Quantum Forgery Attack Method against POEM Structure

Abstract

The present invention discloses a quantum forgery attack method for the POEM structure, including the following steps: setting a tag generation formula, substituting the tag generation formula into two different d values to generate two tags; jointly XORing the two tags to generate a first function; setting a 2n-bit quantum state, applying a transformation to the first n qubits of the 2n-bit quantum state to obtain a quantum superposition; inputting the quantum superposition into the first function to obtain a first state, and performing a transformation on the first n qubits to obtain a second state; substituting all qubits into a function for measurement, performing multiple experiments on this quantum circuit to obtain n different states, and using Gaussian elimination to obtain a first period; calculating a secret parameter according to the first period, obtaining an input using the secret parameter, constructing a second function using the input and the tag generation formula to obtain a second period, and setting the second period as a first key; obtaining a second key, forging ciphertexts and tags of arbitrary messages according to the key, and sending them to the sender.

Description

Technical Field

[0001] The present invention relates to the field, specifically a quantum forgery attack method for the POEM structure. Background Art

[0002] In the research on cryptographic security, authenticated encryption algorithms can simultaneously achieve the confidentiality and integrity verification of information and are widely used in various network security systems. The authenticated encryption working mode is a cryptographic scheme that solves practical problems such as the privacy and authenticity of user information by encrypting information to generate ciphertext and calculating an authentication tag. Currently, a large amount of information not only needs to be kept confidential during transmission but also needs to be authenticated after being received by the receiving party to ensure the confidentiality, integrity, and authenticity of the information during transmission. Therefore, it is very necessary to design and study authenticated encryption algorithms. The goal of the CAESAR competition is to determine a reliable, efficient, secure, and uniquely-attribute authenticated encryption algorithm combination for different application scenarios. In the initial stage of this encryption competition, a total of 57 algorithms were collected.

[0003] On the other hand, in the quantum world, since the Shor algorithm was proposed, it has been announced that quantum computers will pose a serious threat to public-key cryptography. More and more researchers have started to use quantum algorithms to break symmetric cryptosystems, such as the Simon algorithm and the Bernstein-Vazirani algorithm. In addition, they have also proposed some new quantum algorithms and even extended classical cryptanalysis methods to the quantum domain. Among them, the Simon algorithm was first used to break the 3-round Feistel construction and proved that the Even-Mansour construction is insecure under superposition queries. Inspired by them, Kaplan et al. demonstrated several classical attacks based on finding collisions, and using the Simon algorithm can greatly accelerate the attack speed. Shi et al. also adopted a similar method to achieve a collision attack on the authenticated encryption AEZ in the CAESAR competition.

[0004] - The OTR authenticated encryption algorithm (v1.0 / 1.1) is a CAESAR candidate algorithm submitted by Kavun et al. It includes a newly designed efficient swap, namely swap. - The OTR variant is used in the single-key Even-Mansour structure - OTR-Even-Mansour (POEM) Arrange as a block cipher for the Minematsu provably secure, Feistel-based OTR mode of operation. The Even-Mansour method has been widely studied and has been proven secure under different security concepts. In addition, detailed security levels and key length bounds have been given. However, it is inherently vulnerable to related keys. The OTR mode of operation allows this property to be lifted to a complete encryption and authentication scheme. However, this unfortunate combination of security components proposed by Christoph et al. shows that the related-key properties of the Even-Mansour construction are not well covered by classical security concepts and they can lead to powerful forgery attacks. The attack by Christoph et al. requires the ciphertexts and tags of any two messages to be given under two related keys, and then they can forge and modify the ciphertexts and tags of the messages. Their attack is a selective forgery attack. However, to the best of our knowledge, this forgery attack has stringent limiting conditions, making the scenario relatively strict. Summary of the Invention

[0005] To address the deficiencies mentioned in the above background art, the object of the present invention is to provide a quantum forgery attack method for the POEM structure, to solve the need in the prior art that cannot meet the requirement of quantum forgery attack on the -OTR-Even-Mansour structure; and to meet the purpose of forgery attack on the block cipher mode of operation.

[0006] The object of the present invention can be achieved by the following technical solutions: A quantum forgery attack method for the POEM structure, the method comprising the following steps:

[0007] Set a tag generation formula and substitute the tag generation formula into two different d to generate two tags;

[0008] XOR the two tags jointly to generate a first function; where d represents the number of plaintext blocks.

[0009] Select parameters as input and select the generated first function as output to obtain a quantum superposition;

[0010] Set a 2n-bit quantum state and apply the Hadamard transform to the first n qubits of the 2n-bit quantum state to obtain a quantum superposition;

[0011] Input the quantum superposition into the first function to obtain a first state, and perform the Hadamard transform on the first n qubits to obtain a second state;

[0012] Substitute all qubits into the function for measurement, conduct multiple trials on this quantum circuit to obtain n different states, and use Gaussian elimination to obtain the first period according to the inner product of the obtained state and the period being 0;

[0013] Calculate the secret parameter according to the first period, calculate the input using the secret parameter, and construct the second function using the input and the tag generation formula. Repeat the above steps to obtain the second period, and set the second period as the first key;

[0014] Calculate the second key using the first key, forge the ciphertext and tag of any message according to the first key and the second key, and send them to the sender.

