Lattice-based method for generating encryption keys and digital signatures

Abstract

A method for generating digital signature information is disclosed, comprising: receiving a message; calculating a special solution, wherein the result of calculating the special solution in a public key becomes a predetermined function-processed output value in the received message; and generating digital signature information for the message using the calculated special solution, wherein the public key is calculated using a ring having a dimension (d) represented by multiplication of powers of 2 and integers of 3 or greater.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on and claims the benefit of priority of Korean Patent Application No. 10-2020-0147995 filed in the Korean Intellectual Property Office on November 6, 2020, which application claims the benefit of Korean Patent Application No. 10-2019-0155709 filed in the Korean Intellectual Property Office on November 28, 2019, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] Apparatuses and methods consistent with the present application relate to methods for generating encryption keys and digital signatures based on a lattice, and more particularly to methods for generating encryption keys and digital signatures based on a lattice capable of ensuring parameter flexibility. Background Art

[0004] As is known to all, encryption methods make it impossible to know the contents of a digital message (data) even if a third party steals the message during the process of sending and receiving the message. Encryption methods can be roughly divided into symmetric key encryption methods and asymmetric key encryption methods.

[0005] The symmetric key encryption method is a method in which the encryption key and the decryption key are the same as each other, while the asymmetric key encryption method is a method in which the encryption key and the decryption key are different from each other. In the asymmetric key encryption method, a message can generally be encrypted using a public key of a recipient, and the recipient can decrypt the encrypted message using a private key of the recipient.

[0006] In asymmetric key encryption methods, a digital signature can be generated on a message to prove the integrity of the message. A digital signature can usually be generated by encrypting the hash value (integrity check value) of the message using the sender's private key.

[0007] The recipient who receives the encrypted message and its digital signature information can obtain the message by performing decryption using the recipient's private key, and can obtain the message integrity check value by decrypting the digital signature information using the sender's public key. By performing hash calculation on the obtained message and determining whether its output power value is the same as the value of the integrity verification result, the recipient can confirm whether the message has not been forged or altered.

[0008] Conventionally, the RSA scheme, the Elgamal scheme, etc. have been widely used to generate asymmetric encryption keys. However, due to the advancement of quantum computing technology, these conventional encryption methods are very likely to fail easily.

[0009] Trapdoor lattice methods have been proposed as security methods for quantum computing technology.

[0010] In their 2014 paper “Efficient Identity-Based Encryption over NTRU Lattices”, Leo Ducas et al. proposed a method based on the Number Theoretic Research Unit (NTRU) lattice, which is one of the methods for generating private and public keys using identity-based encryption.

[0011] The key generation process in the related art can be performed in a polynomial ring However, in the related art, the total dimension needs to be a power of 2, and if it is not, its security has not been proven and the parameter flexibility is limited. For example, with 2 10 In order to improve security, the dimension is required to be 2. 11 However, in that case, the value of the dimension increases rapidly from 1024 to 2048, which greatly increases the amount of computation or computation time required to generate the key. Summary of the invention

[0012] The embodiments of the present application overcome the above disadvantages and other disadvantages not described above. In addition, it is not necessary for the present application to overcome the above disadvantages, and the embodiments of the present application may not overcome any of the above problems.

[0013] The present application provides a method for generating encryption keys and digital signatures based on a lattice, which eliminates parameter rigidity, thereby enabling flexible parameter selection while ensuring its stability.

[0014] According to an embodiment of the present application, a method for generating a digital signature includes: receiving a message; calculating a special solution, wherein the result of calculating the special solution in a public key becomes a predetermined function-processed output value in the received message; and using the calculated special solution to generate digital signature information for the message, wherein the public key can be calculated using a ring with a dimension (d), which is represented by multiplying a power of 2 and an integer of 3 or greater.

[0015] In this case, in the generation of the digital signature information, the digital signature information can be generated by reducing the calculated particular solution using the private key.

[0016] Meanwhile, the method for generating a digital signature may further include: calculating a trapdoor (T); and determining the calculated trapdoor (T) as a private key.

[0017] In this case, the method of generating a digital signature may further include: sampling linearly independent elements in a ring To calculate a first random matrix (S), where the number of columns is 1 less than the dimension and the number of rows is equal to the dimension; calculate a second random matrix (A), where the number of columns is equal to the dimension and the number of rows is 1; and calculate a public key based on the second random matrix (A).

[0018] In this case, in the calculation of the second random matrix, the matrix Excluding the i-th row to calculate the d×d matrix (M i ), and (-1) i-1 ·det(M i ) is determined as the determinant (a i ), thus calculating As the second random matrix.

[0019] In this case, the computation of the trapdoor (T) may include the calculation of Vector of which is calculated as a trapdoor (T).

[0020] In this case, in the sampling of the vector, the element Reduces the elements of a vector and outputs the resulting vector value.

