Key encapsulation methods and devices

Abstract

Embodiments of the present application provide a key encapsulation method and device, the method comprising: in response to a key encapsulation request for transmitting data to a receiving end, obtaining a public key corresponding to the receiving end, and encoding a plaintext message to be encapsulated into a message polynomial on a polynomial ring; performing linear compression on the message polynomial using an inverse element of a preset small coefficient polynomial to obtain a compressed plaintext polynomial; generating a first ciphertext component based on a second public key component and an encryption polynomial, and generating a second ciphertext component based on a first public key component and the compressed plaintext polynomial. The encapsulation result containing the first ciphertext component and the second ciphertext component is sent to the receiving end, so that the receiving end uses a corresponding private key to unencapsulate the encapsulation result, obtains the compressed plaintext polynomial, and decodes the compressed plaintext polynomial to restore the plaintext message. This can effectively resist quantum computers, effectively reduce the ciphertext length of the encapsulated plaintext message, and further reduce storage and communication overhead.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a key encapsulation method and device. Background Technology

[0002] With the rapid development of quantum computing technology, mathematical problems such as large number factorization and discrete logarithms, which are relied upon by traditional public-key cryptography algorithms, are easily and efficiently cracked by quantum algorithms. Passive attackers can eavesdrop on and store currently encrypted communication data, and then backtrack and decrypt it once quantum computers mature, posing a permanent security threat to currently sensitive data.

[0003] To address the quantum threat, post-quantum cryptography has become a key research focus. Existing post-quantum key encapsulation schemes based on encoding achieve quantum security by relying on the difficulty of decoding random linear codes, but they require a large parameter space, resulting in large linear code dimensions and generator matrix sizes. This leads to large public key and ciphertext volumes, which in turn result in high storage and communication overhead, severely limiting their deployment and application in scenarios with limited bandwidth and scarce computing resources.

[0004] Therefore, there is an urgent need for a post-quantum key encapsulation scheme that can effectively resist quantum computers while reducing the length of public keys and ciphertext. Summary of the Invention

[0005] This application provides a key encapsulation method and a device key encapsulation method to effectively resist quantum computers and reduce ciphertext length.

[0006] In a first aspect, embodiments of this application provide a key encapsulation method. This key encapsulation method is applied at a sending end, and the method includes: In response to a user-triggered key encapsulation request for transmitting data to a receiving end, the public key corresponding to the receiving end is obtained. The encapsulation request includes a plaintext message to be encapsulated. The public key includes a first public key component randomly generated on a preset polynomial ring and a second public key component superimposed with small coefficient noise. Encode the plaintext message into a message polynomial on the preset polynomial ring; The message polynomial is linearly compressed using the inverse of a pre-defined small-coefficient polynomial to obtain the compressed plaintext polynomial. A first ciphertext component is generated based on the second public key component and the cryptographic polynomial, and a second ciphertext component is generated based on the first public key component and the compressed plaintext polynomial; the cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process. The encapsulation result containing the first ciphertext component and the second ciphertext component is sent to the receiving end, so that the receiving end can use its private key to decapsulate the encapsulation result, obtain the compressed plaintext polynomial, and decode the compressed plaintext polynomial to restore the plaintext message.

[0007] Secondly, embodiments of this application provide a key encapsulation device applied at a transmitting end, the device comprising: The response module is used to respond to a key encapsulation request triggered by a user for transmitting data to a receiving end, and to obtain the public key corresponding to the receiving end. The encapsulation request includes a plaintext message to be encapsulated, and the public key includes a first public key component randomly generated on a preset polynomial ring and a second public key component superimposed with small coefficient noise. The encoding module is used to encode the plaintext message into a message polynomial on the preset polynomial ring; The compression module is used to linearly compress the message polynomial using the inverse of a preset small-coefficient polynomial to obtain the compressed plaintext polynomial. A generation module is used to generate a first ciphertext component based on the second public key component and the cryptographic polynomial, and to generate a second ciphertext component based on the first public key component and the compressed plaintext polynomial; the cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process. The sending module is configured to send the encapsulation result containing the first ciphertext component and the second ciphertext component to the receiving end, so that the receiving end can use its corresponding private key to decapsulate the encapsulation result, obtain the compressed plaintext polynomial, and decode the compressed plaintext polynomial to restore the plaintext message.

[0008] Thirdly, embodiments of this application provide an electronic device applied to a transmitting end, comprising: a memory, a processor, and a communication interface; wherein, the memory stores executable code, and when the executable code is executed by the processor, the processor can at least implement the key encapsulation method as described in the first aspect.

[0009] Fourthly, embodiments of this application provide a non-transitory machine-readable storage medium storing executable code, which, when executed by a processor of an electronic device, enables the processor to at least implement the key encapsulation method as described in the first aspect.

[0010] Fifthly, embodiments of this application provide a computer program product, including: a computer program or instructions, which, when executed by a processor of an electronic device, enable the processor to at least implement the key encapsulation method as described in the first aspect.

[0011] Sixthly, embodiments of this application provide a key encapsulation method applied at a receiving end, the method comprising: The receiver sends an encapsulation result containing a first ciphertext component and a second ciphertext component. The first ciphertext component is generated based on the second public key component in the public key corresponding to the receiver and a cryptographic polynomial, wherein the cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process. The second ciphertext component is generated based on the first public key component in the public key corresponding to the receiver and a compressed plaintext polynomial, wherein the compressed plaintext polynomial is obtained by encoding and linearly compressing the plaintext message to be encapsulated. Using the first and second private key components from the private key corresponding to the receiving end, the encapsulation result is decapsulated to eliminate the cryptographic polynomial introduced during encapsulation and obtain the compressed plaintext polynomial. The compressed plaintext polynomial is decoded to restore the plaintext message.

[0012] Seventhly, embodiments of this application provide a key encapsulation device applied at a receiving end, the device comprising: The receiving module is used to receive the encapsulation result containing a first ciphertext component and a second ciphertext component sent by the sending end; the first ciphertext component is generated based on the second public key component in the public key corresponding to the receiving end and a cryptographic polynomial, the cryptographic polynomial being used to introduce a cancelable random mask during the encapsulation process; the second ciphertext component is generated based on the first public key component in the public key corresponding to the receiving end and a compressed plaintext polynomial, the compressed plaintext polynomial being obtained by encoding and linearly compressing the plaintext message to be encapsulated. The decapsulation module is used to decapsulate the encapsulation result using the first private key component and the second private key component in the private key corresponding to the receiving end, thereby eliminating the encryption polynomial introduced during encapsulation to obtain the compressed plaintext polynomial. The decoding module is used to decode the compressed plaintext polynomial and restore the plaintext message.

[0013] Eighthly, embodiments of this application provide an electronic device applied to a receiving end, comprising: a memory, a processor, and a communication interface; wherein, the memory stores executable code, and when the executable code is executed by the processor, the processor can at least implement the key encapsulation method as described in the sixth aspect.

[0014] In a ninth aspect, embodiments of this application provide a non-transitory machine-readable storage medium storing executable code, which, when executed by a processor of an electronic device, enables the processor to at least implement the key encapsulation method as described in the sixth aspect.

[0015] In a tenth aspect, embodiments of this application provide a computer program product, including: a computer program or instructions that, when executed by a processor of an electronic device, enable the processor to at least implement the key encapsulation method as described in the sixth aspect.

[0016] The key encapsulation scheme provided in this application embodiment can be applied to the sending end. The plaintext message to be encapsulated is encoded into a message polynomial, the message polynomial is linearly compressed, and the compressed plaintext polynomial is encapsulated using the two public key components corresponding to the receiving end to generate two ciphertext components. The two ciphertext components are sent to the receiving end, so that the receiving end can use its private key to decapsulate the two ciphertext components to obtain the compressed plaintext polynomial, and decode the compressed plaintext polynomial to restore the plaintext message. This not only effectively resists quantum computers and ensures the security of the data to be transmitted, but also reduces the length of the public key and ciphertext.

