RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning

Abstract

The present invention relates to an RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning. The analysis process of the evaluation method is based on a deep belief network structure of intelligent reinforcement learning. The structure uses a fully connected neural network structure of a basic Boltzmann machine structure to process RSA-OAEP ciphertext samples. Under the optimization effect based on a dual-feature driven model, the optimal structure of the deep belief network is obtained, thereby forming an approximate distribution description of the input samples in the hidden layer. The learned deep belief network structure is integrated with the indistinguishability semantic security rule, so as to quantitatively realize the indistinguishability evaluation in the RSA-OAEP semantic analysis process and obtain the indistinguishability probability of the current RSA-OAEP algorithm instance.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer data security protection, relates to the field of data encryption algorithm analysis, and particularly to an RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning. Background Art

[0002] Under the framework of provable security, even if a secure cryptographic algorithm can be manually reduced to a one-way trapdoor permutation problem that is recognized to be difficult, the process is affected by many factors. If there is an implementable algorithm (polynomial complexity algorithm) that can accumulate these uncontrollable factors or find clues that have a qualitative change in the security of the algorithm, then the provably secure reduction process is only of theoretical significance. Currently, RSA-OAEP is one of the mainstream algorithms for public key cryptography. Its IND-CCA2 security reduction process requires that the ciphertext c* is completely random, the inverse transformation of RSA is difficult everywhere, and the two random oracles G and H are uniform everywhere and the polynomial algorithm cannot find collisions. Then, when a set of legal parameters is selected and used to implement a cryptographic algorithm that meets provable security, it is impossible to ensure that all of the above factors are met. Therefore, in the algorithm instance, there is still a lack of a quantitative measurement process that connects provable security and the security of the analytical model of the algorithm instance.

[0003] The security proof or evaluation of cryptographic systems is an important step in the design of cryptographic algorithms. Provable security theory is a classical theoretical method with universal applicability (manual proof method). Correspondingly, the analysis of cryptographic algorithms is instantiated, and methods such as protocol semantic transformation and observation equivalence are used to design automated security verification models with the assistance of computer verification algorithms. The latter method is an important practical guarantee for the security evaluation of cryptographic systems by verifying the security of high-level encapsulation systems of cryptographic primitives. Many standard public key cryptographic algorithms and security protocols can already achieve algorithm security verification through automated provers such as Coq, Certicrypt, CryptoVerif, and HACL.

[0004] Public key cryptography is an important area of ​​modern cryptographic design. The security assessment of cryptographic algorithms not only uses provable security methods to prove the theoretical security level from the algorithm semantics, but also verifies the security strength of cryptographic algorithm instances through automated security assessment methods. The latter aspect focuses on the following factors:

[0005] (1) RO model assumption problem. The security of the current public key cryptographic system is based on the RO model assumption, which requires that the hash function is ideal and satisfies the uniformity, completeness and collision-free properties of the black box function. At present, this cannot be achieved in cryptographic algorithm examples.

[0006] (2) Incomplete randomness of the one-way trapdoor permutation result. The encapsulation scheme of the public key cryptographic algorithm requires that the generated ciphertext is uniformly randomly distributed, that is, in polynomial time, it is difficult to statistically distinguish the ciphertext generated by the same random source in the algorithm.

[0007] (3) Defects in the selection of encapsulation parameters. When encapsulating the algorithm, the operation program will process multiple algorithm parameters, such as random auxiliary parameters, security parameters, key parameters, padding parameters, and intermediate results of the encryption and decryption programs. The use of these parameters may lead to the generation of statistical laws, thereby causing the leakage of side channel information.

[0008] (4) Security threats caused by the accumulation and combination of multiple factors under the analyst's adaptive conditions. With the assistance of modern artificial intelligence algorithms, the analyst's ability to design analytical algorithms has been greatly enhanced. There are many automated methods to assist in searching for the optimal analytical path, as well as finding the implicit features of algorithm instances, and automatically optimizing the combination of multiple feature points to achieve a better analytical method.

