IPsec key exchange method against quantum computing

Abstract

This invention relates to a quantum-resistant IPSEC key exchange method. The invention utilizes lattice cryptography and an improved SM4-256 symmetric encryption to achieve secure communication between main mode and fast mode. In main mode, the initiator sends an IKE message via UDP to negotiate SA parameters and exchange lattice cryptographic certificates with the responder. Both parties encapsulate a temporary 32-byte key using the other party's public key, encrypt it with SM4-256 to generate a 512-bit random number, and then sign and transmit it, achieving secure random number exchange and certificate verification. Both parties calculate the first session key based on a pseudo-random function (PRF) and encrypt the hash value of the exchanged data to complete the main mode key consistency confirmation. Upon entering fast mode, communication continues using the main mode session key as the SM4-256 symmetric key. Both parties send SA messages carrying 512-bit random numbers, calculate the second session key, and establish an ESP tunnel. This method improves the security of IPSEC against quantum computing threats through lattice cryptography.

Description

Technical Field

[0001] This invention relates to the field of quantum computing technology, and in particular to a quantum computing-resistant IPSEC key exchange method. Background Technology

[0002] With the rapid development of quantum computing technology, traditional cryptographic systems face unprecedented security challenges. Currently widely used public-key cryptography algorithms, such as RSA, Diffie-Hellman, and elliptic curve cryptography (ECC), rely on computationally complex mathematical problems like large integer factorization and discrete logarithms for security. However, the advent of quantum computers has fundamentally changed this security assumption. Shor's algorithm, a representative quantum algorithm, can efficiently solve these problems in polynomial time, directly breaking the security mechanisms of RSA, ECC, and their variants (including the Chinese national standard SM2). Grover's algorithm can reduce the exhaustive search complexity of symmetric cryptography and hash functions by an order of magnitude, reducing the equivalent security strength of symmetric encryption algorithms such as AES-128 and SM4 to 64 bits. Although the impact of Grover's algorithm can be compensated for by doubling the key length (e.g., AES-256 or SM4-256), the threat posed by Shor's algorithm to existing public-key algorithms is structural and irreparable.

[0003] While quantum computers are still in the experimental stage, their evolution is already well-defined. Existing mainstream quantum computing architectures, such as superconducting and ion trap architectures, can already achieve parallel operations of hundreds of qubits, and quantum computers truly capable of breaking cryptography are expected to emerge around 2030. Research shows that if thousands of stable logical qubits can be achieved, algorithms such as RSA-2048 or ECC-256 can be broken within an acceptable timeframe. This trend necessitates the early migration and hardening of current cryptographic systems, as the update cycle for cryptographic systems typically takes 5 to 10 years, encompassing algorithm standardization, system adaptation, protocol compatibility, and hardware and software upgrades. Failure to deploy quantum-resistant cryptographic systems in advance will result in a security vacuum when quantum computers become available.

[0004] Post-quantum cryptography (PQC) has emerged to address this need, aiming to maintain computational security even in hybrid environments combining traditional and quantum computing. PQC is primarily based on mathematical structures considered unsolvable by quantum computing, such as the lattice problem, the code problem, and the multivariate problem. Among these, CRYSTALS-Dilithium (based on the SIS / LWE problem) and CRYSTALS-Kyber (based on the LWE problem) are widely accepted quantum-resistant signature and key exchange algorithms in the NIST standardization process. These two types of algorithms achieve a good balance between security, efficiency, and implementation complexity, making them ideal alternatives to traditional public-key algorithms such as RSA and ECC.

[0005] In network security, IPSEC (Internet Protocol Security), as a secure communication protocol at the network layer, is widely used in scenarios such as enterprise virtual private networks (VPNs), government private networks, cross-domain communications of financial institutions, and backbone networks of telecom operators. Its security mechanism relies on public-key algorithms to implement core functions such as identity authentication, key negotiation, and symmetric key distribution. Taking the traditional IKE (Internet Key Exchange) protocol as an example, RSA or ECC is used for identity signature authentication between the communicating parties, Diffie-Hellman or SM2 algorithms are used to negotiate the session key, and AES or SM4 is used for symmetric encryption of the data. However, once quantum computers become feasible, attackers can use Shor's algorithm to crack these public-key algorithms in a very short time, thereby forging identities, intercepting and decrypting communication data, and rendering the entire IPSEC security system ineffective.

[0006] More seriously, attackers could store large amounts of encrypted data transmitted via IPSEC at this stage, only to decrypt it once quantum computers become more advanced. This poses a potential risk of permanent leakage for data transmissions involving long-term sensitive information (such as government documents, medical records, and financial transaction files). Therefore, IPSEC's quantum-resistant upgrade is not only a necessary means to address future quantum threats, but also an urgent need to ensure the confidentiality of long-term data.

[0007] Currently, apart from IPsec, there are no alternative protocols that can provide equivalent security protection at the network layer. Application-layer encryption (such as TLS / SSL) can only protect the security of some application data and cannot achieve encryption and authentication of all traffic at the IP layer; while the security of hardware firewalls or encrypted gateways still depends on the underlying cryptographic algorithms, and once the public-key algorithm is breached by a quantum attack, its protective capabilities will also fail. Therefore, modifying IPsec to be quantum-resistant is the only way to ensure the security of future network infrastructure. Summary of the Invention

[0008] To address this, the present invention provides a quantum-resistant IPSEC key exchange method that improves the security of IPSEC under the threat of quantum computing through lattice cryptography, significantly improving negotiation efficiency and implementation performance, and enhancing the security of IPSEC key exchange.

[0009] To address the aforementioned technical problems, this invention provides a quantum-resistant IPSEC key exchange method, comprising:

[0010] S1. The initiator sends an IKE first message to the responder via UDP. The first message includes the first SA negotiation content and the first cookie data used to identify the local session.

[0011] S2. The responder R receives and detects the first message. If it does not detect that the first SA negotiation content contains an asymmetric encryption lattice encryption algorithm and an SM4-256 negotiation item, it terminates the current interaction. Otherwise, the responder sends a second message to the initiator. The second message includes second cookie data, second SA negotiation content, and a response lattice cryptographic certificate. The response lattice cryptographic certificate includes a response lattice signature certificate and a response lattice encryption certificate.

[0012] S3. The initiator receives and detects the second message. If it does not detect that the second SA negotiation content contains the asymmetric encryption lattice encryption algorithm and the SM4-256 negotiation item, it terminates the current interaction.

