Security analysis method for post-quantum NTRU cryptographic algorithm

Abstract

The invention provides a security analysis method for a post-quantum NTRU cryptographic algorithm, and the method comprises the steps: an attacker carries out the sampling of a public key, and obtains a public key sample, different private keys g with a public Hamming weight, and a fixed target private key; according to each public key sample and information disclosed by the Hamming weight of the private key, establishing a modular equation, and solving the modular equation by combining a linear technology and a preset initial value; obtaining a complete value of the second polynomial based on a linear relation between the equation set solution and other parts except the constant term in the second polynomial and a linear relation between a preset initial value and the constant term of the second polynomial; and according to the public key sample and the complete value of the second polynomial, utilizing a GS algorithm to obtain a speculative value of the target private key, and according to the relationship between the speculative value and the actual value of the target private key, carrying out security analysis on the password security system. The private key is recovered by using the relation between the solution of the modular equation and the private key, and the bottleneck of the existing technical means is broken through.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a security analysis method for a post-quantum NTRU cryptographic algorithm. Background Art

[0002] Security analysis of public-key cryptosystems primarily involves assessing their security and analyzing potential vulnerabilities. Public-key cryptosystems, also known as asymmetric cryptosystems, use a pair of keys: a public key for encryption and a private key for decryption. Security analysis methods include constructing general lattice algorithms and implementing specific cryptographic attacks. For example, the security analysis of lattice-based public-key cryptosystems is conducted from two perspectives: constructing general lattice algorithms and implementing cryptographic attacks. The goal is to reduce the time complexity of the shortest vector problem and propose new lattice basis reduction algorithms and more effective attack methods.

[0003] Existing technologies typically derive secret information, such as private keys or plaintext, from publicly available information (e.g., public keys and ciphertext). While this analytical approach can effectively assess the theoretical security of cryptographic systems, in practical applications, keys are often reused across multiple communication sessions to reduce communication overhead or improve computational efficiency. While this key reuse mechanism can optimize system performance, it also poses potential security risks: attackers could collect public parameters from multiple sessions and employ cryptanalysis to gradually narrow the search space for private keys, ultimately achieving complete recovery of the secret information. Therefore, the conflict between key reuse and system security in existing technologies urgently needs to be resolved through technological innovation. Summary of the Invention

[0004] The present invention provides a security analysis method for the post-quantum NTRU cryptographic algorithm, the main purpose of which is to realize multi-key attacks on private keys under specific conditions, breaking through the limitations of existing attack methods.

[0005] The embodiment of the present invention provides a security analysis method for the post-quantum NTRU cryptographic algorithm. Each data packet corresponds to a public key and a private key pair, wherein the private key pair includes a first private key and a second private key. Each data packet generates a different public key by replacing the first private key in the corresponding private key pair. The second private key in the private key pair corresponding to each data packet is the same target private key. The target private key is a first polynomial. The target private key is expressed as express, , , is a ternary polynomial publicly known by Hamming weight, the first private key is a ternary polynomial publicly known by Hamming weight, the first private key is g It is characterized in that the security analysis method includes: The attacker samples the public key and obtains public key samples, the first private key g and the target private key f ,in, is a positive integer; According to each public key sample and the first private key Hamming weight public information, establish a modular equation for each public key sample, and combine linear technology with preset initial values ​​to Solve modular equations; Based on the linear relationship between the solution of the system of equations and the rest of the second polynomial except the constant term, the rest of the second polynomial except the constant term is obtained, and then according to the relationship between the preset initial value and the constant term in the second polynomial, the constant term of the second polynomial is obtained, thereby obtaining the complete value of the second polynomial. The second polynomial is ,and, yes conjugation of; According to each public key sample and the complete value of the second polynomial, the estimated value of the target private key is obtained, and the security analysis of the cryptographic security system is performed according to the estimated value of the target private key and the actual value of the target private key.