[0021] In this case, sampling from a vector can be done by selecting the elements of the vector Subtract elements from Reduces the elements of a vector by removing the directional component of the element by a constant multiple of .

[0022] Meanwhile, in the sampling of the vector, the extended Euclidean algorithm can be used to reduce each element of the vector.

[0023] Meanwhile, the predetermined function processing may be a hash processing.

[0024] According to another embodiment of the present application, a method for verifying a message includes: receiving a message and digital signature information; verifying whether the result of the calculation of the received digital signature information in the public key becomes a predetermined function-processed output value in the message; determining whether the received digital signature information has a value less than a predetermined parameter; and verifying the received message based on the verification result and the determination result, wherein the public key can be calculated using a ring with a dimension (d), which dimension (d) is represented by multiplying a power of 2 and an integer of 3 or more.

[0025] In this case, the predetermined function processing may be a hash processing.

[0026] According to another embodiment of the present application, a computing device includes: a memory storing at least one instruction; and a processor executing at least one instruction, wherein the processor can calculate a special solution, wherein the result of calculating the special solution in a public key becomes a predetermined function-processed output value in a message, and uses the calculated special solution to generate digital signature information for the message, and the public key can be calculated using a ring with a dimension (d), wherein the dimension (d) is represented by multiplying a power of 2 and an integer of 3 or greater.

[0027] In this case, the processor may reduce the calculated particular solution using the private key, and generate digital signature information by using the reduced particular solution.

[0028] At the same time, when a message and digital signature information are received, the processor can verify whether the result of the calculation of the received digital signature information in the public key becomes the predetermined function-processed output value in the message, determine whether the received digital signature information has a value less than a predetermined parameter, and verify the received message based on the verification result and the determination result.

[0029] According to another embodiment of the present application, a non-transitory computer-readable recording medium is provided, which includes a program for executing a method for generating a digital signature, wherein the method includes: receiving a message; calculating a special solution, wherein the result of calculating the special solution in a public key becomes a predetermined function-processed output value in the received message; and using the calculated special solution to generate digital signature information for the message, and the public key can be calculated using a ring with a dimension (d), which dimension (d) is represented by multiplying a power of 2 and an integer of 3 or more.

[0030] According to various embodiments of the present application as described above, parameters can be flexibly selected based on the trapdoor grid to meet the security required for generating encryption keys, that is, the total dimension can use an integer instead of a power of 2.

[0031] Furthermore, parameters precisely tailored to the security requirements can be freely selected and thus the size of all public keys, private keys, and encrypted texts can be reduced while increasing the overall efficiency of the encryption system.

[0032] Additional and / or other effects and advantages of the present application are partly set forth in the description below and partly are obvious from the description, or may be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above and / or other aspects of the present application will become more apparent by describing certain embodiments of the present application with reference to the accompanying drawings, in which:

[0034] Figure 1 is a flow chart illustrating operations for generating private and public keys according to the present application;

[0035] Figure 2 is a flow chart illustrating the operation of generating a digital signature using a private key according to the present application;

[0036] Figure 3 is a flow chart illustrating a message verification process for digital signature information generated according to the use of the present application;

[0037] Figure 4 is a diagram showing the structure of a random matrix of the present application.

[0038] Figure 5 is a diagram showing a structure of a network system according to an embodiment of the present application; and

[0039] Figure 6 is a block diagram showing a configuration of a computing device according to an embodiment of the present application. DETAILED DESCRIPTION

[0040] Hereinafter, the present application is described in detail with reference to the accompanying drawings. Encryption / decryption may be used as needed in the information (data) transmission process that may be performed in the present application, and all expressions describing the information (data) transmission process in this document and the claims need to be interpreted as including encryption / decryption, even if not specifically mentioned. In the disclosure, expressions such as "sending (transmitting) from A to B" and "receiving from B to A" may also include sending (transmitting) or receiving performed with another medium inserted therebetween, and do not necessarily mean direct sending (transmitting) or receiving only from A to B.

[0041] It should be understood that in the description of this specification, there is no restriction on the order of each step, unless it is logically and temporally required to perform the previous step before its subsequent step. That is, except for such exceptions, even if the process described as the subsequent step is performed before the process described as the previous step, the essence of the present application is not affected, and the scope of the present application also needs to be defined regardless of the order of the steps. In addition, "A or B" in the present application can be defined to mean not only selectively indicating any one of A and B, but also including both A and B. In addition, the term "comprising" in the present application can comprehensively include other elements in addition to the listed including elements.

[0042] The term "module" or "unit" in the present application may be general hardware or software that performs its function, or it may be a logical combination of hardware and software.

[0043] This application only describes the necessary components necessary to describe this application, and does not mention components that are irrelevant to the essence of this application. In addition, it should not be interpreted exclusively that this application only includes the mentioned elements, but should be interpreted non-exclusively that this application may include other elements.