[0013] S4. Otherwise, perform a certificate verification step, including comparing the HASH value of the response grid password certificate with the HASH value registered on this end. If they are inconsistent, terminate this interaction.

[0014] S5. If they match, proceed with the random number transmission step, including: the initiator encrypts a 256-bit initiator temporary encryption key based on the public key of the responder's lattice cryptographic certificate, and generates a 512-bit initiator random number encrypted using SM4-256 with the initiator temporary encryption key; then, the initiator signs the initiator random number using its local signature lattice private key to obtain the initiator lattice cryptographic certificate and sends a third message carrying the initiator lattice cryptographic certificate to the responder; the responder receives the third message and decrypts the initiator lattice cryptographic certificate using its local lattice encryption private key to obtain the initiator random number.

[0015] S6. The responder verifies the initiator's lattice cryptographic certificate. After verifying the validity of the initiator's lattice cryptographic certificate, the responder performs a random number transmission step. After the initiator receives the fourth message sent by the responder, the initiator obtains the responder's random number.

[0016] S7. The responder and the initiator respectively input the random number of the initiator and the random number of the responder, obtain the first session key based on the pseudo-random function, and encrypt the HASH value of the key exchange process data with the first session key as the encryption key of SM4-256, and send the corresponding fifth and sixth messages to the other end to complete the key consistency confirmation in the main mode.

[0017] S8. After completing the main mode, enter the fast mode, and the fast mode uses the first session key as the symmetric key of SM4-256 for encrypted transmission of messages.

[0018] The fast mode includes: the initiator and the responder respectively send a fast mode SA to each other, which carries a 512-bit fast mode random number;

[0019] The second session key is calculated based on two fast-mode 512-bit random numbers from the local end and the remote end. The confirmation data after the two fast-mode 512-bit random numbers are hashed is sent to the remote end, and the ESP tunnel is established based on the second session key.

[0020] Communication is permitted when the ESP tunnel parameters of both parties are consistent.

[0021] In one embodiment of the present invention, 512-bit random numbers from the initiator or responder are encrypted using SM4-256 encryption, including the following steps:

[0022] The key length of the SM4 algorithm is extended from 128 bits to 256 bits, forming a key with a length of 32 bytes, while the block length remains at 128 bits;

[0023] In the round key generation phase, the first 16 bytes of the round key are generated first. The last 16 bytes of the round key are then XORed with the last 16 bytes of the key to obtain the initial key, which is then input into the round function F′.

[0024] Run the round function F′ to obtain the subsequent 32 round keys, and invert the round key sequence to generate the decryption round key;

[0025] The encryption or decryption process is executed, involving 64 rounds of round function operations to obtain the encryption or decryption result.

[0026] According to claim 2, the IPSEC key exchange method resistant to quantum computing is characterized in that the round key generation includes the following steps:

[0027] The first 128 bits of the initial key are represented as MK0, MK1, MK2, and MK3, where MK represents the master key. These bits are then XORed with system parameters FK0, FK1, FK2, and FK3, where FK represents a system parameter constant. Round key expansion is then performed, outputting consecutive k bits. i+4 The key, where k represents the round key word, from which the last four 32-bit words are taken as k. si k si+1 k si+2 k si+3 ;

[0028] The last 128 bits of the initial key are represented as MK4, MK5, MK6, and MK7. The k... si k si+1 k si+2 k si+3 Write the first four 32-bit positions of k, XOR them with system parameters FK0, FK1, FK2, and FK3, and then perform round key expansion to obtain the new k. i+4 Key;

[0029] Repeat step S2 until a complete 64-round key sequence is generated.

[0030] In one embodiment of the present invention, the 64-round round function iteration process includes:

[0031] Write 128 bits of plaintext data into the first four 32-bit positions of k to form k. i k i+1 k i+2 k i+3 The initial input;

[0032] In the i-th iteration, i = 0 to 63, k i+1 k i+2 k i+3After performing an XOR operation, the input is fed into the iteration process, and its output is compared with k. i XORing yields k i+4 Key;

[0033] k i+1 k i+2 k i+3 k i+4 As input for the next round, output the complete k-word sequence in sequence;

[0034] The round function F′ implements a nonlinear mapping based on S-box substitution and linear transformation in each round of iteration to enhance the confusion and diffusion of key expansion.

[0035] In one embodiment of the present invention, step S5 involves encrypting a 256-bit initiator temporary encryption key using a modified lattice encryption method, CRYSTALS-Kyber, including:

[0036] S511. Generate a 256-bit random number R;

[0037] S512. Using a random number R as a seed, use SM3-HMAC to generate a matrix seed ρ and two vector seeds σ. Use the NTT function to generate a k×k CRYSTALS-Kyber matrix A and vectors s and e.

[0038] S513. Calculate t = A s + e, where the public key consists of ρ and t, and the private key is s;

[0039] S514. During encryption, input message m and public key, reconstruct the CRYSTALS-Kyber matrix A, take random data r′, and use SM3-HMAC and NTT to expand matrix r, matrix e1, and matrix e2, where NTT is a fast number theory transformation; calculate:

[0040] u=NTT -1 (A^T*r) + e1;

[0041] v=NTT -1 (t^T*r)+e2+Decompress_q(Decodel(m),1);

[0042] Among them, NTT -1 This is the inverse operation of NTT; A^T and t^T represent the transpose of t or A; Decompress_q represents the decompression function, and Decodel represents the decoding function;

[0043] Based on the above formula, u and v can be calculated, and u and v are the encrypted data;

[0044] S515. During decryption, u and v are recovered, and Compress_q(v-su, 1) is calculated to obtain an approximate message msg′ with errors. The final message msg is obtained by the compression function. Compress_q represents the compression function.

[0045] In one embodiment of the present invention, step S5 involves signing the initiator's random number using a modified lattice signature, CRYSTALS-Dilithium, including:

[0046] S521. Generate a 256-bit random number R;

[0047] S522. Using R as the seed, generate a matrix seed ρ and two vector seeds using SM3-HMAC. And the key Key, and use the NTT function to generate a k×l CRYSTALS-Dilithium matrix A′ and vectors s1 and s2;

[0048] S523. Calculate A′s1+s2 to obtain vector t, decompose vector t into t0 and t1 bit by bit, calculate the hash value of t to obtain tr, where tr represents the digest of t, and the hash algorithm is SM3;

[0049] S524. Generate a public key and a private key, wherein the public key includes ρ and t1, and the private key includes ρ, Key, tr, s1, s2, and t0.

