Theoretical security analysis method of lattice-based PKE / KEM scheme based on compressed public key design

Abstract

The invention provides a theoretical security analysis method of a lattice-based PKE / KEM scheme based on compressed public key design. The method comprises the following steps: obtaining a key packaging scheme; the method comprises the following steps: splitting e into two parts e1 and e2 by utilizing the property of discrete Gaussian distribution, and then re-representing parameters as # imgabs0 #, representing # imgabs1 # imgabs2 # as # imgabs3 #, wherein # imgabs4 # is selected from proper distribution; secondly, splitting a secret # imgabs5 # by utilizing the property of discrete Gaussian distribution, decomposing the secret # imgabs5 # into a secret # imgabs6 # and a redundant part # imgabs7 # of a standard model LWE problem, further rewriting a sample form into # imgabs8 #, evaluating a theoretical difficulty lower bound of a corresponding problem by utilizing the standard model LWE problem corresponding to # imgabs9 #, and further evaluating a safety intensity lower bound of a KEM scheme; and for the required security strength lambda, selecting specific parameters of a key packaging scheme according to the calculation complexity of a standard module LWE problem corresponding to # imgabs10 #.

Description

Technical Field

[0001] The present invention belongs to the technical field of quantum-resistant public key cryptography, and in particular relates to a theoretical security analysis method of a lattice PKE / KEM scheme based on compressed public key design. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In Internet of Things (IoT) related applications, encrypted communication between different IoT devices is required to ensure the privacy of data transmission. The current mainstream communication method is to use the public key encapsulation system to negotiate the session key, and then use block ciphers to encrypt and transmit data. Due to the miniaturization of IoT devices, lightweight cryptographic algorithms are required, requiring the communication bandwidth and computing requirements to be as small as possible. With the development of quantum computing technology, existing lightweight cryptographic algorithms need to migrate to quantum-resistant cryptography.

[0004] A type of lattice-based lightweight cryptographic algorithm can adopt a design similar to the NIST standardized algorithm Kyber, and then use a compressed public key design to save communication bandwidth, so that the relevant scheme may be adapted to IoT application scenarios. However, the problem brought about by this is that it is impossible to evaluate the security of the relevant scheme based on the standard modular LWE problem like evaluating Kyber, that is, the corresponding cryptographic system may have security risks.

[0005] According to the analysis method of existing public literature, the security assessment of the corresponding design scheme has a large loss. Under the premise of achieving λ-bit security strength, the existing evaluation method requires the parameters of the key encapsulation system to be too large, which is not conducive to the application of the algorithm in the IoT environment. Summary of the invention

[0006] In order to overcome the deficiencies of the above-mentioned prior art, the present invention provides a theoretical security analysis method of a lattice PKE / KEM scheme based on compressed public key design, which is suitable for IoT application scenarios.

[0007] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0008] First, a theoretical security analysis method of a lattice PKE / KEM scheme based on compressed public key design is disclosed, including:

[0009] Obtain a key encapsulation scheme, which is a lattice PKE / KEM scheme based on compressed public key design;

[0010] Using the properties of discrete Gaussian distribution, the error e in the key encapsulation algorithm is decomposed into two parts: e1 and e2, and then the parameters are re-expressed as

[0011] Will Expressed as in Taken from appropriate distribution;

[0012] Then use the properties of discrete Gaussian distribution to The secret of decomposing it into a standard modulus LWE problem and redundant parts Then rewrite the sample form as

[0013] use The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated;

[0014] For the required security strength λ, according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

[0015] As a further technical solution, the key encapsulation scheme security requirements are:

[0016] The key K is computationally indistinguishable from a random uniform distribution;

[0017] The compression of ciphertext does not affect the security of the scheme;

[0018] Ciphertext The pseudo-randomness of can be ensured by the standard decision version modulo the LWE problem;

[0019] The pseudo-randomness of the ciphertext c2 requires the assumption and The calculation is indistinguishable, where u is taken from Uniform distribution on .

[0020] As a further technical solution, the steps of obtaining the key encapsulation scheme are:

[0021] Parameter generation Setup(1 λ );

[0022] Key generationKeyGen(pp);

[0023] Key encapsulation Enc(pk);

[0024] Key decapsulation Dec(ct,sk).

