistant to quantum computing attacks and are more secure.

Description

A digital signature method, computer equipment and medium

This application declares to enjoy the priority of the Chinese patent application with the application number 202210182974.0 and the title of the invention "a digital signature method, computer equipment and medium" submitted at the China Patent Office on February 25, 2022. The Chinese patent application The entire content is incorporated by reference in this application.

technical field

This application belongs to the technical field of information security, and in particular relates to a digital signature method, computer equipment and media.

Background technique

Digital signatures can be used to ensure the integrity of information transmission, verify the identity of the sender, and prevent denial of transactions, and are widely used in the field of information security.

The existing digital signature method is based on the classic public key cryptographic algorithm to ensure security. The security of classical public-key cryptographic algorithms relies on the difficulty of factorization and discrete logarithm calculations. However, the quantum computing system will perform the factorization of large integers and the calculation of discrete logarithms in polynomial time, and Google and IBM have respectively declared that their quantum computing systems have been realized or are being realized. This means that public key cryptographic protocols based on RSA, ECC, and E1Gamal will no longer be safe. Therefore, digital signature algorithms that can resist quantum computing are needed.

technical problem

In view of this, the embodiment of the present application provides a digital signature method, computer equipment and media to solve the problem that digital signatures based on existing public key cryptography cannot resist quantum computing attacks.

technical solution

In order to solve the above-mentioned technical problems, the technical solution adopted in the embodiment of the present application is:

The first aspect of the embodiment of the present application provides a digital signature method, which is applied to the signing party, and the method includes:

Determine the first subgroup and the second subgroup from the established braid group, the index of the braid group is an integer greater than or equal to 6, and the multiplication of the elements of the first subgroup and the second subgroup is not possible exchange;

selecting any element from the first subgroup as a private key, and performing a conjugate operation on the private key and the braid group to obtain a first conjugate value;

generating a public key based on the braid group and the first conjugate value;

When receiving the second conjugate value sent by the verifier, calculate the digital signature of the information to be signed according to the second conjugate value and the private key, and the second conjugate value is determined by the verifier according to the The above public key is calculated;

The digital signature is sent to the verifier.

In one embodiment, the following formula is used to perform a conjugate operation on the private key and the braid group to obtain a first conjugate value:

a ₁ = xσ ₁ x ^-1 , a ₂ = xσ ₂ x ^-1 , ..., a _n-1 = xσ _n-1 x ^-1 ;

Among them, σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; x is the private key; a ₁ , a ₂ , ..., a _n-1 are the first common yoke value, n is the exponent.

In one embodiment, the public key includes a hash function, and according to the second conjugate value and the private key, the following formula is used to calculate the digital signature of the information to be signed:

K=x(b ₁ , b ₂ , . . . , b _n-1 );

e=x ^- 1K;

S=H(m||e);

Wherein, b ₁ , b ₂ ,..., b _n-1 is the second conjugate value; S is the digital signature, H is the hash function, m is the information to be signed, and n is the The exponent, || means to concatenate the characters m and e together.

The second aspect of the embodiment of the present application provides a digital signature method, which is applied to the verifier, and the method includes:

calculating a second conjugate value based on the signer's public key, the public key comprising the first conjugate value;

sending the second conjugate value to the signer, where the second conjugate value is used by the signer to calculate a digital signature of the information to be signed;

When the digital signature from the signer is received, the digital signature is verified according to the second conjugate value and the first conjugate value.

In one embodiment, the calculating the second conjugate value according to the public key of the signing party includes:

Obtain the public key of the signing party, the public key also includes a braid group and a subgroup, and the index of the braid group is an integer greater than or equal to 6;

selecting any element from said subgroup;

performing a conjugate operation on the element and the braid group to obtain the second conjugate value.

In one embodiment, the following formula is used to perform a conjugate operation on the element and the braid group to obtain a second conjugate value:

b ₁ =yσ ₁ y ^-1 , b ₂ =yσ ₂ y ^-1 , ..., b _n-1 = yσ _n-1 y ^-1 ;

Wherein, b ₁ , b ₂ , ..., b _n-1 are the second conjugate values; σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; y is the element, n being the index.

In one embodiment, the verifying the digital signature according to the second conjugate value and the first conjugate value includes:

calculating a verification value corresponding to the digital signature according to the second conjugate value and the first conjugate value;

If the verification value is equal to the digital signature, the verification of the digital signature is passed.

In one embodiment, the public key further includes a hash function, and according to the second conjugate value and the first conjugate value, the following formula is used to calculate the verification value corresponding to the digital signature:

K'=y(a ₁ , a ₂ ,..., a _n-1 );

e'=(y ^-1 K') ^-1 ;

S'=H(m||e');

Wherein, y is the element, S' is the verification value, H is the hash function, m is the information to be signed, n is the index, and || indicates that the characters m and e' are connected together.

The third aspect of the embodiment of the present application provides a digital signature device, which is applied to the signing party, and the device includes:

Subgroup determination module, used to determine the first subgroup and the second subgroup from the established braid group, the index of the braid group is an integer greater than or equal to 6, the first subgroup and the second subgroup Multiplication of elements of subgroups is not commutative;

A conjugate operation module, configured to select any element from the first subgroup as a private key, and perform a conjugate operation on the private key and the braid group to obtain a first conjugate value;

A public key generating module, configured to generate a public key based on the braid group and the first conjugate value;

A digital signature module, configured to calculate the digital signature of the information to be signed according to the second conjugate value and the private key when receiving the second conjugate value sent by the verifier, and the second conjugate value is determined by The verifier calculates and obtains according to the public key;

A sending module, configured to send the digital signature to the verifier.