[0044] The present application may be executed by an electronic computing device in a mobile device such as a computer, a server or a smart phone that can perform electronic computing. In the case where the computer program is encoded by a known coding method and / or is designed to be suitable for the present application to perform operations and calculations, the mathematical operations and calculations performed in each step of the present application described below may be implemented as another operation. The computer program that executes the present application may be stored in a computer-readable recording medium.

[0045] Furthermore, the term "value" in this application may be comprehensively defined to include all values ​​that may be represented by mathematical expressions such as vectors, matrices, and polynomials as well as scalar values.

[0046] In the present application, obtaining a predetermined value by performing encryption, hashing, etc. operations on a specific value can be defined as including encryption, hashing, etc. operations on the specific value, and a modified value of the specific value (for example, another value calculated by a process in which a predetermined value is additionally operated on the specific value or the specific value is changed based on a predetermined rule).

[0047] The mathematical operations and calculations performed in each step of the present application described below can be implemented as computer operations through known coding methods and / or codes designed to be suitable for the present application to perform the operations and calculations.

[0048] Each component of the device shown in the drawings of the present application may have any shape, size and dimension that can perform the functions intended by the present application, as well as its shape, size and dimension explicitly shown in the drawings.

[0049] The specific formulas described below are formulas exemplarily described among possible alternatives, and the scope of the present application should not be interpreted as being limited to the formulas mentioned in the present application.

[0050] For ease of explanation, this application uses the following identified symbols.

[0051] a←D: Select an element (a) based on the distribution (D).

[0052] s1,s2∈R: Each of S1 and S2 is an element in the set (R).

[0053] mod(q): modulus is calculated by element(q).

[0054] Internal value is rounded.

[0055] Hereinafter, various embodiments of the present application are described in detail with reference to the accompanying drawings.

[0056] This application proposes a generalized concept of Number Theoretic Research Unit (NTRU) lattice called modular NTRU (MNTRU) lattice, which can address the dimensional flexibility of NTRU-based encryption. Compared with the existing NTRU trapdoors, this MNTRU lattice can show more efficient trapdoor generation. In the following, a new identity-based encryption can be first applied based on the MNTRU trapdoor.

[0057] We first describe the operations used to generalize the NTRU trapdoor.

[0058] Similar to the generalization from ring LWE to module LWE, R 2 The context of the NTRU lattice in can be generalized to a higher-order R d The MNTRU grid.

[0059] First, if from the matrix We sample two small polynomials (f, g) and assume that f is the inverse in the ring. Then we define the NTRU instance as and Here, the following Formula 1 may be satisfied.

[0060] [Formula 1]

[0061] (1, h)·S NTRU ≡0mod q

[0062] Here, h is an NTRU instance, and S NTRU is a matrix.

[0063] In addition, the NTRU grid can be defined as in Formula 2 below.

[0064] [Formula 2]

[0065]

[0066] Here, A NTRU is an NTRU lattice, and q is a prime number.

[0067] This content can be understood as Z 2n The integer lattice in includes the uncommon short vectors (g and -f), and f and g can be solved to obtain F and G∈R, which satisfy the following formula 3, thus producing A NTRU The foundation of the trapdoor

[0068] [Formula 3]

[0069] gF-fG=q

[0070] Here, g and f are short vectors, F and G are matrices, and q is a prime number.

[0071] The NTRU formula is the same as Formula 4 below.

[0072] [Formula 4]

[0073]

[0074] Here, A is the inverse circulant matrix transformation of the polynomial.

[0075] This framework can be generalized to the case of d ≥ 2. To this end, we can first MNTRU ∈R d×(d-1) The elements with smaller coefficients are sampled, and a vector h satisfying the following formula 5 can be constructed MNTRU =(h1,…,h d )∈R q d-1 .

[0076] [Formula 5]

[0077] (1, h MNTRU )·S MNTRU ≡0mod q

[0078] Based on this formula, the n-dimensional MNTRU lattice can be defined as in Formula 6 below.

[0079] [Formula 6]

[0080]

[0081] Here, h=(h1,...,h d-1 ) can be obtained by det i / det1 is determined, and mod q is the determinant of the submatrix, where det i YesS MNTRU (d-1)×(d-1).

[0082] Based on this content, the trapdoor of the present application can be calculated as in Formula 7.

[0083] [Formula 7]

[0084]

[0085] Here, F is Represents the MNTRU formula.

[0086] In the following, reference is made to Figure 4 A lattice structure capable of producing the above-mentioned trapdoor is described.

[0087] Figure 4 is a diagram showing the structure of a random matrix of the present application.

[0088] refer to Figure 4, a first random matrix (S) and a second random matrix (A) are used in a lattice structure according to the present application.

[0089] In the first random matrix (S), the number of columns is dk (i.e., d-1), the number of rows (d) is 1, and in the second random matrix (A), the number of columns is (d), and the number of rows (k) is 1. Here, the number of columns (d) may be a predetermined integer greater than 2, and unlike the prior art, the entire dimension may be determined as an integer other than a power of 2, thereby increasing the flexibility of the parameters.

