An authentication encryption method

Abstract

The application discloses an authentication encryption method, which shares random numbers and irreducible polynomial determination algorithms in a safe way, guarantees that both authentication parties share preset random irreducible polynomials, eliminates security loopholes caused by the cumulative failure probability of multiple rounds of authentication, and can replace the preset random irreducible polynomials by regularly replacing the random numbers in the later period; the absolute safe first key string and the second key string are shared in a safe way, the first key string and the preset irreducible polynomial are used to generate a LFSR hash matrix to generate a message authentication code, and the second key string is used for one-time one-encryption or decryption of the message, which theoretically provides the information theory security that can resist all existing attacks, and guarantees the confidentiality, integrity and authenticity of the information.

Description

Technical Field

[0001] This invention relates to the field of quantum security technology, and specifically to an authentication encryption method. Background Technology

[0002] Encryption and authentication are two basic encryption tools. Encryption ensures data confidentiality, while authentication and signatures ensure data integrity. Authentication encryption technology combines the two, thus simultaneously guaranteeing both confidentiality and integrity of information. In many common internet technology applications, such as e-commerce and electronic payments, both parties exchanging information must ensure both data confidentiality and integrity. Therefore, authentication encryption technology has extremely wide applications in the field of internet information security.

[0003] Traditional authentication and encryption methods utilize asymmetric key systems for encryption and authentication. This presents two potential problems: First, the security of this approach relies on computational complexity. With the rapid increase in classical computing power and the explosive development of quantum algorithms, attackers will soon be able to brute-force various asymmetric key algorithms, rendering current classical authentication and encryption schemes insecure. Second, due to the scalability of asymmetric key systems like RSA, authentication and encryption schemes based on these systems still have security vulnerabilities (such as chosen-ciphertext attacks).

[0004] Chinese patent number 2021108189399 proposes an unconditionally secure hash authentication method based on LFSR. In this patent, both the sending and authenticating ends explicitly generate the irreducible polynomial used in the hash function before authentication begins. This irreducible polynomial is fixed and pre-shared; the security of the hash function is guaranteed solely by a shared set of keys. Although this authentication scheme is based on unconditional security in information theory, the fixed irreducible polynomial means that the key transmission via quantum key distribution during the hashing process has a very small probability of failure. After multiple rounds of authentication or authentication encryption, this failure probability can accumulate to a large value, posing a risk of leakage. Furthermore, this patent does not address the issue of authentication encryption.

[0005] The security of quantum key distribution requires that the classical channel be an authenticated channel. To achieve this, traditional methods use pre-shared keys and LFSR (Free-Low-Sum Recognition) for secure authentication. However, the security of LFSR relies on irreducible polynomials. The traditional approach is to directly generate the polynomial using an n-bit pre-shared key, which is often not irreducible. Therefore, authentication in traditional quantum key distribution is not unconditionally secure, resulting in the shared key generated by quantum key distribution also failing to achieve unconditional security.

[0006] In summary, the security of existing classical encryption authentication schemes is insufficient to meet the demands of today's rapidly evolving digital society. The hash authentication method based on LFSR proposed in Chinese patent number 2021108189399 carries the risk of key leakage after multiple rounds of authentication and does not provide an encryption method. Furthermore, traditional quantum key distribution authentication does not utilize irreducible polynomials, thus its security cannot be guaranteed. Therefore, inventing an efficient and unconditionally secure authentication and encryption scheme is of paramount importance and urgency. Summary of the Invention

[0007] Purpose of the invention: The purpose of this invention is to provide an authentication encryption method that solves the problem that existing LFSR-based authentication methods fix the form of irreducible polynomials, thus leading to a significant risk of information leakage and security vulnerabilities after multiple rounds of authentication; it also solves the problem that traditional methods use n-bit pre-shared keys to directly generate polynomials, which are often not irreducible polynomials, resulting in a lack of guarantee for authentication security.

[0008] Technical solution: This invention provides an authentication encryption method, the method comprising the following steps:

[0009] (1) The sending end and the receiving end share a string of random numbers to generate an irreducible polynomial in advance;

[0010] (2) The sending end determines the message to be used;

[0011] (3) The sending end and the receiving end share the first key string and the second key string. The sending end uses its own second key string to encrypt the message to obtain the ciphertext. Then, it uses the first half of its own first key string as the input random number and a pre-generated irreducible polynomial to generate a hash function based on a linear feedback shift register. The ciphertext is then input into the hash function to generate the first message authentication code. The sending end uses the second half of its own first key string to encrypt the first message authentication code to obtain the encrypted first message authentication code.

