State synchronization for post-quantum signing facilities

1. An apparatus, comprising:

a computer readable memory;

a plurality of hardware security modules, at least a first hardware security module in the plurality of hardware security modules comprising processing circuitry to:

determine a number of hardware security modules available to perform a signature process;

generate a first plurality of pairs of cryptographic key pairs comprising a first plurality of private keys and a first plurality of public keys;

forward the first plurality of public keys to a remote computing device;

receive, from the remote computing device, a first plurality of ciphertexts, wherein each ciphertext in the plurality of ciphertexts represents an encryption of a cryptographic seed with a public key selected from the plurality of public keys;

select, from the plurality of hardware security modules, a subset of hardware security modules to perform the signature process;

receive, from the subset of hardware security modules in the plurality of hardware security modules, a subset of private keys; and

generate at least one of:

a first signal when the subset of private keys comprises a number of private keys that exceeds a threshold; or

a second signal when the subset of private keys comprises a number of private keys that does not exceed a threshold.

2. The apparatus of claim 1 , wherein the at least a first hardware security module in the plurality of hardware security modules comprising processing circuitry to:

generate an error message when the subset of private keys comprises a number of private keys that does not exceed the threshold.

3. The apparatus of claim 1 , wherein the at least a first hardware security module in the plurality of hardware security modules comprising processing circuitry to:

decrypt the cryptographic seed when the subset of private keys comprises a number of private keys that exceeds the threshold.

4. The apparatus of claim 3 , wherein the at least a first hardware security module in the plurality of hardware security modules comprising processing circuitry to:

generate a first plurality of digital signatures for a first plurality of leaf nodes in a Merkle tree.

5. The apparatus of claim 1 , wherein the threshold is a static threshold that represents a fixed number of hardware security modules.

6. The apparatus of claim 1 , wherein the threshold is a dynamic threshold that represents a variable number of hardware security modules.

7. The apparatus of claim 1 , further comprising a state synchronization manager comprising:

a load balancer to select one of the first hardware security module or a second hardware security module to generate a signature.

8. A computer-based method, comprising:

determining a number of hardware security modules available to perform a signature process;

selecting, from a plurality of hardware security modules in a signing facility, a set of hardware security modules to be assigned to a digital signature process, the set of hardware security modules comprising at least a first hardware security module; and

in the at least a first hardware security module:

generating a first plurality of pairs of cryptographic key pairs comprising a first plurality of private keys and a first plurality of public keys;

forwarding the first plurality of public keys to a remote computing device;

receiving, from the remote computing device, a first plurality of ciphertexts, wherein each ciphertext in the plurality of ciphertexts represents an encryption of a cryptographic seed with a public key selected from the plurality of public keys;

selecting, from the plurality of hardware security modules, a subset of hardware security modules to perform the signature process;

receiving, from the subset of hardware security modules in the plurality of hardware security modules, a subset of private keys; and

generating at least one of:

a first signal when the subset of private keys comprises a number of private keys that exceeds a threshold; or

a second signal when the subset of private keys comprises a number of private keys that exceeds a threshold.

9. The method of claim 8 , further comprising:

generating an error message when the subset of private keys comprises a number of private keys that does not exceed the threshold.

10. The method of claim 9 , further comprising:

generating a first plurality of digital signatures for a first plurality of leaf nodes in a Merkle tree.

11. The method of claim 8 , further comprising:

decrypting the cryptographic seed when the subset of private keys comprises a number of private keys that exceeds the threshold.

12. The method of claim 8 , wherein the threshold is a static threshold that represents a fixed number of hardware security modules.

13. The method of claim 8 , wherein the threshold is a dynamic threshold that represents a variable number of hardware security modules.

14. The method of claim 13 , further comprising selecting one of the first hardware security module or a second hardware security module to generate a signature.

15. A non-transitory computer readable medium comprising instructions which, when executed by a processor, configure the processor to:

determine a number of hardware security modules available to perform a signature process;

select, from a plurality of hardware security modules in a signing facility, a set of hardware security modules to be assigned to a digital signature process, the set of hardware security modules comprising at least a first hardware security module; and

in the at least a first hardware security module:

generate a first plurality of pairs of cryptographic key pairs comprising a first plurality of private keys and a first plurality of public keys;

forward the first plurality of public keys to a remote computing device;

receive, from the remote computing device, a first plurality of ciphertexts, wherein each ciphertext in the plurality of ciphertexts represents an encryption of a cryptographic seed with a public key selected from the plurality of public keys;

select, from the plurality of hardware security modules, a subset of hardware security modules to perform the signature process;

receive, from the subset of hardware security modules in the plurality of hardware security modules, a subset of private keys; and

generate at least one of:

a first signal when the subset of private keys comprises a number of private keys that exceeds a threshold; or

a second signal when the subset of private keys comprises a number of private keys that exceeds a threshold.

16. The computer readable medium of claim 15 , comprising instructions to:

generate an error message when the subset of private keys comprises a number of private keys that does not exceed the threshold.

17. The computer readable medium of claim 15 , comprising instructions to:

decrypt the cryptographic seed when the subset of private keys comprises a number of private keys that exceeds the threshold.

18. The computer readable medium of claim 17 , comprising instructions to:

generate a first plurality of digital signatures for a first plurality of leaf nodes in a Merkle tree.

19. The computer readable medium of claim 15 , wherein the threshold is a static threshold that represents a fixed number of hardware security modules.

20. The computer readable medium of claim 15 , wherein the threshold is a dynamic threshold that represents a variable number of hardware security modules.

21. The computer readable medium of claim 20 , further comprising instructions to select one of the first hardware security module or a second hardware security module to generate a signature.