[0050] S525, the first step of the signature process is to input the message msg and the private key, generate fixed-length data μ based on tr using SM3-HMAC, and generate fixed-length data ρ′ based on the key and μ using SM3-HMAC.

[0051] S526. In the second step of the signature process, ρ′ is expanded into a y vector by the NTT function, Ay is calculated to obtain w, the high-order bits of w are taken to obtain w1, a polynomial c is generated based on SM3(μ||w1) and NTT, the polynomial c is multiplied by s1 and s2 respectively, and z and h are obtained by operation with y and w, and the signature results z, h and c are determined according to preset conditions.

[0052] S527. In the verification process, based on tr and μ, the above algorithm is used to restore the original values. UseHintq (h, A′z -ct1·2^d ,2γ2) is calculated to obtain w1′, and SM3 (μ‖w1′) is calculated to obtain c′. The equality of c′ and c is checked to verify the correctness of the signature result. Here, 2γ2 is a fixed value; h is one of the signature results; the CRYSTALS-Dilithium matrix A′ is expanded using the public key ρ; t1 is a part of the public key; d is a fixed value based on different algorithms; z and c are part of the signature result.

[0053] In one embodiment of the present invention, before the initiator and the responder communicate, a step of generating an encryption key and a signature key is included. The same random data is used to simultaneously generate an encryption public key, an encryption private key, a signature public key, and a signature private key. The encryption public key and the signature public key are simultaneously written into the public key field of the certificate. The signature of the certificate is generated by the signature private key corresponding to the CA certificate to ensure the uniqueness and verifiability of the certificate.

[0054] In one embodiment of the present invention, in steps S1 to S4, the transmission of the first message and the second message adopts a data structure compatible with the international standard IKE protocol, and the group parameter transmitted is a lattice cipher sequence number; the public key of the certificate includes a Kyber lattice encryption public key and a Dilithium lattice signature public key, and the random numbers of the two are generated independently; the signature of the certificate is generated by the CA's signature private key; the key file contains the corresponding Kyber encryption private key and Dilithium signature private key, and the two correspond one-to-one with the public key in the certificate;

[0055] In the third and fourth message exchanges in steps S5 and S6, the initiator and the responder exchange random numbers (Nonce) and identity ID payloads. The random number (Nonce) is the pre-key for generating the key, and the ID is the identity information of both parties, taken from their respective signature certificate user information. The data is encrypted and protected by a temporary key (Sk) using the SM4-256 algorithm. The temporary key (Sk) is generated by encryption using the Kyber lattice encryption public key in the encryption certificate. At the same time, the data is signed using the Dilithium lattice signing private key in the signature certificate.

[0056] In one embodiment of the present invention, during the interaction between the third and fourth messages in steps S5 and S6, the message formats of the initiator and the responder are as follows:

[0057] Initiator's message:

[0058] XCH i = Kyber(ski, pub_r) | SM4-256(N i | ID i , ski)

[0059] SIG i _b = Dilithium(ski_b | N i _b | ID i _b | CERT_enc i _b, priv i );

[0060] Responder message:

[0061] XCH r= Kyber(skr, pub_i) | SM4-256(N r | ID r , skr)

[0062] SIG r _b = Dilithium(skr_b | N r _b | ID r _b | CERT_enc r _b, priv r );

[0063] Where Kyber is the lattice encryption algorithm module, ski and skr are the temporary keys of the initiator and responder, respectively, pub_i and pub_r are the lattice encryption public keys of the initiator and responder, respectively, and N i N r Random numbers for the initiator and the responder, ID respectively. i ID r These are the identifiers for the initiator and the responder, respectively. Dilithium is the lattice signature algorithm module, and CERT_enc is the identifier for the initiator and the responder. i CERT_enc r The encrypted certificate contents of the initiator and responder are respectively, priv i priv r These are the signature private keys for the initiator and the responder, respectively. The subscript 'r' indicates the responder, the subscript 'i' indicates the initiator, and the suffix 'b' indicates the binary data format.

[0064] In one embodiment of the present invention, in the fifth and sixth messages of step S7, the data is encrypted and transmitted using the CBC block mode of the SM4-256 algorithm; the encryption key is generated by random numbers transmitted by both parties, and the initialization vector IV is calculated by HASH(Ski_b | Skr_b) and filled in the PKCS#5 format, where Ski_b and Skr_b represent the binary representations of the temporary keys of the initiator and the responder, respectively;

[0065] The encrypted data includes:

[0066] HASHi = PRF(SKEYID , CKY-I | CKY-R | Sai_b | ID i _b);

[0067] HASHr = PRF(SKEYID , CKY-R | CKY-I | Sar_b | ID r _b);

[0068] Wherein, PRF represents a pseudo-random function, SKEYID represents a key identifier generated from random data using PRF, CKY-I and CKY-R represent the cookies of the initiator and responder, respectively, Sai and Sar represent the security association information exchanged between the initiator and responder in main mode, and ID represents the key identifier. i ID r These are the identifiers for the initiator and the responder, respectively, with the suffix 'b' indicating binary data format.

[0069] In fast mode, both parties establish a data tunnel based on SM4-256 symmetric encryption; the hash data transmitted in fast mode includes:

[0070] HASH(1) = PRF(SKEYID_a, MsgID | N i _b | SA [ | ID i | ID r ]);

[0071] HASH(2) = PRF(SKEYID_a, MsgID |N i _b | N r _b | SA [ | ID i | ID r ]);

[0072] HASH(3) = PRF(SKEYID_a, 0 | MsgID | N i _b | N r _b);

[0073] Where MsgID is the message identifier for fast mode, N i N r These represent the fast-mode random numbers for the initiator and responder, respectively. SA is the SA data sent in fast-mode transmission, and ID is the ID. i ID r These are the identifiers for the initiator and the responder, respectively, with the suffix 'b' indicating binary data format.

[0074] Finally, the session key KEYMAT = PRF(SKEYID_d, protocol | SPI |N) is calculated using SM3-HMAC. i _b | N r _b); SKEYID_d represents the derived key identifier used for key derivation, protocol represents the protocol identifier, and SPI represents the security parameter index;

[0075] SKEYID = PRF (hash(Ni_b | Nr_b) , Ci | Cr);

[0076] SKEYID_d = PRF (SKEYID, K | Ci | Cr | 0);

[0077] SKEYID_a = PRF (SKEYID, SKEYID_d | Ci | Cr | 1);

[0078] Ci and Cr are the data transmitted during cookie interaction between the initiator and the responder.

