Quantum security parallelizable message authentication code construction method and system

Abstract

The invention discloses a parallel message authentication code construction method and system for quantum security. The method comprises the following steps: 1) selecting an adjustable block cipher algorithm key K, nonlinear transformation theta and the length tau of a message identification code by a participant; 2) the sender executes an MAC generation scheme, takes the key K, the temporary value N and the message M as input, outputs a message identification code and sends the message identification code to the receiver; the flow of the MAC generation scheme is as follows: a) dividing a message M into a plurality of n-bit groups; b) encrypting the ith group Mi by using an algorithm, and inputting theta to obtain a state Si after the output and the state Si-1 are subjected to XOR; c) intercepting the leftmost side tau bit of the state Sm corresponding to the last group as a message identification code; and 3) the receiver executes an MAC verification scheme, and verifies whether (MAC, M) is correct or not by taking the key K, the temporary value N, the message M and the message authentication code MAC as input.

Description

Technical Field

[0001] This invention belongs to the field of cryptography and relates to a quantum-safe parallel message authentication code construction method and system. Background Technology

[0002] Message authentication code (MAC) algorithms, under key control, map messages into fixed-length bit strings (called message authentication codes, or MACs) that satisfy the following two properties:

[0003] —The algorithm can perform calculations quickly and efficiently for any key and any message;

[0004] —For any fixed key, an attacker, without obtaining key information, even if they obtain some messages and corresponding MAC values, cannot (computationally) predict the MAC value of any new message.

[0005] Message authentication codes (MACs) can be used for data integrity checks, verifying whether data has been altered without authorization; they can also be used for message authentication, ensuring the legitimacy of the message source. MACs are commonly used in data verification and authentication protocols, and are widely applied in finance, telecommunications, and other fields.

[0006] Based on the underlying modules used in the algorithm, message authentication code algorithms are classified into three categories: those using block ciphers, those using dedicated hash functions, and those using generalized hash functions. With the development of the Internet of Things and the increasing demand for lightweight algorithms, a fourth category has been added to the standard—lightweight message authentication code algorithms.

[0007] The security of message authentication codes is typically assessed by the algorithm's ability to resist forgery attacks. Treating the underlying modules as pseudo-random permutations, provable security theory can be used to analyze and demonstrate the algorithm's unforgeability. Due to the limitation imposed by birthday forgery attacks, the security bound of such algorithms is typically around 2. n / 2 , where n is a parameter of the underlying module, such as the group length.

[0008] With the rapid development of quantum computers, quantum security has become a new requirement for algorithm evaluation. Recent research shows that when attackers are allowed to perform quantum superposition state queries, the Simon quantum period discovery algorithm can reduce the attack complexity of many message authentication algorithms from O(2^3) to O(2^3). n / 2 The computation time is reduced to a polynomial level of O(n). PMAC employs a block cipher and Gray code to construct an adjustable block cipher, achieving efficient computation by calling the adjustable block cipher in parallel and then summing the outputs. However, effective quantum theory attacks have been found against PMAC and similar authentication encryption methods.

[0009] In contrast, currently only HMAC and KMAC algorithms have been proven to be quantum-safe message authentication codes.

[0010] I. HMAC, a standard message authentication code algorithm using a dedicated hash function, is based on the NMAC framework and serially calls the round function. It has been proven that when the round function is a quantum pseudo-random function, the algorithm's distinguishing complexity from a quantum random function is Ω(2). n / 3 ), where n is the bit length of the round function output.

[0011] II. KMAC is a standard message authentication code algorithm designed specifically for the SHA-3 series of dedicated hash functions. It employs Keccak permutation and a sponge structure. The sponge structure serially calls the round function Keccak permutation, which has been proven to be quantum collision-resistant when the underlying layer is a quantum pseudo-random permutation.

