CN1207868C - Safety digital signature method and system - Google Patents

Abstract

The present invention relates to a safe digital signature method and a system. The system comprises an on-line task distributor connected through a broadcast channel, k secret sharing arithmetic units, m secret sharing synthesizers and an off-line sub cryptographic key distributor. The distribution operation of sub cryptographic keys has the following steps: a private key d is divided into the sum of t sub cryptographic keys dj and one sub cryptographic key ci by the sub cryptographic key distributor, and t is less than k; k random sub cryptographic keys dj are distributed into the k arithmetic units by the distributor, the assembled representation of one group of ci equations is obtained and is sent to the synthesizers for prestore. The digital signature operation comprises the following steps: the task distributors send HASH value M required to be signed to the k arithmetic units by broadcast; ascending power M<dj> is calculated by the arithmetic units according to received M value, etc. and is sent to the synthesizers by broadcast; the synthesizers are compared with the equation combination of the prestored sub cryptographic keys ci, the combined presentation of a matched equation is found, and the corresponding sub cryptographic keys ci are obtained; M<ci> is solved through a result R obtained by the multiplication of the corresponding ascending power M<dj>; the digital signature S equal to M<d> is obtained.

Description

A Safe Digital Signature Method and System

technical field

The present invention relates to network communication security technology, more specifically to a method and system for ensuring digital signature security that can tolerate intrusion.

Background technique

Digital Signature (Digital Signature) is the most basic technology in today's network communication security. It uses an asymmetric algorithm (Asymmetric Algorithm) to achieve the purpose that others can verify the signature but cannot counterfeit the signature. The most commonly used asymmetric algorithms are RSA, DSA, and elliptic curve algorithms, etc. Many current digital signature systems are based on the RSA algorithm.

The so-called asymmetric algorithm means that a person cannot derive the parameters of the reverse calculation through the known forward calculation parameters, that is, the known forward calculation process has no reverse calculation ability. This asymmetric algorithm itself is public, but everyone can choose different parameters, and the transformation functions formed by different parameters are different. For someone, he can choose a set of parameters, some of which are used for reverse calculation, called secret parameters, technically called secret key or private key; the other part is used for forward calculation, which is public parameters, technically known as the public key or public key.

Digital signatures are implemented based on this asymmetric algorithm. On the one hand, protect your own secret parameter - the private key to ensure that others cannot pretend to be yourself to sign; is computationally infeasible to derive the secret parameters).

Digital signature is first of all a guarantee for network communication and interaction. It can ensure that the other party is authentic and that the one on the Internet is yourself. It can also be used as a tool when signing electronic documents to protect your own documents and signatures. Many countries today regard digital signatures as handwritten signatures, and both have the same legal efficiency.

Digital signature algorithms can also be used to negotiate secret parameters. For example, when user A needs to communicate secretly with user B, user A can set some secret parameters first, and then use the public key (public key) of user B to act. At this time, only user B can restore the original value, because only User B knows his private key (private key).

In addition, digital signatures can also be used in places that require confidentiality, places that require identity authentication, and other places that require non-repudiation services.

The PKI (Public Key Infrastructure: public key infrastructure) that is being vigorously promoted internationally is an application of digital signatures, and it is the most important infrastructure in the network digital society. The importance of this technology is just like the power infrastructure. Facilities do the same for industry.

In order to ensure the security and speed of digital signatures, before signing, HASH calculation must be performed on the signed content to find a HASH value M (HASH value is sometimes called digest value or hash value), and then use the secret key (private key) ) to transform the digest result to obtain the signature value; when verifying the signature, first perform HASH calculation on the content, then use the public parameter (public key) to act on the signature value, and then compare the obtained result with the above HASH result, if they are equal , it means that the signature is correct, otherwise the verification fails.

However, when a user A has his own private key and discloses the public key, if an attacker B regenerates the public key and private key, and replaces the public key released by user A with the public key of the attacker B, the At this time, only the attacker B knows the information sent by the friend of user A to user A, because user A has no way of knowing the private key corresponding to the public key faked by attacker B. At this time, a CA (CertificateAuthority: Certificate Authority or Certificate Authority) is required to prove which public key belongs to user A, or which public key does not belong to user A.

The CA has a longer private key than the private key of ordinary users, that is to say, the private key of the CA is more secure, and the public key of the CA can be widely known in various ways, so that each user can verify what is issued by the CA. When a user binds his identity with his public key and is signed by a CA, he gets an electronic certificate. This certificate can prove the identity of the owner of the public key, and anyone can verify but no one can impersonate.

At present, electronic certificate has become the most critical part of PKI infrastructure, and CA is the most important basic unit in PKI. Using electronic certificates can effectively solve security issues such as confidentiality, integrity and non-repudiation on the network.

PKI-based security will ultimately come down to the protection of the CA's private key. Once the CA's private key is leaked, all certificates issued by the CA must be invalidated, and the entire network security under the jurisdiction of the CA will become insecure. to speak of. With the continuous increase of various attack methods on the network, system loopholes are constantly being discovered, so how to ensure that digital signature services can be provided online while ensuring security has become an important topic in modern network security research.

For the RSA algorithm, the secret key is generally recorded as d, which is an integer that can be as long as 2048 bits (it is generally believed that a private key with a length of 1024 bits can already guarantee security, but for CA, it is necessary to use 2048 bits or more. of). In the RSA algorithm, the modular exponentiation calculation of a number N is used, that is, to find M ^d mod N. This calculation is required to complete the digital signature. When the required public parameters (public key) are disclosed, the protection number d is The private key is protected.