[0025] As a further technical solution, the parameter generation Setup(1 λ ): Select a cyclotomic polynomial ring with dimension \(n\) being a power of 2 according to the security parameter \(\lambda\) Calculate the modulus \(p \lt q\), the Gaussian parameter \(\alpha\) and the rank \(k\) of the modulus, and return the parameters

[0026] As a further technical solution, the key generation KeyGen(pp): Select a 128-bit long random number seed according to the security parameter \(\lambda\), and then use this random number to generate a public matrix in combination with \(F\) Sample from the discrete Gaussian distribution Calculate Return the public key \(pk=(seed, d)\) and the private key \(sk = s\).

[0027] As a further technical solution, the key encapsulation Enc(pk): Recalculate the public matrix using \(seed\) Sample from the discrete Gaussian distribution and Calculate Finally, calculate the key \(K = Con(c2)\), and set the ciphertext Return \((K, ct)\).

[0028] As a further technical solution, the key decapsulation Dec(ct, sk): Calculate Subsequently, use the Rec algorithm to calculate \(K = Rec(c2')\) to obtain an \(n\)-bit session key.

[0029] As a further technical solution, before the steps of obtaining the key encapsulation scheme, assume that \((Con, Rec)\) is a key agreement algorithm that satisfies correctness and security, and \(F\) is a publicly available pseudorandom function.

[0030] In a second aspect, a theoretical security analysis system for a lattice-based PKE / KEM scheme designed based on a compressed public key is disclosed, including:

[0031] A key encapsulation scheme acquisition module, configured to: obtain a key encapsulation scheme;

[0032] A first representation module, configured to: decompose \(e\) into two parts \(e1\) and \(e2\) using the properties of the discrete Gaussian distribution, and then re-represent the parameters as

[0033] A second representation module, configured to: represent as where is taken from an appropriate distribution;

[0034] The third representation module is configured to: reuse the properties of discrete Gaussian distribution to represent the secret The secret of decomposing it into a standard modulus LWE problem and redundant parts Then rewrite the sample form as

[0035] The evaluation module is configured to: The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated;

[0036] The parameter selection module is configured to: for the required security strength λ, according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

[0037] In a second aspect, a communication device is disclosed, including: an initiator and a receiver;

[0038] The initiator uses the receiver's public key to run the key encapsulation algorithm KEM.Enc to obtain the session key K and ciphertext ct. Then it uses the key K to calculate the encrypted ciphertext ct' of the message using the block encryption algorithm, and sends the ciphertext ct and the encrypted ciphertext ct' to the receiver.

[0039] The receiver first uses KEM.Dec to decapsulate ct to obtain the key K, and then uses the block encryption algorithm to decrypt ct′ to obtain the plaintext. Within a certain period of time, the two communicating parties continue to communicate using the session key K;

[0040] The key encapsulation algorithm KEM.Enc is obtained through the theoretical security analysis method or system of the lattice PKE / KEM scheme designed based on compressed public keys.

[0041] One or more of the above technical solutions have the following beneficial effects:

[0042] The technical solution of the present invention is applicable to IoT application scenarios. It utilizes public key compression to save communication bandwidth and designs a lattice key encapsulation algorithm. In addition, a theoretical security assessment method is used to evaluate the design scheme faster and more accurately.

[0043] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0045] Figure 1 This is a schematic diagram of the basic LP framework;

[0046] Figure 2 Design diagram for LP framework compressed public key;

[0047] Figure 3 Provides an introduction to the standard LWE problem and the semi-uniform LWE problem;

[0048] Figure 4 Schematic diagram of the theoretical security evaluation method for LP framework plus public key compression PKE;

[0049] Figure 5 Instance conversion for semi-uniform LWE problem;

[0050] Figure 6 secret Satisfy the properties of the distribution;

[0051] Figure 7 This is the basic application mode of IoT in the embodiment of the present invention. DETAILED DESCRIPTION

[0052] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0053] It should be noted that the terms used herein are for describing specific embodiments only and are not intended to be limiting of exemplary embodiments according to the present invention.