[0012] Both of these quantum-safe message authentication code algorithms employ dedicated hash functions and serial structures, characterized by large scale and increasing computation time with data length. Currently, there is a lack of quantum-safe message authentication code algorithms that support parallel computation; therefore, constructing such a scheme is promising and of significant importance. Summary of the Invention

[0013] The purpose of this invention is to construct a quantum-safe, parallelizable message authentication code method and system. It employs a message authentication code scheme similar to the working mode of an adjustable block cipher, possessing the advantages of parallel implementation and quantum-resistant security. This invention improves the collision resistance of the adjustable block cipher output by rationally setting the handle parameters, and combines nonlinear transformations to achieve a significant upgrade from classical security to quantum security at minimal cost. Except for the final encryption, this invention supports parallel invocation of the adjustable block cipher, exhibiting high speed and efficiency in multiprocessor environments, and is particularly suitable for processing long messages.

[0014] The technical solution adopted in this invention is as follows.

[0015] A quantum-safe, parallelizable message authentication code construction method includes the following steps:

[0016] An adjustable block cipher algorithm in which the participants select n-bit blocks and t-bit handles. And the key K, and the nonlinear transformation θ;

[0017] The sender executes the MAC generation scheme, taking the key K, the temporary value N, and the message M as input, and outputs the message authentication code MAC.

[0018] The receiver executes the MAC verification scheme, using the key K, temporary value N, message M, and message authentication code MAC as inputs, to verify whether (MAC, M) is correct.

[0019] Furthermore, the present invention includes a setting, MAC generation, and MAC verification scheme, which are described in detail below.

[0020] I. Settings

[0021] The participants jointly select an adjustable block cipher algorithm. And a shared key K is determined according to the requirements of the selected algorithm, where the algorithm... The block size is n bits, the handle length is t bits, and the key K is k bits. For the key K, the adjustable block cipher algorithm... The tuning levers all form {0,1} n The permutation family on.

[0022] The participants jointly agree on the length τ of the message authentication code (MAC), which must satisfy τ≤n, and is usually chosen to be τ=n / 2.

[0023] Select the length of the handle parameters, including the length of the temporary value N, the flag, and the counter value ctr, such that the total length of the constructed handle (N, flag, ctr) is t bits.

[0024] The flag is used to identify different stages of the operation. The flag used in this invention includes a 2-bit binary representation of 2, 1, and 0. Users can also choose three different values ​​to replace it.

[0025] Select the nonlinear transformation θ.

[0026] II. MAC Generation Scheme

[0027] Using key K, message M, and temporary value N as input, generate a τ-bit message authentication code (MAC). The process is as follows:

[0028] (1) Divide the message M into several n-bit blocks, denoted as M1, ..., M2. m Among them, |M i |=n(i=1,...,m-1) and|M m |≤n; |A| represents the number of bits in bit string A.

[0029] (2) Set state S0 to an all-zero group. For i = 1 to m-1, respectively, for message group M... i An adjustable block cipher algorithm using K as the key and (N,2,i) as the handle is applied. Obtain an n-bit output; adjust the block cipher. Output and State S i-1 XOR the values ​​and input the XOR result into the nonlinear transformation θ to obtain the new state S. i Until the first m-1 message packets have been processed, the state S is obtained.m-1 .

[0030] (3) For the last message group M m Based on its length, there are two cases: if |M m |<n, then for M m After filling, place the Pad n (M m ) and state S m-1 XOR, and apply an adjustable block cipher algorithm with K as the key and (N,1,m) as the handle to the XOR result. Perform encryption, and use the encryption result as state S. m If |M m If |=n, then directly set M m With state S m-1 XOR, and apply an adjustable block cipher algorithm with K as the key and (N,0,m) as the handle to the XOR result. Obtain state S m Among them, Pad n (A) indicates that bit string A is padded so that the length of the padded bit string is n. Here, the default is to use 1-0 padding, that is, after padding bit string A with one 1 on the right, several 0s are added.

[0031] (4) Capture state S m The leftmost τ bits are used as the message authentication code (MAC) and output.

[0032] III. MAC Verification Scheme

[0033] The process takes key K, message M, temporary value N, and message authentication code MAC as input and outputs a 1-bit value. The procedure is as follows:

[0034] (1) For the received message M, the authentication code MAC' is calculated using the MAC generation method.

[0035] (2) If the calculated MAC' is equal to the received MAC, output 1 to indicate that the message verification is correct; otherwise, output 0 to indicate that the message verification is incorrect.