[0009] The above factors are generally lacking in the evaluation of practical public key cryptographic algorithms, which has led to the long-term independent development of the theoretical design of public key cryptography and practical security verification, and it is difficult to effectively integrate and coordinate. Public key cryptographic analysis technology based on certain security assumptions (for example, one-way trapdoor permutation or ideal hash function) is a systematic and complex problem. There are many factors that affect security characteristics. It is possible that the analyst's analytical advantages cannot be fully utilized by isolating each participating component.

[0010] The emergence of reinforcement learning technology based on deep neural networks has provided a powerful and convenient tool for simplifying password analysis and a new idea for solving the above problems. Reinforcement learning technology based on deep neural networks does not require the establishment of a mathematical model for a certain vulnerability in advance. Instead, it automatically finds and amplifies the statistical characteristics of the algorithm from the explicit or implicit features collected from the operation of the public key cryptographic algorithm, and establishes a statistical quantitative relationship with the analysis target, thereby providing convenient technical support for the automated analysis of cryptographic algorithms.

[0011] In summary, for the current mainstream public key cryptography algorithm RSA-OAEP, a more complete RSA-OAEP ciphertext indistinguishability assessment method is urgently needed. Summary of the invention

[0012] Technical issues to be solved

[0013] In order to avoid the shortcomings of the prior art, the present invention proposes an RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning to solve one or more of the above-mentioned technical problems. The present invention proposes an RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning, which combines the completeness of public key cryptographic semantic security analysis and the operability of deep learning methods, and combines deep learning technology with the indistinguishability evaluation of ciphertext distribution, ensuring the effectiveness of theory and the feasibility of practice.

[0014] Technical Solution

[0015] A RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning is characterized by the following steps:

[0016] Step 1: Construct a deep belief network based on the Boltzmann mechanism, select the maximum depth of the neuron connection relationship E as d, set the maximum input width as n, and initialize the target feature set F1, F2 to be input;

[0017] The deep belief network is represented as DBN(n, d, E, θ1, θ2), which is used to carry the distribution parameters of the input sample feature set;

[0018] Step 2: Preprocess the statistical points of the RSA-OAEP algorithm instance to obtain the compressed original features of the samples as the target feature set F1, F2 to be input into the deep belief network;

[0019] The process is:

[0020] (2.1) Analyst Select plaintext b (supervision value) and input noise N;

[0021] (2.2) Calculate the plaintext mask Mask_b and the noise mask Mask_N, and input them into the RSA-OAEP running instance, where Mask_b and Mask_N come from the output of the hash function instance in the RSA-OAEP algorithm. The resulting data set is S = {c, Mask_b, Mask_N, N; b} B , where B is the analyst Upper bound on the number of execution times of encryption operations in polynomial time;

[0022] (2.3) Compress each set s∈S into a Euclidean vector space with a smaller dimension without losing features as much as possible. The method is to expand the vector using the Gaussian kernel, then project and compress it on some dimensions to obtain the target feature set F1, F2 to be input;

[0023] Step 3: Optimize the parameter set (θ1, θ2) of the deep belief network driven by (F1, F2) to obtain an intelligent reinforcement learning model for RSA-OAEP;

[0024] Step 4: Implement IND-CCA2 indistinguishability analysis of the RSA-OAEP algorithm instance:

[0025] Step 4.1: Initialize RSA-OAEP algorithm parameters: select security parameter k and pseudo-random source r, initialize one-way trapdoor permutation function RSA←RSA(1 k ,r); then select the padding length parameters p0,p1, satisfying p0+p1≤k, and and is a sufficiently small quantity; construct a family of hash functions H i,j :{0,1} i →{0,1} j , where i≤k-p0, j≤p1; finally, (pk,sk)←Gen(RSA,1 k ,r) as the user's public key and private key;

[0026] Step 4.2, RSA-OAEP algorithm encryption machine query: for message m∈{0,1} i , the encryption machine runs the encryption algorithm and obtains the corresponding ciphertext c;

[0027] Step 4.3, RSA-OAEP algorithm decryption machine query: For the ciphertext c, the decryption machine runs the decryption algorithm to obtain the corresponding plaintext m;

[0028] Step 4.4: Use the intelligent reinforcement learning model for RSA-OAEP established in steps 1 to 3 to learn the generated plaintext and ciphertext pairs, and output the evaluation probability of the current RSA-OAEP indistinguishability.