The goal of a secure digital signature is to complete the signature without divulging the private key. There have been many theoretical studies on this topic in the world, many of which cannot be realized due to the difficulty. On the other hand, the focus of current development in the world is how to realize mutually compatible digital signature products, but there are very few developments in terms of intrusion-tolerant security signatures, and the industry has not launched related products. The so-called intrusion tolerance (Intrusion Tolerance) is relative to the technology to ensure the security of CA by detecting intrusion, that is, after some parts of the system are attacked or occupied, the confidential information of the CA system will not be exposed.

To sum up, PKI is based on the public key cryptography algorithm. In the PKI system, the CA is also a trust center in a domain. The communication and verification between devices or individuals on the network depend on the digital certificate (signature) issued by the CA. ). A digital certificate is a data obtained by binding a public key with a personal identity and signing it with a CA's private key. When one party wants to verify the identity of the other party, it can be done in two steps. First, verify whether the certificate signature of the other party is correct (the signature can only be completed by the private key of the CA, and only the CA can sign); If the private key corresponding to the public key in the certificate can be established, the identity of the other party can be determined and can be trusted.

Therefore, the CA's private key is the core of CA security, and protecting it from disclosure is the basis for the security of the entire CA domain. Generally speaking, a CA must be an online network device, especially a CA that directly faces users in order to provide corresponding certificate services, so it is inevitable to encounter network attacks. When a hacker successfully attacks a CA, the attacker may obtain Its internal resources, so as to find the private key of the CA, will cause a fatal blow to the PKI system. key.

In the following, several existing secure digital signature methods are described only from the aspect of equating the signature to realizing the formula M ^d mod N (where d is the private key that should be kept secret).

Referring to FIG. 1 , it shows a block diagram of a prototype system of the ITTC project scheme of Stanford University in the United States. The system implements system intrusion tolerance through threshold cryptography technology. The system includes the signing party (Clients), the server side (Servers) and the management side (Admin). The web server of the signing party refers to the web server that needs to be signed, and the CA is the certificate authority or certificate authority; the server side includes multiple sharing servers (ShareServer, also called sharing calculator or sharing calculator), as shown in the figure Share server 1 To 3, responsible for secure digital signature; the administrator (Admin) is an optional device used to manage each shared server. The characteristics of this scheme are: simple structure and good security, the system adopts multiple shared servers in a single-layer structure.

The security principle of the system is: first decompose the private key d into the sum of t numbers: d=d ₁ +d ₂ +...+d _t ; then distribute each number (d _i ) to each shared server middle. When a signature is required, the client (Web or CA) sends the required signature information-HASH result M value to t sharing servers; each sharing server then sends the calculation result $m_i=m^{d_i}$ Send back to client (Web or CA); multiplication by client (Web or CA):

$\mathrm{<span\; class="notranslate">\; S</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; t</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}{\mathrm{<span\; class="notranslate">\; m</span>}}^{{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; m</span>}}^{\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; l</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; m</span>}}^{\mathrm{<span\; class="notranslate">\; d</span>}}$

The desired result is obtained.

Since redundancy cannot be achieved, multiple sets of equations can be further used to generate redundant configurations, that is, several sets of numbers are randomly found, such as:

The first group: d=d ₁₁ +d ₁₂ +...+d _1t ;

The second group: d=d ₂₁ +d ₂₂ +...+d _2t ;

Then divide multiple sets of numbers (d _ij ) into different sharing servers, each sharing server gets multiple d _ij , but only gets one data in the same set of data (for example, sharing server 1 gets a data d of the first set ₁₁ and another second set of data d ₂₃ ). For example, in the case of 4 shared servers, when t=3, they can be allocated according to the following table: shared server 1 share server 2 share server 3 share server 4 d ₁₁ d ₁₂ d ₁₃ d ₁₃ d ₂₃ d ₂₁ d ₂₂ d ₂₃

When the client (Web or CA) needs to calculate, the client (Web or CA) selects t intact sharing servers, and then tells these sharing servers which set of data (parameters) to use, and then the sharing server can calculate Signed accordingly.

The advantage of this technical solution is obvious, and its weak point has the following points:

1. The distribution and management of the key is difficult. When adding a shared server, the key data must be distributed to each online shared server, and the client must also know the increase;

2. When there are many sharing servers, the key storage capacity of the sharing servers will increase rapidly. If the total number of sharing servers is k, and the total number of intact sharing servers is required to be t, then the number of keys stored in each sharing server At least C _k ^n-1 (C represents a combination), when k=10, t=3, the number of each shared server storage key is 45;

3. There is a problem that must be synchronized first. Before calculation, the client must first select t shared servers. After the selection of t shared servers is completed, it must also find a data group that matches the t shared servers and notify them , when one of the servers is destroyed, the entire process of selecting the shared server above must be repeated;

4. It is difficult for the client (CA or Web server) to remember the change of the shared server every time, and it is not easy to manage and expand. When the client is online, it is even more difficult to expand, resulting in the need to Update the client.