[0090] The first random matrix (S) and the second random matrix (A) can satisfy Figure 4 The relationship shown.

[0091] Figure 5 An environment for performing a grid-based computing process according to the present application is shown.

[0092] Figure 5 is a diagram showing the structure of a network system according to an embodiment of the present application.

[0093] refer to Figure 5 , the network system may include a user terminal 10 , a key generation server 20 , and a digital signature verification server 40 , and each component may be connected to each other via a data communication network 30 .

[0094] The data communication network 30 can be implemented in various types of wired and wireless communication networks, broadcast communication networks, optical communication networks, and cloud networks, and each device can be connected to each other in a manner such as wireless fidelity (WiFi), Bluetooth, near field communication (NFC), etc. without a separate medium.

[0095] The key generation server 20 may generate various key values ​​for encryption based on the lattice. In detail, the key generation server 20 may first determine various parameters and rings, and then generate public keys and private keys based on the determined parameters and rings.

[0096] Here, the loop can be expressed by the following formula 8.

[0097] [Formula 8]

[0098]

[0099] Here, R is a ring and Z is a coefficient. Here, a ring is a set of polynomials having predetermined coefficients and may indicate a set in which addition and multiplication between elements are defined and are closed. This polynomial ring may be referred to as a ring.

[0100] Here, a ring is a ring of polynomials of integer coefficients of order less than the Nth order of the elements, and addition and multiplication operations are defined between the elements in the set. For example, an addition operation may be defined as multiplication between polynomials, and a multiplication operation may be defined as mod x of the corresponding elements after performing the multiplication between the polynomials. N +1. According to this definition, X N-1 *x is the x to be multiplied as a polynomial N , and for mod X N +1, X N = -1, so X N-1 *x=-1.

[0101] [Formula 9]

[0102]

[0103] In Equation 9, the ring is simply the set of polynomials that are less than integers of degree N and have coefficients in [0, q-1]. Addition and multiplication operations are defined in this set and, for example, can be defined as performing mod q on each coefficient while performing mod x on each coefficient. N +1 for the multiplication operation.

[0104] The ring according to the present application has a dimension represented by a power of 2 and an integer of 2 or more, and a lattice trap door corresponding to such an order value can be used. As described above, a dimension represented by an integer multiplication can be used. Therefore, even in the case where the dimension needs to be increased in order to increase the security of the key, it is not necessary to double the dimension, so that the parameter can be flexibly selected.

[0105] The key generation server 20 may calculate the first and second random matrices based on the above-determined ring, and calculate a trapdoor. Here, the trapdoor is special secret information that allows the calculation of an inverse function of a function that is difficult to execute alone. Figure 4 As shown, the trapdoor of the present application is used in the lattice-based encryption technology, and the following reference Figure 1 Describe its specific calculation operations.

[0106] The key generation server 20 can calculate the public key and the private key based on the calculated random matrix and the trapdoor. Figure 1 Describes the specific key generation operation.

[0107] Furthermore, the key generation server 20 may receive the encrypted text from the user terminal 10 and store the encrypted text as it is without performing decryption.

[0108] at the same time, Figure 5It is described that the key generation server 20 generates keys required for encryption, and the user terminal 10 receives some of the generated keys and then performs encryption operations. However, the key generation operation, encryption operation, and decryption operation may be performed in various devices depending on the environment.

[0109] The user terminal 10 can generate digital signature information using the public key generated by the key generation server 20, and send the message and the digital signature information to the digital signature verification server 40. Here, the digital signature information (or digital signature value) is information used to verify whether the message is forged or tampered.

[0110] The digital signature verification server 40 may receive the message and the digital signature information, and verify the message using the received digital signature information.

[0111] The user can input various information through his / her user terminal 10. The input information can be stored in the user terminal 10 itself, but may be transmitted to and stored in an external device for reasons such as storage capacity and security. Figure 5 In the embodiment of the present invention, the key generation server 20 may be used to store such information, and the key generation server 20 may be used to use some or all of the information stored in the key generation server 20.

[0112] The user terminal 10 may receive key information required for encryption from the key generation server 20, and may encrypt a message using the received key information. For example, the user terminal 10 may receive a public key from the key generation server 20, and generate an encrypted text by encrypting a message using the received public key. Here, the user terminal 10 may receive and use a small element required for encryption and an output value processed by a function, or may generate and use an encrypted text by itself.

[0113] In addition, the user terminal 10 may send the encrypted text and digital signature information to the digital signature verification server 40 .

[0114] In addition, the digital signature verification server 40 may decrypt the encrypted text. For example, the user terminal 10 may decrypt the encrypted text using a private key, and the key generation server 20 may perform the decryption operation.