[0006] Furthermore, according to the information disclosed by each public key sample and the Hamming weight of the first private key g, a modular equation is established for each public key sample, wherein the modular equation corresponding to each public key sample is shown in formula (1) to formula (3): ; (1) ; (2) ; (3) in, Represents each public key sample, function Representing the coefficient notation of a polynomial, function represents the circulant matrix form corresponding to the polynomial, is a positive integer, h It is public, so It is public. g is unknown, but It is public.

[0007] Furthermore, the combination of linear technology and preset initial value The steps to solve the modular equation include: By using linearization technology and introducing new variables for further deduction, we can obtain the intermediate mode equations, as shown in formulas (4) to (8): , ; (4) ; (5) ; (6) ; (7) ; (8) in, Denotes the introduction of a new variable, and N denotes the upper bound of the highest degree of the polynomial.

[0008] Furthermore, the combination of linear technology and preset initial value The modular equations are solved, further including: Based on the linear relationship between the coefficients in the modular equation corresponding to each public key sample, further deduction is performed to obtain the final modular equation, as shown in formulas (9) to (12): , ; (9) , ; (10) ; (11) , ; (12) in, represents the preset initial value, 、 、 All represent subscripts.

[0009] Furthermore, choose one of the three numbers -1, 0 and 1 as The coefficients and moduli in formula (5) are simplified according to formulas (9), (10), and (12), and the system of equations (11) with a unique solution is obtained.

[0010] Furthermore, the attacker samples the public key and obtains public key samples, different private keys g with Hamming weights, and a fixed target private key , the steps include: The attacker keeps the target private key unchanged during each sampling process and samples different first private keys g, and obtains the public key samples with different values ​​according to the following formula (13): ; (13) in, Represents each public key sample, Is a positive integer.

[0011] Furthermore, the step of obtaining the estimated value of the target private key based on each public key sample and the complete value of the second polynomial includes: Obtaining a principal ideal basis of the target private key according to each public key sample and the second polynomial; According to the principal ideal basis of the target private key and the complete value of the second polynomial, the GS algorithm is used to obtain the estimated value of the private key to be recovered.

[0012] Furthermore, the security analysis of the cryptographic security system is performed based on the estimated value of the target private key and the actual value of the target private key, the steps comprising: If the estimated value of the target private key is the same as the actual value of the target private key, it indicates that the security of the cryptographic security system is low; If the estimated value of the target private key is different from the actual value of the target private key, it indicates that the security of the cryptographic security system is high.

[0013] The security analysis method for the post-quantum NTRU cryptographic algorithm proposed in this invention has the following technical effects: (1) For the first time, the private key Under the circumstances of the multi-key attack on the NTRU cipher, the limitations of existing attack methods are broken. (2) Under the multi-key model, by collecting multiple public keys, constructing a linear modular equation system, and using the solution of the equation system to recover the key, the success rate of the present invention can reach more than 90%, which has high practicality and reliability. (3) It provides a clear direction for adjusting the parameters of the NTRU algorithm when encrypting data packets, avoiding the use of insecure private key structures; at the same time, it can also help cipher designers detect vulnerabilities in NTRU implementations and improve the security of public key cryptography systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A flowchart of encryption using the NTRU cryptographic algorithm in the prior art; Figure 2 An encryption flow chart of a post-quantum NTRU cryptographic algorithm provided in an embodiment of the present invention; Figure 3 This is a flowchart of an attack method based on multi-key NTRU provided in an embodiment of the present invention.

[0015] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0016] The embodiments of the present application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application and are not to be construed as limiting the present application.

[0017] In order to enable those skilled in the art to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0018] In the embodiments of the present application, at least one refers to one or more; a plurality refers to two or more. In the description of the present application, words such as "first", "second", and "third" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order. In addition, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0019] References to "one embodiment" or "some embodiments" in this specification mean that a particular feature, structure, or characteristic described in conjunction with that embodiment is included in one or more embodiments of the present application. Thus, the terms "including," "comprising," "having," and their variations in this specification all mean "including but not limited to," unless otherwise specifically stated.