[0017] In practice, before the sending end performs key encapsulation processing on the plaintext message to be transmitted, the receiving end first randomly generates a first public key component on a preset polynomial ring and generates a second public key component by superimposing small-coefficient noise. Thus, when the sending end receives a key encapsulation request triggered by a user for transmitting data to the receiving end, it can directly obtain the public key corresponding to the receiving end. This encapsulation request includes the plaintext message to be encapsulated, and the public key includes the first and second public key components. Next, the plaintext message is encoded into a message polynomial on the preset polynomial ring, and the message polynomial is linearly compressed using the inverse of the preset small-coefficient polynomial to obtain the compressed plaintext polynomial. Then, a first ciphertext component is generated based on the second public key component and the cryptographic polynomial, and a second ciphertext component is generated based on the first public key component and the compressed plaintext polynomial. The cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process. Finally, the encapsulation result containing the first ciphertext component and the second ciphertext component is sent to the receiving end, so that the receiving end can use its corresponding private key to decapsulate the encapsulation result, obtain the compressed plaintext polynomial, and decode the compressed plaintext polynomial to restore the plaintext message.

[0018] In the above scheme, a first public key component is randomly generated on a pre-defined polynomial ring structure, and a second public key component is generated by superimposing small-coefficient noise on the ring. The two components are combined to form the public key at the receiving end, thus constructing a public key based on the difficulty of the NTWE problem. This not only reduces the public key size but also ensures that the generated public key pair is resistant to quantum computer attacks. Furthermore, during key encapsulation, the original plaintext is mapped to a smaller, more compact representation space without losing semantic information. This compression operation significantly reduces the parameter size of the plaintext and effectively reduces noise accumulation introduced during subsequent encryption, thus ensuring correct decryption. Additionally, the second public key component is combined with a randomly generated encryption polynomial to generate the first ciphertext component. The first public key component is then combined with the compressed plaintext polynomial to generate the second ciphertext component. The entire ciphertext structure is naturally embedded in the mathematical difficulty of the NTWE problem, making it impossible for attackers with powerful computing capabilities to effectively recover the original plaintext message from the ciphertext, thus resisting quantum computer attacks. The receiving end, by using the small-coefficient polynomial in the private key, can efficiently cancel noise and restore the compressed plaintext message, thereby achieving high security and high reliability while controlling computational overhead and communication bandwidth. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A schematic diagram of a key encapsulation system provided in an embodiment of this application; Figure 2 A flowchart illustrating a key encapsulation method provided in this application embodiment; Figure 3 A flowchart illustrating another key encapsulation method provided in an embodiment of this application; Figure 4 A flowchart illustrating yet another key encapsulation method provided in this application embodiment; Figure 5 A schematic diagram of a key encapsulation device provided in an embodiment of this application; Figure 6 To and Figure 5 A schematic diagram of the electronic device corresponding to the key encapsulation device provided in the embodiment shown; Figure 7 A schematic diagram of another key encapsulation device provided in an embodiment of this application; Figure 8 To and Figure 7 The illustrated embodiment provides a schematic diagram of the electronic device corresponding to the key encapsulation device. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. “Multiple” generally includes at least two, but does not exclude the inclusion of at least one. It should be understood that the term “and / or” as used herein is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Additionally, the character “ / ” in this document generally indicates that the preceding and following related objects are in an “or” relationship. Depending on the context, the words “if” or “when” as used herein can be interpreted as “when…” or “when…”.

[0023] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a product or system comprising a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a product or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the product or system that includes said element.

[0024] Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0025] In the digital information age, network communication security determines the security of all types of data transmission. Currently, the mainstream approach to secure network communication is to use public-key cryptography to authenticate the identities of both communicating parties, negotiate and establish a shared key, and then use this shared key as the key for a symmetric cryptographic algorithm to encrypt the massive amounts of data transmitted subsequently, thereby ensuring the confidentiality and integrity of the data.

[0026] However, with the rapid development of quantum computing technology, mathematical problems such as large number factorization and discrete logarithms, which are relied upon by traditional public-key cryptography algorithms, are facing the risk of being efficiently cracked by quantum algorithms. Passive attackers can eavesdrop on and store encrypted data from current secure communications, and then decrypt it once quantum computers mature in the future, thus posing a permanent security threat to sensitive data.

[0027] To address the quantum threat, post-quantum cryptography has become a key research focus. However, current post-quantum key encapsulation schemes based on encoding rely on the decoding difficulty of random linear codes for security. Specifically, the receiver first randomly generates a high-dimensional linear code, then constructs a corresponding generator matrix based on this code, and uses this matrix to generate a public and private key. The sender obtains the receiver's public key and uses it to encrypt the session key, generating the corresponding ciphertext. The receiver then decrypts the ciphertext using its own private key to recover the session key. However, to ensure quantum-resistant security, this scheme requires a large parameter space, resulting in high-dimensional linear codes and large generator matrix sizes. This leads to exceptionally large public and ciphertext volumes, resulting in high storage and communication overhead, severely limiting its practical deployment and application in scenarios with limited bandwidth and computational resources.

[0028] Furthermore, NIST's post-quantum key encapsulation standard, FIPS 203 ML-KEM, is based on the modular lattice hard problem. The lattice has a relatively large dimension, which leads to a large ciphertext, affecting system performance and hindering the system's transition to post-quantum.

[0029] To address the aforementioned technical challenges, this application proposes a key encapsulation scheme leveraging the computational difficulty of the NTWE problem. This scheme employs a compact public-key structure built upon a polynomial ring, where the public key consists of only two small-scale polynomials. This eliminates the need for high-dimensional matrix operations during key encapsulation, significantly reducing the number of parameters in ciphertext generation. Furthermore, during key encapsulation, the plaintext message is compressed and mapped to a smaller, more compact representation space, reducing the parameter size of the plaintext and effectively mitigating noise accumulation introduced during subsequent encryption. The first ciphertext component is generated by combining the second public-key component with a randomly generated encryption polynomial, and the second ciphertext component is generated by combining the first public-key component with the compressed plaintext polynomial. This embeds the ciphertext into the mathematical difficulty of the NTWE problem, effectively resisting quantum computers and further suppressing ciphertext expansion, resulting in a significantly shorter ciphertext length and a substantial reduction in communication overhead.

[0030] The key encapsulation scheme will be illustrated below with reference to the following embodiments.

[0031] Figure 1 A schematic diagram of a key encapsulation system provided in an embodiment of this application is shown below. Figure 1 As shown, the system may include a transmitter and a receiver.

[0032] The sending end can be any device that needs to transmit data to the receiving end. Specifically, the sending end can be a mobile phone, personal computer (PC), tablet computer, application program, etc. It can also be any device that can provide computing services, such as a cluster server, regular server, cloud server, cloud host, virtual data center, etc.

[0033] The receiving end can be any device that receives the encapsulation key and related data transmitted by the sending end. Specifically, the receiving end can be a mobile phone, personal computer (PC), tablet computer, configuration application, etc. It can also be any device capable of providing computing services, such as a cluster server, regular server, cloud server, cloud host, virtual data center, etc. Furthermore, both the sending end and the receiving end are equipped with the key encapsulation device described in this application to perform the corresponding key encapsulation processing.

[0034] In practical applications, when a sender needs to transmit data to a receiver, to prevent the data from being stolen, tampered with, or forged during transmission, the transmitted data can first be key-encapsulated to send ciphertext containing the plaintext message to be transmitted to the receiver. Specifically, in response to a user-triggered key encapsulation request for transmitting data to the receiver, the sender obtains the receiver's public key. This encapsulation request includes the plaintext message to be encapsulated. The plaintext message can be the data to be transmitted itself, or a session key used to encrypt data, etc.