[0012] (4) The sender sends the ciphertext and the encrypted first message authentication code to the receiver;

[0013] (5) The receiving end uses the first half of its first key string as the input random number and the pre-generated irreducible polynomial to generate a hash function based on a linear feedback shift register. Then, the received ciphertext is input into the hash function to generate the second message authentication code. The receiving end then uses the second half of its first key string to decrypt the received encrypted first message authentication code to obtain the decrypted first message authentication code.

[0014] (6) The receiving end verifies whether the decrypted first message authentication code is the same as the generated second message authentication code; if they are the same, the authentication is successful, otherwise it fails.

[0015] (7) After passing, the receiving end uses its own second key string to decrypt the received ciphertext and obtain the message.

[0016] Furthermore, in step (3), the encryption method is to use bitwise XOR to perform one-time one-pad encryption.

[0017] Furthermore, in step (1), the specific process of pre-generating the irreducible polynomial is as follows:

[0018] 1) First, both the sending end and the receiving end use each bit of the random number to correspond to the coefficient of each term in the polynomial except for the highest term, to generate an nth-order polynomial in the GF(2) field, with the coefficient of the highest term being 1.

[0019] 2) Then, verify whether this polynomial is irreducible. If the verification result is "no", the sender and receiver share another set of random numbers generated and return to step 1) to regenerate the polynomial and verify it. If the verification result is "yes", stop the verification and both the sender and receiver obtain the irreducible polynomial.

[0020] Furthermore, the method for verifying whether a polynomial is irreducible is as follows:

[0021] Verify in sequence Whether it is valid, among which Indicates to If the verification passes for all i, then p1(x) is an irreducible polynomial of order n on GF(2); where gcd(f(x),g(x)) represents the greatest common divisor of f(x) and g(x) on GF(2), and f(x) and g(x) refer to two arbitrary polynomials.

[0022] Furthermore, the method for verifying whether a polynomial is irreducible is as follows:

[0023] Verification conditions Whether they are both true or false, among which express The remainder of is the same as the remainder of xmodp1(x), d is any prime factor of n, gcd(f(x),g(x)) represents the greatest common factor of f(x) and g(x) on GF(2), f(x) and g(x) refer to two arbitrary polynomials. When both of these verification conditions are satisfied, then p1(x) is an irreducible polynomial of order n on GF(2).

[0024] Furthermore, before step 1), if the last digit of the random number is 0, then set the last digit of the random number to 1; or if the last digit of the random number is 0, then regenerate the random number until the last digit of the generated random number is 1.

[0025] Furthermore, in step (3), the hash function based on the linear feedback shift register is a Toeplitz matrix of dimension n×m, where n is the length of the first half of the first key string and m is the length of the message.

[0026] Furthermore, in step (1), the random number shared by the sending end and the receiving end is shared in a secure sharing manner and the random number is updated periodically.

[0027] Furthermore, the secure sharing method includes quantum key distribution or secure delivery of quantum random numbers.

[0028] Furthermore, in step (3), if the shared second key string is all zeros or all 1s, it constitutes unconditionally secure authentication.

[0029] The beneficial effects of the present invention are as follows: The authentication encryption method of the present invention is based on a shared, irreducible polynomial decision algorithm, one-time pad and LFSR hash, which simultaneously protects confidentiality, integrity and authenticity.

[0030] (1) The sharing of random numbers and irreducible polynomial determination algorithm in a secure manner ensures that both parties to the authentication share a pre-set random irreducible polynomial, eliminating the security vulnerabilities caused by the accumulation of failure probabilities in multiple rounds of authentication; at the same time, the random numbers can be changed periodically in the later stage to change the pre-set irreducible polynomial.

[0031] (2) An absolutely secure first key string and second key string are shared in a secure manner. An LFSR hash matrix is ​​generated using the first key string and a pre-set irreducible polynomial to generate a message authentication code. The message is then encrypted (decrypted) using the second key string. In principle, this provides information theory security that can resist all existing attacks, while ensuring the confidentiality, integrity, and authenticity of the information. The probability of an attacker successfully tampering with the message does not exceed [a certain value]. The probability of successfully guessing the ciphertext is no more than

[0032] (3) The present invention prevents the problem of circular argument in authentication by using pre-shared random numbers to generate and verify irreducible polynomials at both the sending end and the receiving end; both parties obtain the same irreducible polynomial by verifying the shared random numbers without having an irreducible polynomial, and the irreducible polynomial does not need to be sent by the party that maintains confidentiality and integrity to the other party. Attached Figure Description

[0033] Figure 1 This is a flowchart illustrating the sending end's process during encryption authentication. Detailed Implementation

[0034] The present invention will be further described below with reference to the accompanying drawings and embodiments:

[0035] The present invention provides an authentication encryption method that can maintain security even under multi-round authentication encryption. The specific steps are as follows:

[0036] (1) The sending end and the receiving end share a string of random numbers to generate an irreducible polynomial in advance; the random numbers can be shared in a secure way, which can ensure that the random numbers are truly random and unconditionally secure; secure sharing methods include quantum key distribution, secure delivery of quantum random numbers, etc.

