A deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks

Abstract

The present invention belongs to the technical field of cryptographic privacy protection, and more specifically, to a deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks. In the encryption algorithm of the method of the present invention, the operation performed at the "0" bit position in the encrypted random number s is exactly the same as the operation performed at the "1" bit position in the encrypted random number s, which makes the energy, time consumption, or cache access and other side channel information generated by the method of the present invention when running the encryption algorithm will not leak any bit knowledge about s, so even if a forced attacker uses simple energy analysis attacks, time attacks and cache attacks and other side channel attack means, it is impossible to destroy the deniability of the method of the present invention. In addition, due to the use of a public key encryption scheme based on modular fault-tolerant learning, the method of the present invention can resist possible quantum computing attacks, so the method of the present invention is also a post-quantum deniable public key encryption method.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic privacy protection, and more specifically, to a deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks. Background Art

[0002] Deniable public key encryption is a type of public key encryption primitive for coercive attackers. It allows the coerced sender to generate "fake" (but legitimate-looking) random values ​​during encryption, so that for some encrypted communications that have been executed, the ciphertext can be opened as another plaintext message (not the original message). At present, many deniable public key encryption schemes based on different cryptographic primitives have been proposed. Chen Xiaofeng et al. proposed a deniable encryption method based on a decryption controllable public key encryption scheme, Cao Yanmei et al. proposed a deniable public key encryption scheme supporting message authentication based on bilinear pairings, Gao Chongzhi et al. proposed a deniable encryption scheme that is secure against chosen ciphertext attacks, and Sun Long et al. proposed a deniable public key encryption scheme based on the quadratic remainder problem and a trusted third party. However, the security of these existing schemes is based on traditional number theory problems, so they will no longer be secure under possible quantum computing attacks in the future. The existing post-quantum deniable public key encryption schemes are the attribute encryption scheme based on fault-tolerant learning proposed by Liu Fenghao et al., the sender deniable scheme based on fault-tolerant learning proposed by Wu Wenyuan et al., and the bidirectional deniable scheme based on modular fault-tolerant learning. However, the above schemes are not resistant to some common side channel attacks, such as simple energy analysis attacks, timing attacks, and cache attacks. Therefore, malicious forced attackers can perform side channel analysis on applications containing these schemes to steal data and endanger the security of the entire system. There is currently no post-quantum deniable public key encryption scheme that is resistant to side channel attacks.

[0003] Side channel attacks refer to the ability of an adversary to recover part or all of the key and obtain secret information inside the system by passively or actively detecting the side channel information (physical quantities) of a cryptographic device, such as energy and clock cycle consumption, cache access hit rate, etc. Since cryptographic devices or interfaces are usually deployed in a relatively comprehensive software / hardware environment, how to detect and resist possible side channel attacks is a core issue that must be faced in the practical application of cryptographic algorithms or protocols. Summary of the invention

[0004] In order to overcome the defects in the above-mentioned prior art, the present invention provides a deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks, which still supports sender deniability under some basic side channel attacks, and the encrypted public and private keys and ciphertext sizes are relatively small.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: a deniable public key encryption method based on modular fault-tolerant learning and anti-side channel attack, comprising the following steps:

[0006] S1. Key generation algorithm: Generate the public and private keys (dpk, dsk) of the public key encryption scheme E based on modular fault-tolerant learning;

[0007] S2. Encryption algorithm: Input comes from a legitimate plaintext domain To encrypt a message m, first sample a uniformly random bit string s=(s1,…,s n )∈{0,1} n , the subscript set of the "1" and "0" bits in s is recorded as and like If the value is not set, resample; otherwise, use a public pseudo-random generator Select Then, for all i∈[n], perform the following operations to generate n ciphertext pairs: i =0, sampling mask message and 4 random numbers r i (3) , In the above description c′ = l c +l pad , l c is the ciphertext field of scheme E The length of l pad is a fixed positive integer fill value, is the random number field of scheme E; let Using a public hash function To calculate m i Hash value Using dpk and random number r i (4) , use the encryption algorithm in scheme E to encrypt m i ||h i In addition, using dpk and random number r i (3) , using the encryption algorithm in scheme E to encrypt Get another ciphertext Finally, let the ciphertext pair at position i be If i =1, first determine whether i=t, if so, let m i = m; otherwise, randomly sample masked messages and 4 random numbers r i (1) , Then, use calculate Next, use dpk and random number r i (1) , use the encryption algorithm in scheme E to encrypt m i ||h i ,get make In addition, using dpk and random number r i (3) , using the encryption algorithm in scheme E to encrypt get Let the ciphertext pair at position i be The ciphertext obtained by encrypting the message m using this deniable public key encryption method is c = (c1,…,c n );