[0035] The receiving end can pre-generate corresponding public and private keys. The public key is used by the sending end for key encapsulation, and the private key is stored separately by the receiving end for subsequent decapsulation of the encapsulated content by the sending end, ensuring that only the receiving end can obtain the original plaintext message.

[0036] Furthermore, in the specific implementation process, in order to reduce the length of the generated public key, when generating the public-private key pair, two small-coefficient polynomials can be randomly generated in a preset polynomial ring. The two small-coefficient polynomials are used to generate two private key components corresponding to the private key of the receiving end. The first private key component and the small-coefficient error vector in the preset polynomial ring are used to construct the first public key component, and the small-coefficient polynomial randomly generated in the preset polynomial ring is used as the second public key component.

[0037] In other words, the public key generated here for the receiving end consists only of the first and second public key components constructed above. Both public key components are generated based on the small coefficient characteristics of a preset polynomial ring and do not contain any information related to the receiving end's private key. This can significantly reduce the length of the public key and improve its anti-cracking capability through the randomness of the small coefficient polynomial and the concealment of the error vector. It ensures that after the sending end uses the public key for encapsulation, only the receiving end holding the corresponding private key can complete the decapsulation operation, effectively preventing the plaintext message from being illegally stolen or tampered with.

[0038] After generating public and private keys, the receiving end can send the public key to the sending end through secure channels, such as through encrypted communication links or pre-store it in a secure storage node agreed upon by both parties for the sending end to access, thus preventing the public key from being tampered with during transmission.

[0039] After obtaining the public key corresponding to the receiver, the sender encapsulates the plaintext message in the encapsulation request to generate encapsulated ciphertext data, and sends the encapsulation result to the receiver.

[0040] Specifically, when performing key encapsulation, the sending end can first encode the plaintext message into a message polynomial on a preset polynomial ring. Then, it uses the inverse of the preset small-coefficient polynomial to linearly compress the message polynomial, obtaining the compressed plaintext polynomial. Next, it generates a first ciphertext component based on the second public key component and the cryptographic polynomial, and a second ciphertext component based on the first public key component and the compressed plaintext polynomial. The cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process. Finally, the encapsulation result, containing the first and second ciphertext components, is sent to the receiving end.

[0041] After receiving the encapsulation result from the sender, the receiver uses the first and second private key components from its own private key to decapsulate the result, eliminating the cryptographic polynomial introduced during encapsulation to obtain the compressed plaintext polynomial. Then, the compressed plaintext polynomial is decoded to reconstruct the plaintext message.

[0042] In summary, the embodiments of this application utilize a compact small-coefficient polynomial to construct lightweight public and private keys, and further compress the plaintext message through message preprocessing to obtain a compressed plaintext polynomial. This is then encapsulated by noisy ring operations. This not only hides the plaintext message and effectively resists quantum computers, but also significantly shortens the length of the generated ciphertext.

[0043] To facilitate understanding of the specific key encapsulation process between the sender and receiver described above, the following will combine... Figure 2 The specific implementation process of key encapsulation performed by the sending end is illustrated by an example.

[0044] Figure 2 A flowchart illustrating a key encapsulation method provided in this application embodiment; as follows: Figure 2 As shown, this method is applied to the sending end, and specifically, the method may include the following steps: 201. In response to a user-triggered key encapsulation request for transmitting data to the receiving end, obtain the public key corresponding to the receiving end. The encapsulation request includes the plaintext message to be encapsulated, and the public key includes a first public key component randomly generated on a preset polynomial ring and a second public key component superimposed with small-coefficient noise.

[0045] 202. Encode the plaintext message into a message polynomial on a preset polynomial ring.

[0046] 203. Use the inverse of a pre-defined small-coefficient polynomial to linearly compress the message polynomial to obtain the compressed plaintext polynomial.

[0047] 204. Generate a first ciphertext component based on the second public key component and the cryptographic polynomial, and generate a second ciphertext component based on the first public key component and the compressed plaintext polynomial. The cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process.

[0048] 205. Send the encapsulation result containing the first ciphertext component and the second ciphertext component to the receiving end, so that the receiving end can use the private key corresponding to the receiving end to decapsulate the encapsulation result, obtain the compressed plaintext polynomial, and decode the compressed plaintext polynomial to restore the plaintext message.

[0049] In practice, when a user wants to transmit data to the receiving end, a key encapsulation request can be triggered. This key encapsulation request includes the plaintext message to be encapsulated, i.e., the plaintext message to be transmitted. This plaintext message can be the data to be transmitted itself or a session key used to encrypt the transmitted data. Furthermore, the key encapsulation request may also include identification information corresponding to the receiving end.

[0050] Upon receiving the key encapsulation request, the sending end responds by obtaining the public key corresponding to the receiving end. This public key is a pre-generated public key by the receiving end. In practice, the public key can be retrieved from the receiving end or a pre-defined storage area using the receiving end's identification information. Furthermore, this public key includes a first public key component randomly generated on a pre-defined polynomial ring and a second public key component superimposed with small-coefficient noise. The second public key component also contains a hidden first private key component.

[0051] Among them, the predefined polynomial ring can be Where n is the dimension of the polynomial ring, which determines the dimension of the basic lattice and is a core parameter affecting the security and computational efficiency of the algorithm. q is the modulus of the polynomial ring, used to control the range of coefficient values ​​and ensure the security of the cryptographic system; its size must meet the security requirements of resisting lattice attacks and quantum attacks.

[0052] In this embodiment of the application, all processing can be limited to execution on a preset polynomial ring, which can be achieved through a modular approach. By constraining the maximum degree of the polynomial, the polynomial length is fixed at n, which avoids the infinite expansion of the degree during the operation, ensures that the data structure is regular, the storage volume is controllable, and facilitates the construction of structured private keys with small coefficients and controllable noise, thereby improving the correctness of decryption, the ability to resist attacks, and the performance against side channels.

[0053] After obtaining the public key from the receiving end, before encapsulating the plaintext message to be packaged using the public key, the plaintext message can be encoded into a message polynomial on a preset polynomial ring. Specifically, the bit string corresponding to the plaintext message can be converted into a polynomial with coefficients of 0 or 1, directly converting each bit of the plaintext into a coefficient of the message polynomial.

[0054] Specifically, in one optional embodiment, the plaintext message is converted into a binary bit string. Each bit in the binary bit string is used sequentially as the coefficient of a series of low-order terms in a preset polynomial ring for the message polynomial, while the coefficients of the remaining high-order terms of the message polynomial are all zero. For example, suppose the plaintext message is a bit string of length L, i.e. Encode it as a message polynomial on a predefined polynomial ring. .

[0055] Next, the message polynomial is linearly compressed using the inverse of a pre-defined small-coefficient polynomial to obtain the compressed plaintext polynomial. The pre-defined small-coefficient polynomial... The elements are carefully constructed to be invertible within a polynomial ring. In practice, a preset small-coefficient polynomial can be generated based on the order of the preset polynomial ring and a set ratio. This preset small-coefficient polynomial has only two non-zero coefficients: the constant term has a coefficient of 1, and the term whose order is equal to the order of the preset polynomial ring divided by the set ratio has a coefficient of -1; all other coefficients are 0. The multiplicative inverse of the small-coefficient polynomial within the preset polynomial ring is calculated, and the product of the multiplicative inverse and the message polynomial is obtained. The product result is then used as the compressed plaintext polynomial.

[0056] For example, by making ,in, This ensures that it has an inverse in modulo q. Furthermore, its inverse can be calculated based on this preset polynomial with small coefficients, i.e., the inverse is... Then, the inverse of the preset small-coefficient polynomial can be used to linearly compress the message polynomial to obtain the compressed plaintext polynomial. This not only maps the original plaintext message to a representation space with a smaller coefficient norm and a more compact algebraic structure, effectively reducing the accumulation of noise during subsequent encryption, but also allows for efficient recovery of the original plaintext message through the corresponding component in the private key during the decapsulation stage. Thus, while ensuring the correctness of decryption, it significantly reduces the size of the ciphertext and computational overhead.