In one embodiment, the following formula is used to perform a conjugate operation on the private key and the braid group to obtain a first conjugate value:

a ₁ = xσ ₁ x ^-1 , a ₂ = xσ ₂ x ^-1 , ..., a _n-1 = xσ _n-1 x ^-1 ;

Among them, σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; x is the private key; a ₁ , a ₂ , ..., a _n-1 are the first common yoke value, n is the exponent.

In one embodiment, the public key includes a hash function, and according to the second conjugate value and the private key, the following formula is used to calculate the digital signature of the information to be signed:

K=x(b ₁ , b ₂ , . . . , b _n-1 );

e=x ^- 1K;

S=H(m||e);

Wherein, b ₁ , b ₂ ,..., b _n-1 is the second conjugate value; S is the digital signature, H is the hash function, m is the information to be signed, and n is the The exponent, || means to concatenate the characters m and e together.

The fourth aspect of the embodiment of the present application provides a digital signature device, which is applied to the verifier, and the device includes:

a calculation module, configured to calculate a second conjugate value according to the public key of the signer, the public key including the first conjugate value;

A sending module, configured to send the second conjugate value to the signer, where the second conjugate value is used by the signer to calculate a digital signature of the information to be signed;

A verification module, configured to verify the digital signature according to the second conjugate value and the first conjugate value when receiving the digital signature from the signer.

In one embodiment, the calculation module includes:

The obtaining submodule is used to obtain the public key of the signing party, the public key also includes a braid group and a subgroup, and the index of the braid group is an integer greater than or equal to 6;

selecting a sub-module for selecting any element from said subgroup;

The calculation submodule is configured to perform a conjugate operation on the element and the braid group to obtain the second conjugate value.

In one embodiment, the calculation submodule uses the following formula to perform a conjugate operation on the element and the braid group to obtain a second conjugate value:

b ₁ =yσ ₁ y ^-1 , b ₂ =yσ ₂ y ^-1 , ..., b _n-1 = yσ _n-1 y ^-1 ;

Wherein, b ₁ , b ₂ , ..., b _n-1 are the second conjugate values; σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; y is the element, n being the index.

In one embodiment, the verification module includes:

A verification value calculation submodule, configured to calculate a verification value corresponding to the digital signature according to the second conjugate value and the first conjugate value;

A judging submodule, configured to pass the verification of the digital signature if the verification value is equal to the digital signature.

In one embodiment, the public key further includes a hash function, and the verification value calculation submodule uses the following formula to calculate the verification value corresponding to the digital signature:

K'=y(a ₁ , a ₂ ,..., a _n-1 );

e'=(y ^-1 K') ^-1 ;

S'=H(m||e');

Wherein, y is the element, S' is the verification value, H is the hash function, m is the information to be signed, n is the index, and || indicates that the characters m and e' are connected together.

A fifth aspect of the embodiments of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and operable on the processor, when the processor executes the computer program Realize the method described in the first aspect or the second aspect above.

The sixth aspect of the embodiments of the present application provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned first or second aspect can be implemented. described method.

The seventh aspect of the embodiments of the present application provides a computer program product. When the computer program product is run on a computer device, the computer device is made to execute the method described in the first aspect or the second aspect above.

Beneficial effect

In the embodiment of the present application, the signer determines the first subgroup and the second subgroup from the established braid group; then selects an element from the first subgroup as the private key of the signer, and performs a process on the private key and the braid group Conjugate operation to obtain the first conjugate value; then generate a public key based on the braid group and the first conjugate value; the verifier can obtain the public key of the signer to calculate the second conjugate value based on the public key, and the second The two conjugate values are sent to the signer; when the signer receives the second conjugate value sent by the verifier, he can calculate the digital signature with signature information according to the second conjugate value and private key; then send the digital signature to Verifier, the verifier can verify the digital signature. In the scheme in this embodiment, the first subgroup and the second subgroup are two Mihailova subgroups of the braid group, and the multiplication of the elements of the two subgroups is not interchangeable. Since the membership problem of the Mihailova subgroup is unsolvable, there is no algorithm The private key of the signing party is attacked, so that the digital signature method in this application can resist quantum computing attacks.

Description of drawings

In order to illustrate the technical solutions in the embodiments of the present application more clearly, the following briefly introduces the drawings required for the embodiments or the description of the prior art.

Fig. 1 is a schematic flow chart of the steps of a digital signature method provided by the embodiment of the present application;

Fig. 2 is a schematic flow chart of steps of another digital signature method provided by the embodiment of the present application;

Fig. 3 is a schematic diagram of a digital signature device provided by an embodiment of the present application;

Fig. 4 is a schematic diagram of another digital signature device provided by the embodiment of the present application;

Fig. 5 is a schematic diagram of a computer device provided by an embodiment of the present application.

Embodiments of the present invention

In order to illustrate the technical solutions in the embodiments of the present application more clearly, the following briefly introduces the drawings required for the embodiments or the description of the prior art.

Referring to Fig. 1, it shows a schematic flow chart of steps of a digital signature method provided by the embodiment of the present application. The digital signature method shown in Fig. 1 is applied to the signing party, and may specifically include the following steps:

S101, determine the first subgroup and the second subgroup from the established braid group, the index of the braid group is an integer greater than or equal to 6, and the elements of the first subgroup and the second subgroup Multiplication is not commutative.

Specifically, the braid group B _n can be established first, and the braid group B _n is a group defined by the following presentation:

B _n ＝<σ ₁ , σ ₂ ,..., σ _n-1 |σ _i σ _j= σ _j σ _i , |ij|≥2, σ _i σ _i+1 σ _i =σ _i+1 σ _i σ _{i +1} , 1≤i≤n-2>

The elements of the braid group are represented by the words in the set {σ ₁ , σ ₂ ,..., σ _n-1 } representing the unique normal form of the element. The braid group B _n has the following properties: the word representing the elements of B _n on the generator set of B _n has a unique normal form that can be calculated; the product operation and inverse operation of the group based on the normal form are feasible and computable of.