[0029] The optimization of the parameter set (θ1, θ2) of the deep belief network is:

[0030] (1) Initialize the DBN parameters (θ1, θ2) with W and a to describe the distribution of input data, where W is the DBN weight matrix and a is the bias coefficient for each hidden layer;

[0031] (2) Driven by F1 and F2, the (θ1, θ2) of each hidden layer of DBN is calculated to update the distribution parameters of the input set.

[0032] Step 4.2: First, encapsulate the plain text: Satisfy |m0|+|m1|≤k; then calculate the ciphertext: c←Enc(RSA,pk,m0||m1).

[0033] Step 4.3: First, calculate the inverse permutation of the ciphertext: m0||m1←Dec(f -1 ,c,sk); then decapsulate the plain text:

[0034] The step 4.4 is divided into the following seven steps:

[0035] Step 4.4.1, RSA-OAEP algorithm initiator Run the initialization algorithm Init OAEP (1 k ), and randomly selects trapdoor RSA(1 k ) and key pk * Send to Analyst

[0036] Step 4.4.2: Analyst Adaptive construction M={m0,m1,…,m q}, where m i ∈{0,1}, and calculate C={c0,c1,…,c q}, where c i ←Enc OAEP (m i ,pk,r i ), satisfying 0≤i≤q, and sending C to

[0037] Step 4.4.3. Analyst Construct a ciphertext classifier based on the learning model of steps 1 to 3 And create two query queues Q0, Q1:

[0038] Q1: Analyst Randomly select m i ∈M, calculate c i ←Enc OAEP (m i ,pk,r q+i )Towards Do a decryption query. If CL(c i )=1, then enter the next query, otherwise enter Q0;

[0039] Q0: Analyst c i Add to C, update the learning model

[0040] Step 4.4.4, for c i ∈C, Run m i ←Dec OAEP (c i,sk), and the plaintext and ciphertext pair S = {<c i ,m i >}Return

[0041] Step 4.4.5 Randomly select m * ←{0,1}, run c * ←Enc OAPE (m * ,pk,r * ) and send it to where r * ←r;

[0042] Step 4.4.6: Under the conditions, and Repeat steps 4.4.2 to 4.4.4.

[0043] Step 4.4.7. Analyst After the above steps are completed, the indistinguishability probability of the RSA-OAEP algorithm instance is calculated as:

[0044]

[0045] Beneficial Effects

[0046] The present invention proposes an RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning. The analysis process of the evaluation method is based on a deep belief network structure of intelligent reinforcement learning. The structure uses a fully connected neural network structure of a basic Boltzmann machine structure to process RSA-OAEP ciphertext samples. Under the optimization effect based on a dual-feature driven model, the optimal structure of the deep belief network is obtained, thereby forming an approximate distribution description of the input samples in the hidden layer. The learned deep belief network structure is integrated with the indistinguishability semantic security rules, so as to quantitatively realize the indistinguishability evaluation in the RSA-OAEP semantic analysis process and obtain the indistinguishability probability of the current RSA-OAEP algorithm instance.

[0047] A further improvement of the present invention is that a more efficient and accurate method is used to compress the features of the samples during data preprocessing; and a dynamic search of parameters of a deep belief network is used when establishing a deep neural network structure to improve the efficiency of training.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] Existing indistinguishability evaluations of RSA-OAEP public key cryptographic algorithms all use methods such as theoretical analysis and traditional randomness testing, which have relatively obvious limitations and incompleteness in practice. The present invention uses intelligent reinforcement learning technology to instantiate a method for provably secure interactive analysis processes, and performs an automated quantitative evaluation of the RSA-OAEP public key encryption algorithm that semantically complies with indistinguishability security. It is found that different algorithm instances will produce a relatively obvious deviation in attack advantage when the theoretical security is also met, that is, when the advantage of successful attack is negligible based on security parameters. Given the attacker's capabilities, different instance evaluation results lead to different security strengths.

