A security analysis method for a post-quantum NTRU cryptographic algorithm

Abstract

The application provides a security analysis method for a post-quantum NTRU cryptographic algorithm, which comprises the following steps: an attacker samples a public key to obtain a plurality of public key samples, a different private key g with a Hamming weight open to the public, and a fixed target private key; a modular equation is established according to each public key sample and the private key Hamming weight open-to-the-public information, and the plurality of modular equations are solved in combination with a linear technique and a preset initial value; based on a linear relationship between the equation set solution and the rest of a second polynomial except for a constant term and a linear relationship between the preset initial value and the constant term of the second polynomial, a complete value of the second polynomial is obtained; a guess value of the target private key is obtained by using a GS algorithm according to the public key sample and the complete value of the second polynomial, and a security analysis is performed on a cryptographic security system according to a relationship between the guess value and an actual value of the target private key. The application restores the private key by using the relationship between the solution of the modular equation and the private key, and breaks through the bottleneck of the prior art means.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a security analysis method for post-quantum NTRU cryptographic algorithms. Background Technology

[0002] Security analysis of public-key cryptosystems primarily involves assessing their security and analyzing potential vulnerabilities. Public-key cryptosystems, also known as asymmetric cryptosystems, use a pair of keys: a public key for encryption and a private key for decryption. Security analysis methods include constructing general lattice algorithms and implementing specific cryptographic attacks. For example, security analysis of lattice-based public-key cryptosystems is conducted through two dimensions: constructing general lattice algorithms and implementing cryptographic attacks. The aim is to reduce the time complexity of the shortest vector problem and to propose new lattice basis reduction algorithms and more efficient attack methods.

[0003] Existing technologies typically derive private keys or plaintext from publicly available information (such as public keys and ciphertext). While this analytical method can effectively assess the theoretical security of cryptographic systems, in practical applications, keys are often reused across multiple communication sessions to reduce communication overhead or improve computational efficiency. Although this key reuse mechanism can optimize system performance, it introduces potential security vulnerabilities: attackers could collect publicly available parameters from multiple sessions, use cryptanalysis techniques to gradually narrow down the search space for the private key, and ultimately achieve complete recovery of the secret information. Therefore, the contradictory relationship between key reuse and system security in existing technologies urgently needs to be addressed through technological innovation. Summary of the Invention

[0004] This invention provides a security analysis method for the post-quantum NTRU cryptographic algorithm. Its main purpose is to realize multi-key attacks on the private key under specific conditions, thus overcoming the limitations of existing attack methods.

[0005] This invention provides a security analysis method for the post-quantum NTRU cryptographic algorithm. Each data packet corresponds to a public key and a private key pair, wherein the private key pair includes a first private key and a second private key. Each data packet generates a different public key by changing the first private key in the corresponding private key pair. The second private key in the private key pair corresponding to each data packet is the same target private key, which is a first polynomial. The target private key is used... express, , , It is a ternary polynomial publicly disclosed by the Hamming weight, and the first private key is a ternary polynomial publicly disclosed by the Hamming weight. The first private key is used... g The method is characterized in that it includes:

[0006] The attacker samples the public key to obtain... A public key sample, the first private key g and the target private key f ,in, It is a positive integer;

[0007] Based on each public key sample and the first private key The Hamming weight publicly disclosed information establishes a modular equation for each public key sample, and combines linear techniques with preset initial values ​​to... Solve the modular equations;

[0008] Based on the linear relationship between the solution of the system of equations and the remaining part of the second polynomial excluding the constant term, the remaining part of the second polynomial excluding the constant term is obtained. Then, according to the relationship between the preset initial value and the constant term in the second polynomial, the constant term of the second polynomial is obtained, thus obtaining the complete value of the second polynomial. The second polynomial is... ,and, yes The conjugate;

[0009] Based on each public key sample and the complete value of the second polynomial, the predicted value of the target private key is obtained, and the security analysis of the cryptographic security system is performed based on the predicted value of the target private key and the actual value of the target private key.