Victor Shoup of IBM Research-Zurich Institute published an article called "Practical threshold signatures" at the European Cryptography Annual Conference in 2000, which also introduced a theoretical scheme. This scheme uses RSA strong prime number, its secret prime number p=2p'+1, q=2q'+1. All interpolation equations are performed in rings modulo m=p'q'. Because M ^4m modulo N is equal to 1, the square is added once when calculating separately, and the combiner (Combiner) squares each result again to obtain M ^4Δ(gm+d) . where Δ=(k!) ² , and g is an integer. In this scheme, _ci is completed by a combiner, which eliminates the synchronization problem before calculation, but brings the calculation difficulty of the combiner and reduces the calculation performance. As the synthesizer must compute:

$\mathrm{<span\; class="notranslate">\; W</span>}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}}^{\mathrm{<span\; class="notranslate">\; 2</span>}\mathrm{<span\; class="notranslate">\; \&lambda;</span>}{\mathrm{<span\; class="notranslate">\; c</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}}}{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}}^{\mathrm{<span\; class="notranslate">\; 2</span>}\mathrm{<span\; class="notranslate">\; \&lambda;</span>}{\mathrm{<span\; class="notranslate">\; c</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}}}<span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span>{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}}^{\mathrm{<span\; class="notranslate">\; 2</span>}\mathrm{<span\; class="notranslate">\; \&lambda;</span>}{\mathrm{<span\; class="notranslate">\; c</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}}}$

Among them, y _i is the calculation result of each sharing server, λ=k! .

It can be seen that the characteristics and shortcomings of this scheme are:

1. It is still a single-layer sharing structure composed of sharing servers. Its synthesizer does not store any secrets and can be synthesized by any device;

2. The calculation amount of the synthesizer is close to or equivalent to t signatures, which is far greater than the calculation amount of the sharing server. Even if the algorithm can be implemented, it cannot be used for actual signatures;

3. Requiring the use of strong prime numbers will limit some applications;

4. It is only theoretically stated that when adding or deleting a shared server will not affect other devices, but only provides mathematical formulas, without any implementation and system structure instructions.

Yair Frankel of New York CertCo Company and others proposed another scheme, but did not provide the framework and details of system realization. In their scheme, it is proposed to let the coefficients a _i of polynomials be in {0, L, . . . , 2L ³ N ^2+e t}, where L=k! . And take x _i belongs to [1, 2, ..., k-1]. Since all f( _xi ) can be divided by L, the calculation of _bi can be performed in integers without the inverse operation. The scheme can be performed with the general RSA algorithm without strong prime numbers of RSA. Because the selection of its parameters is greatly limited, it brings the complexity of the algorithm principle and security proof. When the shared server calculates _bi , because _bi depends on the selection of _xi , there is also a synchronization problem.

As can be seen from the description of its mathematical scheme, this scheme has the following disadvantages:

1. Adopt equal secret sharing, that is, sharing is a single-layer structure;

2. The selection of parameters is limited, which proves that its security is very complicated and increases the possibility of loopholes;

3. There is a problem of synchronization, and if the synchronization is removed, the calculation amount of the synthesizer will be greatly increased.

The above scheme of IBM Research-Zurich Research Institute and the scheme of New York CertCo are all based on the scheme of Shamir's secret sharing, using LaGrange interpolation equation. In the original Shamir secret sharing scheme, a secret key can be generated by randomly taking t keys. However, in the original Shamir scheme, the secret key must be recovered first, which is undesirable in any scheme. Because the secure signature scheme must first ensure that the secret key cannot be recovered in any device.

The basic principle of this Shamir-based secret sharing scheme is:

given a polynomial $f\left(x\right)=\underset{i=0}{\overset{t-1}{\mathrm{\&Sigma;}}}{a}_1{x}_{i,}$ Using the LaGrange interpolation formula, there are:

$\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; t</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; t</span>}}{\overset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&NotEqual;</span>\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}\frac{\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>$

Choose t x _i and f( _xi ), you can get:

${\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; 0</span>}}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; t</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; t</span>}}{\overset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&NotEqual;</span>\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}\frac{<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>$

You can set a ₀ as the secret key d, at this time, the signature calculation for a HASH value M is:

${\mathrm{<span\; class="notranslate">\; m</span>}}^{\mathrm{<span\; class="notranslate">\; d</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; m</span>}}^{\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; t</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}{\mathrm{<span\; class="notranslate">\; m</span>}}^{\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; t</span>}}{\overset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&NotEqual;</span>\mathrm{<span\; class="notranslate">\; i</span>}}{<span\; class="notranslate">\; \&prod;</span>}}\frac{<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; t</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}}{\mathrm{<span\; class="notranslate">\; m</span>}}^{{\mathrm{<span\; class="notranslate">\; b</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; )</span>$

in $b_i=f\left(x_i\right)*c_i=f\left(x_i\right)\underset{j=1,t}{\overset{j\&NotEqual;i}{\mathrm{\&Pi;}}}\frac{-x_j}{x_i-x_j}---\left(4\right)$

In this way, the secret key d can be divided into k shared servers (k≥t). Each sharing server calculates M ^bi , and then a synthesizer multiplies the calculation results of each sharing server to obtain M ^d , and any sharing server will not disclose the secret key d. Since there is a division calculation in b _i in formula (4), it is easy to think of finding a field or ring Z _v for calculation. Among them, the condition that must be satisfied is: v is a prime number, or the value of the determinant of all t-order (Vandermonde) matrices formed by x _i is guaranteed to be mutually prime to v.

In general, the result of calculating M ^bi separately is to do multiplication: $\underset{i=1}{\overset{t}{\mathrm{\&Pi;}}}{m}^{b_i}=m^{d+\mathrm{wv}}.$ How to remove the influence of v, many people think of using Φ(N), because M ^Φ(N) =1. But choosing v=Φ(N) will make the selection of x _i greatly limited by the above conditions, and knowing a certain element o and its inverse o ^-1 to Φ(N), we can find Φ(N), obviously this is not safe.

Therefore, it can be seen from the theory that the above schemes have obvious weaknesses, and there are still many problems to be solved before the actual application.