[0115] Furthermore, the digital signature verification server 40 may verify the received message using the received digital signature information.

[0116] Figure 5 One user terminal is shown, but multiple user terminals may be used. For example, the user terminal 10 may be implemented as various types of devices, such as a smart phone, a tablet computer, a game console, a personal computer (PC), a laptop computer, a home server, a self-service terminal, etc., and a home appliance to which an Internet of Things (IoT) function is applied.

[0117] Figure 1 is a flow chart illustrating the operation of generating public and private keys according to the present application.

[0118] refer to Figure 1 , calculate the first random matrix (S) (100). For example, the first random matrix (S) can be calculated by sampling the element values ​​satisfying the following formula 10. In detail, the first random matrix (S) can be calculated by sampling the elements that are linearly independent of each other in the ring. Sampling is performed to compute a first random matrix (S) in which the number of columns is one less than the dimension and the number of rows is equal to the dimension.

[0119] [Formula 10]

[0120]

[0121] Here, Represents the sampled element value, and all Value in R q If the values ​​are not linearly independent of each other, the element values ​​can be resampled.

[0122] Then the second random matrix (A) is calculated (110). In detail, the random coefficients (r) can be sampled and the determinant (a) corresponding to the number of rows of the first random matrix can be used. i ) and the sampled random coefficients (r), as shown in the following formula 11 to calculate the second random matrix (A).

[0123] [Formula 11]

[0124] r·(a1, a2, …a d )

[0125] Here, the determinant (a i ) is (-1) i-1 ·det(M i ), and M i From the matrix Remove the i-th row (M i ) is a d×d matrix. Here, r is the random coefficient r(∈R q ).

[0126] For example, if the random coefficient (r) is a1 -1 , then the second random matrix (A) can be (1, A1, ..., A d-1 ).

[0127] The trapdoor (T) can then be calculated (120). For example, this can be done by using the first random matrix (S) and the newly sampled The trap gate (T) is calculated as shown in Formula 12 below.

[0128] [Formula 12]

[0129]

[0130] Here, T is a trapdoor. are the element values ​​of the first random matrix (S), and is a short vector sampled from the ring to satisfy the following formula 13. In addition, "||" represents concatenation.

[0131] [Formula 13]

[0132]

[0133] Here, det is the determinant operation, is the element value of the first random matrix (S), is the sampled short vector, and q is a constant.

[0134] Below, we describe the short vector The specific method of sampling.

[0135] First, we can calculate Alpha i Here, we can assume that gcd(res(a i ),…res(a d ))and

[0136] α i It can be calculated by extending the Euclidean algorithm. In addition, F can be calculated based on the above calculated values ​​as follows i .

[0137] [Formula 14]

[0138]

[0139] Thus, the following relationship is established in Formula 15.

[0140] [Formula 15]

[0141]

[0142] By using Come to reduce Then the result value can be output

[0143] This reduction means removing While the directional component of Minus This reduction may allow the trapdoor (T) to have a smaller size. Taking integers as an example, in the case of F = (2, 5) and f = (1, 2), if [F, f] and [F-2f, f] are compared with each other, the same column space may be defined, but the columns of the subsequent reduction matrix may have a reduced size.

[0144] Then the private key and the public key may be determined (130). In detail, the calculated trapdoor (T) may be determined as the private key, and the public key may be determined as (A1, ..., Ad-1).

[0145] If the private and public keys are determined in this way, they can be converted into to publish the public key.

[0146] Figure 2 is a flow chart illustrating the operation of generating a digital signature using a private key according to the present application.

[0147] refer to Figure 2 , receiving a message (m) to be digitally signed (200).

[0148] A special solution may be calculated, wherein the result of calculating the special solution in the public key becomes the output value processed by the function predetermined in the received message (210). In detail, a special solution satisfying As0=H(m) may be calculated. Here, the particular solution may be calculated using, for example, Gaussian elimination. In addition, the public key may be a key calculated using a ring having a dimension (d) represented by multiplying powers of 2 and integers of 3 or more.

[0149] The calculated special solution can then be used to generate digital signature information for the message (220). In detail, the special solution s0 can be reduced using the private key (T), and then its result value can be The digital signature information is output as the message (m). As described above, such digital signature information can satisfy As = H (m).

[0150] Here, the reduction process may be a process of sampling a small discrete normal distribution using a private key (T), the discrete normal distribution being centered on s calculated in the S200 operation on the set {s:As=0}. Specifically, a standard deviation (σ) may be selected, calculated by a Gaussian sampler (c), and a small solution (s=(s0,s1,…,s d-1 ), where the product of the small solution and the second random matrix becomes the hash value, and s is output in the calculated small solution as the above-mentioned digital signature information.