[0008] S3. Decryption algorithm, input ciphertext c = (c1,…,c n ), first define an all-“0” bit string s=(s1,…,s n )=(0,…,0)∈{0,1} n , for all i∈[n], perform the following operations to decrypt c: i Parsed into two sub-ciphertexts Then, use dsk to decrypt using the decryption algorithm in solution E Get R, if R = ⊥, it means decryption failed, then let s i =0; otherwise, calculate Then, use dsk to decrypt using the decryption algorithm in solution E Get m i ||h i , if m i ||h i =⊥or Then let s i =0; otherwise, let s i = 1; Finally, use the public pseudo-random generator Select a "1" bit in s at position t; use this deniable public key encryption method to decrypt the ciphertext c and obtain the plaintext m t ;

[0009] S4. Forgery algorithm: Input the original message m, the internal random number used to encrypt the message m Fake news Perform the following operations to generate a fake random number: Let s′ = (s′1,…,s′ n )=(s1,…,st-1 ,0,s t+1 ,…,s n ), ′ The subscript set of the "1" bit and the "0" bit is recorded as and like Output "forgery failed" and shut down; otherwise, use Select element t′ in; then, for all i∈[n]: if make like make If i = t, random sampling make Finally, the forged internal random number is output as

[0010] In the present invention, an auxiliary bit string s is used in the deniable encryption algorithm, and n ciphertext pairs are generated according to the pattern of n bits in s, one of which is the encrypted ciphertext about the real message m, and the remaining n-1 pairs are masked ciphertexts. Specifically, at the "0" bit position, a random ciphertext is generated, and a random number is encrypted using the public key encryption scheme E based on modular fault-tolerant learning, and the result is used as another ciphertext. At the "1" bit position, a random message or a real message is encrypted using E, and the encryption result is XORed with a random number, and the result is used as a ciphertext, and then E is used to encrypt the random number acting in the XOR process, and the result is used as another ciphertext. In addition, in order to enable the recipient to successfully decrypt, when using E to encrypt a random message or a real message, the hash value of the message will also be encrypted at the same time.

[0011] The present invention also provides a deniable public key encryption system based on modular fault-tolerant learning and resistant to side channel attacks, comprising:

[0012] Key generation module: used to generate public and private keys (dpk, dsk) of the public key encryption scheme E based on module fault-tolerant learning;

[0013] Encryption module: used to input from the legitimate plaintext domain To encrypt a message m, first sample a uniformly random bit string s=(s1,…,s n )∈{0,1} n , the subscript set of the "1" and "0" bits in s is recorded as and like If the value is not set, resample; otherwise, use a public pseudo-random generator Select Then, for all i∈[n], perform the following operations to generate n ciphertext pairs:i =0, sampling mask message and 4 random numbers r i (3) , In the above description c′ = l c +l pad , l c is the ciphertext field of scheme E The length of l pad is a fixed positive integer fill value, is the random number field of scheme E; let Using a public hash function To calculate m i Hash value Using dpk and random number r i (4) , use the encryption algorithm in scheme E to encrypt m i ||h i In addition, using dpk and random number r i (3) , using the encryption algorithm in scheme E to encrypt Get another ciphertext Finally, let the ciphertext pair at position i be If i =1, first determine whether i=t, if so, let m i = m; otherwise, randomly sample masked messages and 4 random numbers r i (1) , Then, use calculate Next, use dpk and random number r i (1) , use the encryption algorithm in scheme E to encrypt m i ||h i ,get make In addition, using dpk and random number r i (3) , using the encryption algorithm in scheme E to encrypt get Let the ciphertext pair at position i be The ciphertext obtained by encrypting the message m using this deniable public key encryption method is c = (c1,…,c n );