Contents of the invention

The purpose of the present invention is to design a safe digital signature method and system, which is an intrusion-tolerant safe signature method and system. On the basis of the existing basic principles of CA security, the problem of pre-synchronization can be eliminated, and online CA can be satisfied. When some components of the system are attacked or occupied, ensure that the system secrets are not leaked.

The secure digital signature method of the present invention is based on the RSA algorithm. The method must meet the following conditions:

1. Although the intruder attacks or occupies several components in the system, he cannot obtain the private key;

2. The system is easy to expand. When a shared calculator needs to be added, it will not affect the work of the entire system;

3. The management during operation is simple. Management includes adding, removing, and modifying service hardware and software. When there are system management and configuration activities, the system operation cannot be affected;

4. When one or more devices in the system are damaged, the normal service will not be affected;

5. When a shared computing unit is damaged, the operating efficiency of the entire system will not decrease too much, that is, the task allocation unit does not need to know any information about the task executor;

6. When starting the calculation, any device does not need to know who its partner is, so there is no need for a designated organization of the cooperation group (pre-synchronization);

7. The algorithm and principle of the system should be very simple;

8. After the design is completed, the operating efficiency of the entire system should at least be at the same level as the conventional system.

The technical scheme that realizes the object of the present invention is such: a kind of safe digital signature method, comprises

The issuance and calculation of the digital signature of the sub-key is characterized in that:

The issuance of the subkey includes the following processing steps:

A. Set up a secure digital signature system, including online task distributors, online k secret sharing operators, online m secret sharing synthesizers, broadcast channels and offline subkey distributors, where k and m are positive integer;

B. The offline sub-key distributor expresses the stored digital signature private key d as the sum of t first sub-keys d _j and a second sub-key c _i , d, t, c, j, i Both are positive integers and let t<k;

C. The offline sub-key distributor uses k random numbers as the first sub-key d _j , distributes them to k secret sharing operators, and obtains a set of second sub-keys by subtraction according to the sum formula in step B The subkey _ci and its equation combination representation, the group of second subkey _ci 's equation combination representation and the corresponding _ci are respectively sent to m secret sharing synthesizers for pre-stored;

The described computing digital signature includes the following processing steps:

D. The online task distributor sends the HASH value M that needs to be signed to k secret sharing operators through the broadcast data packet through the first broadcast channel;

Among the Ek secret sharing operators, t or more secret sharing operators calculate the raising power M ^di according to the received M value, and send the code j of the secret sharing operator, the HASH value M to be signed and the calculation result M ^dj sends the broadcast data packet to m secret sharing synthesizers through the second broadcast channel;

F. The secret sharing combiner compares the received result with the expression combination of equations of a set of pre-stored second sub-keys c _i , finds a combination of equations that can be matched to obtain the corresponding second sub-key c _i , and then combines Multiply the exponentiation results of the matching t secret sharing operators to obtain the result R, calculate M ^ci according to the found second subkey _ci , and finally multiply M ^ci and R to obtain the digital signature S=M ^d .

Said step A also includes arbitrarily giving a code name to the online task distributor, giving different code names to k secret sharing operators, giving different code names and Set the initial value of t.

Described step C, further comprises:

c1. Take k random numbers less than d/t as the first subkey d _j by the offline subkey distributor;

c2. The offline sub-key distributor sends the k first sub-keys d _j to the k secret sharing operators through management permission;

c3. Take t d j from the k first sub-keys d _j (d ₁ , d ₂ , d ₃ ,..., d _k ) by the offline sub-key distributor, and form _them according to the combination formula $\mathrm{no}=C_k^t$ a combination representation, and calculate the second subkey c _i (i=1, 2, .

c4. The offline sub-key distributor sends the group of second sub-keys _ci 's equation combination representation and the corresponding _ci to the m secret sharing synthesizers in a manner permitted by management.

The offline sub-key distributor is in a physically isolated state or in a shutdown state after executing steps A, B, and C to complete the distribution of sub-keys.

Described step D further comprises:

d1. An online task distributor receives digitally signed tasks and performs security checks and checks;

d2. Determine a task number that is unique to the task distributor within a predetermined time for the task by the online task distributor;

d3. Broadcast the broadcast data packet composed of its code name and task number along with the HASH value M that needs to be signed to the first broadcast channel by the online task distributor;

Described step E further comprises:

e1. After receiving the broadcast, t or more secret sharing operators send a notification to the online task allocator that they have been received;

e2. t or more secret sharing calculators check the uniqueness of the task, and perform the calculation of the raising power when it is determined to be a new task;

e3. t or more secret sharing calculators will also form the code name of the online task distributor, the task number of the task along with the code j of the secret sharing calculator, the HASH value M to be signed and the calculation result M ^dj The broadcast data packet is broadcast to the second broadcast channel;

Described step F, further comprises:

f1. The secret sharing synthesizer that receives the broadcast puts the broadcast data packets with the same task allocator code and task number in one group;

f2. The above-mentioned secret sharing synthesizer finds at least t broadcast data packets, and then finds an equation combination representation matching the pre-stored equation combination representation, and obtains the corresponding second subkey c _i .

The steps D, E, and F are performed sequentially to complete the calculation operation of the digital signature.

After the step F, a step G is also included, and the online secret sharing synthesizer broadcasts the digital signature S=M ^d , the task distributor code number and the task number to form a broadcast data packet to an online output interface device, and The output interface device checks the signature result with the public key, ends the digital signature if it is correct, and performs error handling or alarm if it is wrong.