[0050] In order to efficiently distinguish the security strength of different algorithms, the present invention introduces an automated classification model based on a deep learning structure, and by modulating different parameter combinations, partially amplifies the heterogeneous characteristics in RSA-OAEP encapsulation and hash function calls, thereby more clearly distinguishing ciphertext samples from different encryption schemes from the attacker's perspective. The corresponding example operation results verify the feasibility and effectiveness of the automated evaluation method of the present invention. The invention provides a new method support for the quantitative evaluation of the RSA-OAEP public key cryptographic algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 :Comparison of the discrimination probability of RSA-OAEP algorithm under different random source conditions

[0052] Figure 2 :Comparison of the discrimination probability of RSA-OAEP algorithm under different hash functions DETAILED DESCRIPTION

[0053] The present invention will now be further described with reference to the embodiments and the accompanying drawings:

[0054] The analysis process of the evaluation method is based on the deep belief network structure of intelligent reinforcement learning. The structure uses a fully connected neural network structure of the basic Boltzmann machine structure to process the ciphertext samples of RSA-OAEP; under the optimization based on the dual-feature driven model, the optimal structure of the deep belief network is obtained, thereby forming an approximate distribution description of the input samples in the hidden layer; the learned deep belief network structure is integrated with the indistinguishability semantic security rules, which can quantitatively realize the indistinguishability evaluation in the RSA-OAEP semantic analysis process and obtain the corresponding indistinguishability probability.

[0055] During data preprocessing, the method of projecting data in different dimensions is used to compress the features of the samples. When establishing the deep neural network structure, a deep belief network is used to perceive and judge the statistical heterogeneity of samples from different inputs. A hidden layer output process with a simplified structure is designed to improve efficiency. A parameter update method is designed in the hidden layer to express the approximate distribution of sample features. The intelligent reinforcement learning model is integrated into the semantic security challenge process of RSA-OAEP to calculate the indistinguishability probability.

[0056] An RSA-OAEP ciphertext indistinguishability assessment method based on intelligent reinforcement learning according to an embodiment of the present invention is a deep belief network structure based on intelligent reinforcement learning. The structure uses a fully connected neural network structure of a basic Boltzmann machine structure to process RSA-OAEP ciphertext samples. Under the optimization effect based on a dual-feature driven model, the optimal structure of the deep belief network is obtained, thereby forming an approximate distribution description of the input samples in the hidden layer. The learned deep belief network structure is integrated with the indistinguishability semantic security rules, so as to quantitatively realize the indistinguishability assessment in the RSA-OAEP semantic analysis process, and calculate the corresponding indistinguishability probability.

[0057] An RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning according to an embodiment of the present invention comprises the following specific steps:

[0058] Step 1, preprocess the statistical points of the RSA-OAEP algorithm instance to obtain the compressed sample original features (F1, F2) with a dimension of 512;

[0059] Step 2: Establish a deep neural network structure with a maximum depth of 784 as a model for intelligent reinforcement learning. The model is based on a deep belief network constructed by the Boltzmann mechanism.

[0060] Step 3, initialize the parameter set (θ1, θ2) with Gaussian distribution noise, and optimize the parameter set (θ1, θ2) of the deep belief network driven by (F1, F2);

[0061] Step 4: Implement IND-CCA2 indistinguishability analysis of the RSA-OAEP algorithm instance; wherein the analysis process includes:

[0062] Initialize the RSA-OAEP algorithm parameters, that is, select the security parameter k = 512 and the Gaussian distribution pseudo-random source r, initialize the one-way trapdoor permutation function RSA←RSA(1 k ,r); RSA-OAEP algorithm encryption machine query, that is, for message m∈{0,1} i, the encryption machine runs the encryption algorithm to obtain the corresponding ciphertext c; the RSA-OAEP algorithm decryption machine queries, that is, for the ciphertext c, the decryption machine runs the decryption algorithm to obtain the corresponding plaintext m; according to steps 1 to 3, an intelligent reinforcement learning model for RSA-OAEP is established, and the total number of generated k / 14 The plaintext and ciphertext pairs are learned and the evaluation probability of the current RSA-OAEP indistinguishability is output.