[0057] Then, a cryptographic polynomial is generated, which is used to introduce a counteractable random mask during the encapsulation process. In an alternative embodiment, this can be achieved using security parameters. Using a seed, an unpredictable random bit string is generated using a pseudo-random function. Then, based on this random bit string, a cryptographic polynomial is generated by sampling using a central binomial distribution. For example, the generated random bit string is... And use central binomial distribution sampling to generate encrypted polynomials ,Right now Where n is the dimension of the polynomial ring, and σ is the Gaussian distribution sampling parameter used to control the range of coefficient distribution of the noise polynomial. The range of values ​​for the cryptographic polynomial or private key coefficients determines the coefficients of the generated cryptographic polynomial. constraint. This represents central binomial sampling, used to transform a random bit string into a polynomial with very small coefficients and a symmetrical distribution.

[0058] Subsequently, a first ciphertext component is generated based on the second public key component in the receiver's public key and the cryptographic polynomial, and a second ciphertext component is generated based on the first public key component in the receiver's public key and the compressed plaintext polynomial. The first ciphertext component provides a cancelable mask associated with the cryptographic polynomial, while the second ciphertext component carries the compressed plaintext message and noise. Together, they ensure that the receiver can recover the original plaintext message knowing only the private key. Together, they form a complete ciphertext pair, the security of which depends on the computational difficulty of the NTWE problem.

[0059] The embodiments of this application employ a double-ciphertext component structure, which is the key to resolving the contradiction between the uncontrollability of random masking and the susceptibility of message embedding to noise interference in lattice ciphers, achieving high decapsulation accuracy while ensuring security.

[0060] Furthermore, in an optional embodiment, the specific implementation process for generating the first ciphertext component can be: randomly generating a first noise polynomial. Based on the second public key component, the cryptographic polynomial, and the first noise polynomial, a first ciphertext component is generated. The first noise polynomial can be generated using a random generator or by using a pseudo-random function and sampling from a central binary distribution.

[0061] Specifically, the generation of the first ciphertext component based on the second public key component, the cryptographic polynomial, and the first noise polynomial can be achieved by: obtaining the product of the second public key component and the cryptographic polynomial; determining the sum of the product and the first noise polynomial; and using the sum as the first ciphertext component. Furthermore, the second public key component itself contains hidden private key information, which can be canceled by the receiving end using the private key during the decapsulation stage. On the other hand, the introduction of noise effectively masks the algebraic relationship between the cryptographic polynomial and the public key, making it impossible for an attacker to deduce the cryptographic polynomial or private key parameters even if they know the first ciphertext component and the public key.

[0062] For example, suppose the first randomly generated noise polynomial is The second public key component is The cryptographic polynomial is First, obtain the product of the second public key component and the cryptographic polynomial. And determine the sum of the product value and the first noise polynomial. And it was identified as the first ciphertext component. That is, the first ciphertext component is .

[0063] In one optional embodiment, the specific implementation process for generating the second ciphertext component can be as follows: A second noise polynomial is generated using a pseudo-random function and central binary distribution sampling; the first public key component and the encryption polynomial are multiplied in a preset polynomial ring to obtain an intermediate mask polynomial; the intermediate mask polynomial, the second noise polynomial, and the compressed plaintext polynomial are added together in the preset polynomial ring, and the result is used as the second ciphertext component.

[0064] For example, suppose the generated second noise polynomial is The first public key component is The encrypted polynomial is The compressed plaintext polynomial is The first public key component is multiplied with the cryptographic polynomial in a preset polynomial ring to obtain the intermediate mask polynomial. The intermediate mask polynomial, the second noise polynomial, and the compressed plaintext polynomial are added together in a preset polynomial ring, and the result is used as the second ciphertext component. That is, the second ciphertext component is .

[0065] As described above, by constructing a lattice structure on a polynomial ring and replacing high-dimensional linear codes with a low-dimensional polynomial ring lattice structure, the dimensionality of the lattice is reduced, thus reducing the parameters and computational redundancy required for ciphertext generation. Combined with compression processing, the ciphertext length is further reduced. This approach retains the quantum resistance of lattice cryptography while achieving lightweighting through dimensionality control, making it suitable for constrained scenarios.

[0066] In summary, in this embodiment, by combining a pre-defined polynomial ring structure, a first public key component is randomly generated on the ring, and a second public key component is generated by superimposing small-coefficient noise. The two are combined as the public key for the receiving end, thereby constructing a public key based on the difficulty of the NTWE problem. This not only reduces the public key size but also ensures that the generated public key pair can resist attacks from quantum computers. Furthermore, during key encapsulation, the original plaintext can be mapped to a representation space with smaller coefficients and a more compact structure without losing semantic information. This compression operation not only significantly reduces the parameter size of the plaintext but also effectively reduces the noise accumulation introduced during subsequent encryption, thus ensuring correct decryption. Additionally, the second public key component is combined with a randomly generated encryption polynomial to generate a first ciphertext component, and the first public key component is combined with the aforementioned compressed plaintext polynomial to generate a second ciphertext component. The entire ciphertext structure is naturally embedded in the mathematical difficulty of the NTWE problem, making it impossible for attackers with powerful computing capabilities to effectively recover the original plaintext message from the ciphertext, thus resisting attacks from quantum computers. The receiving end, by using the small-coefficient polynomial in the private key, can efficiently cancel noise and restore the compressed plaintext message, thereby achieving high security and high reliability while controlling computational overhead and communication bandwidth.

[0067] The above embodiments describe the specific implementation process of key encapsulation operations performed by the sending end. The following describes the specific implementation process of ciphertext encapsulation performed by the receiving end from the perspective of the receiving end.

[0068] Figure 3 A flowchart illustrating another key encapsulation method provided in this application embodiment; see attached diagram. Figure 3 As shown, this method can be applied to the receiving end. Specifically, the method may further include the following steps: 301. Receive the encapsulation result containing the first ciphertext component and the second ciphertext component sent by the sending end.

[0069] 302. Using the first and second private key components from the private key corresponding to the receiving end, decapsulate the encapsulation result to eliminate the cryptographic polynomial introduced during encapsulation and obtain the compressed plaintext polynomial.

[0070] 303. Decode the compressed plaintext polynomial to restore the plaintext message.

[0071] To facilitate understanding of the unsealing process performed by the receiving end, the specific implementation process of generating the public and private keys by the receiving end will be explained in detail below.

[0072] Using security parameters as a seed, a first private key component is generated using a pseudo-random function and central binary distribution sampling. A preset small-coefficient polynomial is then generated based on the order of the preset polynomial ring and a set ratio. This preset small-coefficient polynomial has only two non-zero coefficients: a constant term with a coefficient of 1, and a term whose order equals the preset polynomial ring order divided by the set ratio with a coefficient of -1. All other coefficients are 0. A private key polynomial is constructed based on this preset small-coefficient polynomial and designated as the second private key component. This private key polynomial possesses a multiplicative inverse on the preset polynomial ring. An error vector is generated, and a first public key component is generated based on the first private key component and the error vector. A polynomial is randomly selected from the preset polynomial ring as the second public key component. The private key for the receiving end is generated based on both the first and second private key components. Finally, the public key for the receiving end is generated based on both the first and second public key components.

[0073] The specific implementation of constructing the private key polynomial based on the preset small-coefficient polynomial can be as follows: A first polynomial is randomly generated using a distributed sampler; polynomial multiplication is performed on the first polynomial and the preset small-coefficient polynomial, and the preset integer is superimposed to obtain the private key polynomial. Alternatively, an error vector can be generated using a pseudo-random function and central binary distribution sampling.

[0074] In one optional embodiment, the specific implementation of generating the first public key component based on the first private key component and the error vector can be as follows: multiply the first private key component and the second public key component, and superimpose the error vector to obtain a noisy public key item; calculate the inverse of the second private key component; multiply the public key item and the inverse of the second private key component to obtain the first public key component.