_The braid group B _n contains ^a _{subgroup L i} isomorphic to _{F 2} ×F ₂ , ^{that is} , two rank- ² Subgroups of direct product isomorphisms of free groups:

L _i =<σ _i ² , σ _i+1 ² , σ _i+3 ² , σ _i+4 ² >, i=1, 2, .., n-5

Then construct a Mihailova subgroup M _i of L _i from the finite presentation group H whose word problem is unsolvable generated by two elements (see reference [3]). Below are the 56 generators of _Mi :

σ _i ² σ _i+3 ² , σ _i+1 ² σ _i+4 ² , S _ij , T _ij , j=1, 2,..., 27

And the 27 S _1j are (replace all σ ₁ with σ _i , σ ₂ with σ _i+1 , then get all S _ij ; replace all σ ₁ with σ _i+3 , and σ ₂ with σ _i+4 , that is, all T _ij ):

The membership problems of all Mihailova subgroups M _i (i=1, 2, . . . , n-5) are unsolvable.

The first subgroup and the second subgroup above are two Mihailova subgroups P and Q of the braided group, and the multiplication of the elements in the first subgroup and the second subgroup is not commutative.

S102. Select any element from the first subgroup as a private key, and perform a conjugate operation on the private key and the braid group to obtain a first conjugate value.

Specifically, the signer can select an element from the first subgroup as the private key x, and then perform a conjugate operation on the private key and the braid group to obtain the first conjugate value.

Specifically, the calculation formula of the first conjugate value is: a ₁ =xσ ₁ x ^-1 , a ₂ =xσ ₂ x ^-1 ,..., a _n-1 =xσ _n-1 x ^-1 , (a ₁ , a ₂ ,…, a _n-1 ), where 1, 2,…, n 1 are multiple generators of the braid group; x is the private key; a1, a2,…, an-1 is the first conjugate value, n is an exponent.

S103. Generate a public key based on the braid group and the first conjugate value.

The braid group B _n , the exponent n, the second subgroup Q and the first conjugate value a ₁ , a ₂ ,..., a _n-1 are used as the public key of the signer, and the public key can be obtained by the verifier.

In a possible implementation manner, the public key also includes a collision-resistant hash function.

S104. When receiving the second conjugate value sent by the verifier, calculate the digital signature of the information to be signed according to the second conjugate value and the private key, and the second conjugate value is determined by the verifier Calculated based on the public key.

The verifier can obtain the public key of the signer, and then calculate the second conjugate value according to the public key of the signer; then the verifier can send the second conjugate value to the signer.

When the signer receives the second conjugate value sent by the verifier, it can calculate a digital signature with signature information according to the second conjugate value and the private key.

Specifically, the signer can replace the occurrences of all generators in the private key with the first public value, and then calculate the product of the private key and the first conjugate value; use the private key and the reciprocal to calculate an intermediate value; based on the The intermediate value encrypts the information to be signed. The anti-collision hash function can be used for encryption, and the anti-collision hash function is irreversible, which can guarantee the security of the digital signature in the data communication process.

Specifically, the calculation formula of the digital signature can be:

K=x(b ₁ , b ₂ , . . . , b _n-1 );

e=x ^- 1K;

S=H(m||e);

Among them, b ₁ , b ₂ ,..., b _n-1 is the second conjugate value; S is the digital signature, H is the anti-collision hash function, m is the information to be signed, n is the exponent, || Connect with e.

S105. Send the digital signature to the verifier.

The signer sends the calculated digital signature to the verifier, and the verifier can confirm the identity of the signer based on the digital signature.

In the embodiment of this application, the signer uses an element in the Mihailova subgroup as the private key, and the membership problem in the Mihailova subgroup is unsolvable, and the security guarantee of the digital signature algorithm depends on the unsolvability of the corresponding decision problem , so that the digital signature algorithm in this embodiment is resistant to all known attacks including quantum computing attacks.

Referring to Figure 2, it shows a schematic flow chart of another digital signature method provided by the embodiment of the present application. The digital signature method shown in Figure 2 is applied to the verifier, and may specifically include the following steps:

S201. Calculate a second conjugate value according to the public key of the signer, where the public key includes the first conjugate value.

Specifically, the verifier may obtain the public key of the signer, and the public key may include a first conjugate value, and the first conjugate value is calculated by the signer according to the step in S102.

The public key also includes a braid group and a subgroup, the index of the braid group is an integer greater than or equal to 6, and the subgroup is a Mihailova subgroup of the braid group, that is, the Mihailova subgroup Q in the above step S101.

The verifier can select an element from the subgroup, and then use this element to perform a conjugate operation with the braid group to obtain a second conjugate value. The calculation formula of the second conjugate value can be:

b ₁ =yσ ₁ y ^-1 , b ₂ =yσ ₂ y ^-1 , ..., b _n-1 = yσ _n-1 y ^-1 ;

Wherein, b ₁ , b ₂ , ..., b _n-1 are the second conjugate values; σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; y is an element, and n is an index.

S202. Send the second conjugate value to the signer, where the second conjugate value is used by the signer to calculate a digital signature of the information to be signed.

Specifically, when the signer needs to be verified, the verifier can send the second conjugate value to the signer, and after receiving the second conjugate value, the signer can use the above steps in S104 to calculate the digital value of the information to be signed sign.

S203. When receiving the digital signature from the signer, verify the digital signature according to the second conjugate value and the first conjugate value.

When the verifier receives the digital signature of the signer, it can calculate the verification value corresponding to the digital signature according to the second conjugate value and the first conjugate value; if the verification value is equal to the digital signature, the digital signature verification is passed . If the verification value is not equal to the digital signature, the verification fails.