[0010] Furthermore, based on the publicly disclosed information of each public key sample and the Hamming weight of the first private key g, a modular equation is established for each public key sample, wherein the modular equation corresponding to each public key sample is shown in formulas (1) to (3):

[0011] (1)

[0012] (2)

[0013] (3)

[0014] in, Representing each public key sample, the function Coefficient representation of a polynomial, function This represents the cyclic matrix form corresponding to the polynomial. It is a positive integer. h It is public, so It is public. g It is unknown, but It is public.

[0015] Furthermore, the combination of linear techniques and preset initial values... Solving the modular equation involves the following steps:

[0016] Using linearization techniques, new variables are introduced for further derivation, resulting in intermediate module equations, as shown in equations (4) to (8):

[0017] , (4)

[0018] (5)

[0019] (6)

[0020] (7)

[0021] (8)

[0022] in, This indicates the introduction of a new variable, where N represents the upper bound of the degree of the highest term of the polynomial.

[0023] Furthermore, the combination of linear techniques and preset initial values... Solving the modular equations further includes:

[0024] Based on the linear relationship between the coefficients in the modular equation corresponding to each public key sample, further derivation is performed to obtain the final modular equation, as shown in formulas (9) to (12):

[0025] , (9)

[0026] , (10)

[0027] (11)

[0028] , (12)

[0029] in, This represents the preset initial value. , , Both indicate subscripts.

[0030] Furthermore, choose one of the three numbers -1, 0, and 1 as... The values ​​of are simplified according to formulas (9), (10), and (12) to obtain a system of equations (11) with a unique solution.

[0031] Furthermore, the attacker samples the public key to obtain... A public key sample, different private keys g publicly disclosed by the Hamming weight, and a fixed target private key. The steps include:

[0032] The attacker keeps the target private key unchanged during each sampling process and samples different first private keys g, obtaining public key samples with different values ​​according to the following formula (13):

[0033] (13)

[0034] in, This represents each public key sample. It is a positive integer.

[0035] Further, the step of obtaining the predicted value of the target private key based on each public key sample and the complete value of the second polynomial includes:

[0036] The basis of the principal ideal of the target private key is obtained based on each public key sample and the second polynomial;

[0037] Based on the base of the primary ideal of the target private key and the complete value of the second polynomial, the GS algorithm is used to obtain the estimated value of the private key to be recovered.

[0038] Furthermore, the step of performing a security analysis on the cryptographic security system based on the estimated value of the target private key and the actual value of the target private key includes:

[0039] If the predicted value of the target private key is the same as the actual value of the target private key, it indicates that the security of the cryptographic security system is low.

[0040] If the predicted value of the target private key is different from the actual value of the target private key, it indicates that the cryptographic security system has high security.

[0041] The security analysis method for post-quantum NTRU cryptographic algorithms proposed in this invention has the following technical advantages:

[0042] (1) For the first time, it was achieved that when the private key satisfies In the case of NTRU cryptography, the multi-key attack breaks through the limitations of existing attack methods. (2) Under the multi-key model, by collecting multiple public keys, constructing a linear modular equation system, and using the solution of the equation system to recover the key, the success rate of this invention can reach more than 90%, which has high practicality and reliability. (3) It provides a clear direction for parameter adjustment when the NTRU algorithm encrypts data packets, avoiding the use of insecure private key structures; at the same time, it can also help cryptographic designers detect vulnerabilities in the NTRU implementation and improve the security of public key cryptographic systems. Attached Figure Description

[0043] Figure 1 A flowchart illustrating encryption using the NTRU cryptographic algorithm in existing technologies;

[0044] Figure 2 An encryption flowchart of a post-quantum NTRU cryptographic algorithm provided in an embodiment of the present invention;

[0045] Figure 3 This is a flowchart illustrating an attack method based on multi-key NTRU provided in an embodiment of the present invention.

[0046] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0047] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0048] To enable those skilled in the art to better understand the solutions of this application, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0049] In the embodiments of this application, "at least one" refers to one or more; "multiple" refers to two or more. In the description of this application, terms such as "first," "second," and "third" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0050] References such as “one embodiment” or “some embodiments” as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the terms “comprising,” “including,” “having,” and variations thereof, as used in this specification, mean “including, but not limited to,” unless otherwise specifically emphasized.