[0079] The technical solution of the present invention has the following advantages compared with the prior art:

[0080] This invention discloses a quantum-resistant IPSEC key exchange method. It introduces a lattice cryptography algorithm into the IPSEC main mode for key exchange protection. A temporary 32-byte session key is generated, and the peer's lattice cryptographic public key is used to perform key encapsulation before sending encrypted data to the peer. The receiving end uses its own lattice cryptographic private key to decapsulate the data and recover the temporary key. This temporary key is further used to protect the shared key generation material, thereby achieving secure main mode key negotiation under quantum attack resistance.

[0081] In the symmetric encryption algorithm portion, this invention makes a structural improvement to the Chinese national standard SM4 algorithm: through two key expansions and 64 rounds of encryption iterations, the key length is increased from 128 bits to 256 bits, while maintaining the same block size. This improvement significantly enhances the algorithm's resistance to exhaustive search and quantum attacks, and improves the overall security strength and key space complexity.

[0082] This invention improves the generation method of the first and second hashes in the original national standard IPSEC scheme in IPSEC fast mode, optimizes the PRF input structure, reduces the splicing operation of redundant fields, makes the hash calculation process more concise and efficient, and improves the overall processing speed and implementation efficiency of key derivation and verification. Attached Figure Description

[0083] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0084] Figure 1 This is a flowchart of the IPSEC key exchange method for quantum computing resistance of the present invention.

[0085] Figure 2 This is the flowchart for SM4-256 key expansion.

[0086] Figure 3This is the flowchart for the SM4-256 round key iteration.

[0087] Figure 4 This is a fast-mode interaction diagram. Detailed Implementation

[0088] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0089] Reference Figure 1 As shown, the present invention provides a quantum-resistant IPSEC key exchange method, comprising:

[0090] S1. The initiator I (the initiator computer) sends an IKE (Internet Key Exchange Protocol) first message to the responder R (the responder computer) via UDP (User Datagram Protocol). The first message includes the first SA (Security Association) negotiation content and the first cookie data (session identification data) used to identify the local session.

[0091] S2. The responder R receives and detects the first message. If it does not detect any negotiation items in the first SA negotiation content that include the asymmetric encryption lattice encryption algorithm and SM4-256 (256-bit national standard block symmetric encryption algorithm), it terminates the current interaction; otherwise, the responder sends a second message to the initiator. The second message includes second cookie data, second SA negotiation content, and a response lattice cryptographic certificate. The response lattice cryptographic certificate includes a response lattice signature certificate and a response lattice encryption certificate.

[0092] S3. The initiator receives and detects the second message. If it does not detect that the second SA negotiation content contains the asymmetric encryption lattice encryption algorithm and the SM4-256 negotiation item, it terminates the current interaction.

[0093] S4. Otherwise, perform a certificate verification step, including comparing the HASH value of the response grid password certificate with the HASH value registered on this end. If they do not match, terminate the current interaction.

[0094] S5. If they match, proceed with the random number transmission step, including: the initiator encrypts a 256-bit initiator temporary encryption key based on the public key of the responder's lattice cryptographic certificate, and generates a 512-bit initiator random number encrypted using SM4-256 with the initiator temporary encryption key; then, the initiator signs the initiator random number using its local signature lattice private key to obtain the initiator lattice cryptographic certificate and sends a third message carrying the initiator lattice cryptographic certificate to the responder; the responder receives the third message and decrypts the initiator lattice cryptographic certificate using its local lattice encryption private key to obtain the initiator random number.

[0095] S6. The responder verifies the initiator's lattice cryptographic certificate. After verifying the validity of the initiator's lattice cryptographic certificate, the responder performs a random number transmission step. After the initiator receives the fourth message sent by the responder, the initiator obtains the responder's random number.

[0096] S7. The responder and the initiator respectively input the random number of the initiator and the random number of the responder, obtain the first session key based on the pseudo-random function (PRF), and encrypt the HASH value of the key exchange process data with the first session key as the encryption key of SM4-256, and send the corresponding fifth and sixth messages to the other end to complete the key consistency confirmation in the main mode.

[0097] The HASH value is: HASHi = PRF(SKEYID, CKY-I|CKY-R|Sai_b|Idi_b) HASHr = PRF(SKEYID, CKY-R|CKY-I|Sar_b|Idr_b);

[0098] SKEYID is the key obtained by using the pseudo-random function (PRF) on the above random number; CKY-I is the initiator cookie, and CKY-R is the responder cookie; Sai_b and Sar_b| are SA data in the process of exchanging the fifth and sixth messages; Idi_b and Idr_b are ID data in the process of exchanging the fifth and sixth messages.

[0099] S8. After completing the main mode, enter the fast mode, and the fast mode uses the first session key as the symmetric key of SM4-256 for encrypted transmission of messages.

[0100] The fast mode includes: the initiator and the responder respectively send a fast mode SA to each other, which carries a 512-bit fast mode random number;

[0101] The second session key is calculated based on two fast-mode 512-bit random numbers from the local end and the remote end. The confirmation data after the two fast-mode 512-bit random numbers are hashed is sent to the remote end. An ESP (Secure Encapsulated Payload) tunnel is established based on the second session key.

[0102] Communication is permitted when the ESP tunnel parameters of both parties are consistent.

[0103] Reference Figure 2 , Figure 3 As shown, encrypting a 512-bit random number from the sender or responder using SM4-256 encryption includes the following steps:

[0104] The key length of the SM4 algorithm is extended from 128 bits to 256 bits, forming a key with a length of 32 bytes, while the block length remains at 128 bits;

[0105] In the round key generation phase, the first 16 bytes of the round key are generated first. The last 16 bytes of the round key are then XORed with the last 16 bytes of the key to obtain the initial key, which is then input into the round function F′.

[0106] Run the round function F′ to obtain the subsequent 32 round keys, and invert the round key sequence to generate the decryption round key;

[0107] The encryption or decryption process is executed, involving 64 rounds of round function operations to obtain the encryption or decryption result.

[0108] Specifically, the round key generation includes the following steps:

[0109] The first 128 bits of the initial key are represented as MK0, MK1, MK2, and MK3, where MK represents the master key. These bits are then XORed with system parameters FK0, FK1, FK2, and FK3, where FK represents a system parameter constant. Round key expansion is then performed, outputting consecutive k bits. i+4 The key, where k represents the round key word, from which the last four 32-bit words are taken as k. si k si+1 k si+2 k si+3 ;

[0110] The last 128 bits of the initial key are represented as MK4, MK5, MK6, and MK7. The k... si k si+1 k si+2 k si+3 Write the first four 32-bit positions of k, XOR them with system parameters FK0, FK1, FK2, and FK3, and then perform round key expansion to obtain the new k. i+4 Key;

[0111] Repeat step S2 until a complete 64-round key sequence is generated.