In the step G, the online secret sharing combiner broadcasts the broadcast data packet to a separately set online output interface device through a third broadcast channel.

In the step G, the online secret sharing combiner broadcasts the broadcast data packet to the output interface device set in the task distributor through the first broadcast channel.

The technical solution for realizing the object of the present invention is still like this: a kind of safe digital signature system is characterized in that comprising:

At least one online task distributor, k online secret sharing operators, m online secret sharing synthesizers and offline subkey distributors; the online task distributor communicates with k secret sharing operators through the first broadcast channel The k secret sharing operators are connected with the m secret sharing synthesizers through the second broadcast channel, and the offline sub-key distributor is connected with the k secret sharing operators and m secret sharing synthesizers during system initialization or system configuration. The synthesizers are connected respectively, and k and m are positive integers.

More preferably, the system further includes a separately provided output interface device, which is connected to the m secret sharing synthesizers through the third broadcast channel.

More preferably, in the system, the online task allocator is also provided with an output interface device, which is connected to the m secret sharing combiners through the first broadcast channel.

The at least one online task distributor, k online secret sharing operators, m online secret sharing synthesizers, and offline subkey distributors all use common computers or servers.

The first broadcast channel, the second broadcast channel and the third broadcast channel are physically connected channels or independent channels that are not connected at all.

The secure digital signature method and system of the present invention, based on the RSA algorithm, overcomes the difficulties in system management and implementation in the background technology through an unbalanced secret sharing with a double-layer structure composed of a sharing operator and a sharing synthesizer , to achieve the purpose of the invention.

The method and system of the present invention have the following characteristics:

1. The online task distributor can broadcast digital signature tasks without selecting a secret sharing calculator and specifying a key. When the system is updated, it can guarantee that the work of the online task distributor will not be affected. When a secret sharing calculator is suddenly damaged It will also not affect the execution time of the broadcast task (if it is designated to be calculated by a secret sharing calculator, but this device does not respond in the end, you must re-designate the device and key and start again);

2. When adding a secret sharing operator, you only need to generate a sub-key for it, and the offline sub-key distributor will compare the serial number of the newly added secret sharing operator with the serial number of the existing secret sharing operator. Equation combination, calculate the corresponding second sub-key c _n , then add these newly added equation combination expressions and the calculated c _n to the secret sharing synthesizer in a way approved by key management, this addition is Does not affect the system work;

3. When dismantling a secret sharing calculator, you only need to turn off the device. For the sake of efficiency, you can delete the equation combination representation and the corresponding c of the secret sharing calculator serial number in the secret sharing synthesizer;

4. At the same time, the present invention, like other background technologies, also has the ability of intrusion tolerance. When less than t sets of secret sharing arithmetic units are invaded, the system secret d will not be disclosed, and because the structure of the secret sharing synthesizer is added, even if All secret sharing operators are hacked, and the system secret d will not be disclosed (it can also be proved theoretically that the system secret d cannot be obtained by attacking the secret sharing synthesizer. Although there are many equations, the coefficient matrix of all equations rank is less than the number of variables).

Description of drawings

Figure 1 is a schematic diagram of the prototype structure of the CA system in the ITTC project plan studied by Stanford University.

Fig. 2 is a schematic diagram of the implementation structure of a secure digital signature system of the present invention.

Fig. 3 is a schematic diagram of the implementation structure of another secure digital signature system of the present invention.

Fig. 4 is a block diagram of an implementation flow of a secret sharing calculator.

Fig. 5 is a block diagram of an implementation flow of a secret sharing synthesizer.

Detailed ways

Referring to Fig. 2, the figure schematically shows a secure digital signature system structure, which adopts the RSA algorithm as the basic algorithm.

The structure includes an offline sub-key distribution machine (device, the same below) 21, at least one online task distribution machine 22, k online sub-secret sharing operators 23, and m online secret sharing synthesizers 24 and an independently set online output interface device 25. These devices can all be served by different ordinary computers or servers. The online task distribution machine 22 is connected with the k station secret sharing computing unit 23 through the broadcast channel B1 (such as UDP protocol channel), and the k station secret sharing computing unit 23 is connected with the m station secret sharing synthesizer 24 through the broadcast channel B2. The sharing synthesizer 24 is connected to the output interface device 25 through the broadcast channel B3, and the offline sub-key distribution machine is respectively connected to the k sub-secret sharing computing unit 23 and the m sub-secret sharing computing unit 24 (as shown in the figure) when the system is initialized or the system is configured. shown by the dotted line).

The off-line sub-key distributor 21 keeps the secret d and does not have network connection with other systems. The broadcast channels B1, B2, and B3 may be one broadcast channel that is physically connected, or broadcast channels that are completely unconnected and independent of each other.

The basic principle of realizing the whole system structure is to express a large integer as the sum of several integers, using an expression such as d=d ₁ +d ₂ +d ₃ +...+d _t +c _i , expressed by d _j Any one of d ₁ to d _t in the equation, set the private key in the digital signature as d in the equation, the number of d _j is t, d, d ₁ , d ₂ , d ₃ ...d _1. Both c _{and i} are positive integers, and d _{and j} use random numbers to realize simple management. The difference between this equation expression and the equation expression d=d ₁ +d ₂ +d ₃ +...+d _t in the background technology is that a c _j item is added, thus forming a new safe and easy-to-manage system structure.