Specifically, the public key may also include a hash function, and the calculation formula of the verification value may be:

K'=y(a ₁ , a ₂ ,..., a _n-1 );

e'=(y ^-1 K') ^-1 ;

S'=H(m||e');

Among them, y is the element, S' is the verification value, H is the hash function, m is the information to be signed, n is the index, and || means to connect the characters m and e' together.

The verification principle is:

e=x ^- 1K

＝x ^-1 x(b ₁ , b ₂ , . . . , b _n-1 )

= x ^-1 x(y ^-1 σ ₁ y, y ^-1 σ ₂ y, ..., y ^-1 σ _n-1 y)

= x ^-1 y ^-1 x(σ ₁ ,σ ₂ ,...,σ _n-1 )y

= x ^-1 y ^-1 xy

e'=(y ^-1 K') ^-1

＝(y ^-1 y(a ₁ , a ₂ ,..., a _n-1 )) ^-1

=(y ^-1 y(x ^-1 σ ₁ x,x ^-1 σ ₂ x,...,x ^-1 σ _n-1 x)) ^-1

=(y ^-1 x ^-1 y(σ ₁ ,σ ₂ ,...,σ _n-1 )x) ^-1

＝(y ^-1 x ^-1 yx) ^-1 ＝x ^-1 y ^-1 xy

So S'=H(m||e')=H(m||e)=S

In the embodiment of this application, the signer determines an element from a Mihailova subgroup of the braid group as a private key, and the verifier determines an element from another Mihailova subgroup of the braid group to perform the conjugate operation. The private key only needs to be in the hands of the signer, and it can be verified without sending the private key to the verifier, thereby avoiding the theft of the private key during data communication; the security of the digital signature in this embodiment depends on Mihailova The membership problem in the subgroup is unsolvable, so the digital signature method in this embodiment can resist quantum computing attacks and has higher security.

It should be noted that the sequence numbers of the steps in the above embodiments do not mean the order of execution, the execution order of each process should be determined by its functions and internal logic, and should not constitute any limited.

For ease of understanding, a complete example is used below to introduce the digital signature method provided by this application.

In this embodiment, the signer and the verifier may reach an agreement in advance, so that the digital signature method in this embodiment is used for identity verification and information completeness verification. The digital signature method in this embodiment may include three processes of key generation, signature and verification.

The key generation process can include:

The signer selects a braid group B _n with index n≥6 as the public key, whose generators are σ ₁ , σ ₂ ,..., σ _n-1 , and selects an input byte of arbitrary length and a fixed output byte A collision-resistant hash function H of length k bytes: B _n → {0, 1} ^k , where k is a sufficiently large fixed natural number.

The signer selects two Mihailova subgroups P and Q of B _n , and the multiplication of the elements of P and Q is not commutative, and Q is used as the public key.

The signer selects an element x from the Mihailova subgroup P as its private key, denoted as x=x(σ ₁ ,σ ₂ ,…,σ _n-1 ), and calculates a ₁ =xσ ₁ x ^-1 , a ₂ ＝xσ ₂ x ^-1 ,..., a _n-1 ＝xσ _n-1 x ^-1 , (a ₁ , a ₂ ,..., a _n-1 ) as its public key; the public key of the signer is (n, B _n , Q, H, a ₁ , a ₂ ,..., a _n-1 ), the private key is x.

The signing process can include:

The verifier selects an element y from the public key Q published by the signer, denoted as y=y(σ ₁ , σ ₂ ,…,σ _n-1 ), and calculates b ₁ =yσ ₁ y ^-1 , b ₂ = yσ ₂ y ^-1 , ..., b _n-1 = yσ _n-1 y ^-1 , and send (b ₁ , b ₂ , ..., b _n-1 ) to the signer.

After receiving (b ₁ , b ₂ , ..., b _n-1 ) from the verifier, the signer replaces all occurrences of σ _i in the private key x with b _i (i=1, 2, ..., n-1) , and calculate x(b ₁ , b ₂ ,..., b _n-1 ), denoted as K. Further use the private key to calculate e=x ^-1 K, and further calculate S=H(m||e) (where || means to connect characters m and e together). m is the information to be signed, and the signer's signature on m is S.

The verification process can include:

The verifier obtains the public key (a ₁ , a ₂ , ..., a _n-1 ) announced by the signer, and then replaces all occurrences of σ _i in the previously selected y with a _i , i=1, ..., n-1 , and calculate y(a ₁ , a ₂ ,..., a _n-1 ), denote it as K', further calculate e'=(y ^-1 K') ^-1 , and further calculate S ^' = H(m| |e') (where || means to connect the characters m and e' together). And verify whether S ^' = S, if the equality is established, then accept the signature, otherwise reject the signature.

The verifier obtains the public key (a ₁ , a ₂ , ..., a _n-1 ) announced by the signer, and then replaces all occurrences of σ _i in y in step (4) with a _i , i=1, ..., n-1, and calculate y(a ₁ , a ₂ ,..., a _n-1 ), denote it as K', further calculate e'=(y ^-1 K') ^-1 , and further calculate S ^' = H (m||e') (where || means to connect the characters m and e' together). And verify whether S ^' = S, if the equality is established, then accept the signature, otherwise reject the signature.

In the embodiment of this application, the platform for establishing the digital signature protocol is two Mihailova subgroups P and Q with multiplicative non-commutative elements in a braid group B _n and B _n with an index of n≥6, and at the same time, P and Q The subgroup membership problem of is unsolvable.

Subgroup membership problem (membership problem or generalized word problem) refers to a subgroup H whose generator set is X for a given group G, to determine whether any element g in G can be represented by a word on X, that is, to determine whether g is Elements in H.