[0075] For example, using a distributed sampler, the first polynomial is randomly generated. ,Right now Perform polynomial multiplication on the first polynomial and a preset polynomial with small coefficients, and then add the preset integers to obtain the private key polynomial. ,Right now The private key polynomial is determined as the second private key component. Using a security parameter as a seed, a pseudo-random function and central binary distribution sampling are employed to generate the first private key component. ,Right now This allows the generation of the private key corresponding to the receiving end. Next, an error vector is generated. Based on the first private key component and the error vector, the first public key component is generated. The error vector is then generated using a pseudo-random function and central binary distribution sampling. ,Right now Randomly select a uniform polynomial from a preset polynomial ring. The elements of this matrix are polynomial ring elements. A polynomial multiplication operation is performed on the first private key component and the uniform polynomial, and the error vector is superimposed to obtain the public key polynomial. And based on the inverses of the public-key and private-key polynomials, the first public-key component is obtained. ,Right now A polynomial is randomly selected from the preset polynomial ring as the second public key component. That is, the public key corresponding to the receiving end is .

[0076] When the receiving end receives the encapsulation result containing the first ciphertext component and the second ciphertext component, it decapsulates the encapsulation result to restore the plaintext message. The first ciphertext component... It is generated based on the second public key component in the public key corresponding to the receiving end and the cryptographic polynomial. The cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process. Second ciphertext component It is generated based on the first public key component in the public key corresponding to the receiving end and the compressed plaintext polynomial. The compressed plaintext polynomial is obtained by encoding and linearly compressing the plaintext message to be encapsulated. The specific implementation process can be referred to the description of the specific embodiments above, and will not be repeated here.

[0077] When the receiving end decapsulates the encapsulation result, it first uses the first and second private key components from the receiving end's private key to decapsulate the result, eliminating the cryptographic polynomial introduced during encapsulation to obtain the compressed plaintext polynomial. Then, it uses the first and second private key components to perform linear operations on the first and second ciphertext components to eliminate the cryptographic polynomial kernel noise introduced during public key encapsulation, thus recovering the compressed plaintext polynomial.

[0078] In one optional embodiment, the specific implementation of decapsulation processing of the encapsulation result can be as follows: multiplying the first private key component and the first ciphertext component in the private key corresponding to the receiving end to obtain a first multiplication result; multiplying the second private key component and the second ciphertext component in the private key corresponding to the receiving end to obtain a second multiplication result; and determining the difference between the first and second multiplication results as the compressed plaintext polynomial. For example, this can be achieved using... To perform linear operations, we obtain the compressed plaintext polynomial.

[0079] Then, the compressed plaintext polynomial is decoded to reconstruct the plaintext message. Specifically, the coefficients of each term in the compressed plaintext polynomial can be centered and calibrated. This can be achieved by subtracting half of a preset modulus from each coefficient and performing a symmetric modulo operation within the preset modulus range, so that the calibrated coefficient values ​​are distributed within an integer interval centered at zero, thus completing the coefficient centering calibration.

[0080] Then, according to preset grouping rules, the calibrated coefficients are grouped according to their positions in the polynomial. All coefficients belonging to the same group have the same remainder when their positions are modulo a specified group modulus, and this remainder uniquely corresponds to a specific bit in the plaintext message. Furthermore, for each group of coefficients, the sum of the absolute values ​​of all coefficients in that group is calculated, and each sum is compared with a preset decision threshold: if the sum is less than the threshold, the corresponding bit is determined to be the first value; otherwise, it is determined to be the second value. Based on the determination results of all bits, the plaintext message is generated.

[0081] For example, suppose the compressed plaintext polynomial obtained after decapsulation is: First, the coefficients of each term in the compressed plaintext polynomial are centered and calibrated, i.e., the calculation is performed. The calibrated coefficients are obtained. The calibrated coefficients are grouped according to their position subscripts in the polynomial. The absolute values ​​of the coefficients in the same group are taken and summed to obtain a total. Each sum is compared with a preset decision threshold. By comparing, each bit in the plaintext message can be obtained. .

[0082] In other words, a set of noisy coefficients can be used to determine each bit of the plaintext message, which can reduce the error rate and thus allow q to be smaller.

[0083] In summary, by using the small-coefficient polynomial in the private key, the receiving end can efficiently cancel noise and restore the compressed plaintext message, thereby achieving high security and high reliability while controlling computational overhead and communication bandwidth.

[0084] The above embodiments describe the specific implementation process of key encapsulation at the sending end and key decapsulation at the receiving end in a chosen-plaintext attack. However, in practical applications, communication environments often face more severe security threats—attackers may not only be able to obtain the ciphertext of any plaintext, but may also infer the structure of the valid ciphertext or shared key information by repeatedly submitting forged ciphertexts and observing the decapsulation results (such as whether decryption was successful, the returned error type, etc.). This type of attack is called a chosen-ciphertext attack. To defend against attacks under this strong adversary model, the original scheme that only satisfies CPA security is insufficient to guarantee the security of the system in a real network environment.

[0085] Therefore, this application also provides a specific implementation process for performing key encapsulation at the sending end and key decapsulation at the receiving end in the event of a chosen-ciphertext attack (CCA). Based on the aforementioned CPA security scheme, this process further introduces a ciphertext integrity verification mechanism and a deterministic key derivation process, and strictly verifies the ciphertext legitimacy and decryption consistency during the decapsulation stage, thereby ensuring that any tampering with the ciphertext will lead to decapsulation failure and no leakage of additional information. This process is described in detail below.

[0086] Figure 4 A flowchart illustrating another key encapsulation method provided in this application embodiment; as follows: Figure 4 As shown, this method is applied to the sending end, and specifically, the method may include the following steps: 401. In response to a user-triggered key encapsulation request for transmitting data to the receiving end, obtain the public key corresponding to the receiving end. The encapsulation request includes the plaintext message to be encapsulated.

[0087] 402. Generate a random number and calculate the first hash value corresponding to the random number.

[0088] 403. Hash the public key corresponding to the receiving end to obtain the second hash value, and perform a hash operation on the first hash value and the second hash value to obtain the third hash value.

[0089] 404. Execute the key encapsulation scheme that is secure against plaintext attacks and output the encapsulated ciphertext.

[0090] 405. Generate a shared key based on the third hash value and the encapsulated ciphertext.

[0091] 406. Send the ciphertext to the receiving end so that the receiving end can use its corresponding private key to perform a secure decapsulation process for chosen-plaintext attacks, obtain the plaintext message, and verify the plaintext message.

[0092] In practice, in response to a user-triggered key encapsulation request for transmitting data to the receiving end, the system obtains the receiving end's public key. The encapsulation request includes the plaintext message to be encapsulated. This public key can be generated using the same method as in the chosen-plaintext attack scenario described above. It's important to note that when generating its private key, the receiving end encapsulates the private key generated in the chosen-plaintext attack scenario to obtain the target private key. This target private key is then used as the receiving end's private key, thus improving its security.

[0093] Specifically, in one optional embodiment, a random number can be generated. and the public key corresponding to the receiving end. Perform hashing based on random numbers Hash results and the original private key corresponding to the receiving end. Generate the target private key. That is, the target private key is... .

[0094] Next, generate random numbers. And calculate the first hash value corresponding to the random number. Then, the public key corresponding to the receiving end is hashed to obtain the second hash value. Then, a hash operation is performed on the first and second hash values ​​to obtain the third hash value. .in, It is a hash function, that is , Take 32 or 64. That is, the third hash value is 32 or 64. .

[0095] Next, a key encapsulation scheme secure against plaintext attacks is executed, and the encapsulated ciphertext is output. Generating requires a shared key. Finally, the ciphertext and public key are sent to the receiving end, so that the receiving end can use its corresponding private key to perform secure decapsulation of the selected plaintext, obtain the plaintext message, and verify the plaintext message.