[0037] The specific process of generating irreducible polynomials from a pre-defined set is as follows:

[0038] 1) First, both the sending and receiving ends sequentially use the coefficients of each term in the polynomial (excluding the highest term) corresponding to each bit of the random number to generate an nth-order polynomial in the GF(2) field, with the coefficient of the highest term being 1; for example, the random number is n bits long and has a coefficient of (a n-1 ,a n-2 If a, ..., a1, a0), then the generated polynomial is p1(x) = x. n +a n-1 x n-1 +…+a1x+a0; Preferably, the generated polynomial is only likely to be irreducible when a0=1. Therefore, to reduce the computational load during later verification of the irreducible polynomial, the n-bit random number can be judged first: if the last bit of the n-bit random number is 0, then set the last bit of the random number to 1; or if the last bit of the n-bit random number is 0, then regenerate the n-bit random number until the last bit of the generated n-bit random number is 1. This can reduce the computational load during later verification of the irreducible polynomial, and finally make a0=1, and the generated polynomial is p1(x)=x n +a n-1 x n-1 +…+a1x+1;

[0039] 2) Then, verify whether this polynomial is irreducible. If the verification result is "no", the sender and receiver share another set of random numbers generated and return to step 1) to regenerate the polynomial and verify it. If the verification result is "yes", stop the verification and both the sender and receiver obtain the irreducible polynomial.

[0040] There are several ways to verify the irreducible polynomial here, but the two methods mentioned in this invention are preferred:

[0041] Method 1: Verify sequentially Whether it is valid, among which Indicates to If the verification passes for all i, then p1(x) is an irreducible polynomial of order n on GF(2); where gcd(f(x),g(x)) represents the greatest common divisor of f(x) and g(x) on GF(2), and f(x) and g(x) refer to two arbitrary polynomials.

[0042] Method 2: Verification Conditions Whether they are both true or false, among which express The remainder of is the same as the remainder of xmodp1(x), d is any prime factor of n, gcd(f(x),g(x)) represents the greatest common factor of f(x) and g(x) on GF(2), f(x) and g(x) refer to two arbitrary polynomials. When both of these verification conditions are satisfied, then p1(x) is an irreducible polynomial of order n on GF(2).

[0043] Generally, we take n = 2 k Therefore, in condition (2), we only need to take d = 2. Alternatively, we can take n = 2. 7 =128. Since this method only needs to verify these two conditions, we use the Fast modular composition algorithm to quickly obtain... and use Replacement condition (2) The calculation is performed, and the result is obtained more quickly by reducing the order of the calculation.

[0044] A pre-configured polynomial can be reused multiple times, but after a period of use, the irreducible polynomial needs to be re-pre-configured to avoid the risk of polynomial information leakage. Therefore, the random numbers shared by the sender and receiver need to be updated periodically through a secure sharing method to replace the pre-configured irreducible polynomial. Optionally, the irreducible polynomial can be updated daily.

[0045] (2) The sending end determines the message M to be used. The length of message M in binary bit string form is m.

[0046] (3) The sender and receiver share the first key string and the second key string. The sharing of keys is carried out using the existing quantum key distribution protocol, which can ensure the unconditional security of the key sharing process. The sender uses its own second key string to encrypt the message. The encryption method is to perform one-time pad encryption by bitwise XOR to obtain the ciphertext. The length of the second key string is m. Then, the sender uses the first half of its own first key string as the input random number and the pre-generated irreducible polynomial to generate a hash function based on a linear feedback shift register. The ciphertext is then input into the hash function to generate the first message authentication code, which is the MAC. The sender uses the second half of its own first key string to encrypt the first message authentication code. The encryption method is to perform one-time pad encryption by bitwise XOR to obtain the encrypted first message authentication code.

[0047] The hash function based on the linear feedback shift register is a Toeplitz matrix of dimension n×m, where n is the length of the first half of the first key string and m is the length of message M, i.e., m is the length of message M in binary bit string form.