[0014] Decryption module, used to input ciphertext c=(c1,…,c n ), first define an all-“0” bit string s=(s1,…,s n )=(0,…,0)∈{0,1} n , for all i∈[n], perform the following operations to decrypt c: i Parsed into two sub-ciphertexts Then, use dsk to decrypt using the decryption algorithm in solution E Get R, if R = ⊥, it means decryption failed, then let s i =0; otherwise, calculate Then, use dsk to decrypt using the decryption algorithm in solution E Get m i ||h i , if m i ||h i =⊥or Then let s i =0; otherwise, let s i = 1; Finally, use the public pseudo-random generator Select a "1" bit in s at position t; use this deniable public key encryption method to decrypt the ciphertext c and obtain the plaintext m t ;

[0015] Forgery module: used to input the original message m, the internal random number used to encrypt the message m Fake news Perform the following operations to generate a fake random number: Let s′ = (s′1,…,s′ n )=(s1,…,s t-1 ,0,s t+1 ,…,s n ), the subscript set of the "1" bit and "0" bit in s' is recorded as and like Output "forgery failed" and shut down; otherwise, use Select element t′ in; then, for all i∈[n]: if make like make If i = t, random sampling make Finally, the forged internal random number is output as

[0016] Compared with the prior art, the beneficial effect is that the present invention provides a deniable public key encryption method based on modular fault-tolerant learning to resist side channel attacks, which realizes a deniable public key encryption system that resists side channel attacks for the first time, that is, in the encryption algorithm of the present invention, the operation performed at the "0" bit position in the encrypted random number s is exactly the same as the operation performed at the "1" bit position in the encrypted random number s, which makes the energy, time consumption, or cache access and other side channel information generated by the present invention when running the encryption algorithm will not leak any bit knowledge about s, so even if a forced attacker uses simple energy analysis attacks, time attacks and cache attacks and other side channel attack methods, it is impossible to destroy the deniability of the present invention. In addition, due to the use of a public key encryption scheme based on modular fault-tolerant learning, the present invention can resist possible quantum computing attacks, so the present invention is also a post-quantum deniable public key encryption method. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flow chart of the key generation algorithm of the present invention.

[0018] Figure 2 It is a flow chart of the encryption algorithm of the present invention.

[0019] Figure 3 It is a flow chart of the decryption algorithm of the present invention.

[0020] Figure 4 It is a flow chart of the forgery algorithm of the present invention. DETAILED DESCRIPTION

[0021] In order to facilitate a clear understanding of the purpose, technical solutions and advantages of the present invention, the invention will be described in more detail below with reference to the accompanying drawings and embodiments. It should be understood that the present invention can be implemented in many different forms and is not limited to the embodiments set forth herein. The purpose of the embodiments of the present invention is to make the disclosure of the present invention more thorough and comprehensive for easy understanding.

[0022] Parameter settings and symbol description:

[0023] n=1000, λ=2048, k=3, η=4, q=7681, d u =11,d v =3,d t =11,l pad =80,l c′ =9296;

[0024] For any s∈{0,1} n ,gather and are the ordered subscript sets of the "1" bit and the "0" bit in s respectively ( or The order of elements in is arranged from small to large according to the absolute value of the elements);

[0025] They are defined as polynomial rings

[0026] Distribution B η Defined as: Random sampling Output

[0027] Distribution Beta η Defined as: Random sampling Output

[0028] Pseudo-random functions

[0029] SHA3-256 hash function

[0030] Compression function Com q Defined as: input (x, d), output

[0031] Decompression function Decompression q Defined as: input (x, d), output

[0032] Vector, bold italic lowercase letters, such as v. In the following text, if v∈{0,1} n , then v also represents The elements on (whose coefficient vector is v);

[0033] For a polynomial vector x, x||y represents the XOR and concatenation of the coefficient bit vectors (length is kλlog2q) of x and y respectively;

[0034] Legal plaintext domain Random Number Field

[0035] Example 1

[0036] A deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks comprises the following steps:

[0037] S1. Key generation algorithm: Generate the public and private keys (dpk, dsk) of the public key encryption scheme E based on modular fault-tolerant learning;