[0096] Specifically, the receiving end performs decapsulation to securely perform plaintext attacks and obtain the plaintext. Generate hash value ,in It is a hash function, that is , Choose either 32 or 64 bytes, execute the key encapsulation method for choosing a plaintext attack secure method, and output the ciphertext. .Compare Check if the conditions are met; if they are equal, output the shared key. Otherwise output .

[0097] In summary, this application's embodiments, based on the aforementioned CPA security scheme, further introduce a ciphertext integrity verification mechanism and a deterministic key derivation process, and strictly verify the legality of the ciphertext and the consistency of decryption during the decapsulation stage. This ensures that any tampering with the ciphertext will lead to decapsulation failure and no leakage of additional information, thereby improving the security of the private key and ciphertext.

[0098] The specific implementation process involved in the embodiments of this application can be referred to the content of the above embodiments, and will not be repeated here.

[0099] To facilitate understanding of the key encapsulation implementation process described above, examples of key encapsulation processes in specific application scenarios will be provided.

[0100] In practical applications, when the sending end wants to transmit data to the receiving end, the sending end can first encapsulate the data to be transmitted or the session key, and then the receiving end can decapsulate the encapsulation result to restore the corresponding data to be transmitted or the session key.

[0101] The following section will explain the key encapsulation and decapsulation process under the chosen plaintext attack security condition.

[0102] In practice, before performing key encapsulation processing, the receiving end can first generate the corresponding public key and private key.

[0103] Specifically: Step 1: Initialize security parameters and define a predefined polynomial ring .

[0104] in, Let be the dimension of the polynomial ring. Let be the modulus of a finite ring. The sampling parameters are Gaussian distribution. This represents the boundary of the maximum absolute value of the noise figure. This is a parameter representing the range of values ​​for the coefficients of the cryptographic polynomial or private key polynomial.

[0105] in, This indicates that all polynomial operations satisfy Higher-order terms are automatically reduced in order, and the polynomial length is fixed. The average value of the coefficients Calculation.

[0106] Step 2: Randomly generate polynomials using a distribution sampler (such as a central binomial distribution or a narrow Gaussian distribution). .

[0107] Step 3: Generate small polynomials , And pre-compute the inverse of v, i.e. .

[0108] Step 4: Construct a reversible private key polynomial with a special structure .Right now And calculate the multiplicative inverse of polynomial f on a predefined polynomial ring. ,if If it does not exist, return to step 2.

[0109] Step 5: Randomly generate polynomials The elements of this matrix are polynomial ring elements.

[0110] Step 6: Randomly generate the first private key component, i.e. .

[0111] Step 7: Randomly generate error vector .

[0112] Step 8: Calculate the first public key component. , .

[0113] Step 9: Output the public key pair (public key) private key .

[0114] During key encapsulation processing, the system first responds to a user-triggered key encapsulation request for transmitting data to the receiving end, obtaining the public key corresponding to the receiving end. This encapsulation request includes the plaintext message to be encapsulated, and the public key includes a first public key component randomly generated on a preset polynomial ring and a second public key component superimposed with small-coefficient noise. Then, the plaintext message is encoded into a message polynomial on the preset polynomial ring, and the message polynomial is linearly compressed using the inverse of the preset small-coefficient polynomial to obtain the compressed plaintext polynomial. Next, a first ciphertext component is generated based on the second public key component and the encryption polynomial, and a second ciphertext component is generated based on the first public key component and the compressed plaintext polynomial. Finally, the encapsulation result, containing the first and second ciphertext components, is sent to the receiving end.

[0115] The specific key encapsulation process can be as follows: Step 1: Enter the public key ,information .

[0116] Step 2: Encode the plaintext message to obtain the message polynomial. That is, given the plaintext message is... The encoding is a message polynomial on a predefined polynomial system ring. .

[0117] Step 3: Randomly generate encrypted polynomials .

[0118] Step 4: Randomly generate the error polynomial , .

[0119] Step 5: Calculate the first ciphertext component and the second ciphertext component respectively. and .

[0120] Step 6: Output ciphertext The encrypted text is then sent to the receiving end as the encapsulation result.

[0121] After the receiving end receives the encapsulation result, it uses the private key corresponding to the receiving end to decapsulate the encapsulation result, obtains the compressed plaintext polynomial, and decodes the compressed plaintext polynomial to restore the plaintext message.

[0122] The specific key decapsulation process can be as follows: Step 1: Input the encapsulation result and the private key corresponding to the receiving end. Step 2: Using the private key Decrypt to obtain the compressed plaintext message. mod p.

[0123] Step 3: [Regarding...] Decode the polynomial. That is, input the decrypted polynomial. ,calculate , , Step 4: Return plaintext message .

[0124] The following describes the specific implementation process of key encapsulation and decapsulation for choosing ciphertext attack security.

[0125] In practice, before performing key encapsulation processing, the receiving end can first generate the corresponding public key and private key.

[0126] Specifically: Step 1: Enter security parameters .

[0127] Step 2: Generate a 32-byte random number .

[0128] Step 3: Execute the key generation method for choosing plaintext attack security to generate a key pair for choosing plaintext attack security. .

[0129] Step 4: Generate the target private key corresponding to the receiving end, i.e. .

[0130] Step 5: Output the key pair for selecting ciphertext attack security. This is used as the public and private keys for the receiving end.

[0131] During key encapsulation, in response to a user-triggered key encapsulation request for transmitting data to the receiving end, the system obtains the public key corresponding to the receiving end. The encapsulation request includes the plaintext message to be encapsulated. A random number is generated, and its corresponding first hash value is calculated. This hash value is then hashed against the receiving end's public key to obtain a second hash value. A third hash value is obtained by performing a hash operation on both the first and second hash values. A secure key encapsulation scheme for chosen-plaintext attacks is executed, and the encapsulated ciphertext is output. A shared key is generated based on the third hash value and the encapsulated ciphertext. The ciphertext and the public key are sent to the receiving end, enabling the receiving end to use its corresponding private key to perform secure decapsulation processing based on chosen-plaintext attacks, obtain the plaintext message, and verify the plaintext message.

[0132] The specific key encapsulation process can be as follows: Step 1: Enter the public key .

[0133] Step 2: Generate a 32-byte random number And calculate the hash value. Step 3: Generate hash value ,in It is a hash function, that is , Choose 32 or 64.

[0134] Step 4: Execute the key encapsulation method for selecting plaintext attack security and output the ciphertext. .

[0135] Step 5: Generate the required shared key .

[0136] Step 6: Output ciphertext and shared keys The encrypted text is then identified as the encapsulation result and sent to the receiving end.

[0137] After receiving the encapsulation result, the receiving end uses its corresponding private key to perform decapsulation processing for choosing plaintext attack security, obtains the plaintext message, and verifies the plaintext message.

[0138] The specific key decapsulation process can be as follows: Step 1: Enter the ciphertext c and the private key .

[0139] Step 2: Perform decapsulation to obtain the plaintext message, which is secure against plaintext attacks. .

[0140] Step 3: Generate hash value ,in It is a hash function, that is , Choose 32 or 64.

[0141] Step 4: Execute the key encapsulation method for selecting plaintext attack security and output the ciphertext. .

[0142] Step 5: Comparison Check if the conditions are met; if they are equal, output the shared key. Otherwise output .

[0143] In summary, based on polynomial rings The difficulty of the NTWE problem leads to the development of a new lattice-based key encapsulation scheme, which effectively protects data from quantum computer attacks. It has a low decryption failure rate, as each plaintext bit is encoded into the most significant bit of multiple coefficients of the message polynomial. This allows the use of a noisy coefficient vector to decode each plaintext bit during decryption, and significantly reduces the size of 𝑞 while keeping the decryption failure rate negligible.