[0036] Based on the same inventive concept, this invention also provides a quantum-safe parallelizable message authentication code construction system, which includes:

[0037] The setup module is used by the participants to select an adjustable block cipher algorithm with n-bit blocks and t-bit handles. And the key K, and the nonlinear transformation θ;

[0038] The generation module is used to execute the MAC generation scheme, taking the key K, temporary value N and message M as input, and outputting the message authentication code MAC.

[0039] The verification module is used to execute the MAC verification scheme, taking the key K, temporary value N, message M and message authentication code MAC as input, and verifying whether (MAC, M) is correct.

[0040] This invention is based on a temporary value design. During use, the temporary value cannot be reused without changing the key. In other words, when using the same key, a different temporary value N needs to be selected for each message M. A collision-resistant handle is constructed by communicating the fresh temporary value, tokens, and counter values, thereby ensuring strong randomness in the output of the adjustable block cipher during use.

[0041] Furthermore, this invention can be efficiently implemented on multiprocessors and can be combined with lightweight algorithms for resource-constrained environments. When executing the MAC generation scheme, this invention supports fully parallel calls to the adjustable block cipher, except for the final encryption. Processing a single message on a multiprocessor requires at least the time it takes to encrypt a single message using the adjustable block cipher twice. Alternatively, this invention can also process message blocks and call the adjustable block cipher sequentially, requiring only about 2n bits (2 blocks) of storage space.

[0042] Furthermore, this invention employs nonlinear transformations to enhance resistance to quantum attacks. These nonlinear transformations can be flexibly selected based on the application environment to ensure fast and efficient computation. For example, when considering hardware implementation, simple logical operations can be chosen to implement the nonlinear transformation; cyclically shifting or keeping the last bit of state S unchanged is a simple implementation method.

[0043] Furthermore, this invention possesses good security. When the adjustable block cipher has good security, the message authentication code calculated using the scheme of this invention also has good security. This invention has been proven through provable security theory analysis that when the adjustable block cipher possesses (quantum) pseudo-randomness, the message authentication code of this invention also possesses (quantum) pseudo-randomness.

[0044] Compared with the prior art, the positive effects of the present invention are as follows:

[0045] This invention offers enhanced security, achieving resistance to quantum computing attacks; furthermore, the algorithm is simple to design and easy to implement.

[0046] This invention is widely applicable to fields such as communications and finance, used for protecting data integrity or authenticating data sources. It offers flexibility in application implementation, suitable for efficient implementation on multi-processor systems such as smart computers, servers, and high-performance computers, as well as lightweight implementation on resource-constrained devices such as smart cards, secure batteries, and sensor networks.

[0047] This invention belongs to the working mode of adjustable block ciphers, and different adjustable block ciphers can be selected during implementation.

[0048] In this invention, users can select different nonlinear transformations θ according to the application environment. It is important to note that nonlinear transformations can affect the randomness of the state. The selected nonlinear transformation should provide nonlinearity to the state value while preserving high information entropy to prevent attackers from exploiting the loss of randomness to construct attacks. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of the MAC generation process. Detailed Implementation

[0050] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below through specific examples.

[0051] In one embodiment of the present invention, an adjustable block cipher algorithm The Deoxys-TBC-256 adjustable block cipher algorithm of the Deoxys-TBC family as specified in ISO / IEC 18033-7:2022 is adopted, with a block length of 128 bits, a key length of 128 bits, and a handle length of 128 bits.

[0052] Deoxys-BC-256 Algorithm: Deoxys-BC-256 uses a round function similar to the AES-128 algorithm. The main difference from AES-128 is that the round key plus AddRoundKey operation is replaced with the round handle key plus AddRoundTweakey. After 16 rounds of iteration, the encrypted result is produced.

[0053] The replacement round handle key is added using AddRoundTweakey: For a key K and a handle T, let TK = T||K. The handle key arrangement algorithm divides the input TK into n = 128 bits. And generate the Tweakey value required for each step in sequence.

[0054] For i ← 1, ..., r,

[0055]

[0056] The byte substitution P is defined as follows:

[0057]

[0058] The functions of the linear feedback shift registers LFSR2 and LFSR3 are defined as follows.