[0020] In the existing technology, the NTRU cryptographic algorithm is a typical post-quantum public key cryptographic system, and its private key is composed of two polynomials with a specific mathematical structure. Figure 1 This is a flowchart of encryption using the NTRU cryptographic algorithm in the prior art, such as Figure 1 As shown in the figure Representing polynomials The number of elements with coefficient "1" in Indicates the number of elements with coefficients of "1" or "-1" in the private key g, Indicates the quotient ring , Indicates the quotient ring , is a large prime number, , Represents the public key , Represents a private key pair , The number of coefficients "1" is The number of coefficients is "-1" The set of three-variable polynomials; The number of coefficients "1" is The number of coefficients with a value of "-1" is A set of three-variable polynomials.

[0021] In the prior art, there is a multi-key model based on NTRU: by fixing one polynomial parameter and dynamically adjusting the other polynomial, this can improve the efficiency of encryption and decryption operations to a certain extent while reducing communication costs. However, this method of fixing partial keys has exposed new security flaws in actual deployment: when the communicating parties generate multiple differentiated public keys through a key generation algorithm while keeping some private key parameters constant and publicly transmit them, attackers can use the multiple sets of public key data to construct a mathematical relationship model. Specifically, the multi-key attack method based on NTRU can effectively reconstruct the complete private key parameters that the communicators should have kept secret by analyzing the algebraic correlation between these public keys.

[0022] In the field of NTRU-based cryptanalysis, existing key recovery technologies mainly adopt the following technical routes: first, a modular linear equation system is constructed by collecting a sufficient number of public key samples, and the uniqueness of the solution of the modular equation system is ensured when the number of equations meets specific conditions; then, the basis of the principal ideal of the target private key is denoted as as well as As the input of the Gentry-Szudlo (GS) algorithm, the target private key is obtained. However, this technical solution has obvious application limitations: its effectiveness strictly depends on the private key Selection method.

[0023] With the widespread application of the NTRU encryption algorithm, its parameter selection schemes are showing a trend of diversification. To improve the efficiency of algorithm implementation, the current mainstream schemes, such as the algorithms collected by the National Institute of Standards and Technology (NIST) for post-quantum cryptography standards, such as NTRUEncrypt (a public key encryption algorithm based on lattice theory, proposed by Jeffrey Hoffstein, Jill Pipher and Joseph H. Silverman in 1996) or NTRU-HPS (a patented open source public key encryption system that uses a lattice-based encryption algorithm to encrypt data, including two algorithms: NTRUEncrypt for encryption and NTRUSign for digital signatures.), are generally adopted. The private key optimized form of is a fixed parameter (usually ), is a ternary polynomial with public Hamming weight.

[0024] In the prior art, the solution of a system of linear equations is usually performed under a specific modulus. Therefore, the solution of the system of equations is limited to the values ​​obtained under modular operation. However, the premise of calling the GS algorithm is to obtain the solution of the linear equations under the integer ring. When the coefficient of the private key is small, the solution of the system of equations under modular operation is equal to the solution on the integer ring. However, this kind of situation is not common and depends on the size of the integer solution and the structure of the system of equations. As the coefficient of the private key increases, the limitations introduced by the modular operation will make it impossible to accurately restore the integer solution from the modular solution, which will lead to the failure of the key recovery process. Therefore, how to recover the private key in the mainstream scheme under the multi-key NTRU model? The sampling method is still an unresolved issue.