[0151] The digital signature information may be generated by the user terminal 10 to which the message is to be sent, and the digital signature information may be verified by the digital signature verification server 40 . Figure 5 It is shown that the digital signature verification server 40 verifies the digital signature. However, the receiving terminal that receives the message (m) may also verify the digital signature, and the scope of the present application is not limited to the subject that performs the verification.

[0152] Figure 3 is a flow chart showing a message verification process using the generated digital signature information according to the present application.

[0153] Reference Figure 3 , a subject that performs digital signature verification (e.g., a digital signature verification server 40 or a terminal that receives a message (m)) may first receive digital signature information (s) (300). Here, the subject may receive the message (m) together. Here, the message may be received from a device that sends digital signature information or from another subject.

[0154] It can then be verified whether the result of calculating the received digital signature information in the public key becomes the predetermined function-processed output value in the message (310). In detail, the subject performing the digital signature verification can determine whether the result satisfies As=H(m). Here, s is the digital signature information, H() is the predetermined function processing, and can be, for example, a hash processing, and m is the message. In addition, A is a public key, which can be calculated using a ring having a dimension (d) represented by multiplying an integer of a power of 2 and a number of 3 or more.

[0155] Then, it may be determined whether the received digital signature information has a value less than a predetermined parameter (320). That is, it may be determined whether the digital signature information s has a sufficiently small size. Here, the predetermined parameter may be determined considering the possibility of failure in the size comparison object for verifying the digital signature information, stability, etc.

[0156] The received message may be verified based on the verification result and the determination result. For example, if both conditions are met, it may be determined that the digital signature verification is successful (330); if not, it may be determined that the verification fails (340).

[0157] Meanwhile, the embodiment shows and describes that it is first checked whether the operation formula is established, and then the size of the digital signature information and the predetermined parameters can be compared with each other. However, the method can be implemented in the following manner: first the size of the digital signature information and the predetermined parameters can be compared with each other, and then it can be checked whether the operation formula is established.

[0158] exist Figure 2 The above method shown in or 3 can reduce the amount of calculation or calculation time required to generate the key, because the dimension represented by the multiplication of powers of 2 and integers can be used without doubling the dimension to improve the security of the key.

[0159] at the same time, Figure 2The above method shown in 3 can be implemented as a program code for executing each step, and can be stored in a recording medium and distributed. In this case, the device on which the recording medium is installed can perform the operation of the above encryption method.

[0160] The recording medium may be one of various types of computer-readable media, such as read-only memory (ROM), random access memory (RAM), a memory chip, a memory card, an external hard drive, a hard drive, a compact disk (CD), a digital versatile disk (DVD), a disk, or a tape.

[0161] at the same time, Figure 2 and Figure 3 The method is shown and described as generating digital signature information for a message, and then performing an operation of verifying the message using the generated digital signature information. However, the method can also be implemented in the following manner: generating digital signature information for an encrypted message, that is, generating a digital signature for an encrypted text, and performing an operation of verifying the encrypted text.

[0162] Figure 6 is a block diagram showing the configuration of a computing device according to an embodiment of the present application.

[0163] Specifically, the computing device may refer to a device that performs encryption such as a user terminal, a device that generates a key required for generating an encrypted text such as a key generation server, and a device that performs encryption such as a user terminal. Figure 5 A device for using encrypted text in a system. Such a computing device may be a variety of devices, such as a personal computer (PC), a laptop, a smart phone, a tablet, or a server.

[0164] refer to Figure 6 The computing device 600 may include a communication device 610 , a memory 620 , a display 630 , an operation input device 640 , and a processor 650 .

[0165] The communication device 610 may be formed to connect the computing device 600 to an external device (not shown), and may be connected to the external device through a local area network (LAN) and the Internet, or may be connected to the external device through a universal serial bus (USB) port or a wireless communication (e.g., wireless fidelity (WiFi) 802.11a / b / g / n, near field communication (NFC) or Bluetooth) port. The communication device 610 may also be referred to as a transceiver.

[0166] The communication device 610 may receive various keys required to generate the encrypted text. For example, when generating the key, the communication device 610 may receive three parameters (n, q, and d). Here, n is a value multiplied by a power of 2 representing the dimension, and d is an integer. Therefore, 2 n*d may be the dimension of a ring generated by corresponding parameters, and q is a decimal value. Various keys may also be input by operating the input device 640 .

[0167] In addition, the communication device 610 can send a key generated by itself to an external device. Here, the key can be a public key, a private key, etc.

[0168] In addition, the communication device 610 may receive a message from an external device, and may transmit the generated encrypted text and / or digital signature information to the external device.

[0169] In addition, the communication device 610 may receive various parameters required to generate a key or an encrypted text from an external device. Meanwhile, various parameters may be implemented as direct input from the user through the operation input device 640 to be described below.

[0170] In addition, the communication device 610 may receive the encrypted text. Here, the communication device 610 may receive digital signature information for the encrypted text (or message) together.