In this system structure, the sharing of secret d is completed by two layers of components. One layer of components is composed of a simple secret sharing calculator 23, and the other layer of components is composed of a secret sharing synthesizer 24. Each d _j item is stored in the device 23 respectively, and the c _i item is stored in the secret sharing synthesizer, thus forming a two-layer secret sharing structure. Subkeys are stored in the two layers of equipment, respectively the first subkey d _j and the second subkey c _i . The two-layer sharing structure is also manifested in: only after the secret sharing operator of the first layer completes the calculation, the secret sharing synthesizer of the second layer can start to work; since the secret sharing synthesizer also saves the subkey c _i , so it is impossible for the secret sharing synthesizer to be replaced by other devices.

The system first completes the distribution of subkeys, and the operation process adopted is as follows:

The off-line sub-key distributor 21 generates a random d _j for each secret sharing operator 23, for a system with k secret operation sharers 23, there will be k first sub-keys d _j , j=1, 2, 3, 4, . . . , k. These first subkeys are sent to the corresponding secret sharing calculator 23 in a manner approved by key management.

It is necessary to design a suitable t in advance, and the meaning of t is that when t-1 secret sharing calculators 23 are invaded, the security of the system will not be affected. It should be guaranteed that t<k, so as to ensure that the system can obtain t results from k secret sharing calculators 23 to complete the calculation.

The off-line sub-key distributor 21 takes t sub-keys out of k sub-keys, according to the equation d=d ₁ +d ₂ +d ₃ +...+d _t +c _i can then calculate c _i . Since there are C _k ^t methods of taking t out of k, the c _i of C _k ^t equations can be calculated. here, $\mathrm{no}=C_k^t$ represents combinations such as $C_5^3=10,$ There are 10 _ci values and 10 equation combinations, and each equation combination is a combination of the corresponding t first subkey d _j labels, and the key d _j labels corresponding to such an equation are Key combinations, obviously, different first subkeys in an equation combination are in different secret sharing operators, and the equation combination is only related to the subscript j of the key d _j , without revealing any subkeys Information.

The number of bits of d _j is far less than 1/4 of the number of bits of c _i , such as when d is a number of 2048 bits, c _i is a number of 2048 bits, and d _j is a number of 500 bits or less, so as to ensure the secret sharing operation unit 23 operation speed, so as to improve the operation speed of the system.

The off-line sub-key distributor 21 sends all equation combination representations and corresponding _ci values to the secret sharing synthesizer 24 for pre-storage in a manner permitted by management.

During the operation, the secret sharing operator calculates the raising power for the subkeys it owns, and the secret sharing combiner finds the combination, calculates and synthesizes the result.

The operation process of the system to calculate the digital signature:

When calculating the digital signature, the task allocator will send the signed HASH value M to k secret sharing operators 23 via the broadcast channel B1, as long as there are more than t correct secret sharing operators (referring to the unattacked The secret sharing calculator) can guarantee the calculation result after receiving the data;

The j-th secret sharing operator calculates the raising power M ^dj after receiving the data, each secret sharing operator calculates the raising power for the first subkey it owns, and uses its own code j, The HASH value M and the calculation result M ^dj are sent to the secret sharing synthesizer 24 through the broadcast channel B2;

The secret sharing synthesizer 24 compares the received data packet with its pre-stored equation combination expression by traversal method, finds t combination expressions that can be matched, and obtains the corresponding subkey c _i , and then combines and matches the combined expression Multiply the results of raising the power to get the result R, and then calculate M ^ci according to the found _ci , and finally multiply M ^ci by R to get the digital signature S=M ^d that should be obtained;

The secret sharing synthesizer 24 sends the digital signature result S to the output interface device 25, and the output interface device 25 checks the correctness of the signature result according to the public key.

In the above calculation process, all broadcast data packets should also include: the code name of the task allocator, the task code assigned by the task allocator, etc. To ensure that the system can distinguish different tasks and support multi-task parallel operation.

Referring to Fig. 3, it is an embodiment structure of a secure digital signature system, using an offline sub-key distributor 31, five online secret sharing operators 33 (k=5), and three online secret sharing synthesizers 34. An online task allocator 32 is also used as an output interface device. The online task allocator 32 is connected to five secret sharing computing units 33 through the broadcast channel B1, and the five secret sharing computing units 33 are connected to the two secret sharing computing units through the broadcast channel B2. Two secret sharing synthesizers 34 are connected, and the two secret sharing synthesizers 34 are also connected to the online task distributor 32 through the broadcast channel B1, and an offline subkey distributor 31 is connected to 5 units respectively during system initialization or system configuration. A secret sharing calculator 33 and two secret sharing synthesizers 34 .

First perform the issuing operation of the subkey:

Given any code number of the online task distributor 32, such as 22, a code name of each secret sharing calculator 33, such as 1, 2, 3, 4, 5, and a code name of each secret sharing synthesizer 34, such as 1 , 2, the system sets the initial value t=3, and the offline subkey distributor 31 grasps the secret key d;

Offline sub-key distributor 31 arbitrarily selects 5 random numbers d ₁ , d ₂ , d ₃ , d ₄ , d ₅ less than d/3(d/t), and assigns d ₁ Send to secret sharing calculator #1, send _d2 to secret sharing calculator #2, send d3 to secret sharing calculator # ₃ , send _d4 to secret sharing calculator #4, send _d5 to No. 5 Secret Sharing Calculator;