[0051] In existing technologies, the NTRU cryptographic algorithm, as a typical post-quantum public-key cryptosystem, uses a private key composed of two polynomials with specific mathematical structures. Figure 1 This is a flowchart illustrating encryption using the NTRU cryptographic algorithm in existing technologies, such as... Figure 1 As shown in the figure Representing a polynomial The number of elements with a coefficient of "1" in the middle. This represents the number of elements in the private key g whose coefficient is either "1" or "-1". Indicates the commercial ring , Indicates the commercial ring , For large prime numbers, , Public key , Indicates private key pair , The number of numbers with a coefficient of "1" is The number of elements with a coefficient of "-1" is A set of ternary polynomials; The number of numbers with a coefficient of "1" is The number of items with a coefficient of "-1" is A set of ternary polynomials.

[0052] Existing technologies include a multi-key model based on NTRU: by fixing one polynomial parameter and dynamically adjusting another, encryption and decryption efficiency can be improved to some extent while reducing communication costs. However, this method of fixing part of the key exposes new security vulnerabilities in practical deployments: when communication participants maintain some private key parameters constant and generate multiple differentiated public keys through key generation algorithms and transmit them publicly, attackers can use the publicly available public key data to construct mathematical relationship models. Specifically, NTRU-based multi-key attack methods can effectively reconstruct the complete private key parameters that the communicators should have kept secret by analyzing the algebraic correlations between these public keys.

[0053] In the field of NTRU-based cryptanalysis, existing key recovery techniques mainly adopt the following approach: First, a modular linear equation system is constructed by collecting a sufficient number of public key samples. When the number of equations meets a specific condition, the uniqueness of the solution to the modular equation system is ensured. Then, the basis of the principal ideal of the target private key is denoted as... as well as The target private key is obtained by using it as input to the Gentry-Szudlo (GS) algorithm. The specific value. However, this technical solution has obvious limitations: its effectiveness depends strictly on the private key. The selection method.

[0054] With the widespread application of the NTRU encryption algorithm, its parameter selection schemes have shown a diversified development trend. To improve the efficiency of algorithm implementation, current mainstream schemes, such as those solicited by the National Institute of Standards and Technology (NIST) for post-quantum cryptography standards, such as NTRUEncrypt (a lattice-based public-key encryption algorithm proposed by Jeffrey Hoffstein, Jill Pipher, and Joseph H. Silverman in 1996) or NTRU-HPS (a patented open-source public-key encryption system that uses a lattice-based encryption algorithm to encrypt data, comprising two parts: NTRUEncrypt for encryption and NTRUSign for digital signatures), generally adopt... The optimized form of the private key, in which For fixed parameters (usually taken as...) ), It is a ternary polynomial with a publicly known Hamming weight.

[0055] In existing technologies, solving linear equation systems is typically performed with a specific modulus. Therefore, the solution to the system is limited to values ​​under modular arithmetic. However, calling the GS algorithm requires obtaining the solution to the linear equation system under the integer ring. When the coefficients of the private key are small, the solution to the system under modular arithmetic is equal to the solution under the integer ring. However, this is not common and depends on the size of the integer solution and the structure of the equation system. As the coefficients of the private key increase, the limitations introduced by modular arithmetic will prevent the accurate reconstruction of the integer solution from the modular solution, leading to the failure of the key recovery process. Therefore, how to recover the private key in mainstream schemes under the multi-key NTRU model is a crucial question. The sampling method is still an unsolved problem.

[0056] In response to the above problems, Figure 2 An encryption flowchart of a post-quantum NTRU cryptographic algorithm provided in an embodiment of the present invention is shown below. Figure 2 As shown, the communicator uses the NTRU algorithm to encrypt the data packets to be sent, with each data packet corresponding to a public key. and a private key pair The private key pair includes a first private key and a second private key. Each time encryption is performed, a different public key is generated by changing the first private key. and a shared target private key However, the target private key remains fixed throughout the entire communication process. The target private key is a first polynomial, which is represented by... express, , , The ternary polynomial disclosed in Hamming weights, and the security analysis method therein include:

[0057] This invention provides a security analysis method for post-quantum NTRU cryptographic algorithms. This method is primarily used to analyze the security of public-key cryptosystems. The main applications of public-key cryptosystems include encryption / decryption, digital signatures, and key exchange, and they can also be applied to digital certificates and authentication systems. Digital certificates are used to prove digital identity and ensure the security of network communication. Authentication systems protect sensitive data and resources by verifying user identity.