[0171] The memory 620 is a component for storing an operating system (OS), various software, data, etc. for driving the computing device 600. The memory 620 may be implemented in various types of devices such as a random access memory (RAM), a read-only memory (ROM), a flash memory, a hard disk drive (HDD), an external memory, a memory card, etc., and is not limited thereto.

[0172] The memory 620 can store identity information (or user information). Here, the identity information can be a social security number, an email address, a phone number, fingerprint information, iris information, etc., and can be used when generating a user private key or encrypted text.

[0173] In addition, the memory 620 can store messages to be encrypted. Here, the messages can be various types of credit information and personal information cited by the user, or information related to the usage history, such as location information used in the computing device 600, time information about using the Internet, etc.

[0174] In addition, the memory 620 may store a public key, and may store the public key and various parameters required to generate a private key, and a private key when the computing device 600 is a device that directly generates a public key.

[0175] The memory 620 may also store encrypted text and / or digital signature information generated in the process described below. The memory 620 may also store intermediate data, etc. during the generation of the encrypted text and / or digital signature information.

[0176] The memory 620 may also store encrypted text sent from an external device. In addition, the memory 620 may also store a message, which is the result of decrypting the encrypted text. In addition, the memory 620 may store digital signature information sent from an external device.

[0177] The display 630 may display a user interface window for the user to select functions supported by the computing device 600. For example, the display 630 may display a user interface window for the user to select various functions provided by the computing device. The display 630 may be a monitor such as a liquid crystal display (LCD), an organic light emitting diode (OLED), etc., and as described below, may be implemented as a touch screen that can simultaneously perform the functions of the operation input device 640.

[0178] The display 630 may display a message requesting the user to input parameters required to generate a private key and a public key. The display 630 may also display a user interface (UI) requesting the user to select an encryption target. For example, the display 630 may display a UI for the user to select user identity information for use in identity-based encryption based on a grid.

[0179] At the same time, the encryption target can be implemented as being directly selected by the user or automatically selected. That is, even if the user does not directly select the message, the personal information that needs to be encrypted can be automatically determined.

[0180] The operation input device 640 may receive a function selection of the computing device 600 and a command for controlling the corresponding function from the user. For example, the operation input device 640 may receive parameters required to generate a private key and a public key from the user. In addition, the operation input device 640 may receive a confirmation message to be encrypted from the user.

[0181] The processor 650 may control each component in the computing device 600. The processor 650 may be configured by a single device such as a central processing unit (CPU) or an application specific integrated circuit (ASIC), or may be configured by a plurality of devices such as a CPU, a graphic processing unit (GPU), and the like.

[0182] If a message to be transmitted is input, the processor 650 may store the message in the memory 620. The processor 650 may encrypt the message by using various determined values ​​and programs stored in the memory 620. In this case, a public key may be used.

[0183] The processor 650 may generate and use a public key required to perform encryption by itself, or may use a public key received from an external device. For example, the key generation server 20 that performs decryption may distribute the public key to another device.

[0184] In the case where the key generation server 20 generates the public key itself, the processor 650 may generate Figure 5 The first random matrix (S) and the second random matrix (A) to be generated and the public key based on the second random matrix are shown.

[0185] In case of generating a public key, the processor 650 may control the communication device 610 to transmit the key to another device.

[0186] The processor 650 may also generate encrypted text for the message. For example, in the case of input identity information, the processor 650 may generate a function-processed output value by performing a function on the input identity information. In addition, the processor 650 may randomly sample small elements and generate encrypted text for the message by using the sampled small elements, the function-processed output value, and the public key.

[0187] Furthermore, the processor 650 may store the generated encrypted text in the memory 620, and may control the communication device 610 to transmit the same encrypted text to another device based on a user request or a predetermined default command.

[0188] The processor 650 may generate digital signature information for encrypted text or messages. For example, the processor 650 may calculate a special solution, wherein the result of calculating the special solution in the public key becomes an output value processed by a predetermined function in the message, and generate digital signature information for the message by using the calculated special solution.

[0189] The processor 650 can also decrypt the encrypted text by using the user's private key. In addition, when receiving a message and digital signature information, the processor 650 can use the received digital signature information to verify the message. In detail, the processor 650 can verify the received message (or encrypted text) by checking whether the result of the calculation of the received digital signature information in the public key becomes the output value of the function processing predetermined in the message, and by determining whether the received digital signature information has a value less than a predetermined parameter.

[0190] As described above, the computing device according to the present application can perform encryption processing using a ring having a dimension represented by a power of 2 and an integer of 2 or more. The amount of computation or computing time required to generate a key can be reduced because the dimension represented by a power of 2 and an integer can be used without doubling the dimension to improve the security of the key.

[0191] at the same time, Figure 6 One device is shown and described as performing both encryption and decryption operations, but the one device may be implemented to perform one operation, for example, only one of a key generation operation, an encryption operation, and a decryption operation.