[0038] S2. Encryption algorithm: Input comes from a legitimate plaintext domain To encrypt a message m, first sample a uniformly random bit string s=(s1,…,s n )∈{0,1}n , the subscript set of the "1" and "0" bits in s is recorded as and like If the value is not set, resample; otherwise, use a public pseudo-random generator Select Then, for all i∈[n], perform the following operations to generate n ciphertext pairs: i =0, sampling mask message and 4 random numbers r i (3) , In the above description c′ = l c +l pad , l c is the ciphertext field of scheme E The length of l pad is a fixed positive integer fill value, is the random number field of scheme E; let Using a public hash function To calculate m i Hash value Using dpk and random number r i (4) , use the encryption algorithm in scheme E to encrypt m i ||h i In addition, using dpk and random number r i (3) , using the encryption algorithm in scheme E to encrypt Get another ciphertext Finally, let the ciphertext pair at position i be If i =1, first determine whether i=t, if so, let m i = m; otherwise, randomly sample masked messages and 4 random numbers r i (1) , Then, use calculate Next, use dpk and random number r i (1) , use the encryption algorithm in scheme E to encrypt m i ||h i ,get make In addition, using dpk and random number r i(3) , using the encryption algorithm in scheme E to encrypt get Let the ciphertext pair at position i be The ciphertext obtained by encrypting the message m using this deniable public key encryption method is c = (c1,…,c n );

[0039] S3. Decryption algorithm, input ciphertext c = (c1,…,c n ), first define an all-“0” bit string s=(s1,…,s n )=(0,…,0)∈{0,1} n , for all i∈[n], perform the following operations to decrypt c: i Parsed into two sub-ciphertexts Then, use dsk to decrypt using the decryption algorithm in solution E Get R, if R = ⊥, it means decryption failed, then let s i =0; otherwise, calculate Then, use dsk to decrypt using the decryption algorithm in solution E Get m i ||h i , if m i ||h i =⊥or Then let s i =0; otherwise, let s i = 1; Finally, use the public pseudo-random generator Select a "1" bit in s at position t; use this deniable public key encryption method to decrypt the ciphertext c and obtain the plaintext m t ;

[0040] S4. Forgery algorithm: Input the original message m, the internal random number used to encrypt the message m Fake news Perform the following operations to generate a fake random number: Let s′ = (s′1,…,s′ n )=(s1,…,s t-1 ,0,s t+1 ,…,s n ), the subscript set of the "1" bit and "0" bit in s' is recorded as and like Output "forgery failed" and shut down; otherwise, use Select element t′ in; then, for all i∈[n]: if make like make If i = t, random sampling make Finally, the forged internal random number is output as

[0041] Example 2

[0042] A deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks specifically comprises the following steps:

[0043] Step 1: Key generation algorithm, random sampling and two polynomial vectors Embed the secret value s into the modular fault-tolerant learning problem to obtain a pseudo-random polynomial vector t:=s+e; compress t to obtain some high-order bits of t t:=Com q (t,d t );Output encryption public key dpk: = (A, t), decryption private key dsk: = s.

[0044] Step 2: Encryption algorithm, input message And the encrypted public key dpk, follow the steps below:

[0045] S21. Decompression t: = Decom q (t,d t ), random sampling s=(s1,…,s n )←{0,1} n ,like Resampling;

[0046] S22. Calculation Next, for all i∈[n], randomly sample Further judgment, if i = t, let m i : = m, otherwise, random sampling

[0047] S23. For all i∈[n], continue to execute the following branch steps:

[0048] like make calculate v i,1 =Com q , For encryption Will Divide into For j∈[4], Calculated from this for calculate After the above operations, encryption The ciphertext obtained is Finally, let

[0049] S24. If calculate make For encryption Likewise Divide into For j∈[4], Calculated from this for calculate Finally, let

[0050] Step 3: Decryption algorithm, input ciphertext c = (c1,…,c n ) and decryption private key dsk, follow the steps below:

[0051] S31. Let s=(s1,…,s n )←0 n , for all i∈[n], perform the following steps:

[0052] c i Parses as in For all j∈[2,6], calculate as well as Then, reassign make Next, calculate as well as Final calculation

[0053] like Reassign s i =1;

[0054] S32. Calculation The output decryption result is m t .