[0058] For example, in e-commerce, merchants can use NTRU key encryption technology to verify customer identities and ensure transaction security. The user, acting as the communicator, enters their website account and password, and the data packet containing these credentials is encrypted using the NTRU algorithm before being sent to the website merchant's client.

[0059] To verify the encryption performance of the e-commerce system, the attacker sampled the public key of each data packet and recovered the target private key through the following steps. If the recovered target private key is the same as the target private key generated when encrypting the previous data packets, it means that the e-commerce system has not prevented the attack and its security is insufficient. If the recovered target private key is different from the target private key generated when encrypting the previous data packets, it means that the e-commerce system has prevented the attack and its security is sufficient.

[0060] Among them, the NTRU (Number Theory Research Unit) algorithm is a public-key cryptosystem invented in 1996 by three mathematics professors at Brown University in the United States. NTRU is a relatively new public-key cryptosystem. Because the key generation method of NTRU is relatively easy, its encryption and decryption speeds are much faster than well-known algorithms such as RSA. NTRU has become a hot topic in post-quantum public-key cryptosystem research.

[0061] This invention applies only to the public key generated by the NTRU encryption algorithm and the target private key. , , This is the case of the Hamming weighted ternary polynomial.

[0062] S10, the attacker samples the public key to obtain... A public key sample, the first private key g and the target private key f ,in, It is a positive integer;

[0063] Figure 3 Here is a flowchart of an attack method based on multi-key NTRU provided in an embodiment of the present invention, as shown below. Figure 3 As shown, this embodiment of the invention removes the relevant parts of the coefficients in the constructed system of equations using linearization techniques, thereby achieving an attack on multi-key NTRU.

[0064] Step 1: Set parameters The attacker samples the public key of the data packet and obtains... A public key sample.

[0065] Specifically, the attacker keeps the target private key unchanged in each sampling process and samples a different first private key g, according to the formula... We obtained public key samples with different values, among which, This represents a public key sample. This is the first private key publicly available for Hamming weights. It is a positive integer.

[0066] S20, based on the publicly available information regarding the Hamming weight of each public key sample and the first private key g, establish a modular equation for each public key sample, and combine linear techniques and preset initial values ​​to... Solve the modular equations;

[0067] Step 2: For each public key sample, based on the property that the Hamming weight of the first private key g is public, obtain the modular equation system. Specifically, for one public key sample: ,according to Properties, Let g represent the number of elements in the private key g with coefficients of "1" or "-1". Construct the following modular equation:

[0068] ;

[0069] ;

[0070] ;

[0071] in, This represents each public key sample. The function represents the first private key publicly disclosed by the Hamming weight. Coefficient representation of a polynomial, function This represents the cyclic matrix form corresponding to the polynomial. It is a positive integer. h It is public, so It is public. g It is unknown, but It is public.

[0072] Step 3: Using linearization techniques, introduce new variables:

[0073] , ;

[0074] get The following are modular equations:

[0075] ;

[0076] ;

[0077] ;

[0078] ;

[0079] in, Let N represent the new variable introduced, and let N represent the upper bound of the degree of the highest term of the polynomial.

[0080] Step 4: Based on the linear relationship between the coefficients in the system of equations: , ; , The new modular equation can be derived as follows:

[0081] ;

[0082] in, , At this point, the number of unknown variables has increased from the original number. Reduce to .

[0083] The embodiments of the present invention reduce the complexity of the method and improve efficiency by removing the correlated parts between coefficients in the equation, retaining the uncorrelated parts, and using linear techniques to reduce the number of variables in the equation.

[0084] It should be noted that: for , The proof process is as follows:

[0085] Known , ,So:

[0086] .