[0192] Although the present application has been described with reference to the accompanying drawings, the scope of the present application is not to be interpreted as being limited to the described embodiments and / or drawings, but is defined by the appended claims. In addition, it should be clearly understood that it is obvious to those skilled in the art that improvements, changes and modifications to the present application as described in the claims are all included within the scope of the present application.

Claims

1. A method for generating a digital signature, comprising: Receive messages; Calculating a particular solution, wherein the result of calculating the particular solution in the public key becomes the function-processed output value predetermined in the received message, and Generate digital signature information for the message using the calculated special solution, wherein the public key is calculated using a ring (Rq) having a dimension (d) represented by a power of 2 multiplied by an integer of 3 or greater, Wherein, in the generation of the digital signature information, the digital signature information is generated by reducing the calculated particular solution using a private key, Also includes: By sampling linearly independent elements in the ring to compute a first random matrix (S) where the number of columns is 1 less than the dimension and the number of rows is equal to the dimension; Compute a second random matrix (A) having a number of columns equal to the dimension and a number of rows equal to 1; and The public key is calculated based on the second random matrix (A).

2. The method according to claim 1, further comprising: Calculate the trapdoor (T); as well as The calculated trapdoor (T) is determined as the private key.

3. The method according to claim 2, wherein: In the calculation of the second random matrix, by Excluding the i-th row to calculate the d×d matrix (M i ), and (-1) i-1 ·det(M i ) is determined as the determinant (a i ), thus calculating As the second random matrix.

4. The method according to claim 3, wherein: The calculation of the trapdoor (T) includes the following steps: Vector Sampling of, where q is a prime number, vector is calculated as a trapdoor (T).

5. The method according to claim 4, wherein: In sampling the vector, by using the element After reducing the elements of the vector, the resulting vector value is output.

6. The method according to claim 5, wherein: In sampling the vector, by taking the elements of the vector Subtract the element from The elements of the vector are reduced by removing the directional component of the elements by a constant multiple of .

7. The method according to claim 5, wherein in the sampling of the vector, an extended Euclidean algorithm is used to reduce the elements of the vector.

8. The method according to claim 1, wherein: The predetermined function processing is a hash processing.

9. A method for verifying a message, comprising: Receive messages and digitally sign information; Verify whether the result of the calculation of the received digital signature information in the public key becomes the output value processed by the function predetermined in the message; determining whether the received digital signature information has a value less than a predetermined parameter; as well as verifying the received message based on the verification result and the determination result, wherein the public key is calculated using a ring having a dimension (d) represented by a power of 2 multiplied by an integer of 3 or greater, Also includes: By sampling linearly independent elements in the ring to compute a first random matrix (S) where the number of columns is 1 less than the dimension and the number of rows is equal to the dimension; Compute a second random matrix (A) having a number of columns equal to the dimension and a number of rows equal to 1; and The public key is calculated based on the second random matrix (A).

10. The method according to claim 9, wherein: The predetermined function processing is a hash processing.

11. A computing device, comprising: a memory storing at least one instruction; as well as a processor that executes the at least one instruction, wherein the processor calculates a special solution, wherein a result of calculating the special solution in the public key becomes a function-processed output value predetermined in the message, and the processor generates digital signature information for the message using the calculated special solution, and The public key is calculated using a ring having a dimension (d) represented by a power of 2 multiplied by an integer of 3 or greater, The processor reduces the calculated special solution using the private key, and generates the digital signature information by using the reduced special solution. The processor samples linearly independent elements in the ring. to compute a first random matrix (S) where the number of columns is 1 less than the dimension and the number of rows is equal to the dimension; wherein the processor calculates a second random matrix (A) in which the number of columns is equal to the dimension and the number of rows is 1; and The processor calculates the public key based on the second random matrix (A).

12. The computing device according to claim 11, wherein: Upon receiving the message and the digital signature information, the processor verifies whether the result of the calculation of the received digital signature information in the public key becomes a function-processed output value predetermined in the message, determines whether the received digital signature information has a value less than a predetermined parameter, and verifies the received message based on the verification result and the determination result.

13. A non-transitory computer-readable recording medium comprising a program for executing a method for generating a digital signature, wherein: The method comprises: Receive messages; Calculating a particular solution, wherein a result of calculating the particular solution in the public key becomes a function-processed output value predetermined in the received message; and Generate digital signature information for the message using the calculated special solution, wherein the public key is calculated using a ring having a dimension (d) represented by a power of 2 multiplied by an integer of 3 or greater, Wherein, in the generation of the digital signature information, the digital signature information is generated by reducing the calculated particular solution using a private key, Also includes: By sampling linearly independent elements in the ring to compute a first random matrix (S) where the number of columns is 1 less than the dimension and the number of rows is equal to the dimension; Compute a second random matrix (A) having a number of columns equal to the dimension and a number of rows equal to 1; and The public key is calculated based on the second random matrix (A).

Images