According to the decomposed expression of d=d _j +...+d _t + _ci and the combination formula C _k ^t , there are 10 kinds of equation combinations of c _i , which are respectively:

c ₁ ＝dd ₁ -d ₂ -d ₃ Equation combination representation (1, 2, 3)

c ₂ ＝dd ₁ -d ₂ -d ₄ Equation combination representation (1, 2, 4)

c ₃ ＝dd ₁ -d ₂ -d ₅ Equation combination representation (1, 2, 5)

c ₄ ＝dd ₁ -d ₃ -d ₄ Equation combination representation (1, 3, 4)

c ₅ ＝dd ₁ -d ₃ -d ₅ Equation combination representation (1, 3, 5)

c ₆ ＝dd ₁ -d ₄ -d ₅ Equation combination representation (1, 4, 5)

c ₇ ＝dd ₂ -d ₃ -d ₅ Equation combination representation (2, 3, 4)

c ₈ ＝dd ₂ -d ₃ -d ₅ Equation combination representation (2, 3, 5)

c ₉ ＝dd ₂ -d ₄ -d ₅ Equation combination representation (2, 4, 5)

c ₁₀ = dd ₃ -d ₄ -d ₅ Equation combination representation (3, 4, 5)

The off-line sub-key distributor 31 sends the 10 values of _ci and the corresponding equation combination expressions to each secret sharing synthesizer 34 in a management-approved manner, that is, there are ten equations in each secret sharing synthesizer 34 Combined representation and ten corresponding _ci values.

After the subkey distribution is completed, the off-line subkey distributor 31 can be shut down (or in a physically isolated state).

The workflow for computing a digital signature is:

The task that must be signed is received by the online task distributor 32, and corresponding security checks and checks are performed, and then the HASH value M that needs to be signed is obtained;

Determine a task number for the current signature by the online task distributor 32, which should be unique to the task distributor within a certain time frame (such as two days);

The task allocator broadcasts its own code (22), the task number of the task, and the HASH value M into a data packet to the broadcast channel B1;

After receiving the broadcast, the secret sharing calculator j (at least 3 secret sharing calculators in the secret sharing calculator 33) notifies the task distributor 32 that it has successfully received;

The secret sharing calculator j checks the uniqueness of the task, and calculates M ^dj when the task is a new task;

Secret sharing calculator j broadcasts its own code j, task dispatcher code 22, task number, HASH value M and calculation result M ^dj to the broadcast channel B2;

The secret sharing synthesizer 34 receives the broadcast information, and puts the information with the same task allocator code number and task number into a group;

The secret sharing synthesizer 34 checks whether there are more than three results in a set of results and three of them match the stored equation combination representation, if so, find the corresponding matching equation combination representation, obtain the corresponding c _i , and calculate M according to c _i ^ci , and then calculate R (which is the product of the corresponding three power-raising results that match the combination representation), and finally multiply M ^ci and R to get the digital signature S=M ^d that should be obtained;

The secret sharing synthesizer 34 sends the code name of the task distributor, task number and digital signature result S= ^Md to the broadcast channel B1;

After the task distributor 32 receives the digital signature result, it uses the public key to check whether the signature result is correct. If it is wrong, it will enter error processing or alarm, and if it passes the check, it will end the calculation task.

The more detailed execution steps in the embodiment in FIG. 3 are also applicable to the embodiment in FIG. 2 .

Referring to Fig. 4 and Fig. 5, they are block diagrams of the implementation flow of the secret sharing calculator and the secret sharing synthesizer in Fig. 2 and Fig. 3 respectively, which are a specific practical flow. Its realization is to use multi-threading technology, that is, the multi-task parallel technology used in computer operating systems, as shown in the figure, three threads: task processing program, listening program and interface program, to realize a secret sharing calculator or secret sharing synthesizer. All tasks that need to be calculated are managed by a task queue, and system parameters (including subkeys) required for calculation are also accessible to all three threads.

The task handler is specially used for calculation. Since calculation is the most time-consuming work, a separate thread is created for calculation to ensure that the interaction with the user can be maintained during calculation, and at the same time, the network data can be maintained. monitoring so as not to lose network data. The thread first uses the event synchronization mechanism to wait, which can save CPU time when there is no task, and can use system events such as EVENT in NT to perform synchronization; when the task execution thread is awakened, it scans the tasks of the system Queue, find the tasks that should be processed and process them, including the sending of data packets that should be resent.

The listener is set up to ensure that the data of network communication is not lost. A single thread is used to monitor the broadcast data of the network. This process only performs simple task processing, such as deleting a task or adding a task. When there is a new computing task , wake up the task processing thread.

The interface program is used for user interface processing, and a separate thread is also used to ensure that system parameters can be modified, subkeys can be added, etc. without affecting system operation.

The system structure of the present invention is simple, easy to implement, and has intrusion tolerance. Although the total workload of signing a signature is increased compared with general signatures, it can ensure system security. By using parallel computing and making the number of bits of d _j far The number of bits less than _ci can be basically equal to the general signature time.

The digital signature device with security function designed according to the technical scheme of the present invention can be widely used in enterprises and institutions. Each device stores a set of corresponding data for each enterprise, and the task distributor puts the enterprise code in the data when broadcasting tasks. In order to distinguish different enterprises, the secret sharing calculator finds and calculates the corresponding key according to the enterprise code, and the calculation result is sent to the synthesizer together with the enterprise code.

After the management of enterprise code is added to the whole system, the system can become the agent of users and enterprises at different levels, and carry out secure digital signatures on behalf of them. And the sub-key distributor and task distributor can be controlled by the enterprise or individual themselves. Under this structure, multiple sub-key distribution centers, multiple task distributors, multiple secret sharing calculators, and multiple secret sharing synthesizers are formed, forming a complete secure digital signature service system.

The defect in the scheme of the present invention is that it is impossible to resist the attack on the system by the collusion of the shared computing unit and the shared synthesizer, that is, when a shared computing unit and a shared synthesizer jointly attack the system, it is possible to obtain the secret d of.