[0112] Specifically, the 64-round round function iteration process includes:

[0113] Write 128 bits of plaintext data into the first four 32-bit positions of k to form k. i k i+1 k i+2 k i+3 The initial input;

[0114] In the i-th iteration, i = 0 to 63, k i+1 k i+2 k i+3 After performing an XOR operation, the input is fed into the iteration process, and its output is compared with k. i XORing yields k i+4 Key;

[0115] k i+1 k i+2 k i+3 k i+4 As input for the next round, output the complete k-word sequence in sequence;

[0116] The round function F′ implements a nonlinear mapping based on S-box substitution and linear transformation in each round of iteration to enhance the confusion and diffusion of key expansion.

[0117] Specifically, in step S5, the 256-bit initiator's temporary encryption key is encrypted using a modified lattice encryption method, CRYSTALS-Kyber, including:

[0118] S511. Generate a 256-bit random number R;

[0119] S512. Using a random number R as a seed, generate a matrix seed ρ and two vector seeds σ using SM3-HMAC (HMAC based on SM3, HMAC: Hash-based Message Authentication Code). Use the NTT function to generate a k×k CRYSTALS-Kyber matrix A and vectors s and e.

[0120] S513. Calculate t = A s + e, where the public key consists of ρ and t, and the private key is s;

[0121] S514. During encryption, input message m and public key, reconstruct the CRYSTALS-Kyber matrix A, take random data r′, and use SM3-HMAC and NTT to expand matrix r, matrix e1, and matrix e2, where NTT is a fast number theory transformation; calculate:

[0122] u=NTT -1(A^T*r) + e1;

[0123] v=NTT -1 (t^T*r)+e2+Decompress_q(Decodel(m),1);

[0124] Among them, NTT -1 This is the inverse operation of NTT; A^T and t^T represent the transpose of t or A; Decompress_q represents the decompression function, and Decodel represents the decoding function;

[0125] Based on the above formula, u and v can be calculated, and u and v are the encrypted data;

[0126] S515. During decryption, u and v are recovered, and Compress_q(v-su, 1) is calculated to obtain an approximate message msg′ with errors. The final message msg is obtained by the compression function. Compress_q represents the compression function.

[0127] It should be noted that `Compress_q` and `Decompress_q` are the compression and decompression functions, respectively. Specifically:

[0128] Compress_q(x,d) = d(2d / q) ·xc mod+2d;

[0129] Decompress_q(x,d) = d(q / 2d) ·xc;

[0130] When Compress_q and Decompress_q are used for x ∈ Rq or x ∈ Rkq, the process is applied individually to each coefficient. The main reason for defining the Compress_q and Decompress_q functions is to discard some low-order bits in the ciphertext that have little impact on the probability of correct decryption—thus reducing the size of the ciphertext. Compress_q and Decompress_q are also used for purposes other than compression—namely, to perform the usual LWE error correction during encryption and decryption. The Decompress_q function is used to create an error tolerance gap by mapping message bits 0 to 0 and 1 to "q / 2". Subsequently, in line 4 of the decryption process (Algorithm 6), the Compress_q function is used to decrypt the result to 1 if v - s^T u is closer to "q / 2", otherwise decrypting it to 0.

[0131] `Encodel` and `Decodel` are the encoding and decoding functions, respectively. Kyber needs to serialize two data types into byte arrays: byte arrays and (vector) polynomials. Byte arrays can be easily serialized using the identity operation; therefore, how to serialize and deserialize polynomials is defined. The `Decodel` function deserializes a 32-byte array into a polynomial. The `Encodel` function is defined as the inverse operation of the `Decodel` function. When `Encodel` is applied to a polynomial vector, each polynomial is encoded individually, and then the output byte arrays are concatenated.

[0132] Specifically, in step S5, the initiator's random number is signed using a modified lattice signature, CRYSTALS-Dilithium, including:

[0133] S521. Generate a 256-bit random number R;

[0134] S522. Using R as the seed, generate a matrix seed ρ and two vector seeds using SM3-HMAC. And the key Key, and use the NTT function to generate a k×l CRYSTALS-Dilithium matrix A′ and vectors s1 and s2;

[0135] S523. Calculate A′s1+s2 to obtain vector t, decompose vector t into t0 and t1 bit by bit, calculate the hash value of t to obtain tr, and the hash algorithm is SM3;

[0136] (t1,t0) := Power2Roundq (t,d);

[0137] tr ∈{0,1}384 := CRH(ρ ‖t1);

[0138] Where Power2Round_q represents the power rounding function, d represents the bit width parameter; CRH represents the collision-resistant hash function, and || represents concatenation;

[0139] The public key size is approximately halved, while the signature increases by less than one hundred bytes. To achieve this size reduction, the key generation algorithm outputs t1 := Power2Roundq (t,d) as the public key; the number of bits required for each coefficient changes from dlog qe to dlog q ed;

[0140] q ≈ 2 23 And d = 13, with each public key coefficient being 10 bits. The function CRH used in the signature scheme is a collision-resistant hash function that maps to {0,1}^384, and ρ is generated based on ςhmac.

[0141] S524. Generate a public key and a private key, wherein the public key includes ρ and t1, and the private key includes ρ, Key, tr, s1, s2, and t0.

[0142] S525, the first step of the signature process is to input the message msg and the private key, generate fixed-length data μ based on tr using SM3-HMAC, and generate fixed-length data ρ′ based on the key and μ using SM3-HMAC.

[0143] S526. In the second step of the signature process, ρ′ is expanded into a y vector by the NTT function, Ay is calculated to obtain w, the high-order bits of w are taken to obtain w1, a polynomial c is generated based on SM3(μ||w1) and NTT, the polynomial c is multiplied by s1 and s2 respectively, and z and h are obtained by operation with y and w, and the signature results z, h and c are determined according to preset conditions.

[0144] S527. In the verification process, based on tr and μ, the above algorithm is used to reconstruct UseHintq (h, A′z -ct1 ·2^d ,2γ2) to obtain w1′, and SM3 (μ‖w1′) is calculated to obtain c′. The equality of c′ and c is then checked to verify the correctness of the signature result. The UseHintq process is as follows:

[0145] UseHintq (h,r,α):

[0146] m := (q-1) / α;

[0147] (r1,r0) := Decompose_q (r,α);

[0148] if h = 1 and r0>0 return (r1 + 1) mod+ m;

[0149] if h = 1 and r0 ≤0 return (r1-1) mod+ m;

[0150] return r1;

[0151] UseHintq.