[0054] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0055] The practical lattice-based public key encryption / key encapsulation mechanism (PKE / KEM) scheme is generally designed based on the modular lattice using the LP framework. The basic design idea is to first design a PKE scheme that meets IND-CPA security based on the decision modular LWE problem, and then use this IND-CPA-secure PKE scheme as a component, and use a variant of the general FO transformation to design a PKE / KEM scheme that meets IND-CCA2 security.

[0056] Since the FO paradigm is an efficient and general method for designing practical PKE / KEM schemes, a well-designed basic PKE scheme that meets IND-CPA security is the basis for designing efficient, practical, and standardized PKE / KEM schemes.

[0057] At present, the key generation, encryption and decryption algorithms of the IND-CPA secure PKE scheme are designed based on the modular LWE problem using the LP framework as follows: Figure 1 As shown in the figure, only the cyclotomic polynomial ring used in the standardized algorithm is used as an example. During the standardization process of NIST (National Institution of Standards and Technology), a series of optimization measures were used in Kyber to balance error rate, security strength, computing efficiency and communication bandwidth. Among them, in order to save communication bandwidth, the first round of candidate algorithms submitted by Kyber to NIST adopted the following Figure 2 Here, the public matrix A and the ciphertext are omitted. and c2, because in the design of Kyber (and similar schemes such as Aigis, AKC-MLWE, etc.), A is generated by a random 256-bit seed, and the compression of the ciphertext does not affect the security proof. Note that when the parameter p is smaller than the parameter q, the size of the public key can be compressed. In practical applications, p is generally chosen to be a positive integer slightly smaller than q, such as a difference of 1 to 3 bits.

[0058] In the corresponding IND-CPA security proof, two versions of the modulus LWE assumption are used to determine the public key and ciphertext Replace with corresponding random uniform elements. Figure 1 The standard LP design framework shown can be based on Figure 3 The reduction proof is completed by using the standard decision version modulo LWE problem shown in the figure, and then the IND-CPA security of the scheme is strictly reduced to the standard modulo LWE problem with appropriate parameters for theoretical security analysis. Figure 2 The design of the LP framework to compress the public key shown requires the use of Figure 3 The semi-uniform decision version shown in the figure is modulo the LWE problem to perform theoretical security reduction. Here, semi-uniform means generating LWE problem instances The public matrix of is not much different from A and can be calculated from A. More precisely, the public matrix A is compressed by the transformation and decompression Afterwards, the (matrix) spectral norm of the difference with the original matrix A is smaller.

[0059] Before the paper "Jia WJ, Zhang J, Xiang BW, Wang BC. Hardness of (M) LWE with semi-uniform seeds. Theoretical Computer Science, 2024, 994: 114481.", there was no theoretical reduction of the standard modulus LWE problem to the semi-uniform modulus LWE problem, so we adopted Figure 2 The theoretical IND-CPA security proof of the PKE scheme designed in the manner shown is heuristic. The security estimate of the related scheme is estimated by treating the semi-uniform LWE problem as a standard LWE problem. For this reason, starting from the second round of NIST, the Kyber design team cancelled the compression of public keys to eliminate the potential security risks / concerns caused by the lack of theoretical reduction to the scheme. This paper first gave the reduction of the standard LWE problem to the semi-uniform LWE problem, and then gave the use of Figure 2 The theoretical IND-CPA security evaluation method of the PKE scheme designed in the shown design approach.

[0060] However, since the reduction loss from the standard LWE problem to the semi-uniform LWE problem given in the above literature is too large, if the reduction method given in the above literature is used to evaluate the adoption Figure 2 When the theoretical IND-CPA security of the PKE scheme designed by the design method shown in the figure is considered, the corresponding security evaluation has a large loss. At this time, in order to achieve a certain security strength (such as a specific λ-bit security strength) in theory, the evaluation method given in the above literature will require the corresponding scheme's (calculation modulus, discrete Gaussian parameters, etc.) parameters or (ring) dimensions to be increased accordingly, thereby increasing the size of the public key / ciphertext of the corresponding PKE scheme and reducing the operating efficiency.