If a third party tries to attack this protocol, she can only use the public information {σ ₁ , σ ₂ ,…,σ _n-1 }, {n, B _n , Q, H, a ₁ , a ₂ ,…, a _n-1 }(a _i =x ^-1 σ _i x, i=1,…,n-1) and {b ₁ ,b ₂ ,…,b _n-1 }(b _i =y ^-1 σ _i y, i=1,...,n-1) to implement the attack. If she can get the elements s and t of B _n such that

s ^-1 σ _i s=y ^-1 σ _i y,t ^-1 σ _i t=x ^-1 σ _i x,i=1,2,...,n-1,

Make s=cy, t=dx (wherein c, d are some element of B _n ), then have

s ^-1 σ _i s = (cy) ^-1 σ _i cy = y ^-1 c ^-1 σ _i cy = y ^-1 σ _i y, i = 1, 2, ..., n-1

thus have

c ^-1 σ _i c = σ _i , i = 1, 2, ..., n-1

That is, c is commutative with every σ _i multiplication. Since B _n is generated by σ ₁ , σ ₂ , . . . , σ _n-1 , c is an element at the center of B _n . And the center of B _n is the infinite cyclic subgroup <Δ ² > generated by Δ ² , where

Δ=σ ₁ σ ₂ ...σ _n-1 σ ₁ σ ₂ ...σ _n-2 ...σ ₁ σ ₂ σ _{3 σ 1} σ ₂ σ ₁

Thus c is an element of <Δ ² >. Similarly, d is also an element of <Δ ² >. Since <Δ ² > is the center of B _n , and σ _i ² <Δ ² >, σ _i+1 ² <Δ ² >, σ _i+3 ² <Δ ² > and σ _i+4 ² <Δ ² > generate The subgroups of the quotient group B _n /<Δ ² > are isomorphic to the subgroups of B _n generated by σ _i ² , σ _i+1 ² , σ _i+3 ² and σ _i+4 ² , so that the rank of is 2 free group. So the sub-quotient group (M _i <Δ ² >)/<Δ ² > is also a Mihailova subgroup of the quotient group B _n /<Δ ² >. Therefore, the subgroup membership problem of (M _i <Δ ² >)/<Δ ² > is also unsolvable. Therefore, if the attacker can obtain the elements s and t of B _n such that

s ^-1 σ _i s=y ^-1 σ _i y,t ^-1 σ _i t=x ^-1 σ _i t,i=1,2,...,n-1,

Then s=cy, t=dx, c, d∈<Δ ² >, so in the quotient group B _n /<Δ ² >, there are s<Δ ² >=y<Δ ² > and t<Δ ² >=x <Δ ² >. That is, the attacker must find the elements y<Δ ² > and x<Δ ² > in the Mihailova subgroup (M _i <Δ ² >)/<Δ ² > in the quotient group B _n /<Δ ² >. Since the subgroup membership problem of (M _i <Δ ² >)/<Δ ² > is unsolvable, there is no algorithm that allows the attacker to successfully obtain y<Δ ² > and x<Δ ² >, so there is no algorithm So that the attacker can successfully obtain the required s and t.

This application selects the elements of the Mihailova subgroup of the braid group B _n as the key components of its private key through the signing party, and proves that all possible attacks are feasible and incomputable, that is, the digital signature method of the present invention is resistant to including All known attacks against quantum computing.

Compared with the existing technology, it has the following advantages: the security guarantee of the established digital signature algorithm depends on the unsolvability of the corresponding decision problem, rather than the computational difficulty of the corresponding decision problem; the classic public key cryptographic algorithm is based on the calculation difficulty, so that the digital signature algorithm of the present invention is resistant to all known attacks including quantum computing attacks.

The digital signature method can be used for identity verification. The digital signature method in the application is described below with an example of the digital signature method in the application in the identity verification scenario:

Alice wants to send information to Bob. In order to prevent Oscar from pretending to be Alice and sending information to Bob, the digital signature method in this embodiment can be used to implement Bob's authentication of Alice.

First, Alice and Bob can reach a digital signature agreement according to the method in this embodiment. At this time, Alice is the signer, and Bob is the verifier.

Alice can choose a braid group B _n whose index is n≥6 as the public key. The generators of the braid group B _n are σ ₁ , σ ₂ ,..., σ _n-1 , and at the same time choose an input byte of any length and output The byte is a collision-resistant hash function H of fixed length k bytes: B _n →{0, 1} ^k , where k is a sufficiently large fixed natural number.

Alice selects two Mihailova subgroups P and Q of B _n , and the multiplication of elements satisfying P and Q is not commutative.

Alice selects an element x from the Mihailova subgroup P as its private key, denoted as x=x(σ ₁ ,σ ₂ ,…,σ _n-1 ), and calculates a ₁ =xσ ₁ x ^-1 , a ₂ = xσ ₂ x ^-1 , . . . , a _n-1 = xσ _n-1 x ^-1 , (a ₁ , a ₂ , . . . , a _n-1 ).

Alice's public key is (n, B _n , Q, H, a ₁ , a ₂ ,..., a _n-1 ), and her private key is x. Bob can publicly obtain Alice's public key.

When identity verification is to be performed, Alice and Bob can agree to use Alice's unique identification information m for identity verification.

Bob selects an element y from the public key Q published by Alice, denoted as y=y(σ ₁ ,σ ₂ ,…,σ _n-1 ), and calculates b ₁ =yσ ₁ y ^-1 , b ₂ =yσ ₂ y ^-1 , ..., b _n-1 = yσ _n-1 y ^-1 , and send (b ₁ , b ₂ , ..., b _n-1 ) to Alice.

After receiving Bob's (b ₁ , b ₂ , ..., b _n-1 ), Alice replaces all occurrences of σ _i in the private key x with b _i (i=1, 2, ..., n-1), And calculate x(b ₁ , b ₂ , . . . , b _n-1 ), denoted as K. Further use the private key to calculate e=x ^-1 K, and further calculate S=H(m||e) (where || means to connect characters m and e together). Alice's signature on m is S.