[0087] for , The proof is as follows:

[0088] Known , ;

[0089] So, .

[0090] so , .

[0091] for The proof process is as follows:

[0092] Known ,

[0093] and , ,and , It can be deduced that:

[0094] ;

[0095] again , ,so:

[0096] .

[0097] Step 5: Choose one of the three numbers -1, 0, and 1 as... The value of , and the number of unknown variables in the system of equations becomes . The embodiments of the present invention rely on guessing. The value of can further reduce the number of variables.

[0098] Step 6: Further, by removing the common factors between the coefficients and moduli in the equations, the coefficients and moduli are reduced to obtain a system of linear equations with a unique solution, namely:

[0099] .

[0100] S30, based on the linear relationship between the solution of the system of equations and the remaining part of the second polynomial excluding the constant term, the remaining part of the second polynomial excluding the constant term is obtained. Then, according to the relationship between the preset initial value and the constant term in the second polynomial, the constant term of the second polynomial is obtained, thereby obtaining the complete value of the second polynomial, wherein the second polynomial is... ,and, yes The conjugate;

[0101] Step 7: Based on the solution of the system of equations and The linear relationship between the remaining parts excluding the constant term is as follows: , ,get The rest of the terms except for the constant term.

[0102] It should be noted that the proof process is as follows:

[0103] Known ,make ,according to , , , Furthermore, when It can be deduced that:

[0104] ;

[0105] ;

[0106] ;

[0107] ;

[0108] ...

[0109] , ;

[0110] ;

[0111] ...

[0112] ;

[0113] Summing the above formulas, we get:

[0114] = = ;because , It can be deduced that , And because ,so .

[0115] Step 8: Then according to The selected values ​​and The relationship between the constant terms in the middle, i.e. (wherein, function) (representing the Hamming weight of the polynomial), we obtain The constant term. Combined with step 7, the complete polynomial is restored. .

[0116] S40, based on each public key sample and the complete value of the second polynomial, obtain the predicted value of the target private key, and perform security analysis on the cryptographic security system based on the predicted value of the target private key and the target private key.

[0117] Step 9: Obtain the base of the principal ideal of the target private key based on each public key sample and the complete value of the second polynomial.

[0118] Step 10: Based on the basis of the primary ideal of the target private key and the complete value of the second polynomial, use the GS algorithm to obtain the predicted value of the target private key.

[0119] Specifically, if the predicted value of the target private key is the same as the target private key, it indicates that the cryptographic security system has low security; if the predicted value of the target private key is different from the target private key, it indicates that the cryptographic security system has high security.

[0120] Existing technologies for selecting parameters such as the private key suffer from inconsistencies between solutions in the integer sense and solutions in the modular arithmetic sense, thus failing to recover the private key. The highlight of this invention lies in effectively constructing a new set of modular equations and utilizing the relationship between the solutions to these equations and the private key to recover the private key, overcoming the bottleneck of existing technologies. In summary, the security analysis method for post-quantum NTRU cryptographic algorithms proposed in this invention has the following technical effects:

[0121] (1) For the first time, it was achieved that when the private key satisfies In this case, the multi-key attack on the NTRU cipher breaks through the limitations of existing attack methods.

[0122] (2) Under the multi-key model, by collecting multiple public keys, constructing a linear modular equation system, and using the solution of the equation system to recover the key, the success rate of this invention can reach more than 90%, and it has high practicality and reliability.

[0123] (3) It provides a clear direction for adjusting parameters when the NTRU algorithm encrypts data packets, avoiding the use of insecure private key structures; at the same time, it can also help cryptographers detect vulnerabilities in the NTRU implementation and improve the security of public key cryptosystems.