[0025] In response to the above issues, Figure 2 An encryption flow chart of a post-quantum NTRU cryptographic algorithm provided by an embodiment of the present invention is as follows: Figure 2 As shown, the communicator uses the NTRU algorithm to encrypt the data packets to be sent, and each data packet corresponds to a public key and a private key pair The private key pair includes a first private key and a second private key. Each time encryption is performed, a different public key is generated by replacing the first private key. and the common target private key , but the target private key remains unchanged during the entire communication process. The target private key is the first polynomial, and the first polynomial is used express, , , is a ternary polynomial with a public Hamming weight, and the security analysis method includes: This embodiment of the present invention provides a security analysis method for the post-quantum NTRU cryptographic algorithm. This method is primarily used to analyze the security of public-key cryptographic systems. Public-key cryptographic systems are primarily used for encryption / decryption, digital signatures, and key exchange. They can also be applied to digital certificates and authentication systems. Digital certificates are used to verify digital identities and ensure secure network communications. Authentication systems protect sensitive data and resources by verifying user identities.

[0026] For example, in e-commerce, merchants can use NTRU key encryption technology to verify customer identities and ensure transaction security. The user, acting as the communicator, enters their website account and password, which is then encrypted using the NTRU algorithm and sent to the merchant's client.

[0027] In order to verify the encryption performance of the e-commerce system, the attacker samples the public key of each data packet and recovers the target private key through the following steps. If the recovered target private key is the same as the target private key generated when the previous data packet was encrypted, it means that the e-commerce system has not prevented the attack and the security of the e-commerce system is insufficient. If the recovered target private key is different from the target private key generated when the previous data packet was encrypted, it means that the e-commerce system has prevented the attack and the security of the e-commerce system is sufficient.

[0028] The NTRU (Number Theory Research Unit) algorithm is a public-key system invented in 1996 by three mathematics professors at Brown University. NTRU is a relatively new public-key system. Because it generates keys more easily and encrypts and decrypts much faster than well-known algorithms like RSA, it has become a hot topic in post-quantum public-key research.

[0029] The embodiment of the present invention is only applicable to the public key generated by the NTRU encryption algorithm and the target private key. 、 、 is the case of a ternary polynomial whose Hamming weight is public.

[0030] S10, the attacker samples the public key and obtains public key samples, the first private key g and the target private key f ,in, is a positive integer; Figure 3 A flowchart of an attack method based on multi-key NTRU provided in an embodiment of the present invention is shown in FIG. Figure 3As shown, the embodiment of the present invention removes the relevant parts of the coefficients in the constructed equation group through linearization technology, thereby realizing the attack on the multi-key NTRU.

[0031] Step 1: Set parameters , the attacker samples the public key of the data packet and obtains A sample public key.

[0032] Specifically, the attacker keeps the target private key unchanged during each sampling process and samples different first private keys g. According to the formula Get public key samples with different values, among which, represents a public key sample, The first private key is the Hamming weight of the public key, Is a positive integer.

[0033] S20, based on the information disclosed by each public key sample and the Hamming weight of the first private key g, a modular equation is established for each public key sample, and a linear technique and a preset initial value are combined to calculate the modular equation. Solve modular equations; Step 2: For each public key sample, obtain a modular equation system based on the public property of the Hamming weight of the first private key g. Specifically, for one public key sample: ,according to the nature of Representing the number of elements with coefficients of "1" or "-1" in the private key g, the following modular equation is constructed: ; ; ; in, Represents each public key sample, The function represents the first private key with Hamming weight public. Representing the coefficient notation of a polynomial, function represents the circulant matrix form corresponding to the polynomial, is a positive integer, h It is public, so It is public. g is unknown, but It is public.

[0034] Step 3: Using linearization techniques, by introducing new variables: , ; get A modular equation as follows: ; ; ; ; in, Represents the introduced new variable, and N represents the upper bound of the highest degree of the polynomial.

[0035] Step 4: Based on the linear relationship between the coefficients in the equation system: , ; , The new modular equation can be deduced as follows: ; in, , At this time, the number of unknown variables is reduced from the original Reduce to .

[0036] The embodiment of the present invention reduces the complexity of the method and improves the efficiency by removing the correlated parts between coefficients in the equation, retaining the uncorrelated parts, and using linear technology to reduce the number of variables in the equation.

[0037] It should be noted that: , , and the proof process is as follows: Known , ,So: .