[0061] For adoption Figure 2 The IND-CPA security evaluation of the PKE scheme with the design method shown in the figure, the main problem solved by this application is: how to convert the semi-uniform modulus LWE problem with fixed parameters into the corresponding standard modulus LWE problem, reduce the reduction loss in the evaluation process so that the corresponding scheme can select smaller parameters when reaching a certain security strength, and thus the corresponding scheme can have more parameter selection, higher computational efficiency and smaller communication bandwidth.

[0062] The present invention draws on the reduction technique of Hint-LWE problem, and uses the joint Gaussian distribution analysis and other techniques to optimize the conversion process from the instance of the semi-uniform LWE problem to the instance of the standard LWE problem, thereby providing a more compact reduction method from the standard LWE problem to the semi-uniform LWE problem with smaller reduction loss. The problem conversion method provided by the present invention does not depend on the algebraic structure, and can be uniformly applied to corresponding problems defined on structures such as Euclidean lattices, ideal lattices, and modular lattices. At the same time, the conversion method provided by the present invention can maintain the dimension of the corresponding LWE problem, and the loss of the error Gaussian parameter is small. Furthermore, a more compact theoretical security assessment of the IND-CPA security of the LP framework PKE scheme designed using the public key compression method can be provided.

[0063] Theoretical introduction:

[0064] For a fixed set of parameters, the method for evaluating the theoretical IND-CPA security of LP-framed PKE schemes designed with public key compression is as follows: Figure 4 As shown, it can be summarized as first taking the IND-CPA of the corresponding scheme.

[0065] The security is reduced to the standard LWE problem + semi-uniform LWE problem, and then the corresponding semi-uniform LWE problem is reduced to the standard LWE problem with appropriate parameters. The solution complexity of the lower difficulty of the above two standard LWE problems (with different parameters) is used as the theoretical computational complexity of the PKE scheme.

[0066] The technical solution of the present invention focuses on improving the reduction process of the semi-uniform LWE problem to the standard LWE problem 2. Specifically, we use the technique of joint Gaussian distribution analysis to provide a new instance conversion method related to the semi-uniform LWE problem, converting the instance of the semi-uniform LWE problem into a sample form that is easy to embed into the standard LWE problem instance, thereby theoretically establishing the connection between the standard LWE problem and the semi-uniform LWE problem. The specific conversion is as follows Figure 5 As shown in the figure, the basic idea is to first use the properties of discrete Gaussian distribution, and first convert the error It is divided into two parts. Used to serve as the error part of the standard LWE problem; Used in Partially fully covered information so that even if it is known There is still enough entropy. In this way, we can use the properties of the joint Gaussian distribution (specifically Figure 6 As shown), select an appropriate and efficient distribution χ to resample so that The joint distribution of Finally, we use the properties of discrete Gaussian distribution to further transform the secret It is divided into two parts. Here, is the main part, acting as the secret part of the standard LWE problem, is the reduction loss. Parts can be sampled effectively, so we can embed instances of the standard LWE problem into Figure 5 In the example at the bottom, the reduction from the standard LWE problem to the semi-uniform LWE problem is completed.

[0067] By adopting the sample conversion method in the technical solution of the present invention, the standard LWE problem can be reduced to a semi-uniform LWE problem while maintaining the dimension of the corresponding grid.

[0068] The sample conversion method of the technical solution of the present invention is applicable to corresponding LWE problems defined on different structures such as Euclidean lattices, ideal lattices, modular lattices, and is applicable to the case where the rank of the modular lattice is k=O(1). At the same time, the sample conversion method of the technical solution of the present invention maintains the dimension of the (ideal / modular) lattice, and has no additional restrictions on the calculation of the modulus q.

[0069] The best results in the currently known public literature require that the calculated modulus q be a prime number with good splitting properties and that the secret distribution modulus The sample conversion method is also not applicable to the case of ring LWE problems and modular LWE problems with k = O(1). At the same time, its theoretical reduction has a loss of at least O(logn+logq) for the dimension of the lattice (the dimension of the lattice is the main factor in measuring the theoretical difficulty of related problems).