[0063] In the method of the embodiment of the present invention, the step 1 specifically includes the following steps:

[0064] (1) Analyst Select plaintext b∈{0,1} (supervision value) and input random noise N from Gaussian distribution;

[0065] (2) Calculate the plaintext mask Mask_b and the noise mask Mask_N, and input them into the RSA-OAEP running instance, where Mask_b and Mask_N come from the output of the hash function SHA-1 instance. The resulting data set is S = {c, Mask_b, Mask_N, N; b} B , where B = 50000 is The average number of times the RSA-OAEP algorithm is run in a single thread for 1 hour;

[0066] (3) Compress each group s∈S into a Euclidean vector space with a smaller dimension without losing features as much as possible. The method is to use the Gaussian kernel of the vector to expand it, then project and compress it on some dimensions to obtain features F1 and F2. The kernel function uses the RBF function, the penalty factor is 0.5, and the kernel function amplitude is 2 / (|F1|+|F2|). The calculation compression process is as follows:

[0067] Assume that the upper limit of the number of F1 and F2 is n1=512 and n2=256 respectively, let s={c||Mask_b||Mask_N||N||b}, and convert s into a binary vector, that is

[0068]

[0069] Then, let F1||F2={f i} n , calculate

[0070] where 1≤j≤|F1|+|F2|,

[0071] Then the set {(s″;b)} B As compressed drive data.

[0072] In the method of the embodiment of the present invention, the step 2 specifically includes the following steps:

[0073] (1) Select the neuron connection relationship E, set the maximum input width to n = n1 + n2 = 768, select the maximum depth of E to d = 256, and initialize the target feature set F1, F2 to be input;

[0074] (2) Construct a deep belief network based on the Boltzmann mechanism, denoted as DBN(n,d,E,θ1,θ2), which is used to carry the distribution parameters of the input sample feature set. Each hidden layer is,

[0075]

[0076] Among them, v is the data item of the input layer, h i is the state value of each hidden layer, W is the weight matrix of the model, a is the bias coefficient for each hidden layer, 1<i≤d. After training the model, the approximate distribution of the input v is obtained and implicit in each hidden layer.

[0077] In the method of the embodiment of the present invention, step 3 specifically includes:

[0078] (1) Use W and a to initialize the DBN parameters (θ1, θ2) to describe the distribution of input data, where W is the weight matrix of the model and a is the bias coefficient for each hidden layer.

[0079]

[0080] (2) Driven by F1 and F2, the (θ1, θ2) of each hidden layer of DBN is calculated, and the distribution of each hidden layer is calculated as

[0081]

[0082] Final Order

[0083] F1||F2=h d ,

[0084] Among them, σ is the activation function, and the result is repeatedly fed back to the first hidden layer, and then the above steps of updating θ1, θ2 are repeated to complete the update of the distribution parameters of the input set.

[0085] In the method of the embodiment of the present invention, step 4 specifically includes:

[0086] (1) Initialize the RSA-OAEP algorithm parameters, that is, select the security parameter k = 512 and the Gaussian distribution random source r, and initialize the one-way trapdoor permutation function RSA←RSA(1 k ,r), then select the padding length parameters p0=40,p1=472; calculate the hash function family Hi,j :{0,1} i →{0,1} j , where i≤k-p0, j≤p1; finally, (pk,sk)←Gen(RSA,1 k ,r) as the user's public key and private key;

[0087] (2) RSA-OAEP algorithm encryption machine query, that is, for message m∈{0,1} i , the encryption machine runs the encryption algorithm to obtain the corresponding ciphertext c. The process is divided into two steps:

[0088] 1) Plain text encapsulation: Satisfies |m0|+|m1|≤k;

[0089] 2) Calculate the ciphertext: c←Enc(RSA,pk,m0||m1).