[0038] for , The proof process is as follows: Known , ; So, .

[0039] so , .

[0040] for , and the proof process is as follows: Known , and , ,and , It can be deduced that: ; again , ,so: .

[0041] Step 5: Choose one of the three numbers -1, 0 and 1 as The number of unknown variables in the equation system becomes The embodiment of the present invention is guessed The value of can reduce the number of variables again.

[0042] Step 6: Further, by removing the common factors between the coefficients and the modulus in the equation, the coefficients and the modulus are simplified to obtain a modular linear equation system with a unique solution, namely: .

[0043] S30, based on the linear relationship between the solution of the system of equations and the rest of the second polynomial except the constant term, obtain the rest of the second polynomial except the constant term, and then obtain the constant term of the second polynomial according to the relationship between the preset initial value and the constant term in the second polynomial, thereby obtaining the complete value of the second polynomial, wherein the second polynomial is ,and, yes conjugation of; Step 7: Based on the solution of the system of equations and The linear relationship between the rest of the components except the constant term is: , ,get The rest except the constant term.

[0044] It should be noted that the proof process is as follows: Known ,make ,according to , , , . Further, when , we can deduce that: ; ; ; ; … , ; ; … ; Adding the above formulas together we get: = = ;because , , it can be deduced that , . And because ,so .

[0045] Step 8: Then according to The selected value and The relationship between the constant terms, that is, (where function represents the Hamming weight of the polynomial), we get Combined with step 7 to restore the complete polynomial .

[0046] S40, obtaining a presumed value of the target private key according to each public key sample and the complete value of the second polynomial, and performing a security analysis on the cryptographic security system according to the presumed value of the target private key and the target private key.

[0047] Step 9: Obtain the principal ideal basis of the target private key according to each public key sample and the complete value of the second polynomial.

[0048] Step 10: According to the basis of the principal ideal of the target private key and the complete value of the second polynomial, the estimated value of the target private key is obtained using the GS algorithm.

[0049] Specifically, if the estimated value of the target private key is the same as the target private key, it means that the security of the cryptographic security system is low; if the estimated value of the target private key is different from the target private key, it means that the security of the cryptographic security system is high.

[0050] The existing technology for selecting parameters for private keys has the problem that the solution in the integer sense and the solution in the modular operation sense are inconsistent, making it impossible to recover the private key. The highlight of the embodiment of the present invention is to effectively construct a new modular equation system and use the relationship between the solution of the modular equation and the private key to recover the private key, breaking through the bottleneck of the existing technical means. In summary, the security analysis method for the post-quantum NTRU cryptographic algorithm proposed in the present invention has the following technical effects: (1) For the first time, the private key In this case, the multi-key attack on the NTRU cipher breaks through the limitations of existing attack methods.

[0051] (2) Under the multi-key model, by collecting multiple public keys, constructing a linear modular equation system, and using the solution of the equation system to recover the key, the success rate of the present invention can reach more than 90%, which has high practicality and reliability.

[0052] (3) It provides a clear direction for adjusting parameters when the NTRU algorithm encrypts data packets, avoiding the use of insecure private key structures. At the same time, it can also help cryptographic designers detect vulnerabilities in NTRU implementations and improve the security of public key cryptographic systems.