[0152] Where 2γ2 is a fixed value;

[0153] h is one of the results of the signature;

[0154] The matrix A′ of CRYSTALS-Dilithium is expanded using the public key ρ;

[0155] t1 is part of the public key;

[0156] z and c are part of the signature result;

[0157] d is a fixed value based on different algorithms.

[0158] Specifically, before the initiator and responder communicate, the process includes generating encryption and signing keys, initializing and generating encryption and signing key certificates for both parties, and securely storing the other party's signing certificate. The same random data is used to simultaneously generate encryption public and private keys, as well as signing public and private keys; these keys are simultaneously written into the public key field of the certificate, and the certificate's signature is generated from the signing private key corresponding to the CA certificate, ensuring the certificate's uniqueness and verifiability.

[0159] Specifically, in steps S1 to S4, the transmission of the first message and the second message adopts a data structure compatible with the international standard IKE protocol, and the group parameter transmitted is the lattice cipher sequence number; the public key of the certificate includes a Kyber lattice encryption public key and a Dilithium lattice signature public key, and the random numbers of the two are generated independently; the signature of the certificate is generated by the CA's signature private key; the key file contains the corresponding Kyber encryption private key and Dilithium signature private key, and the two correspond one-to-one with the public key in the certificate;

[0160] In the third and fourth message exchanges in steps S5 and S6, the initiator and the responder exchange random numbers (Nonce) and identity ID payloads. The random number (Nonce) is the pre-key for generating the key, and the ID is the identity information of both parties, taken from their respective signature certificate user information. The data is encrypted and protected by a temporary key (Sk) using the SM4-256 algorithm. The temporary key (Sk) is generated by encryption using the Kyber lattice encryption public key in the encryption certificate. At the same time, the data is signed using the Dilithium lattice signing private key in the signature certificate.

[0161] Specifically, in the interaction between the third and fourth messages in steps S5 and S6, the message formats of the initiator and the responder are as follows:

[0162] Initiator's message:

[0163] XCH i = Kyber(ski, pub_r) | SM4-256(N i | ID i , ski)

[0164] SIG i _b = Dilithium(ski_b | N i _b | ID i _b | CERT_enc i _b, priv i );

[0165] Responder message:

[0166] XCH r = Kyber(skr, pub_i) | SM4-256(N r | ID r , skr)

[0167] SIG r _b = Dilithium(skr_b | N r _b | ID r _b | CERT_enc r _b, priv r );

[0168] Where Kyber is the lattice encryption algorithm module, ski and skr are the temporary keys of the initiator and responder, respectively, pub_i and pub_r are the lattice encryption public keys of the initiator and responder, respectively, and N i N r Random numbers for the initiator and the responder, ID respectively. i ID r These are the identifiers for the initiator and the responder, respectively. Dilithium is the lattice signature algorithm module, and CERT_enc is the identifier for the initiator and the responder. i CERT_enc r The encrypted certificate contents of the initiator and responder are respectively, priv i priv r These are the signature private keys for the initiator and the responder, respectively. The subscript 'r' indicates the responder, the subscript 'i' indicates the initiator, and the suffix 'b' indicates the binary data format.

[0169] Specifically, in the fifth and sixth messages of step S7, the data is encrypted and transmitted using the CBC (Cryptographic Block Linking) block mode of the SM4-256 algorithm; the encryption key is generated by random numbers transmitted by both parties, and the initialization vector IV is calculated by HASH(Ski_b | Skr_b) and filled in the PKCS#5 format, where Ski_b and Skr_b represent the binary representations of the temporary keys of the initiator and the responder, respectively;

[0170] The encrypted data includes:

[0171] HASHi = PRF(SKEYID , CKY-I | CKY-R | Sai_b | ID i _b);

[0172] HASHr = PRF(SKEYID , CKY-R | CKY-I | Sar_b | IDr _b);

[0173] Wherein, PRF represents a pseudo-random function, SKEYID represents a key identifier generated from random data using PRF, CKY-I and CKY-R represent the cookies of the initiator and responder, respectively, Sai and Sar represent the security association information exchanged between the initiator and responder in main mode, and ID represents the key identifier. i ID r These are the identifiers for the initiator and the responder, respectively, with the suffix 'b' indicating binary data format.

[0174] Reference Figure 4 As shown, in fast mode, both parties establish a data tunnel based on SM4-256 symmetric encryption; the HASH data transmitted in fast mode includes:

[0175] HASH(1) = PRF(SKEYID_a, MsgID | N i _b | SA [ | ID i | ID r ]);

[0176] HASH(2) = PRF(SKEYID_a, MsgID |N i _b | N r _b | SA [ | ID i | ID r ]);

[0177] HASH(3) = PRF(SKEYID_a, 0 | MsgID | N i _b | N r _b);

[0178] Where MsgID is the message identifier for fast mode, N i N r These represent the fast-mode random numbers for the initiator and responder, respectively. SA is the SA data sent in fast-mode transmission, and ID is the ID. i ID r These are the identifiers for the initiator and the responder, respectively, with the suffix 'b' indicating binary data format.

[0179] Finally, the session key KEYMAT = PRF(SKEYID_d, protocol | SPI |N) is calculated using SM3-HMAC. i _b | N r _b); SKEYID_d represents the derived key identifier used for key derivation, protocol represents the protocol identifier, and SPI represents the security parameter index;

[0180] SKEYID = PRF (hash(Ni_b | Nr_b) , Ci | Cr);

[0181] SKEYID_d = PRF (SKEYID, K | Ci | Cr | 0);

[0182] SKEYID_a = PRF (SKEYID, SKEYID_d | Ci | Cr | 1);

[0183] Ci and Cr are the data transmitted during cookie interaction between the initiator and the responder.