[0124] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0125] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0126] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A security analysis method for post-quantum NTRU cryptographic algorithms, applied to the security analysis of public-key cryptographic security systems. The communicator uses the NTRU algorithm to encrypt data packets to be sent. Each data packet corresponds to a public key and a private key pair, wherein the private key pair includes a first private key and a second private key. Each data packet generates a different public key by changing the first private key in the corresponding private key pair. The second private key in the private key pair corresponding to each data packet is the same target private key, which is a first polynomial. The target private key uses... express, , , It is a ternary polynomial publicly disclosed by the Hamming weight, and the first private key is a ternary polynomial publicly disclosed by the Hamming weight. The first private key is used... g It is indicated that, The security analysis method includes: The attacker samples the public key and obtains... A public key sample, the first private key g and the target private key f ,in, It is a positive integer; Based on each public key sample and the first private key The Hamming weight publicly disclosed information establishes a modular equation for each public key sample, and combines linear techniques with preset initial values ​​to... Solve the modular equations; Based on the linear relationship between the solution of the system of equations and the remaining part of the second polynomial excluding the constant term, the remaining part of the second polynomial excluding the constant term is obtained. Then, according to the relationship between the preset initial value and the constant term in the second polynomial, the constant term of the second polynomial is obtained, thus obtaining the complete value of the second polynomial. The second polynomial is... ,and, yes The conjugate; Based on each public key sample and the complete value of the second polynomial, the predicted value of the target private key is obtained, and the security analysis of the cryptographic security system is performed based on the relationship between the predicted value of the target private key and the actual value of the target private key.

2. The security analysis method for post-quantum NTRU cryptographic algorithms according to claim 1, characterized in that, Based on the publicly available information about each public key sample and the Hamming weight of the first private key g, a modular equation is established for each public key sample, as shown in formulas (1) to (3): ；（1） ；（2） ；（3） in, Representing each public key sample, the function The representation of the coefficients of a polynomial within parentheses, a function This represents the cyclic matrix form corresponding to the polynomial within the parentheses. It is a positive integer. h It is public, so It is public. g It is unknown, but It is public.

3. The security analysis method for post-quantum NTRU cryptographic algorithms according to claim 2, characterized in that, The combination of linear technology and preset initial value pair Solving the modular equation involves the following steps: Using linearization techniques, new variables are introduced for further derivation, resulting in intermediate module equations, as shown in equations (4) to (8): ， ；（4） ；（5） ；（6） ；（7） ；（8） in, This indicates the introduction of a new variable, where N represents the upper bound of the degree of the highest term of the polynomial.

4. The security analysis method for post-quantum NTRU cryptographic algorithms according to claim 3, characterized in that, The combination of linear technology and preset initial value pair Solving the modular equations further includes: Based on the linear relationship between the coefficients in the modular equation corresponding to each public key sample, further derivation is performed to obtain the final modular equation, as shown in formulas (9) to (12): ， ；（9） ， ；（10） ；（11） ， ；（12） in, This represents the preset initial value. , , Both indicate subscripts.

5. The security analysis method for post-quantum NTRU cryptographic algorithms according to claim 4, characterized in that, Choose one of the three numbers: -1, 0, and 1. The values ​​of are simplified according to formulas (9), (10), and (12) to obtain a system of equations (11) with a unique solution.

6. The security analysis method for post-quantum NTRU cryptographic algorithms according to claim 1, characterized in that, The attacker samples the public key to obtain... A public key sample, and different private keys publicly disclosed by the Hamming weight. and a fixed target private key The steps include: The attacker keeps the target private key unchanged during each sampling process and samples different first private keys g, obtaining public key samples with different values ​​according to the following formula (13): ；（13） in, This represents each public key sample. It is a positive integer.

7. The security analysis method for post-quantum NTRU cryptographic algorithms according to claim 1, characterized in that, The step of obtaining the predicted value of the target private key based on each public key sample and the complete value of the second polynomial includes: The basis of the principal ideal of the target private key is obtained by taking the complete floor function of each public key sample and the second polynomial. Based on the base of the primary ideal of the target private key and the complete value of the second polynomial, the predicted value of the target private key is obtained using the GS algorithm.

8. The security analysis method for post-quantum NTRU cryptographic algorithms according to claim 1, characterized in that, The step of performing a security analysis on the cryptographic security system based on the relationship between the predicted value of the target private key and the actual value of the target private key includes: If the predicted value of the target private key is the same as the actual value of the target private key, it indicates that the security of the cryptographic security system is low. If the predicted value of the target private key is different from the actual value of the target private key, it indicates that the cryptographic security system has high security.

Images