[0090] (3) RSA-OAEP algorithm decryption machine query, that is, for the ciphertext c, the decryption machine runs the decryption algorithm to obtain the corresponding plaintext m. This process is divided into two steps:

[0091] 1) Calculate the inverse permutation of the ciphertext: m0||m1←Dec(f -1 ,c,sk);

[0092] 2) Plaintext decapsulation:

[0093] (4) According to steps 1 to 3 of the method of the present invention, an intelligent reinforcement learning model for RSA-OAEP is established, the generated plaintext and ciphertext pairs are learned, and the evaluation probability of the current RSA-OAEP indistinguishability is output. The process is implemented according to the following 7 steps:

[0094] 1)RSA-OAEP algorithm initiator Run the initialization algorithm Init OAEP (1 k ), and randomly selects trapdoor RSA(1 k ) and key pk * Send to Analyst

[0095] 2) Adaptive construction M={m0,m1,…,m q}, where m i ∈{0,1}, and calculate C={c0,c1,…,c q}, where c i ←Enc OAEP (m i ,pk,r i), satisfying 0≤i≤q, and sending C to

[0096] 3) Construct a ciphertext classifier based on the learning model of steps 1 to 3 And create two query queues Q0, Q1:

[0097] Q1: Randomly select m i ∈M, calculate c i ←Enc OAEP (m i ,pk,r q+i )Towards Do a decryption query. If CL(c i )=1, then enter the next query, otherwise enter Q0;

[0098] Q0: c i Add to C, update the learning model

[0099] 4) For c i ∈C, Run m i ←Dec OAEP (c i ,sk), and the plaintext and ciphertext pair S = {<c i ,m i >}Return

[0100] 5) Randomly select m * ←{0,1}, run c * ←Enc OAPE (m * ,pk,r * ) and send it to where r * ←r;

[0101] 6) In Under the conditions, and Repeat steps 2) to 4).

[0102] 7) After the above steps are completed, the indistinguishability probability of the RSA-OAEP algorithm instance is calculated as:

[0103]

[0104] The beneficial effect of the method of the embodiment of the present invention is that: by instantiating the provable security theory of cryptographic algorithms, the semantic security evaluation of the RSA-OAEP algorithm instance is integrated with the deep learning technology, and the RSA-OAEP public key encryption algorithm that semantically complies with indistinguishability security is automatically quantitatively evaluated, thereby evaluating the performance deviation of different algorithm instances in indistinguishability under the condition of satisfying theoretical indistinguishability. Under the given analyst's computing power, different instance evaluation results show different security strengths.

[0105] In order to efficiently distinguish the security strength of different algorithms, the inventive method introduces an automated classification model based on a deep learning structure, and by modulating different parameter combinations, partially amplifies the heterogeneous characteristics in RSA-OAEP encapsulation and hash function calls, thereby more clearly distinguishing ciphertext samples from different algorithm instances from the analyst's perspective. The corresponding example operation results verify the feasibility and effectiveness of the automated evaluation method in this paper.

[0106] The main indicator for examining the invention method is the significance of the probability of distinction; a corresponding RSA-OAEP algorithm analysis example is designed for the function of the evaluation method of the invention to perform functional testing. The computing unit of the analysis example includes an analysis agent node (Core i7@2.6GHz, 16GBytes Ram) for interacting with the initiator of RSA ciphertext analysis (Core i5@3.4GHz, 8GBytes Ram), a computing node (Xeon Silver 4110@2.1GHz*2, GTX 2080*2, 32GBytes Ram) for running the feature extraction model, and a computing node (Xeon Silver 4110@2.1GHz*2, GTX2080*2, 32GBytes Ram) for running the classification model. The library files that the model depends on are scikit-learn and pytorch.

[0107] The feature extraction model consists of a fully connected compressed neural network DBN, with a dynamic depth setting, a minimum of three layers, and a maximum of 50% layers determined by the number of features |F1|+|F2|. The compression rate of each layer is 50%, and the activation function of the model hidden layer is ReLU, and the output is normalized. The output layer is activated by Softmax. Each layer of input features selectively discards 50% of the parity of the output of the previous layer, and in each round of iteration, the parity of the output of each layer of the current model is selected according to the scale of Q1 to strengthen the sample features implied by the model input.