[0184] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0185] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0186] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0187] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0188] Finally, it should be noted that the above specific embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to examples, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A quantum-resistant IPSEC key exchange method, characterized in that, include: S1. The initiator sends an IKE first message to the responder via UDP. The first message includes the first SA negotiation content and the first cookie data used to identify the local session. S2. The responder R receives and detects the first message. If it does not detect that the first SA negotiation content contains an asymmetric encryption lattice encryption algorithm and an SM4-256 negotiation item, it terminates the current interaction. Otherwise, the responder sends a second message to the initiator. The second message includes second cookie data, second SA negotiation content, and a response lattice cryptographic certificate. The response lattice cryptographic certificate includes a response lattice signature certificate and a response lattice encryption certificate. S3. The initiator receives and detects the second message. If it does not detect that the second SA negotiation content contains the asymmetric encryption lattice encryption algorithm and the SM4-256 negotiation item, it terminates the current interaction. S4. Otherwise, perform a certificate verification step, including comparing the HASH value of the response grid password certificate with the HASH value registered on this end. If they are inconsistent, terminate this interaction. S5. If they match, proceed with the random number transmission step, including: the initiator encrypts a 256-bit initiator temporary encryption key based on the public key of the responder's lattice cryptographic certificate, and generates a 512-bit initiator random number encrypted using SM4-256 with the initiator temporary encryption key; then, the initiator signs the initiator random number using its local signature lattice private key to obtain the initiator lattice cryptographic certificate and sends a third message carrying the initiator lattice cryptographic certificate to the responder; the responder receives the third message and decrypts the initiator lattice cryptographic certificate using its local lattice encryption private key to obtain the initiator random number. S6. The responder verifies the initiator's lattice cryptographic certificate. After verifying the validity of the initiator's lattice cryptographic certificate, the responder performs a random number transmission step. After the initiator receives the fourth message sent by the responder, the initiator obtains the responder's random number. S7. The responder and the initiator respectively input the random number of the initiator and the random number of the responder, obtain the first session key based on the pseudo-random function, and encrypt the HASH value of the key exchange process data with the first session key as the encryption key of SM4-256, and send the corresponding fifth and sixth messages to the other end to complete the key consistency confirmation in the main mode. S8. After completing the main mode, enter the fast mode, and the fast mode uses the first session key as the symmetric key of SM4-256 for encrypted transmission of messages. The fast mode includes: the initiator and the responder respectively send a fast mode SA to each other, which carries a 512-bit fast mode random number; The second session key is calculated based on two fast-mode 512-bit random numbers from the local end and the remote end. The confirmation data after the two fast-mode 512-bit random numbers are hashed is sent to the remote end, and the ESP tunnel is established based on the second session key. Communication is permitted when the ESP tunnel parameters of both parties are consistent. The process of encrypting a 512-bit random number from either the initiator or the responder using SM4-256 encryption includes the following steps: The key length of the SM4 algorithm is extended from 128 bits to 256 bits, forming a key with a length of 32 bytes, while the block length remains at 128 bits; In the round key generation phase, the first 16 bytes of the round key are generated first. The last 16 bytes of the round key are then XORed with the last 16 bytes of the key to obtain the initial key, which is then input into the round function F′. Run the round function F′ to obtain the subsequent 32 round keys, and invert the round key sequence to generate the decryption round key; The encryption or decryption process is executed, involving 64 rounds of round function operations to obtain the encryption or decryption result.

2. The quantum-resistant IPSEC key exchange method according to claim 1, characterized in that, The round key generation includes the following steps: The first 128 bits of the initial key are represented as MK0, MK1, MK2, and MK3, where MK represents the master key. These bits are then XORed with system parameters FK0, FK1, FK2, and FK3, where FK represents a system parameter constant. Round key expansion is then performed, outputting consecutive k bits. i+4 The key, where k represents the round key word, from which the last four 32-bit words are taken as k. si k si+1 k si+2 k si+3 ; The last 128 bits of the initial key are represented as MK4, MK5, MK6, and MK7. The k... si k si+1 k si+2 k si+3 Write the first four 32-bit positions of k, XOR them with system parameters FK0, FK1, FK2, and FK3, and then perform round key expansion to obtain the new k. i+4 Key; Repeat step S2 until a complete 64-round key sequence is generated.

3. The quantum-resistant IPSEC key exchange method according to claim 2, characterized in that, The 64-round round function iteration process includes: Write 128 bits of plaintext data into the first four 32-bit positions of k to form k. i k i+1 k i+2 k i+3 The initial input; In the i-th iteration, i = 0 to 63, k i+1 k i+2 k i+3 After performing an XOR operation, the input is fed into the iteration process, and its output is ANDed with k. i XORing yields k i+4 Key; k i+1 k i+2 k i+3 k i+4 As input for the next round, output the complete k-word sequence in sequence; The round function F′ implements a nonlinear mapping based on S-box substitution and linear transformation in each round of iteration to enhance the confusion and diffusion of key expansion.

4. The quantum-resistant IPSEC key exchange method according to claim 1, characterized in that, In step S5, a 256-bit temporary encryption key for the initiator is encrypted using a modified lattice encryption method, CRYSTALS-Kyber, including: S511. Generate a 256-bit random number R; S512. Using a random number R as a seed, use SM3-HMAC to generate a matrix seed ρ and two vector seeds σ. Use the NTT function to generate a k×k CRYSTALS-Kyber matrix A and vectors s and e. S513. Calculate t = A s + e, where the public key consists of ρ and t, and the private key is s; S514. During encryption, input message m and public key, reconstruct the CRYSTALS-Kyber matrix A, take random data r′, and use SM3-HMAC and NTT to expand matrix r, matrix e1, and matrix e2, where NTT is a fast number theory transformation; calculate: u=NTT -1 (A^T*r)+e1; v=NTT -1 (t^T*r)+e2+Decompress_q(Decodel(m),1); Among them, NTT -1 This is the inverse operation of NTT; A^T and t^T represent the transpose of t or A; Decompress_q represents the decompression function, and Decodel represents the decoding function; Based on the above formula, u and v can be calculated, and u and v are the encrypted data; S515. During decryption, u and v are recovered, and Compress_q(v-su, 1) is calculated to obtain an approximate message msg′ with errors. The final message msg is obtained by the compression function. Compress_q represents the compression function.