Alice can then send the digital signature to Bob when she sends information to Bob. Bob uses the digital signature to determine whether the information comes from Alice, preventing Oscar from masquerading as Alice.

After Bob receives Alice's information, he can obtain the digital signature carried. Then replace all occurrences of σ _i in the previously selected y with a _i , i=1,...,n-1, and calculate y(a ₁ , a ₂ ,...,a _n-1 ), denoted as K' , and further calculate e'=(y ^-1 K') ^-1 , and further calculate S ^' =H(m||e') (where || means connecting characters m and e' together). Bob verifies whether S ^' = S, and if the equality holds, it indicates that the information is indeed from Alice, otherwise the information is not sent by Alice.

The digital signature method can also be used to ensure the integrity of information transmission. The following uses an example of the digital signature method in this application in the identity verification scenario to illustrate the digital signature method in the application:

Alice wants to send information to Bob. In order to prevent Oscar from tampering with the information Alice sent to Bob, the digital signature method in this embodiment can be used to confirm the integrity of the information.

First, Alice and Bob can reach a digital signature agreement according to the method in this embodiment. At this time, Alice is the signer in this application, and Bob is the verifier in this application.

Alice can choose a braid group B _n whose index is n≥6 as the public key. The generators of the braid group B _n are σ ₁ , σ ₂ ,..., σ _n-1 , and at the same time choose an input byte of any length and output The byte is a collision-resistant hash function H of fixed length k bytes: B _n →{0, 1} ^k , where k is a sufficiently large fixed natural number.

Alice selects two Mihailova subgroups P and Q of B _n , and the multiplication of elements satisfying P and Q is not commutative.

Alice selects an element x from the Mihailova subgroup P as its private key, denoted as x=x(σ ₁ ,σ ₂ ,…,σ _n-1 ), and calculates a ₁ =xσ ₁ x ^-1 , a ₂ = xσ ₂ x ^-1 , . . . , a _n-1 = xσ _n-1 x ^-1 , (a ₁ , a ₂ , . . . , a _n-1 ).

Alice's public key is (n, B _n , Q, H, a ₁ , a ₂ ,..., a _n-1 ), and her private key is x. Bob can publicly obtain Alice's public key.

When Alice sends a message to Bob, a hash function can be used to generate the digest m of the message.

Bob selects an element y from the public key Q published by Alice, denoted as y=y(σ ₁ ,σ ₂ ,…,σ _n-1 ), and calculates b ₁ =yσ ₁ y ^-1 , b ₂ =yσ ₂ y ^-1 , ..., b _n-1 = yσ _n-1 y ^-1 , and send (b ₁ , b ₂ , ..., b _n-1 ) to Alice.

After receiving Bob's (b ₁ , b ₂ , ..., b _n-1 ), Alice replaces all occurrences of σ _i in the private key x with b _i (i=1, 2, ..., n-1), And calculate x(b ₁ , b ₂ , . . . , b _n-1 ), denoted as K. Further use the private key to calculate e=x ^-1 K, and further calculate S=H(m||e) (where || means to connect characters m and e together). Alice's signature on m is S.

Then when Alice sends a message to Bob, she can send the digital signature along with the message to Bob. Bob uses the digital signature to determine whether the message has been tampered with.

After Bob receives Alice's information, he can obtain the digital signature carried. Then use the same hash function as Alice to generate the digest m' of the message. Then replace all occurrences of σ _i in the previously selected y with a _i , i=1,...,n-1, and calculate y(a ₁ , a ₂ ,...,a _n-1 ), denoted as K' , and further calculate e'=(y ^-1 K') ^-1 , and further calculate S ^' = H(m'|| e') (where || means connecting characters m' and e' together). Bob verifies whether S ^' = S, if the equality holds, it indicates that the message has not been tampered with, otherwise the message has been tampered with.

Referring to FIG. 3, it shows a schematic diagram of a digital signature device provided by the embodiment of the present application. The digital signature device shown in FIG. Key generation module 33, digital signature module 34 and sending module 35, wherein:

The subgroup determination module 31 is used to determine the first subgroup and the second subgroup from the established braid group, the index of the braid group is an integer greater than or equal to 6, the first subgroup and the second subgroup Multiplication of elements of two subgroups is not commutative;

A conjugate operation module 32, configured to select any element from the first subgroup as a private key, and perform a conjugate operation on the private key and the braid group to obtain a first conjugate value;

A public key generating module 33, configured to generate a public key based on the braid group and the first conjugate value;

The digital signature module 34 is configured to calculate the digital signature of the information to be signed according to the second conjugated value and the private key when receiving the second conjugated value sent by the verifier, and the second conjugated value calculated by the verifier based on the public key;

A sending module 35, configured to send the digital signature to the verifier.

In a possible implementation manner, the conjugate operation module 32 uses the following formula to perform a conjugate operation on the private key and the braid group to obtain a first conjugate value:

a ₁ = xσ ₁ x ^-1 , a ₂ = xσ ₂ x ^-1 , ..., a _n-1 = xσ _n-1 x ^-1 ;

Among them, σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; x is the private key; a ₁ , a ₂ , ..., a _n-1 are the first common yoke value, n is the exponent.

In a possible implementation, the public key includes a hash function, and the digital signature module 34 uses the following formula to calculate the digital signature of the information to be signed:

K=x(b ₁ , b ₂ , . . . , b _n-1 );

e=x ^- 1K;

S=H(m||e);

Wherein, b ₁ , b ₂ ,..., b _n-1 is the second conjugate value; S is the digital signature, H is the hash function, m is the information to be signed, and n is the The exponent, || means to concatenate the characters m and e together.