[0048] The sending end generates a Toplitz matrix based on a linear feedback shift register (LFSR) as a hash function. The Toplitz matrix based on LFSR is an n×m matrix, where m is the length of the message, which is a variable value, and n is a fixed value representing the length of the message authentication code generated after the matrix is ​​applied to the message. In other words, the Toplitz matrix based on LFSR can transform a vector of arbitrary length m, which is the message, into a vector of fixed length n, i.e., the message authentication code.

[0049] (4) The sender sends the ciphertext and the encrypted first message authentication code to the receiver;

[0050] (5) The receiving end uses the first half of its first key string as the input random number and the pre-generated irreducible polynomial to generate a hash function based on a linear feedback shift register. Then, the received ciphertext is input into the hash function to generate the second message authentication code. The receiving end then uses the second half of its first key string to decrypt the received encrypted first message authentication code to obtain the decrypted first message authentication code.

[0051] (6) The receiving end verifies whether the decrypted first message authentication code is the same as the generated second message authentication code; if they are the same, the authentication is successful, otherwise it fails.

[0052] (7) After passing, the receiving end uses its own second key string to decrypt the received ciphertext and obtain the message.

[0053] If the second key string in this embodiment is all zeros or all 1s, its encryption effect is negligible, and the entire authentication encryption method can constitute unconditionally secure authentication.

Claims

1. An authentication encryption method characterized by, The method comprises the following steps: (1) the sending end and the receiving end share a string of random numbers, thereby presetting generation of an irreducible polynomial; (2) the sending end determines a message to be used; (3) the sending end and the receiving end share a first key string and a second key string, the sending end encrypts the message by using the second key string thereof, thereby obtaining ciphertext; the sending end generates a hash function based on a linear feedback shift register by using the first key string thereof as an input random number and the preset irreducible polynomial, and then inputs the ciphertext into the hash function, thereby generating a first message authentication code; the sending end encrypts the first message authentication code by using the latter half of the first key string thereof, thereby obtaining the encrypted first message authentication code; (4) the sending end sends the ciphertext and the encrypted first message authentication code to the receiving end; (5) the receiving end generates a hash function based on a linear feedback shift register by using the first key string thereof as an input random number and the preset irreducible polynomial, and then inputs the received ciphertext into the hash function, thereby generating a second message authentication code; the receiving end decrypts the received encrypted first message authentication code by using the latter half of the first key string thereof, thereby obtaining the decrypted first message authentication code; (6) the receiving end verifies whether the decrypted first message authentication code is identical to the generated second message authentication code; if yes, authentication is passed, otherwise, authentication is not passed; (7) after authentication is passed, the receiving end decrypts the received ciphertext by using the second key string thereof, thereby obtaining the message; In step (1), the specific process of the preset generation of the irreducible polynomial is as follows: 1) first, the sending end and the receiving end each generate an n-order polynomial in a GF(2) field by using each bit of a random number to correspond to the coefficient of each term except the highest term in the polynomial, and the coefficient of the highest term is 1; 2) then, the polynomial is verified to be an irreducible polynomial, if the verification result is "no", the sending end and the receiving end share another set of random numbers generated as new random numbers to return to step 1) to regenerate the polynomial and verify; if the verification result is "yes", the verification is stopped, and the sending end and the receiving end each obtain an irreducible polynomial; The method for verifying whether the polynomial is an irreducible polynomial is as follows: Verification condition (1) (2) whether the following two conditions are simultaneously satisfied, wherein denotes the remainder of xmodp1(x) is the same, gcd(f(x), g(x)) denotes the greatest common divisor of f(x) and g(x) on GF(2), f(x) and g(x) denote two arbitrary polynomials, and when the two verification conditions are simultaneously satisfied, p1(x) is an irreducible polynomial of order n on GF(2).

2. The method of claim 1, wherein: In step (3), the encryption mode is a one-time pad by using bit-wise XOR.

3. The method of claim 1, wherein: Before step 1), if the last bit of the random number is 0, the last bit of the random number is set to 1; or if the last bit of the random number is 0, the random number is regenerated until the last bit of the generated random number is 1.

4. The method of claim 1, wherein: In step (3), the hash function based on the linear feedback shift register is a Toeplitz matrix with a dimension of n x m, wherein n is the length of the former half of the first key string, and m is the length of the message.

5. The method of claim 1, wherein: In step (1), the random number shared by the sending end and the receiving end is shared by a safe sharing mode and is regularly updated.

6. The method of authenticated encryption of claim 5, wherein: The safe sharing mode comprises quantum key distribution or safe distribution of quantum random numbers.

7. The method of claim 1, wherein: In the step (3), the shared second key string is data of all zeros or all ones, i.e., constitutes an unconditionally secure authentication.

Images