[0059]

[0060] Based on the handle key arrangement, the wheel handle key is defined as follows.

[0061]

[0062] Among them, RC i Let be the round constant, defined in matrix form as follows:

[0063]

[0064] RCON[i] represents the (i+15)th key arrangement constant of AES, specifically in hexadecimal as shown in Table 1.

[0065] Table 1. Constant values ​​used in Deoxys-TBC-256

[0066] Number of rounds RCON[i] is a constant value. i = 0 to i = 16 2F,5E,BC,63,C6,97,35,6A,D4,B3,7D,FA,EF,C5,91,39,72

[0067] The nonlinear transformation θ is implemented using the byte permutation h and the linear feedback shift register LFSR3 in the Deoxys-TBC handle key arrangement operation, and is formally defined as:

[0068]

[0069] Set the length of the temporary value N to 64 bits, the length of the flag to 2 bits, and the length of the counter value ctr to 62 bits. Set the length of the message authentication code τ to 64 bits.

[0070] The key K is to be jointly and secretly held by all participating parties.

[0071] I. MAC Generation Scheme

[0072] Given a 64-bit temporary value N and a message M of arbitrary length, generate a 64-bit Message Authentication Code (MAC). The process is as follows:

[0073] (1) For the input message M, divide it into m message groups M1,...,M according to n=128 bits. m The last group M m It may be less than n bits.

[0074] (2) Divide the message into groups M respectively. i (i = 1 to m-1) Apply an adjustable block cipher algorithm with K as the key and (N, 2, i) as the handle. The state S is obtained by XORing the outputs of m-1 values. m-1 .

[0075] (3) For the last message group M mIf its length is less than that of a group, then for M m Pad is obtained by performing 1-0 filling. n (M m ), put Pad n (M m ) and state S m-1 XOR, applying an adjustable block cipher algorithm with K as the key and (N,1,m) as the handle to XOR. Obtain state S m Otherwise, M m With state S m-1 XOR, and an adjustable block cipher algorithm using K as the key and (N,0,m) as the handle. Obtain state S m .

[0076] (4) Capture state S m The leftmost 64 bits are used as the message authentication code (MAC) and output.

[0077] II. MAC Generation Scheme

[0078] Input a 64-bit temporary value N, a message M of arbitrary length, and a 64-bit message authentication code (MAC), and output a 1-bit verification result. The process is as follows:

[0079] (1) The message authentication code MAC' is calculated for (N,M) using the MAC generation method.

[0080] (2) If MAC' = MAC, output 1; otherwise, output 0.

[0081] Another embodiment of the present invention provides a quantum-resistant message authentication code construction system using an adjustable block cipher, comprising:

[0082] The setup module is used by the participants to select an adjustable block cipher algorithm with n-bit blocks and t-bit handles. And the key K, and the nonlinear transformation θ;

[0083] The generation module is used to execute the MAC generation scheme, taking the key K, temporary value N and message M as input, and outputting the message authentication code MAC.

[0084] The verification module is used to execute the MAC verification scheme, taking the key K, temporary value N, message M and message authentication code MAC as input, and verifying whether (MAC, M) is correct.

[0085] Another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0086] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) storing a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0087] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.