Referring to FIG. 4, it shows a schematic diagram of another digital signature device provided by the embodiment of the present application. The digital signature device shown in FIG. in:

A calculation module 41, configured to calculate a second conjugate value according to the public key of the signer, where the public key includes the first conjugate value;

A sending module 42, configured to send the second conjugate value to the signer, where the second conjugate value is used by the signer to calculate a digital signature of the information to be signed;

The verification module 43 is configured to verify the digital signature according to the second conjugate value and the first conjugate value when receiving the digital signature from the signer.

In a possible implementation, the calculation module 41 includes:

The obtaining submodule is used to obtain the public key of the signing party, the public key also includes a braid group and a subgroup, and the index of the braid group is an integer greater than or equal to 6;

selecting a sub-module for selecting any element from said subgroup;

The calculation submodule is configured to perform a conjugate operation on the element and the braid group to obtain the second conjugate value.

In a possible implementation manner, the calculation submodule uses the following formula to perform a conjugate operation on the element and the braid group to obtain a second conjugate value:

b ₁ =yσ ₁ y ^-1 , b ₂ =yσ ₂ y ^-1 , ..., b _n-1 = yσ _n-1 y ^-1 ;

Wherein, b ₁ , b ₂ , ..., b _n-1 are the second conjugate values; σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; y is the element, n being the index.

In a possible implementation manner, the above verification module 43 includes:

A verification value calculation submodule, configured to calculate a verification value corresponding to the digital signature according to the second conjugate value and the first conjugate value;

A judging submodule, configured to pass the verification of the digital signature if the verification value is equal to the digital signature.

In a possible implementation, the public key further includes a hash function, and the verification value calculation submodule uses the following formula to calculate the verification value corresponding to the digital signature:

K'=y(a ₁ , a ₂ ,..., a _n-1 );

e'=(y ^-1 K') ^-1 ;

S'=H(m||e');

Wherein, y is the element, S' is the verification value, H is the hash function, m is the information to be signed, n is the index, and || indicates that the characters m and e' are connected together.

As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related details, please refer to the description of the method embodiment.

FIG. 5 is a schematic structural diagram of a computer device provided by an embodiment of the present application. As shown in Figure 5, the computer device 5 of this embodiment includes: at least one processor 50 (only one is shown in Figure 5), a processor, a memory 51, and a processor that is stored in the memory 51 and can be processed in the at least one processor. A computer program 52 running on the processor 50, when the processor 50 executes the computer program 52, implements the steps in any of the above-mentioned method embodiments.

The computer device 5 may be computing devices such as desktop computers, notebooks, palmtop computers, and cloud servers. The computer device may include, but is not limited to, a processor 50 and a memory 51 . Those skilled in the art can understand that Fig. 5 is only an example of the computer device 5, and does not constitute a limitation to the computer device 5, and may include more or less components than those shown in the figure, or combine certain components, or different components , for example, may also include input and output devices, network access devices, and so on.

The so-called processor 50 can be a central processing unit (Central Processing Unit, CPU), and the processor 50 can also be other general processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit) , ASIC), off-the-shelf programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

The storage 51 may be an internal storage unit of the computer device 5 in some embodiments, such as a hard disk or memory of the computer device 5 . The memory 51 can also be an external storage device of the computer device 5 in other embodiments, such as a plug-in hard disk equipped on the computer device 5, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, flash memory card (Flash Card), etc. Further, the memory 51 may also include both an internal storage unit of the computer device 5 and an external storage device. The memory 51 is used to store operating system, application program, boot loader (BootLoader), data and other programs, such as the program code of the computer program. The memory 51 can also be used to temporarily store data that has been output or will be output.

The embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in each of the foregoing method embodiments can be realized.

An embodiment of the present application provides a computer program product. When the computer program product is run on a computer device, the computer device can implement the steps in the foregoing method embodiments when executed.

Claims (18)

1. A digital signature method, characterized in that it is applied to a signatory, the method comprising:

   Determine the first subgroup and the second subgroup from the established braid group, the index of the braid group is an integer greater than or equal to 6, and the multiplication of the elements of the first subgroup and the second subgroup is not possible exchange;

   selecting any element from the first subgroup as a private key, and performing a conjugate operation on the private key and the braid group to obtain a first conjugate value;

   generating a public key based on the braid group and the first conjugate value;

   When receiving the second conjugate value sent by the verifier, calculate the digital signature of the information to be signed according to the second conjugate value and the private key, and the second conjugate value is determined by the verifier according to the The above public key is calculated;

   The digital signature is sent to the verifier.
2. The method according to claim 1, wherein the following formula is used to perform a conjugate operation on the private key and the braid group to obtain the first conjugate value:

   a ₁ = xσ ₁ x ^-1 , a ₂ = xσ ₂ x ^-1 , ..., a _n-1 = xσ _n-1 x ^-1 ;

   Among them, σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; x is the private key; a ₁ , a ₂ , ..., a _n-1 are the first common yoke value, n is the exponent.
3. The method according to claim 1 or 2, wherein the public key includes a hash function, and according to the second conjugate value and the private key, the following formula is used to calculate the digital signature of the information to be signed:

   K=x(b ₁ , b ₂ , . . . , b _n-1 );

   e=x ^- 1K;

   S=H(m||e);

   Wherein, b ₁ , b ₂ ,..., b _n-1 is the second conjugate value; S is the digital signature, H is the hash function, m is the information to be signed, and n is the The exponent, || means to concatenate the characters m and e together.
4. A digital signature method, characterized in that it is applied to a verifier, the method comprising:

   calculating a second conjugate value based on the signer's public key, the public key comprising the first conjugate value;

   sending the second conjugate value to the signer, where the second conjugate value is used by the signer to calculate a digital signature of the information to be signed;

   When the digital signature from the signer is received, the digital signature is verified according to the second conjugate value and the first conjugate value.
5. The method according to claim 4, wherein said calculating the second conjugate value according to the public key of the signing party comprises:

   Obtain the public key of the signing party, the public key also includes a braid group and a subgroup, and the index of the braid group is an integer greater than or equal to 6;

   selecting any element from said subgroup;

   performing a conjugate operation on the element and the braid group to obtain the second conjugate value.
6. The method according to claim 5, wherein the following formula is used to perform a conjugate operation on the elements and the braid group to obtain a second conjugate value:

   b ₁ =yσ ₁ y ^-1 , b ₂ =yσ ₂ y ^-1 , ..., b _n-1 = yσ _n-1 y ^-1 ;

   Wherein, b ₁ , b ₂ , ..., b _n-1 are the second conjugate values; σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; y is the element, n being the index.
7. The method according to any one of claims 5 or 6, wherein the verifying the digital signature according to the second conjugate value and the first conjugate value comprises:

   calculating a verification value corresponding to the digital signature according to the second conjugate value and the first conjugate value;

   If the verification value is equal to the digital signature, the verification of the digital signature is passed.
8. The method according to claim 7, wherein the public key further includes a hash function, and according to the second conjugate value and the first conjugate value, the following formula is used to calculate the hash function corresponding to the digital signature: Verify value:

   K'=y(a ₁ , a ₂ ,..., a _n-1 );

   e'=(y ^-1 K') ^-1 ;

   S'=H(m||e');

   Wherein, y is the element, S' is the verification value, H is the hash function, m is the information to be signed, n is the index, and || indicates that the characters m and e' are connected together.
9. A digital signature device, characterized in that it is applied to a signatory, and the device includes:

   Subgroup determination module, used to determine the first subgroup and the second subgroup from the established braid group, the index of the braid group is an integer greater than or equal to 6, the first subgroup and the second subgroup Multiplication of elements of subgroups is not commutative;

   A conjugate operation module, configured to select any element from the first subgroup as a private key, and perform a conjugate operation on the private key and the braid group to obtain a first conjugate value;

   A public key generating module, configured to generate a public key based on the braid group and the first conjugate value;

   A digital signature module, configured to calculate the digital signature of the information to be signed according to the second conjugate value and the private key when receiving the second conjugate value sent by the verifier, and the second conjugate value is determined by The verifier calculates and obtains according to the public key;

   A sending module, configured to send the digital signature to the verifier.
10. The device according to claim 9, wherein the following formula is used to carry out conjugate operation on the private key and the braid group to obtain the first conjugate value:

    a ₁ = xσ ₁ x ^-1 , a ₂ = xσ ₂ x ^-1 , ..., a _n-1 = xσ _n-1 x ^-1 ;

    Among them, σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; x is the private key; a ₁ , a ₂ , ..., a _n-1 are the first common yoke value, n is the exponent.
11. The device according to claim 9 or 10, wherein the public key includes a hash function, and according to the second conjugate value and the private key, the following formula is used to calculate the digital signature of the information to be signed:

    K=x(b ₁ , b ₂ , . . . , b _n-1 );

    e=x ^- 1K;

    S=H(m||e);

    Wherein, b ₁ , b ₂ ,..., b _n-1 is the second conjugate value; S is the digital signature, H is the hash function, m is the information to be signed, and n is the The exponent, || means to concatenate the characters m and e together.
12. A digital signature device is characterized in that it is applied to a verifier, and the device includes:

    a calculation module, configured to calculate a second conjugate value according to the public key of the signer, the public key including the first conjugate value;

    A sending module, configured to send the second conjugate value to the signer, where the second conjugate value is used by the signer to calculate a digital signature of the information to be signed;

    A verification module, configured to verify the digital signature according to the second conjugate value and the first conjugate value when receiving the digital signature from the signer.
13. The device according to claim 12, wherein the computing module comprises:

    The obtaining submodule is used to obtain the public key of the signing party, the public key also includes a braid group and a subgroup, and the index of the braid group is an integer greater than or equal to 6;

    selecting a sub-module for selecting any element from said subgroup;

    The calculation submodule is configured to perform a conjugate operation on the element and the braid group to obtain the second conjugate value.
14. The device according to claim 13, wherein the calculation submodule uses the following formula to perform a conjugate operation on the element and the braid group to obtain a second conjugate value:

    b ₁ =yσ ₁ y ^-1 , b ₂ =yσ ₂ y ^-1 , ..., b _n-1 = yσ _n-1 y ^-1 ;

    Wherein, b ₁ , b ₂ , ..., b _n-1 are the second conjugate values; σ ₁ , σ ₂ , ..., σ _n-1 are multiple generators of the braid group; y is the element, n being the index.
15. The device according to any one of claims 13 or 14, wherein the verification module comprises:

    A verification value calculation submodule, configured to calculate a verification value corresponding to the digital signature according to the second conjugate value and the first conjugate value;

    A judging submodule, configured to pass the verification of the digital signature if the verification value is equal to the digital signature.
16. The device according to claim 15, wherein the public key further includes a hash function, and the verification value calculation submodule uses the following formula to calculate the verification value corresponding to the digital signature:

    K'=y(a ₁ , a ₂ ,..., a _n-1 );

    e'=(y ^-1 K') ^-1 ;

    S'=H(m||e');

    Wherein, y is the element, S' is the verification value, H is the hash function, m is the information to be signed, n is the index, and || indicates that the characters m and e' are connected together.
17. A computer device, comprising a memory, a processor, and a computer program stored in the memory and operable on the processor, characterized in that, when the processor executes the computer program, the computer program according to claim 1- 4 or the digital signature method described in any one of 5-8.
18. A computer-readable storage medium, the computer-readable storage medium stores a computer program, characterized in that, when the computer program is executed by a processor, the method according to any one of claims 1-4 or 5-8 is realized. Digital signature method.

Images