Claims (9)

1. the digital signature method of a safety comprises the granting of sub-key and calculates digital signature, its

Be characterised in that:

The granting of described sub-key comprises following treatment step:

A., a secure digital signature system is set, comprises the quantum key distribution device of online task distributor, online k secret sharing arithmetic unit, online m secret sharing synthesizer, broadcast channel and off-line, k, m are positive integer;

B. the quantum key distribution device of off-line is expressed as the digital signature private key d that preserves by t the first sub-key d _jAnd one second sub-key c _iAnd, d, t, c, j, i are positive integer and allow t＜k;

C. the quantum key distribution device of off-line with k random number as the first sub-key d _j, correspondence is distributed in k the secret sharing arithmetic unit, and according to obtaining one group of second sub-key c with formula by subtracting each other among the step B _iAnd equation combination expression, should organize the second sub-key c _iEquation combination expression and corresponding c _iDeliver to respectively in m the secret sharing synthesizer and prestore;

Described calculating digital signature comprises following treatment step:

D. online task distributor will need the HASH value M that signs to be sent to k secret sharing arithmetic unit by broadcast data packet through first broadcast channel;

T in E.k secret sharing arithmetic unit or t above secret sharing arithmetic unit are according to the M value calculating ascending power M that receives ^Dj, and with the code name j of this secret sharing arithmetic unit, the HASH value M and the result of calculation M that need sign ^DjBe sent to m secret sharing synthesizer by broadcast data packet through second broadcast channel;

F. the secret sharing synthesizer is with reception result and the one group of second sub-key c that prestores _iEquation combination expression compare, find the equation combination expression that can mate to obtain the corresponding second sub-key c _i, will multiply each other with the ascending power operation result of t secret sharing arithmetic unit of combinations matches obtains R as a result again, according to the second sub-key c that finds _iObtain M ^Ci, at last with M ^CiMultiply each other with R and to obtain digital signature S=M ^d

2. a kind of safe digital signature method according to claim 1 is characterized in that: also comprise to any given code name of online task distributor in the described steps A, give the given respectively code name inequality of k secret sharing arithmetic unit, give given respectively code name inequality of m secret sharing synthesizer and the initial value of setting t.

3. a kind of safe digital signature method according to claim 1, it is characterized in that: described step C further comprises:

C1. by the quantum key distribution device of off-line get k less than the random number of d/t as the first sub-key d _j

C2. the quantum key distribution device by off-line passes through the mode of management permission with k the first sub-key d _jCorrespondence is delivered in k the secret sharing arithmetic unit;

C3. by the quantum key distribution device of off-line from k the first sub-key d _j(d ₁, d ₂, d ₃..., d _k) t d of middle taking-up _j, form by the combination formula $n=C_k^t$ Plant the combination expression, and calculate all combinations according to described and formula and represent the pairing second sub-key c _i(i=1,2 ..., n), constitute described set of equations combination expression;

C4. should organize the second sub-key c by the quantum key distribution device of off-line by the mode that management allows _iEquation combination expression and corresponding c _iDeliver in described m the secret sharing synthesizer.

4. a kind of safe digital signature method according to claim 1 is characterized in that: after the quantum key distribution device of described off-line is finished the distribution of sub-key at execution of step A, B, C, be in physical segregation state or be in off-mode.

5. a kind of safe digital signature method according to claim 1 is characterized in that:

Described step D further comprises:

D1. receive the digital signature task by an online task distributor, and carry out safety inspection and check;

D2. determine that for this task one is unique task number to task distributor within the predetermined time by online task distributor;

D3. the HASH value M that its code name and task number is signed with the need by online task distributor forms described broadcast data packet and is broadcast on described first broadcast channel;

Described step e further comprises:

E1. receive after the broadcasting t or t above secret sharing arithmetic unit and send the notice that has received to this online task distributor;

The uniqueness of e2.t or t above secret sharing arithmetic unit inspection task is carried out the calculating of described ascending power when being defined as new task;

The code name that e3.t or t above secret sharing arithmetic unit also will this online task distributor, the task number of task with the code name j of this secret sharing arithmetic unit, need the HASH value M and the result of calculation M that sign ^DjForming described broadcast data packet is broadcast on described second broadcast channel;

Described step F further comprises:

F1. the broadcast data packet that the secret sharing synthesizer that receives broadcasting will have same task distributor code name and task number is placed in one group;

F2. above-mentioned secret sharing synthesizer is found out t broadcast data packet at least, therefrom finds out with an equation combination of the described equation combination expression coupling that prestores again and represents, and obtain the second corresponding sub-key ci.

6. a kind of according to claim 1 or 5 safe digital signature method is characterized in that: described step D, E, F are the calculating operations of the complete digital signature of order.

7. a kind of safe digital signature method according to claim 1 is characterized in that:

Also comprise a step G after the described step F, by online secret sharing synthesizer, with digital signature S=M ^dForm broadcast data packet with task distributor code name, task number and be broadcast on the online output interface device, and by this output interface device with public-key cryptography inspection signature result, the end number signature carries out fault processing or alarm when being correct when being mistake.

8. a kind of safe digital signature method according to claim 7 is characterized in that: be described broadcast data packet to be broadcast on the online output interface device that is provided with separately by one the 3rd broadcast channel by online secret sharing synthesizer.

9. a kind of safe digital signature method according to claim 7 is characterized in that: be described broadcast data packet to be broadcast on the output interface device that is arranged in the task distributor by described first broadcast channel by online secret sharing synthesizer.

Images