[0055] Step 4: Forge the algorithm, input the original message m, random number Fake news Follow these steps:

[0056] S41. Let s′=(s′1,…,s′ n )=(s1,…,s t-1 ,0,s t+1 ,…,sn ), the subscript set of the "1" and "0" bits in s' is recorded as and like Output "forgery failed" and shut down; otherwise, For all i∈[n], continue with the following steps;

[0057] S42. If i≠t, let

[0058]

[0059] If i = t, let

[0060] Random Sampling

[0061] S43. Output the forged internal random number:

[0062] Example 3

[0063] A deniable public key encryption system based on modular fault-tolerant learning and resistant to side channel attacks, comprising:

[0064] Key generation module: used to generate public and private keys (dpk, dsk) of the public key encryption scheme E based on module fault-tolerant learning;

[0065] Encryption module: used to input from the legitimate plaintext domain To encrypt a message m, first sample a uniformly random bit string s=(s1,…,s n )∈{0,1} n , the subscript set of the "1" and "0" bits in s is recorded as and like If the value is not set, resample; otherwise, use a public pseudo-random generator Select Then, for all i∈[n], perform the following operations to generate n ciphertext pairs: i =0, sampling mask message and 4 random numbers r i (3) , In the above description c′ = l c +l pad , l c is the ciphertext field of scheme E The length of l pad is a fixed positive integer fill value, is the random number field of scheme E; let Using a public hash function To calculate m i Hash value Using dpk and random number r i (4) , use the encryption algorithm in scheme E to encrypt m i ||h i In addition, using dpk and random number r i (3) , using the encryption algorithm in scheme E to encrypt Get another ciphertext Finally, let the ciphertext pair at position i be If i =1, first determine whether i=t, if so, let m i = m; otherwise, randomly sample masked messages and 4 random numbers r i (1) , Then, use calculate Next, use dpk and random number r i (1) , use the encryption algorithm in scheme E to encrypt m i ||h i ,get make In addition, using dpk and random number r i (3) , using the encryption algorithm in scheme E to encrypt get Let the ciphertext pair at position i be The ciphertext obtained by encrypting the message m using this deniable public key encryption method is c = (c1,…,c n );

[0066] Decryption module, used to input ciphertext c=(c1,…,c n ), first define an all-“0” bit string s=(s1,…,s n )=(0,…,0)∈{0,1} n , for all i∈[n], perform the following operations to decrypt c: i Parsed into two sub-ciphertexts Then, use dsk to decrypt using the decryption algorithm in solution E Get R, if R = ⊥, it means decryption failed, then let s i =0; otherwise, calculate Then, use dsk to decrypt using the decryption algorithm in solution E Get m i ||h i , if m i ||h i =⊥or Then let s i =0; otherwise, let s i = 1; Finally, use the public pseudo-random generator Select a "1" bit in s at position t; use this deniable public key encryption method to decrypt the ciphertext c and obtain the plaintext m t ;

[0067] Forgery module: used to input the original message m, the internal random number used to encrypt the message m Fake news Perform the following operations to generate a fake random number: Let s′ = (s′1,…,s′ n )=(s1,…,s t-1 ,0,s t+1 ,…,s n ), the subscript set of the "1" bit and "0" bit in s' is recorded as and like Output "forgery failed" and shut down; otherwise, use Select element t′ in; then, for all i∈[n]: if make like make If i = t, random sampling make Finally, the forged internal random number is output as