[0144] The key encapsulation apparatus of one or more embodiments of this application will be described in detail below. Those skilled in the art will understand that these apparatuses can be configured using commercially available hardware components through the steps taught in this solution.

[0145] Figure 5 This is a schematic diagram of a key encapsulation device provided in an embodiment of this application, applied at the sending end, such as... Figure 5 As shown, the device includes: a response module 11, an encoding module 12, a compression module 13, a generation module 14, and a sending module 15.

[0146] The response module 11 is used to respond to a key encapsulation request triggered by a user for transmitting data to a receiving end, and to obtain the public key corresponding to the receiving end. The encapsulation request includes a plaintext message to be encapsulated, and the public key includes a first public key component randomly generated on a preset polynomial ring and a second public key component superimposed with small coefficient noise.

[0147] Encoding module 12 is used to encode the plaintext message into a message polynomial on the preset polynomial ring.

[0148] Compression module 13 is used to linearly compress the message polynomial using the inverse of a preset small-coefficient polynomial to obtain a compressed plaintext polynomial.

[0149] The generation module 14 is used to generate a first ciphertext component based on the second public key component and the cryptographic polynomial, and to generate a second ciphertext component based on the first public key component and the compressed plaintext polynomial; the cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process.

[0150] The sending module 15 is used to send the encapsulation result containing the first ciphertext component and the second ciphertext component to the receiving end, so that the receiving end can use its private key to decapsulate the encapsulation result, obtain the compressed plaintext polynomial, and decode the compressed plaintext polynomial to restore the plaintext message.

[0151] Optionally, the generation module 14 is specifically used to: generate a small-coefficient encryption polynomial using a pseudo-random function and central binomial distribution sampling; randomly generate a first noise polynomial; and generate a first ciphertext component based on the second public key component, the encryption polynomial, and the first noise polynomial.

[0152] Optionally, the generation module 14 is specifically used to: obtain the product value of the second public key component and the cryptographic polynomial; determine the sum of the product value and the first noise polynomial; and determine the sum value as the first ciphertext component.

[0153] Optionally, the generation module 14 is specifically used to: generate a second noise polynomial using a pseudo-random function and central binomial distribution sampling; multiply the first public key component and the encryption polynomial in the preset polynomial ring to obtain an intermediate mask polynomial; add the intermediate mask polynomial, the second noise polynomial, and the compressed plaintext polynomial in the preset polynomial ring, and use the addition result as the second ciphertext component.

[0154] Optionally, the encoding module 12 is specifically used to: convert the plaintext message into a binary bit string; and use each bit in the binary bit string as the coefficient of the consecutive low-order terms of the message polynomial in the preset polynomial ring; wherein the coefficients of the remaining high-order terms of the message polynomial are all zero.

[0155] Optionally, the compression module 13 is specifically used to: generate a preset small-coefficient polynomial based on the order of a preset polynomial ring and a set ratio; the preset small-coefficient polynomial has only two non-zero coefficients, where the constant term has a coefficient of 1, the term whose order is equal to the order of the preset polynomial ring divided by the set ratio has a coefficient of -1, and all other terms have coefficients of 0; calculate the multiplicative inverse of the small-coefficient polynomial in the preset polynomial ring; obtain the product of the multiplicative inverse and the message polynomial, and determine the product result as the compressed plaintext polynomial.

[0156] Figure 5 The device shown can perform the steps described in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0157] In one possible design, the above Figure 5 The key encapsulation device shown can be implemented as an electronic device, such as... Figure 6 As shown, the electronic device may include: a memory 21, a processor 22, and a communication interface 23. The memory 21 stores executable code, which, when executed by the processor 22, enables the processor 22 to at least implement the key encapsulation method performed by the sending end as provided in the foregoing embodiments.

[0158] Figure 7 This is a schematic diagram of another key encapsulation device provided in an embodiment of this application, applied at the receiving end, such as... Figure 7 As shown, the device includes: a receiving module 31, a decapsulation module 32, and a decoding module 33.

[0159] The receiving module 31 is used to receive the encapsulation result containing a first ciphertext component and a second ciphertext component sent by the sending end; the first ciphertext component is generated based on the second public key component in the public key corresponding to the receiving end and a cryptographic polynomial, the cryptographic polynomial being used to introduce a cancelable random mask during the encapsulation process; the second ciphertext component is generated based on the first public key component in the public key corresponding to the receiving end and a compressed plaintext polynomial, the compressed plaintext polynomial being obtained by encoding and linearly compressing the plaintext message to be encapsulated.

[0160] The decapsulation module 32 is used to decapsulate the encapsulation result using the first private key component and the second private key component in the private key corresponding to the receiving end, thereby eliminating the encryption polynomial introduced during encapsulation to obtain the compressed plaintext polynomial.

[0161] The decoding module 33 is used to decode the compressed plaintext polynomial and restore the plaintext message.

[0162] Optionally, the receiving module 31 is further configured to: use a security parameter as a seed, and sample using a pseudo-random function and a central binomial distribution to generate a first private key component; generate a preset small-coefficient polynomial based on the order of a preset polynomial ring and a set ratio; the preset small-coefficient polynomial has only two non-zero coefficients, where the constant term coefficient is 1, the term whose order is equal to the order of the preset polynomial ring divided by the set ratio coefficient is -1, and the coefficients of all other terms are 0; construct a private key polynomial based on the preset small-coefficient polynomial, and determine the private key polynomial as a second private key component; the private key polynomial has a multiplicative inverse on the preset polynomial ring; generate an error vector; generate a first public key component based on the first private key component and the error vector; randomly select a polynomial in the preset polynomial ring as the second public key component; generate the private key corresponding to the receiving end based on the first private key component and the second private key component; and generate the public key corresponding to the receiving end based on the first public key component and the second public key component.

[0163] Optionally, the receiving module 31 is further configured to: randomly generate a first polynomial using a distributed sampler; perform polynomial multiplication on the first polynomial and the preset small-coefficient polynomial, and superimpose a preset integer to obtain a private key polynomial.

[0164] Optionally, the receiving module 31 is further configured to: perform a multiplication operation on the first private key component and the second public key component, and superimpose the error vector to obtain a noisy public key item; calculate the inverse of the second private key component; and perform a multiplication operation on the public key item and the inverse of the second private key component to obtain the first public key component.

[0165] Optionally, the decapsulation module 32 is specifically used to: perform a multiplication operation on the first private key component and the first ciphertext component in the private key corresponding to the receiving end to obtain a first multiplication result; perform a multiplication operation on the second private key component and the second ciphertext component in the private key corresponding to the receiving end to obtain a second multiplication result; and determine the difference between the first multiplication result and the second multiplication result as the compressed plaintext polynomial.

[0166] Optionally, the decoding module 33 is specifically used for: centering and calibrating each coefficient of the compressed plaintext polynomial; grouping the calibrated coefficients according to their position indices in the polynomial according to a preset grouping rule, wherein the remainders obtained by taking the position indices of all coefficients belonging to the same group modulo a specified grouping modulus are the same, and the remainder uniquely corresponds to a bit in the plaintext message; calculating the sum of the absolute values ​​of all coefficients in each group; comparing each sum with a preset decision threshold: if the sum is less than the decision threshold, the corresponding bit is determined to be a first value; otherwise, it is determined to be a second value; and generating the plaintext message by combining the decision results of all bits.

[0167] Figure 7 The device shown can perform the steps described in the foregoing embodiments. For detailed execution process and technical effects, please refer to the description in the foregoing embodiments, which will not be repeated here.

[0168] In one possible design, the above Figure 7 The key encapsulation device shown can be implemented as an electronic device, such as... Figure 8 As shown, the electronic device may include: a memory 41, a processor 42, and a communication interface 43. The memory 41 stores executable code, which, when executed by the processor 42, enables the processor 42 to at least implement the key encapsulation method performed by the receiving end as provided in the foregoing embodiments.