[0053] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0054] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0055] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A security analysis method for the post-quantum NTRU cryptographic algorithm, applied to the security analysis of the public key cryptographic system, wherein the communicator uses the NTRU algorithm to encrypt the data packets to be sent, and each data packet corresponds to a public key and a private key pair, wherein the private key pair includes a first private key and a second private key. Each data packet generates a different public key by replacing the first private key in the corresponding private key pair. The second private key in the private key pair corresponding to each data packet is the same target private key, and the target private key is the first polynomial. The target private key is expressed as express, , , is a ternary polynomial publicly known by Hamming weight, the first private key is a ternary polynomial publicly known by Hamming weight, the first private key is g It is characterized by The safety analysis method comprises: The attacker samples the public key and obtains public key samples, the first private key g and the target private key f ,in, is a positive integer; According to each public key sample and the first private key Hamming weight public information, establish a modular equation for each public key sample, and combine linear technology with preset initial values ​​to Solve modular equations; Based on the linear relationship between the solution of the system of equations and the rest of the second polynomial except the constant term, the rest of the second polynomial except the constant term is obtained, and then according to the relationship between the preset initial value and the constant term in the second polynomial, the constant term of the second polynomial is obtained, thereby obtaining the complete value of the second polynomial. The second polynomial is ,and, yes conjugation of; Based on each public key sample and the complete value of the second polynomial, an estimated value of the target private key is obtained, and based on the relationship between the estimated value of the target private key and the actual value of the target private key, a security analysis of the cryptographic security system is performed.

2. The security analysis method for the post-quantum NTRU cryptographic algorithm according to claim 1 is characterized in that: According to the information disclosed by each public key sample and the Hamming weight of the first private key g, a modular equation is established for each public key sample, wherein the modular equation corresponding to each public key sample is shown in formulas (1) to (3): ；（1） ；（2） ；（3） in, Represents each public key sample, function Indicates the coefficient representation of the polynomial in brackets, function Indicates the circulant matrix form corresponding to the polynomial in the brackets, is a positive integer, h It is public, so It is public. g is unknown, but It is public.

3. The security analysis method for the post-quantum NTRU cryptographic algorithm according to claim 2 is characterized in that: The combination of linear technology and preset initial value The steps to solve the modular equation include: By using linearization technology and introducing new variables for further deduction, we can obtain the intermediate mode equations, as shown in formulas (4) to (8): ， ；（4） ；（5） ；（6） ；（7） ；（8） in, Denotes the introduction of a new variable, and N denotes the upper bound of the highest degree of the polynomial.

4. The security analysis method for the post-quantum NTRU cryptographic algorithm according to claim 3 is characterized in that: The combination of linear technology and preset initial value The modular equations are solved, further including: Based on the linear relationship between the coefficients in the modular equation corresponding to each public key sample, further deduction is performed to obtain the final modular equation, as shown in formulas (9) to (12): ， ；（9） ， ；（10） ；（11） ， ；（12） in, represents the preset initial value, 、 、 All represent subscripts.

5. The security analysis method for the post-quantum NTRU cryptographic algorithm according to claim 4 is characterized in that: Choose one from -1, 0 and 1 as The coefficients and moduli in formula (5) are simplified according to formulas (9), (10), and (12), and the system of equations (11) with a unique solution is obtained.

6. The security analysis method for the post-quantum NTRU cryptographic algorithm according to claim 1, characterized in that: The attacker samples the public key and obtains Public key samples, different private keys with Hamming weights And the fixed target private key , the steps include: The attacker keeps the target private key unchanged during each sampling process and samples different first private keys g, and obtains the public key samples with different values ​​according to the following formula (13): ；（13） in, Represents each public key sample, Is a positive integer.

7. The security analysis method for the post-quantum NTRU cryptographic algorithm according to claim 1, characterized in that: The step of obtaining a guess value of the target private key based on each public key sample and the complete value of the second polynomial includes: Obtaining a principal ideal basis of the target private key according to each public key sample and the complete rounding of the second polynomial; The estimated value of the target private key is obtained by using the GS algorithm according to the basis of the principal ideal of the target private key and the complete value of the second polynomial.

8. The security analysis method for the post-quantum NTRU cryptographic algorithm according to claim 1, characterized in that: The step of performing security analysis on the cryptographic security system based on the relationship between the estimated value of the target private key and the actual value of the target private key comprises: If the estimated value of the target private key is the same as the actual value of the target private key, it indicates that the security of the cryptographic security system is low; If the estimated value of the target private key is different from the actual value of the target private key, it indicates that the security of the cryptographic security system is high.

Images