[0068] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks, characterized in that: The following steps are involved: S1. Key generation algorithm: Generate the public and private keys (dpk, dsk) of the public key encryption scheme E based on modular fault-tolerant learning; S2. Encryption algorithm: Input comes from a legitimate plaintext domain To encrypt a message m, first sample a uniformly random bit string s=(s1,…,s n )∈{0,1} n , the subscript set of the "1" and "0" bits in s is recorded as and like Then resample; Otherwise, use a public pseudo-random generator Select Then, for all i∈[n], perform the following operations to generate n ciphertext pairs: i =0, sampling mask message and 4 random numbers In the above description c′ = l c +l pad , l c is the ciphertext field of scheme E The length of l pad is a fixed positive integer fill value, is the random number field of scheme E; let Using a public hash function To calculate m i Hash value Using dpk and random numbers Encrypt m using the encryption algorithm in scheme E i ||h i In addition, using dpk and random numbers Encrypt using the encryption algorithm in scheme E Get another ciphertext Finally, let the ciphertext pair at position i be If i =1, first determine whether i=t, if so, let m i =m; Otherwise, randomly sample masked messages and 4 random numbers Then, use calculate Next, use dpk and random numbers Encrypt m using the encryption algorithm in scheme E i ||h i ,get make In addition, using dpk and random numbers Encrypt using the encryption algorithm in scheme E get Let the ciphertext pair at position i be The ciphertext obtained by encrypting the message m using this deniable public key encryption method is c = (c1,…,c n ); S3. Decryption algorithm, input ciphertext c = (c1,…,c n ), first define an all-"0" bit string s=(s1,…,s n )=(0,…,0)∈{0,1} n , for all i∈[n], perform the following operations to decrypt c: i Parsed into two sub-ciphertexts Then, use dsk to decrypt using the decryption algorithm in solution E Get R, if R = ⊥, it means decryption failed, then let s i =0; otherwise, calculate Then, use dsk to decrypt using the decryption algorithm in solution E Get m i ||h i , if m i ||h i =⊥or Then let s i =0; otherwise, let s i = 1; Finally, use the public pseudo-random generator Select a "1" bit in s at position t; use this deniable public key encryption method to decrypt the ciphertext c and obtain the plaintext m t ; S4. Forgery algorithm: Input the original message m, the internal random number used to encrypt the message m Fake news Perform the following operations to generate a fake random number: Let s′=(s′1,…,s′ n )=(s1,…,s t-1 ,0,s t+1 ,…,s n ), the subscript set of the "1" bit and "0" bit in s' is recorded as and like Output "forgery failed" and shut down; otherwise, use Select element t′ in; then, for all i∈[n]: if make like make If i = t, random sampling make Finally, the forged internal random number is output as 2. The deniable public key encryption method based on modular fault-tolerant learning and anti-side channel attack according to claim 1 is characterized in that: Step S1 specifically includes: random sampling and two polynomial vectors Embed the secret value s into the modular fault-tolerant learning problem to obtain a pseudo-random polynomial vector t:=As+e; compress t to obtain part of the high-order bits of t:=Com q (t,d t );Output encryption public key dpk:=(A, t), decryption private key dsk:=s.

3. The deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks according to claim 2 is characterized in that: Step S2 specifically includes: input message And the encrypted public key dpk, follow the steps below: S21. Decompression t: = Decom q (t,d t ), random sampling s = (s1, ..., s n )←{0,1} n ,like Resampling; S22. Calculation Next, for all i∈[n], randomly sample Further judgment, if i = t, let m i : = m, otherwise, random sampling S23. For all i∈[n], continue to execute the following branch steps: like make calculate For encryption Will Divide into For j∈[4], Calculated from this for calculate After the above operations, encryption The ciphertext obtained is Finally, let S24. If calculate make For encryption Likewise Divide into For j∈[4], Calculated from this for calculate Finally, let 4. The deniable public key encryption method based on modular fault-tolerant learning and anti-side channel attack according to claim 3 is characterized in that: Step S3 specifically includes: inputting ciphertext c=(c1, ..., c n ) and decryption private key dsk, follow the steps below: S31. Let s=(s1,…,s n )←0 n , for all i∈[n], perform the following steps: c i Parses as in For all j∈[2,6], calculate as well as Then, reassign make Next, calculate as well as Final calculation like Reassign s i =1; S32. Calculation The output decryption result is m t .

5. The deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks according to claim 4 is characterized in that: Step S4 specifically includes: inputting the original message m, the random number Fake news Follow these steps: S41. Let s′=(s′1,…,s′ n )=(s1,…,s t-1 ,0,s t+1 ,…,s n ), the subscript set of the "1" and "0" bits in s' is recorded as and like Output "forgery failed" and shut down; otherwise, For all i∈[n], continue with the following steps; S42. If i≠t, let If i = t, let Random Sampling S43. Output the forged internal random number:

6. A deniable public key encryption system based on modular fault-tolerant learning and resistant to side channel attacks, characterized in that: Includes the following modules: Key generation module: used to generate public and private keys (dpk, dsk) of the public key encryption scheme E based on module fault-tolerant learning; Encryption module: used to input from the legitimate plaintext domain To encrypt a message m, first sample a uniformly random bit string s=(s1,…,s n )∈{0,1} n , the subscript set of the "1" and "0" bits in s is recorded as and like Then resample; Otherwise, use a public pseudo-random generator Select Then, for all i∈[n], perform the following operations to generate n ciphertext pairs: i =0, sampling mask message and 4 random numbers In the above description c′ = l c +l pad , l c is the ciphertext field of scheme E The length of l pad is a fixed positive integer fill value, is the random number field of scheme E; let Using a public hash function To calculate m i Hash value Using dpk and random numbers Encrypt m using the encryption algorithm in scheme E i ||h i In addition, using dpk and random numbers Encrypt using the encryption algorithm in scheme E Get another ciphertext Finally, let the ciphertext pair at position i be If i =1, first determine whether i=t, if so, let m i =m; Otherwise, randomly sample masked messages and 4 random numbers Then, use calculate Next, use dpk and random numbers Encrypt m using the encryption algorithm in scheme E i ||h i ,get make In addition, using dpk and random numbers Encrypt using the encryption algorithm in scheme E get Let the ciphertext pair at position i be The ciphertext obtained by encrypting the message m using the deniable public key encryption method is c=(c1, ..., c n ); Decryption module, used to input ciphertext c=(c1,…,c n ), first define an all-"0" bit string s=(s1,…,s n )=(0,…,0)∈{0,1} n , for all i∈[n], perform the following operations to decrypt c: i Parsed into two sub-ciphertexts Then, use dsk to decrypt using the decryption algorithm in solution E Get R, if R = ⊥, it means decryption failed, then let s i =0; otherwise, calculate Then, use dsk to decrypt using the decryption algorithm in solution E Get m i ||h i , if m i ||h i =⊥or Then let s i =0; otherwise, let s i = 1; Finally, use the public pseudo-random generator Select a "1" bit in s at position t; use this deniable public key encryption method to decrypt the ciphertext c and obtain the plaintext m t ; Forgery module: used to input the original message m, the internal random number used to encrypt the message m Fake news Perform the following operations to generate a fake random number: Let s′=(s′1,…,s′ n )=(s1,…,s t-1 ,0,s t+1 ,…,s n ), the subscript set of the "1" bit and "0" bit in s' is recorded as and like Output "forgery failed" and shut down; otherwise, use Select element t′ in; then, for all i∈[n]: if make like make If i = t, random sampling make Finally, the forged internal random number is output as 7. The deniable public key encryption system based on modular fault-tolerant learning and resistant to side channel attacks according to claim 6 is characterized in that: The key generation module is used for random sampling and two polynomial vectors Embed the secret value s into the modular fault-tolerant learning problem to obtain a pseudo-random polynomial vector t:=As+e; compress t to obtain some high-order bits of t t:=Com q (t,d t );Output encryption public key dpk:=(A, t), decryption private key dsk:=s.

8. The deniable public key encryption system based on modular fault-tolerant learning and resistant to side channel attacks according to claim 7 is characterized in that: The encryption module specifically includes: First input unit: used to input messages and encrypted public key dpk; Decompression unit: used to compress t: = Decom q (t,d t ), random sampling s = (s1, ..., s n )←{0,1} n ,like Resampling; Computational unit: used for calculation Next, for all i∈[n], randomly sample Further judgment, if i = t, let m i : = m, otherwise, random sampling The first judgment unit: used to judge if make calculate For encryption Will Divide into For j∈[4], Calculated from this for calculate After the above operations, encryption The ciphertext obtained is Finally, let like calculate make For encryption Likewise Divide into For j∈[4], Calculated from this for calculate Finally, let 9. The deniable public key encryption system based on modular fault-tolerant learning and resistant to side channel attacks according to claim 7 is characterized in that: The decryption module specifically includes: Decryption unit: used to make s = (s1, ..., s n )←0 n , for all i∈[n], perform the following steps: c i Parses as in For all j∈[2,6], calculate as well as Then, reassign make Next, calculate as well as Final calculation like Reassign s i =1; First output unit: used for calculation The output decryption result is m t .

10. The deniable public key encryption method based on modular fault-tolerant learning and resistant to side channel attacks according to claim 9 is characterized in that: The forgery module specifically includes: Second input unit: used to input the original message m, random number Fake news Execution unit: Let s′=(s′1,…,s′ n )=(s1,…,s t-1 ,0,s t+1 ,…,s n ), the subscript set of the "1" and "0" bits in s' is recorded as and like Output "forgery failed" and shut down; otherwise, For all i∈[n], continue with the following steps: If i≠t, let If i = t, let Random Sampling The second output unit is used to output the forged internal random number.

Images