Claims

1. A quantum-safe parallelizable message authentication code construction method, comprising the following steps: 1) An adjustable block cipher algorithm in which the participants select n-bit blocks and t-bit handles. The key K, the nonlinear transformation θ, and the length τ of the message authentication code, where τ ≤ n; the parameters of the handle include a temporary value N, a flag, and a counter value ctr; the flag is used to identify different stages of the operation; 2) The sender executes the MAC generation scheme, taking the key K, temporary value N, and message M as input, outputting the message authentication code, and sending it to the receiver; the process of the MAC generation scheme is as follows: 21) Divide the message M into several n-bit blocks, denoted as M1,...,M m ; where, |M i |=n, and |M m |≤n;i=1,...,m-1; 22) Set state S0 to an all-zero block; for i = 1, ..., m-1, use an adjustable block cipher algorithm with K as the key and (N, flag, i) as the handle. For the i-th group M i Encryption will be performed using an adjustable block cipher. Output and State S i-1 XOR the values ​​and input the XOR result into the nonlinear transformation θ to obtain the new state S. i ; until the first m-1 message packets have been processed, the state S is obtained. m-1 ; 23) For the last group M m If |M m |<n, then for M m After padding to an n-bit length, it is compared with state S. m-1 XOR is an adjustable block cipher algorithm using K as the key and (N, flag, m) as the handle. Encrypt the XOR result and use the encrypted result as state S. m If |M m If |=n, then directly set M m With state S m-1 XOR is an adjustable block cipher algorithm using K as the key and (N, flag, m) as the handle. Encrypt the XOR result to obtain state S. m ; 24) Capture state S m The leftmost τ bits are used as the message authentication code; 3) The receiver executes the MAC verification scheme, using the key K, temporary value N, message M, and message authentication code MAC as inputs, to verify whether (MAC, M) is correct; the MAC verification scheme process is as follows: 31) For the received message M, the message authentication code is calculated using the MAC generation scheme and denoted as MAC'; 32) If the calculated MAC' is equal to the received message authentication code MAC, then the verification is successful.

2. The method according to claim 1, characterized in that, τ = n / 2.

3. The method according to claim 1, characterized in that, The flag consists of a 2-bit binary representation of 2, 1, and 0.

4. The method according to claim 1, 2, or 3, characterized in that, The adjustable block cipher algorithm The Deoxys-TBC-256 adjustable block cipher algorithm of the Deoxys-TBC family as specified in ISO / IEC 18033-7:2022 is adopted.

5. A quantum-safe parallelizable message authentication code construction system, characterized in that, include The configuration module is used by each participant to select an adjustable block cipher algorithm with n-bit blocks and t-bit handles. The key K, the nonlinear transformation θ, and the length τ of the message authentication code, where τ ≤ n; the parameters of the handle include a temporary value N, a flag, and a counter value ctr; the flag is used to identify different stages of the operation; The generation module is used to execute the MAC generation scheme, taking the key K, temporary value N and message M as input, and outputting the message authentication code MAC. The MAC generation scheme is as follows: 21) Divide the message M into several n-bit groups, denoted as M1, ..., M2. m ; where, |M i |=n, and |M m |≤n;i=1,…,m-1;22) Set state S0 to an all-zero block; for i=1~m-1, use an adjustable block cipher algorithm with K as the key and (N,flag,i) as the handle. For the i-th group M i Encryption will be performed using an adjustable block cipher. Output and State S i-1 XOR the values ​​and input the XOR result into the nonlinear transformation θ to obtain the new state S. i ; until the first m-1 message packets have been processed, the state S is obtained. m-1 ;23) For the last group M m If |M m |<n, then for M m After padding to an n-bit length, it is compared with state S. m-1 XOR is an adjustable block cipher algorithm using K as the key and (N, flag, m) as the handle. Encrypt the XOR result and use the encrypted result as state S. m If |M m If |=n, then directly set M m With state S m-1 XOR is an adjustable block cipher algorithm using K as the key and (N, flag, m) as the handle. Encrypt the XOR result to obtain state S. m ;24) Capture state S m The leftmost τ bits are used as the message authentication code; The verification module is used to execute the MAC verification scheme, taking the key K, temporary value N, message M and message authentication code MAC as input, to verify whether (MAC, M) is correct. The process of the MAC verification scheme is as follows: for the received message M, the message authentication code is calculated using the MAC generation scheme and denoted as MAC'; if the calculated MAC' is equal to the received message authentication code MAC, the verification is successful.

6. The system according to claim 5, characterized in that, τ = n / 2.

7. The system according to claim 5, characterized in that, The flag consists of a 2-bit binary representation of 2, 1, and 0.

8. The system according to claim 5, characterized in that, The adjustable block cipher algorithm The Deoxys-TBC-256 adjustable block cipher algorithm of the Deoxys-TBC family as specified in ISO / IEC 18033-7:2022 is adopted.

9. A computer device comprising a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of claim 1.

10. A computer-readable storage medium for storing a computer program, which, when executed by a computer, implements the steps of the method of claim 1.

Images