5. The quantum-resistant IPSEC key exchange method according to claim 1, characterized in that, In step S5, the initiator's random number is signed using a modified lattice signature, CRYSTALS-Dilithium, including: S521. Generate a 256-bit random number R; S522. Using R as the seed, generate a matrix seed ρ and two vector seeds using SM3-HMAC. And the key Key, and use the NTT function to generate a k×l CRYSTALS-Dilithium matrix A′ and vectors s1 and s2; S523. Calculate A′s1+s2 to obtain vector t, decompose vector t into t0 and t1 bit by bit, calculate the hash value of t to obtain tr, where tr represents the digest of t, and the hash algorithm is SM3. S524. Generate a public key and a private key, wherein the public key includes ρ and t1, and the private key includes ρ, Key, tr, s1, s2, and t0. S525, the first step of the signature process is to input the message msg and the private key, generate fixed-length data μ based on tr using SM3-HMAC, and generate fixed-length data ρ′ based on the key and μ using SM3-HMAC. S526. In the second step of the signature process, ρ′ is expanded into a y vector by the NTT function, Ay is calculated to obtain w, the high-order bits of w are taken to obtain w1, a polynomial c is generated based on SM3(μ||w1) and NTT, the polynomial c is multiplied by s1 and s2 respectively, and z and h are obtained by operation with y and w, and the signature results z, h and c are determined according to preset conditions. S527. In the verification process, based on tr and μ, the above algorithm is used to restore the original values. UseHintq (h, A′z -ct1·2^d ,2γ2) is calculated to obtain w1′, and SM3 (μ‖w1′) is calculated to obtain c′. The equality of c′ and c is checked to verify the correctness of the signature result. Here, 2γ2 is a fixed value; h is one of the signature results; the CRYSTALS-Dilithium matrix A′ is expanded using the public key ρ; t1 is a part of the public key; d is a fixed value based on different algorithms; z and c are part of the signature result.

6. The quantum-resistant IPSEC key exchange method according to claim 1, characterized in that, Before the initiator and responder communicate, the process also includes the generation of encryption keys and signature keys. The same random data is used to generate encryption public keys, encryption private keys, signature public keys, and signature private keys simultaneously. The encryption public keys and signature public keys are written into the public key field of the certificate. The signature of the certificate is generated by the signature private key corresponding to the CA certificate to ensure the uniqueness and verifiability of the certificate.

7. The quantum-resistant IPSEC key exchange method according to claim 1, characterized in that, In steps S1 to S4, the transmission of the first and second messages adopts a data structure compatible with the international standard IKE protocol, and the group parameter transmitted is the lattice cipher sequence number; the public key of the certificate includes a Kyber lattice encryption public key and a Dilithium lattice signature public key, and the random numbers of the two are generated independently; the signature of the certificate is generated by the CA's signature private key; the key file contains the corresponding Kyber encryption private key and Dilithium signature private key, and the two correspond one-to-one with the public key in the certificate; In the third and fourth message exchanges in steps S5 and S6, the initiator and the responder exchange random numbers (Nonce) and identity ID payloads. The random number (Nonce) is the pre-key for generating the key, and the ID is the identity information of both parties, taken from their respective signature certificate user information. The data is encrypted and protected by a temporary key (Sk) using the SM4-256 algorithm. The temporary key (Sk) is generated by encryption using the Kyber lattice encryption public key in the encryption certificate. At the same time, the data is signed using the Dilithium lattice signing private key in the signature certificate.

8. The quantum-resistant IPSEC key exchange method according to claim 1, characterized in that, In the third and fourth message exchanges in steps S5 and S6, the message formats of the initiator and the responder are as follows: Initiator's message: X-X i = Kyber(ski, pub_r) | SM4-256(N i ID i , ski) SIG i _b = Dilithium(ski_b | N i _b | ID i _b | CERT_enc i _b, priv i ); Responder message: X-X r = Kyber(skr, pub_i) | SM4-256(N r ID r , skr) SIG r _b = Dilithium(skr_b | N r _b | ID r _b | CERT_enc r _b, priv r ); Where Kyber is the lattice encryption algorithm module, ski and skr are the temporary keys of the initiator and responder, respectively, pub_i and pub_r are the lattice encryption public keys of the initiator and responder, respectively, and N i N r Random numbers for the initiator and the responder, ID respectively. i ID r These are the identifiers for the initiator and the responder, respectively. Dilithium is the lattice signature algorithm module, and CERT_enc is the identifier for the initiator and the responder. i CERT_enc r The encrypted certificate contents of the initiator and responder are respectively, priv i priv r These are the signature private keys for the initiator and the responder, respectively. The subscript 'r' indicates the responder, the subscript 'i' indicates the initiator, and the suffix 'b' indicates the binary data format.

9. The quantum-resistant IPSEC key exchange method according to claim 1, characterized in that, In the fifth and sixth messages of step S7, the data is encrypted and transmitted using the CBC block mode of the SM4-256 algorithm; the encryption key is generated by random numbers transmitted by both parties, and the initialization vector IV is calculated by HASH(Ski_b | Skr_b) and filled in the PKCS#5 format, where Ski_b and Skr_b represent the binary representations of the temporary keys of the initiator and the responder, respectively; The encrypted data includes: HASHi = PRF(SKEYID , CKY-I | CKY-R | Sai_b | ID i _b); HASHr = PRF(SKEYID , CKY-R | CKY-I | Sar_b | ID r _b); Wherein, PRF represents a pseudo-random function, SKEYID represents a key identifier generated from random data using PRF, CKY-I and CKY-R represent the cookies of the initiator and responder, respectively, Sai and Sar represent the security association information exchanged between the initiator and responder in main mode, and ID represents the key identifier. i ID r These are the identifiers for the initiator and the responder, respectively, with the suffix 'b' indicating binary data format. In fast mode, both parties establish a data tunnel based on SM4-256 symmetric encryption; the hash data transmitted in fast mode includes: HASH(1) = PRF(SKEYID_a, MsgID | N i _b | THIS [ | NIGHT i | NIGHT r ]); HASH(2) = PRF(SKEYID_a, MsgID |N i _b | OF r _b | THIS [ | NIGHT i | NIGHT r ]); HASH(3) = PRF(SKEYID_a, 0 | MsgID | N i _b | N r _b); Where MsgID is the message identifier for fast mode, N i N r These represent the fast-mode random numbers for the initiator and responder, respectively. SA is the SA data sent in fast-mode transmission, and ID is the ID. i ID r These are the identifiers for the initiator and the responder, respectively, with the suffix 'b' indicating binary data format. Finally, the session key KEYMAT = PRF(SKEYID_d, protocol | SPI | N) is calculated using SM3-HMAC. i _b |N r _b); SKEYID_d represents the derived key identifier used for key derivation, protocol represents the protocol identifier, and SPI represents the security parameter index; SKEYID = PRF (hash(Ni_b | Nr_b) , Ci | Cr); SKEYID_d = PRF (SKEYID, K | Ci | Cr | 0); SKEYID_a = PRF (SKEYID, SKEYID_d | Ci | Cr | 1); Ci and Cr are the data transmitted during cookie interaction between the initiator and the responder.

Images