[0015] Preferably, the tag generation formula TE is:

[0016]

[0017] where k1 and k2 are keys, P is a permutation function, L is a secret parameter.

[0018] Preferably, the generation process of the first function is as follows:

[0019] Intercept the tags TE with d equal to 2 and 4 respectively, and construct a function by jointly exclusive-oring the two tags:

[0020]

[0021] P is a permutation function. c is the constant M[4], and L is a secret parameter.

[0022] The parameters are x, c, and c is the constant M[4].

[0023] Preferably, the process of obtaining quantum superposition is as follows:

[0024] Prepare a 2n-bit quantum state Apply the Hadamard transform to the first n qubits to obtain quantum superposition

[0025] Preferably, the first state is:

[0026]

[0027] Preferably, the second state is:

[0028]

[0029] Preferably, the process of calculating the secret parameter according to the first period, calculating the input using the secret parameter, and constructing the second function using the input and the tag generation formula, repeating the above steps to obtain the second period, and setting the second period as the first key is as follows:

[0030] Select Set it as the input x, and reuse the tag to generate the formula and Permutation algorithm constructor And repeat to obtain the second period s, where the second period is equal to the first key k1.

[0031] Preferably, the first key k1 is used to calculate the second key k2, and the calculation formula is as follows:

[0032]

[0033] Tag_OTR is the formula for the tag generation method of the POEM structure.

[0034] Preferably, a device includes:

[0035] One or more processors;

[0036] A memory for storing one or more programs;

[0037] When one or more of the programs are executed by one or more of the processors, one or more of the processors implement the quantum forgery attack method for the POEM structure as described above.

[0038] Preferably, a storage medium containing computer-executable instructions, where the computer-executable instructions are used to execute the quantum forgery attack method for the POEM structure as described above when executed by a computer processor.

[0039] Advantages of the present invention:

[0040] The present invention meets the requirements of the quantum forgery attack scheme for the -OTR-Even-Mansour structure in the quantum environment, and meets the purpose of quantum forgery attack on the block cipher working mode; compared with classical attacks, it can improve the success probability through the quantum mechanics mechanism and obtain a stronger general forgery attack. Description of the drawings

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings;

[0042] Figure 1 is a schematic diagram of the core part of the -OTR-Even-Mansour structure of the present invention. Detailed implementation manners

[0043] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0044] As Figure 1 shown, for the quantum forgery attack method against the POEM structure, the method includes the following steps:

[0045] Set the tag generation formula, and substitute the tag generation formula into two different d values to generate two tags;

[0046] XOR the two tags jointly to generate the first function; where d represents the number of plaintext blocks.

[0047] Select the parameters as the input and the generated first function as the output to obtain the quantum superposition;

[0048] Set a 2n-bit quantum state, and apply the Hadamard gate to the first n qubits of the 2n-bit quantum state to obtain the quantum superposition;

[0049] Input the quantum superposition into the first function to obtain the first state, and perform the Hadamard transformation on the first n qubits to obtain the second state;

[0050] Substitute all qubits into the function for measurement, conduct multiple experiments on this quantum circuit, obtain n different states, and use the Gaussian elimination method to obtain the first period according to the inner product of the obtained state and the period being 0;

[0051] Calculate the secret parameter according to the first period, calculate the input using the secret parameter, and construct the second function using the input and the tag generation formula. Repeat the above steps to obtain the second period, and set the second period as the first key;

[0052] Calculate the second key using the first key, forge the ciphertext and tag of any message according to the first key and the second key, and send them to the sender.

[0053] It should be further noted that in the specific implementation process, assuming that the associated data is an empty string (i.e., TA = 0), the attacker knows a plaintext M = M[1]||M[2]||M[3]||M[4]||...||M[d] and the authentication tag The attacker wants to obtain the key for a general forgery attack.

[0054] The specific attack process is as follows:

[0055] Calculate the tag generation formula TE:

[0056] Intercept d = 2:

[0057] Intercept d = 4:

[0058] Set M[2] to the input x, set M[4] to the constant c, and construct the function

[0059]

[0060] Prepare a 2n - qubit quantum state Apply the Hadamard transformation To the first n qubits to obtain a quantum superposition

[0061] Input the quantum superposition into the function f in (iv) to get the state

[0062] Perform the Hadamard transformation on the first n qubits Obtain

[0063] Measure all qubits. The inner product of the measured state |z> and the period s is 0. Conduct multiple trials on this quantum circuit to obtain n different states |z>, and use Gaussian elimination to obtain the period

[0064] Calculate the secret parameter through transformation

[0065] Set As the input x and construct the function

[0066]

[0067] Prepare a 2n - qubit quantum state Apply the Hadamard transformation To the first n qubits to obtain a quantum superposition

[0068] Input the quantum superposition into the function f in (x) to get the state

[0069] Perform the Hadamard transformation on the first n qubits Obtain

[0070] Measure all qubits. The inner product of the measured state |z> and the period s is 0. Conduct multiple experiments on this quantum circuit to obtain n different states |z>. Use Gaussian elimination to obtain the period s = k1.