[0070] Embodiment 1

[0071] In view of the low hardware configuration of IoT application environment equipment, the cryptographic algorithm used is required to have the characteristics of simple calculation and small communication bandwidth. This paper proposes a design of a lattice key encapsulation protocol suitable for IoT application environment, which is designed with public key compression method, and also provides a specific theoretical security evaluation method.

[0072] The security of the key encapsulation scheme requires that K is computationally indistinguishable from a random uniform distribution. The compression of the ciphertext does not affect the security of the scheme. The pseudo-randomness of can be ensured by the standard decision version modulo LWE problem. The pseudo-randomness of the ciphertext c2 requires the assumption and The calculation is indistinguishable, where u is taken from Uniform distribution on .

[0073] Specific parameter meaning: q is a positive integer, which is the calculation modulus; is the public matrix / vector of the modular LWE problem, in uniformly selected; p is a positive integer, which is the calculation modulus after the public key is compressed, and is generally 1-3 bits smaller than the number of bits of q; T is the matrix transposition symbol; The secret vector modulo the LWE problem is selected from The appropriate parameter discrete Gaussian distribution on the LWE problem is selected from is a discrete Gaussian distribution with appropriate parameters on .

[0074] This embodiment discloses a theoretical security analysis method of a lattice PKE / KEM scheme based on a compressed public key design, including:

[0075] Step (1): Let Using the properties of discrete Gaussian distribution, the error e is decomposed into two parts, e1 and e2, and then Expressed as This form.

[0076] In this step, The introduction is only for convenience of representation. The theoretical role of this step is to decompose the error e so that it can be analyzed in the second step. Definition of is the public matrix / vector of the modular LWE problem, in Uniform selection. The purpose is to conduct subsequent analysis. The case of p and q can be publicly calculated.

[0077] Step (2): Utilize right The information masking effect can explain the known In the case of There is still enough entropy, and the conditional distribution can be calculated. Then we can Expressed as in Taken from an appropriate distribution. In the above way, the secret The sampling was taken from The corresponding appropriate distribution, and then in step (3) Split.

[0078] Step (3): Use the properties of discrete Gaussian distribution to calculate the secret The secret of decomposing it into a standard modulus LWE problem and redundant parts Then rewrite the sample form as So far, we can use the corresponding standard module LWE problem to evaluate the lower bound of the theoretical difficulty of the corresponding problem, and further evaluate the lower bound of the security strength of the KEM scheme.

[0079] Step (4): For the required security strength λ, according to the computational complexity of the corresponding standard module LWE problem, select the specific parameters of the scheme, specifically including the dimension n of the ring, the rank k of the modulus, the computational moduli p, q, and the Gaussian error parameter α, where n and correspond one by one, and only one needs to be determined.

[0080] The key encapsulation method is as follows:

[0081] Design of the key encapsulation scheme KEM(Setup,KeyGen,Enc,Dec)

[0082] Suppose (Con,Rec) is a key agreement algorithm that satisfies correctness and security. F is a publicly known pseudorandom function.

[0083] Step (S1): Parameter generation Setup(1 λ ): Select a cyclotomic polynomial ring with dimension n being a power of 2 according to the security parameter λ Calculate the modulus p < q, the Gaussian parameter α, and the rank k of the modulus. Return the parameters

[0084] Step (S2): Key generation KeyGen(pp): Select a 128-bit long random number seed according to the security parameter λ, and then use this random number to generate a public matrix in combination with F Sample from the discrete Gaussian distribution Calculate Return the public key The private key

[0085] The public matrix is a k×k matrix, and the matrix elements are taken from the ring is the secret vector (for the module LWE problem), and is an element in ; is the error vector (for the module LWE problem), and is an element in ; is the direct sum of k . is the discrete Gaussian distribution with parameter α on; α is a positive real number.

[0086] Step (S3): Key encapsulation Enc(pk): Recalculate the public matrix using seed Sampling discrete Gaussian distribution and calculate Finally, calculate the key K = Con (c2), and let the ciphertext Returns (K, ct).

[0087]

[0088] is the error vector (modulo the error vector of the LWE problem) and is Elements in for The vector in (Rounding sign defaults to polynomial rings Each coefficient in is used); for The vector in .