[0108] The feature classification model is constructed by a high-dimensional support vector machine model. After a large number of hyperparameter optimization tests, RBF is selected as the kernel function, the penalty factor is set to 0.5, the kernel function amplitude is 2 / (|F1|+|F2|), and other hyperparameters use the default settings in the library file (scikit-learn). The model scale parameters are shown in Table 1, and the model safety parameters are shown in Table 2.

[0109] Table 1 Model parameter configuration

[0110]

[0111] Table 2 Security parameter configuration

[0112]

[0113] In order to verify the effectiveness of the method, two sets of indistinguishability analysis processes were designed. Different security parameters and security component settings were used when the RSA initiator initialized the algorithm. The sensitivity of the proposed method to the parameter settings was tested by comparing the results, thereby indirectly verifying whether the public key algorithm instance meets the expected semantic security model under multiple parameter settings.

[0114] The randomness of the RSA-OAEP encryption result is the core factor to ensure the semantic security of indistinguishability. The randomness is determined by the random source used when executing the algorithm, the performance of the hash function, and the switching network based on the Feistel structure. This example conducts comparative tests based on different random sources and hash functions, such as Figure 1 and Figure 2 . Figure 1 The relationship between the IND-CCA2 attacker advantage and query size of the RSA-OAEP algorithm under three random source usage methods, Figure 2 The relationship between the IND-CCA2 attacker advantage and query size of the RSA-OAEP algorithm under three hash function replacements. The above results show that in the case of single-bit plaintext, the analyst has a certain measurable advantage.

[0115] exist Figure 1 In the results, RSA-OAEP encryption uses the SHA-3 hash function as an ideal random oracle to confuse the plaintext, and uses a fixed initial vector seed, a linear congruential generator, and an intermittently reused linear congruential generator as random sources to verify the effectiveness of the evaluation method in different security environments. Obviously, the fixed initial vector seed has the greatest impact on indistinguishable security, and at the same time, reusing random numbers will also weaken indistinguishable security to a certain extent. Figure 2In the RSA-OAEP encryption, the system default linear congruential generator is used as the random source, and different hash functions are replaced to verify the impact of the reliability of the random oracle model on the security of the algorithm. Figure 2 The results show that different hash functions have a greater impact on the indistinguishability characteristics. The plaintext obfuscation method that uses a simple checksum as a hash function has accumulated a relatively obvious analysis advantage for analysts. The hash function security performance of the MD5 algorithm is lower than that of the SHA-3 algorithm, but its accurate performance comparison requires a larger learning sample size. In addition, Figure 2 The results show that the effect of the hash function on indistinguishability is significantly more sensitive than the effect of the random source on security.

[0116] In the method of the embodiment of the present invention, the symbol explanation comparison is shown in Table 3.

[0117] Table 3. Symbol comparison table

[0118]

[0119] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of complete software embodiments or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0120] The above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, a person skilled in the art can still modify or make equivalent substitutions to the specific implementations of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention are within the scope of protection of the claims of the present invention to be approved.