[0071] Calculate the secret key

[0072] Forge the ciphertext C* and tag T* of any message M* according to the secret key and send them to the sender.

[0073] Based on the same inventive concept, the present invention also provides a computer device, which includes: one or more processors, and a memory for storing one or more computer programs; the program includes program instructions, and the processor is used to execute the program instructions stored in the memory. The processor may be a Central Processing Unit (CPU), or may also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, and is used to implement one or more instructions, specifically used to load and execute one or more instructions in the computer storage medium to implement the above method.

[0074] It should be further noted that, based on the same inventive concept, the present invention also provides a computer storage medium, on which a computer program is stored, and the computer program, when run by a processor, executes the above method. The storage medium may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may, for example, but not be limited to, be an electrical, magnetic, optical, electrical, magnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of the computer-readable storage medium include: an electrical connection having one or more wires, a portable computer disk, a hard disk, a Random Access Memory (RAM), a Read Only Memory (ROM), an Erasable Programmable Read Only Memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, the computer-readable storage medium may be any tangible medium that contains or stores a program, and the program may be used or combined with an instruction execution system, apparatus, or device.

[0075] In the description of this specification, the descriptions referring to the terms "one embodiment", "example", "specific example", etc. mean that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0076] The foregoing has shown and described the basic principles, main features and advantages of the present disclosure. Those skilled in the art should understand that the present disclosure is not limited by the above embodiments, and the above embodiments and the descriptions in the specification are only used to illustrate the principles of the present disclosure. Without departing from the spirit and scope of the present disclosure, the present disclosure will have various changes and improvements, and these changes and improvements fall within the scope of the present disclosure claimed.

Claims

1. A quantum forgery attack method against the POEM structure, characterized in that, The method includes the following steps: Set a tag generation formula, and substitute the tag generation formula into two different d values to generate two tags; XOR the two tags together to generate a first function; where d represents the number of plaintext blocks; Select a parameter as the input and the generated first function as the output to obtain a quantum superposition; Set a 2n-bit quantum state, before applying the Hadamard transformation to the 2n-bit quantum state qubit to obtain quantum superposition; Input the quantum superposition into the first function to obtain the first state, and perform Hadamard transformation on the first several qubits to obtain the second state; Measure all qubit substitution functions, conduct multiple trials on this quantum circuit, and obtain different states. Based on the inner product of the obtained states and the period being 0, use Gaussian elimination to obtain the first period; Calculate a secret parameter according to the first period, calculate the input using the secret parameter, and construct a second function using the input and the tag generation formula. Repeat the above steps to obtain a second period, and set the second period as the first key; Calculate a second key using the first key, and forge the ciphertext and tag of any message according to the first key and the second key, and send them to the sender.

2. The quantum forgery attack method for the POEM structure according to claim 1, wherein The tag generation formula TE is: ； Wherein and are secret keys, P is the Prøst permutation function, , and L is a secret parameter.

3. The quantum forgery attack method for the POEM structure according to claim 1, characterized in that The generation process of the first function is as follows: Respectively intercept the tags TE with d equal to 2 and 4, and XOR the two tags together to construct a function: ； P is the Prøst permutation function, and L is the secret parameter; The parameters are , , c is a constant .

4. The quantum forgery attack method for the POEM structure according to claim 1, characterized in that The process of obtaining the quantum superposition is as follows: Prepare a 2n - qubit quantum state , and apply the Hadamard transformation to the first n qubits to obtain a quantum superposition .

5. The quantum forgery attack method for the POEM structure according to claim 1, characterized in that, The first state is: 。 6. The quantum forgery attack method for the POEM structure according to claim 1, characterized in that, The second state is: 。 7. The quantum forgery attack method for the POEM structure according to claim 1, characterized in that, The process of calculating the secret parameter according to the first period, calculating the input using the secret parameter, and constructing a second function using the input and the tag generation formula. Repeat the above steps to obtain a second period, and set the second period as the first key is as follows: Select Set it as the input x, and reuse the label generation formula and the Prøst permutation algorithm to construct a function , and repeat to obtain the second cycle , and the second cycle is equal to the first key .

8. The quantum forgery attack method against the POEM structure according to claim 7, characterized in that, The first key calculates to obtain a second key , and the calculation formula is as follows: ； Tag_OTR is the tag generation method formula of the POEM structure.

9. A device, characterized in that, It includes: One or more processors; A memory for storing one or more programs; When one or more of the said programs are executed by one or more of the said processors, such that one or more of the said processors implement the quantum forgery attack method for the POEM structure as described in any one of claims 1-8.

10. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions are used to execute the quantum forgery attack method for the POEM structure as described in any one of claims 1-8 when executed by a computer processor.

Images