[0089] Step (S4): Key decapsulation Dec(ct,sk): Calculate Then, the Rec algorithm is used to calculate K=Rec(c2′) to obtain an n-bit session key.

[0090] Embodiment 2

[0091] The purpose of this embodiment is to provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the program.

[0092] Embodiment 3

[0093] The purpose of this embodiment is to provide a computer-readable storage medium.

[0094] A computer-readable storage medium stores a computer program, which executes the steps of the above method when executed by a processor.

[0095] Embodiment 4

[0096] The purpose of this embodiment is to provide a theoretical security analysis system for a lattice-based PKE / KEM scheme based on a compressed public key design, including:

[0097] The key encapsulation scheme acquisition module is configured to: obtain a key encapsulation scheme;

[0098] The first representation module is configured to use the properties of discrete Gaussian distribution to decompose e into two parts, e1 and e2, and then re-represent the parameters as

[0099] The second representation module is configured to: Expressed as in Taken from appropriate distribution;

[0100] The third representation module is configured to: reuse the properties of discrete Gaussian distribution to represent the secret The secret of decomposing it into a standard modulus LWE problem and redundant parts Then rewrite the sample form as

[0101] The evaluation module is configured to: The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated; the parameter selection module is configured as follows: for the required security strength λ, according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

[0102] Embodiment 5

[0103] The purpose of this embodiment is to provide a computer program product containing instructions, which, when running on a computer, enables the computer to execute the methods and functions involved in any of the above embodiments.

[0104] Embodiment 6

[0105] The purpose of this embodiment is to provide a basic IoT application model. Figure 7 As shown, the server initializes the KEM parameter pp, and then uses the KeyGen algorithm with the IoT device to generate their own public and private key pairs.

[0106] When communication is required between a server and a device or between devices, a communication device includes: an initiator and a receiver;

[0107] (1) The initiator uses the receiver's public key to run the key encapsulation algorithm KEM.Enc to obtain the session key K and ciphertext ct. It then uses the key K to calculate the encrypted ciphertext ct' of the message using a block encryption algorithm (such as AES), and sends the ciphertext ct and the encrypted ciphertext ct' to the receiver.

[0108] (2) The receiver first uses KEM.Dec to decapsulate ct to obtain the key K, and then uses the block encryption algorithm to decrypt ct' to obtain the plaintext. Within a certain period of time (key life cycle), the two communicating parties can use this session key K to continue communicating.

[0109] The key encapsulation algorithm KEM.Enc is obtained through the theoretical security analysis method or system of the lattice PKE / KEM scheme designed based on compressed public keys.

[0110] The steps involved in the apparatus of the above embodiment correspond to the method embodiment 1, and the specific implementation method can refer to the relevant description part of embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood to include any medium that can store, encode or carry an instruction set for execution by a processor and enable the processor to execute any method in the present invention.

[0111] Those skilled in the art should understand that the modules or steps of the present invention described above can be implemented by a general-purpose computer device, or alternatively, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0112] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. The theoretical security analysis method of the lattice PKE / KEM scheme based on compressed public key design is characterized by: include: Obtain a key encapsulation scheme, which is a lattice PKE / KEM scheme based on compressed public key design; Using the properties of discrete Gaussian distribution, the error e in the key encapsulation algorithm is decomposed into two parts, e1 and e2, and the parameters are re-expressed as The secret vector modulo the LWE problem is selected from The appropriate parameter discrete Gaussian distribution on the LWE problem is selected from discrete Gaussian distribution with appropriate parameters on ; Definition of is the public matrix / vector of the modular LWE problem, in Uniform selection; q is a positive integer, which is the calculation modulus; p is a positive integer, which is the calculation modulus after the public key is compressed; Will Expressed as in Taken from appropriate distribution; Then use the properties of discrete Gaussian distribution to The secret of decomposing it into a standard modulus LWE problem and redundant parts Then rewrite the sample form as use The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated; For the required security strength λ, according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

2. The theoretical security analysis method of the lattice PKE / KEM scheme based on compressed public key design as claimed in claim 1 is characterized in that: The key encapsulation scheme security requirements: The key K is computationally indistinguishable from a random uniform distribution; The compression of ciphertext does not affect the security of the scheme; Ciphertext The pseudo-randomness of can be ensured by the standard decision version modulo the LWE problem; The pseudo-randomness of the ciphertext c2 requires the assumption and The calculation is indistinguishable, where u is taken from Uniform distribution on .