Claims

1. A RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning, characterized in that Here are the steps: Step 1: Construct a deep belief network based on the Boltzmann mechanism, select the maximum depth of the neuron connection relationship E as d, set the maximum input width as n, and initialize the target feature set F1, F2 to be input; The deep belief network is represented as DBN(n, d, E, θ1, θ2), which is used to carry the distribution parameters of the input sample feature set; Step 2: Preprocess the statistical points of the RSA-OAEP algorithm instance to obtain the compressed original features of the samples as the target feature set F1, F2 to be input into the deep belief network; The process is: (2.1) Analyst Select plaintext b as the supervision value and input noise N; (2.2) Calculate the plaintext mask Mask_b and the noise mask Mask_N, and input them into the RSA-OAEP running instance, where Mask_b and Mask_N come from the output of the hash function instance in the RSA-OAEP algorithm. The resulting data set is S = {c, Mask_b, Mask_N, N; b} B , where B is the analyst Upper bound on the number of execution times of encryption operations in polynomial time; (2.3) Compress each set s∈S into a Euclidean vector space with a smaller dimension without losing features as much as possible. The method is to expand the vector using the Gaussian kernel, then project and compress it on some dimensions to obtain the target feature set F1, F2 to be input; Step 3: Optimize the parameter set (θ1, θ2) of the deep belief network driven by (F1, F2) to obtain an intelligent reinforcement learning model for RSA-OAEP; Step 4: Implement IND-CCA2 indistinguishability analysis of the RSA-OAEP algorithm instance: Step 4.1: Initialize RSA-OAEP algorithm parameters: select security parameter k and pseudo-random source r, initialize one-way trapdoor permutation function RSA←RSA(1 k ,r); then select the padding length parameters p0,p1, satisfying p0+p1≤k, and and is a sufficiently small quantity; construct a family of hash functions H i,j :{0,1} i →{0,1} j , where i≤k-p0, j≤p1; finally, (pk,sk)←Gen(RSA,1 k ,r) as the user's public key and private key; Step 4.2, RSA-OAEP algorithm encryption machine query: for message m∈{0,1} i , the encryption machine runs the encryption algorithm and obtains the corresponding ciphertext c; Step 4.3, RSA-OAEP algorithm decryption machine query: For the ciphertext c, the decryption machine runs the decryption algorithm to obtain the corresponding plaintext m; Step 4.4: Use the intelligent reinforcement learning model for RSA-OAEP established in steps 1 to 3 to learn the generated plaintext and ciphertext pairs, and output the evaluation probability of the current RSA-OAEP indistinguishability.

2. The RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning according to claim 1 is characterized by: The optimization of the parameter set (θ1, θ2) of the deep belief network is: (1) Initialize the DBN parameters (θ1, θ2) with W and a to describe the distribution of input data, where W is the DBN weight matrix and a is the bias coefficient for each hidden layer; (2) Driven by F1 and F2, the (θ1, θ2) of each hidden layer of DBN is calculated to update the distribution parameters of the input set.

3. The RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning according to claim 1 is characterized in that: Step 4.2: First, encapsulate the plain text: Satisfy |m0|+|m1|≤k; then calculate the ciphertext: c←Enc(RSA,pk,m0||m1).

4. The RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning according to claim 1 is characterized in that: Step 4.3: First, calculate the inverse permutation of the ciphertext: m0||m1←Dec(f -1 ,c,sk); then decapsulate the plain text:

5. The RSA-OAEP ciphertext indistinguishability evaluation method based on intelligent reinforcement learning according to claim 1 is characterized in that: The step 4.4 is divided into the following seven steps: Step 4.4.1, RSA-OAEP algorithm initiator Run the initialization algorithm Init OAEP (1 k ), and randomly selects trapdoor RSA(1 k ) and key pk * Send to Analyst Step 4.4.2: Analyst Adaptive construction M={m0,m1,…,m q }, where m i ∈{0,1}, and calculate C={c0,c1,…,c q }, where c i ←Enc OAEP (m i ,pk,r i ), satisfying 0≤i≤q, and sending C to Step 4.4.

3. Analyst Construct a ciphertext classifier based on the learning model of steps 1 to 3 And create two query queues Q0, Q1: Q1: Analyst Randomly select m i ∈M, calculate c i ←Enc OAEP (m i ,pk,r q+i )Towards Do a decryption query. If CL(c i )=1, then enter the next query, otherwise enter Q0; Q0: Analyst c i Add to C, update the learning model Step 4.4.4, for c i ∈C, Run m i ←Dec OAEP (c i ,sk), and the plaintext and ciphertext pair S = {<c i ,m i >}Return Step 4.4.5 Randomly select m * ←{0,1}, run c * ←Enc OAPE (m * ,pk,r * ) and send it to where r * ←r; Step 4.4.6: Under the conditions, and Repeat steps 4.4.2 to 4.4.4; Step 4.4.

7. Analyst After the above steps are completed, the indistinguishability probability of the RSA-OAEP algorithm instance is calculated as:

Images