[0169] Furthermore, this application embodiment also provides a non-transitory machine-readable storage medium storing executable code, which, when executed by a processor of an electronic device, enables the processor to at least implement the key encapsulation method provided in the foregoing embodiments.

[0170] In addition, this application also provides a computer program product, which includes a computer program or instructions that, when executed by a processor, enable the processor to implement the steps in the above method embodiments. It should be understood that each step or combination of steps in the above method flow can be implemented by a computer program or instructions.

[0171] In addition, these computer programs or instructions can be applied to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device, so that the processor of the general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device can be implemented as a means to implement the corresponding functions in the above method embodiments.

[0172] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0173] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of a necessary general-purpose hardware platform, or by a combination of hardware and software. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a computer product. This application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A key encapsulation method, characterized in that, Applied to the sending end, the method includes: In response to a user-triggered key encapsulation request for transmitting data to a receiving end, the public key corresponding to the receiving end is obtained. The encapsulation request includes a plaintext message to be encapsulated. The public key includes a first public key component randomly generated on a preset polynomial ring and a second public key component superimposed with small coefficient noise. Encode the plaintext message into a message polynomial on the preset polynomial ring; The message polynomial is linearly compressed using the inverse of a pre-defined small-coefficient polynomial to obtain the compressed plaintext polynomial. A first ciphertext component is generated based on the second public key component and the cryptographic polynomial, and a second ciphertext component is generated based on the first public key component and the compressed plaintext polynomial; the cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process. The encapsulation result containing the first ciphertext component and the second ciphertext component is sent to the receiving end, so that the receiving end can use its private key to decapsulate the encapsulation result, obtain the compressed plaintext polynomial, and decode the compressed plaintext polynomial to restore the plaintext message.

2. The method according to claim 1, characterized in that, The step of generating the first ciphertext component based on the second public key component and the cryptographic polynomial includes: By using pseudo-random functions and central binomial sampling, small-coefficient encrypted polynomials are generated; Randomly generate the first noise polynomial; Based on the second public key component, the cryptographic polynomial, and the first noise polynomial, a first ciphertext component is generated.

3. The method according to claim 2, characterized in that, The step of generating the first ciphertext component based on the second public key component, the encryption polynomial, and the first noise polynomial includes: Obtain the product of the second public key component and the cryptographic polynomial; Determine the sum of the product value and the first noise polynomial; The sum is determined as the first ciphertext component.

4. The method according to claim 1, characterized in that, The step of generating the second ciphertext component based on the first public key component and the compressed plaintext polynomial includes: The second noise polynomial is generated by using a pseudo-random function and central binomial sampling. The first public key component and the cryptographic polynomial are multiplied in the preset polynomial ring to obtain the intermediate mask polynomial. The intermediate mask polynomial, the second noise polynomial, and the compressed plaintext polynomial are added together in the preset polynomial ring, and the result of the addition is used as the second ciphertext component.

5. The method according to claim 1, characterized in that, Encoding the plaintext message into a message polynomial on the preset polynomial ring includes: Convert the plaintext message into a binary bit string; Each bit in the binary bit string is used sequentially as the coefficient of the consecutive low-order terms of the message polynomial in the preset polynomial ring; In this context, the coefficients of the remaining higher-order terms in the message polynomial are all zero.

6. The method according to claim 1, characterized in that, The step of linearly compressing the message polynomial using the inverse of a preset small-coefficient polynomial to obtain the compressed plaintext polynomial includes: Based on the order of the preset polynomial ring and a set ratio, a preset small-coefficient polynomial is generated; the preset small-coefficient polynomial has only two non-zero coefficients, where the constant term has a coefficient of 1, the term whose order is equal to the order of the preset polynomial ring divided by the set ratio has a coefficient of -1, and all other terms have a coefficient of 0. Calculate the multiplicative inverse of the small-coefficient polynomial in the preset polynomial ring; Obtain the product of the multiplicative inverse and the message polynomial, and determine the product result as the compressed plaintext polynomial.

7. A key encapsulation method, characterized in that, Applied to the receiving end, the method includes: The receiver sends an encapsulation result containing a first ciphertext component and a second ciphertext component. The first ciphertext component is generated based on the second public key component in the public key corresponding to the receiver and a cryptographic polynomial, wherein the cryptographic polynomial is used to introduce a cancelable random mask during the encapsulation process. The second ciphertext component is generated based on the first public key component in the public key corresponding to the receiver and a compressed plaintext polynomial, wherein the compressed plaintext polynomial is obtained by encoding and linearly compressing the plaintext message to be encapsulated. Using the first and second private key components from the private key corresponding to the receiving end, the encapsulation result is decapsulated to eliminate the cryptographic polynomial introduced during encapsulation and obtain the compressed plaintext polynomial. The compressed plaintext polynomial is decoded to restore the plaintext message.

8. The method according to claim 7, characterized in that, The method further includes: Using security parameters as seeds, the first private key component is generated by sampling with a pseudo-random function and a central binomial distribution. Based on the order of the preset polynomial ring and a set ratio, a preset small-coefficient polynomial is generated; the preset small-coefficient polynomial has only two non-zero coefficients, where the constant term has a coefficient of 1, the term whose order is equal to the order of the preset polynomial ring divided by the set ratio has a coefficient of -1, and all other terms have a coefficient of 0. Based on the preset small-coefficient polynomial, a private key polynomial is constructed, and the private key polynomial is determined as the second private key component; the private key polynomial has a multiplicative inverse on the preset polynomial ring. Generate an error vector; Based on the first private key component and the error vector, generate the first public key component; A polynomial is randomly selected from the preset polynomial ring as the second public key component. Based on the first private key component and the second private key component, a private key corresponding to the receiving end is generated; Based on the first public key component and the second public key component, the public key corresponding to the receiving end is generated.

9. The method according to claim 8, characterized in that, The step of constructing the private key polynomial based on the preset small-coefficient polynomial includes: The first polynomial is randomly generated using a distributed sampler. Perform polynomial multiplication on the first polynomial and the preset small-coefficient polynomial, and then add the preset integers to obtain the private key polynomial.

10. The method according to claim 8, characterized in that, The step of generating the first public key component based on the first private key component and the error vector includes: Multiply the first private key component and the second public key component, and then superimpose the error vector to obtain a noisy public key item; Calculate the inverse of the second private key component; Multiply the public key item and the inverse of the second private key component to obtain the first public key component.

11. The method according to claim 7, characterized in that, The step of using the first and second private key components from the private key corresponding to the receiving end to decapsulate the encapsulation result and eliminate the cryptographic polynomial introduced during encapsulation to obtain the compressed plaintext polynomial includes: A multiplication operation is performed between the first private key component and the first ciphertext component in the private key corresponding to the receiving end to obtain the first multiplication result; A multiplication operation is performed between the second private key component and the second ciphertext component in the private key corresponding to the receiving end to obtain the second multiplication result; The difference between the result of the first multiplication operation and the result of the second multiplication operation is determined as the compressed plaintext polynomial.

12. The method according to claim 7, characterized in that, Decoding the compressed plaintext polynomial to recover the plaintext message includes: The coefficients of each term in the compressed plaintext polynomial are centered and calibrated. According to the preset grouping rules, the calibrated coefficients are grouped according to their position index in the polynomial. The remainders of all coefficients belonging to the same group after taking the position index modulo a specified group modulus are the same, and the remainder uniquely corresponds to a bit in the plaintext message. For each group of coefficients, calculate the sum of the absolute values ​​of all coefficients in that group; Each sum is compared with a preset decision threshold: if the sum is less than the decision threshold, the corresponding bit is determined to be the first value; otherwise, it is determined to be the second value. The plaintext message is generated by combining the results of the determination of all bits.

13. An electronic device, characterized in that, include: The device includes a memory, a processor, and a communication interface; wherein the memory stores executable code, which, when executed by the processor, causes the processor to perform the key encapsulation method as described in any one of claims 1 to 6 or 7 to 12.

Images