3. The theoretical security analysis method of the lattice PKE / KEM scheme based on compressed public key design as claimed in claim 1 is characterized in that: The steps to obtain the key encapsulation scheme are: Parameter generation Setup(1 λ ); Key generationKeyGen(pp); Key encapsulation Enc(pk); Key decapsulation Dec(ct,sk).

4. The theoretical security analysis method of the lattice PKE / KEM scheme based on compressed public key design as claimed in claim 3 is characterized in that the parameter Generate Setup(1 λ ):Select a cyclotomic polynomial ring with dimension \(n\) being a power of 2 according to the security parameter \(\lambda\). Calculate modulus \(p \lt q\), Gaussian parameter \(\alpha\) and the rank \(k\) of the modulus, and return the parameters 5. The theoretical security analysis method of the lattice PKE / KEM scheme based on compressed public key design as claimed in claim 3 is characterized in that: Key generation KeyGen(pp): Select a 128-bit random number seed based on the security parameter λ, and then use this random number combined with F to generate the public matrix Sampling discrete Gaussian distribution calculate Returns the public key pk = (seed, d), the private key sk = s.

6. The theoretical security analysis method of the lattice PKE / KEM scheme based on compressed public key design as claimed in claim 3 is characterized in that: Key encapsulation Enc(pk): Recalculate the public matrix using seed Sampling discrete Gaussian distribution and calculate Finally, calculate the key K = Con (c2), and let the ciphertext return (K, ct); Prioritize, key decapsulation Dec(ct,sk): Calculate Then, the Rec algorithm is used to calculate K=Rec(c2′) to obtain an n-bit session key; Prior to the step of obtaining the key encapsulation scheme, it is assumed that (Con, Rec) is a key consensus algorithm that satisfies correctness and security, and F is a public pseudo-random function.

7. The theoretical security analysis system of the lattice PKE / KEM scheme based on compressed public key design is characterized by: include: The key encapsulation scheme acquisition module is configured to: obtain a key encapsulation scheme, where the key encapsulation scheme is a lattice PKE / KEM scheme designed based on a compressed public key; The first representation module is configured to: use the properties of discrete Gaussian distribution to decompose the error e in the key encapsulation algorithm into two parts, e1 and e2, and then re-express the parameters as The secret vector modulo the LWE problem is selected from The appropriate parameter discrete Gaussian distribution on the LWE problem is selected from discrete Gaussian distribution with appropriate parameters on ; Definition of is the public matrix / vector of the modular LWE problem, in Uniform selection; q is a positive integer, which is the calculation modulus; p is a positive integer, which is the calculation modulus after the public key is compressed; Will Expressed as in Taken from appropriate distribution; The second representation module is configured to: Expressed as in Taken from appropriate distribution; The third representation module is configured to: reuse the properties of discrete Gaussian distribution to represent the secret The secret of decomposing it into a standard modulus LWE problem and redundant parts Then rewrite the sample form as The evaluation module is configured to: The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated; The parameter selection module is configured to: for the required security strength λ, according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

8. A communication device, characterized in that it comprises: The initiator and the receiver; The initiator uses the receiver's public key to run the key encapsulation algorithm KEM.Enc to obtain the session key K and ciphertext ct. Then it uses the key K to calculate the encrypted ciphertext ct' of the message using the block encryption algorithm, and sends the ciphertext ct and the encrypted ciphertext ct' to the receiver. The receiver first uses KEM.Dec to decapsulate ct to obtain the key K, and then uses the block encryption algorithm to decrypt ct′ to obtain the plaintext. Within a certain period of time, the two communicating parties continue to communicate using the session key K; The key encapsulation algorithm KEM.Enc is obtained through the theoretical security analysis method of the lattice PKE / KEM scheme based on compressed public key design described in any of claims 1 to 6 or the system described in claim 7.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are performed.

Images