A method of key encapsulation and encryption and decryption based on ntru lattice

Abstract

The present application belongs to the technical field of lattice cryptography, and particularly relates to a key encapsulation and encryption / decryption method based on an NTRU lattice. The method comprises a public key encryption method and a key encapsulation method. The method is more compact and efficient, and only needs to change three parameters, i.e. ring dimension n, ring modulus q and ciphertext compression parameter d, when changing a parameter set. The key generation, encryption and decryption algorithm structure of the NTRU is simple, and only one polynomial multiplication is needed in the encryption / decryption process. The method has a shorter ciphertext length, does not need error correction code to compress the ciphertext, i.e. does not use error correction code to recover the plaintext, and has stronger security in both classical and quantum models.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of lattice cryptography, and particularly relates to a key encapsulation and encryption and decryption method based on an NTRU lattice. BACKGROUND

[0002] The public key encryption algorithm currently used is mainly based on a classical mathematical problem and cannot resist quantum computer attacks. Therefore, a cipher that can resist quantum computer attacks has attracted widespread attention. According to different underlying difficult mathematical problems, there are five main post-quantum cryptography schemes: hash-based, code-based, lattice-based, multivariate-based and isogeny-based, among which the lattice-based cryptography scheme is considered to be the most promising cryptography scheme due to its excellent security, small communication bandwidth and high computing efficiency.

[0003] In the third round of algorithm competition held by the National Institute of Standards and Technology (NIST), 7 of the 15 algorithms are lattice-based schemes, and most of the lattice-based cryptography schemes use ordinary lattices and algebraic structure lattices (ideal lattices, NTRU lattices and module lattices). They are mainly instantiated from the following difficult assumptions: the first type of fault-tolerant learning LWE, ring fault-tolerant learning RLWE, module fault-tolerant learning MLWE and integer learning LWR with rounding and ring integer learning RLWR, and the second type is the NTRU assumption.

[0004] Related knowledge and symbol indication

[0005] The definition of a key encapsulation KEM is as follows, a key encapsulation mechanism KEM = (KeyGen, Encaps, Decaps) includes three algorithms. The input security parameter κ, the key generation algorithm KeyGen outputs a key pair (pk, sk), and pk also defines a finite key space And the encapsulation algorithm Encaps outputs a binary tuple (K, c) when inputting pk, where c is an encapsulation of the key K, and K is contained in the key space The determined decapsulation algorithm Decaps outputs the key Or the symbol To indicate that c is not a valid key encapsulation.

[0006] If Pr[Decaps(sk, c) ≠ K | (pk, sk) ← KeyGen(1 κ ); (K, c) ← Encaps(pk)] ≤ δ, then the KEM is δ-approximately correct.

[0007]

[0008] The security notion under chosen ciphertext attack (CCA) is defined as indistinguishability as shown in the following equation (the CCA game for KEM). For any probabilistic polynomial time adversary A, define its CCA advantage as:

[0009]

[0010] A KEM mechanism is said to be CCA-secure if for any large and any probabilistic polynomial time adversary A, the CCA advantage is negligible.

[0011] A public key encryption (PKE) is defined as follows:

[0012] A public key encryption mechanism can be given by a triple of algorithms, for any large

[0013] KeyGen: a key generation algorithm, which is a probabilistic polynomial time algorithm in κ, takes 1 κ as input and outputs a pair of strings (pk, sk), which are called public key and secret key respectively. This experiment can be written as (pk, sk) <- KeyGen(1 κ ).

[0014] ε: an encryption algorithm, which is a probabilistic polynomial time algorithm in κ, takes a public key pk and a message M from the message space MSP, and a coin r uniformly taken from the coin space COIN, and produces a ciphertext C := ε pk (M; r). This experiment is written as C <- ε pk (x).

[0015] Dec: a decryption algorithm, which is a deterministic polynomial time algorithm in κ, takes a secret key sk and a ciphertext C <- {0, 1} * as input and returns a message M ∈ MSP.

[0016] A PKE mechanism is said to be δ-correct if for any large each pair (pk, sk) is generated by KeyGen(1 κ ), and for each M ∈ MSP, we always have

[0017] Definition (CCA security) Let be an asymmetric encryption mechanism, be an adversary to the PKE scheme. For any the CCA advantage is defined as follows:

[0018]

[0019]

[0020] A PKE scheme is said to be CCA-secure if for any sufficiently large security parameter κ and a probabilistic polynomial-time adversary its CCA advantage is negligible in κ. Meanwhile, a PKE scheme is said to be chosen-plaintext attack (CPA) secure if its advantage is negligible in the case that the adversary has no access to a decryption oracle The NTRU one-way hardness assumption is defined as follows: Given a public key h of the NTRU public key encryption scheme and a PPT encryption algorithm Enc, the NTRU one-way function is defined as: where

[0021] The NTRU one-way problem (NTRU-OW) is to compute (r, e) given a public key h and a ciphertext polynomial c. The NTRU one-way problem is hard, meaning that for any PPT adversary its advantage is negligible:

[0022]

[0023] In simple terms, the NTRU one-way hardness assumption means that no PPT adversary can recover (r, e) from a public key h and a ciphertext c.

[0024] Let and be the set of rational integers and the set of real numbers, respectively. n and q are positive integers. Denote and Let be the group of invertible elements of For any is the rounded integer of x. Denote the ring as the general ring, then is its quotient ring and where q is a positive integer; for the ring one of the following polynomial rings can be selected: where n and q are the parameters of the polynomial ring. For the n parameter, the optional parameters are {512, 768, 1024}, corresponding to the schemes LTRU-512, LTRU-768, and LTRU-1024, respectively, and for the q parameter, the optional parameters are {7681, 3457}; where the polynomial ring is a bivariate polynomial ring; where F2[T][x] / (x​​n F2 is a binary finite field; where the polynomial ring is a k x k matrix; where where the polynomial ring is in the form of a matrix; D[x] / (x n -1), where D is a Dedekind domain; where the polynomial ring is a dual special type of binary truncated polynomial with positive integer coefficients; where A[x] / (x n -1), where A = {a + bi + cj + dk | a, b, c, d ∈ K, i 2 = a, j 2 = b, ij = k}, where and The elements on are polynomials. and A polynomial f on can be expressed in the form of a power series or a vector f = (f0, f1,..., f n-1 ), where Define a function is negligible if it satisfies ∈(λ) < 1 / λ c for any positive c and sufficiently large λ. A negligible function is denoted as negl.

[0025] cyclotomic polynomial: Let m be a positive integer, be a primitive m-th root of unity. The m-th cyclotomic polynomial is an irreducible monic polynomial of degree φ(m) with coefficients in , where φ is the Euler function. The m-th cyclotomic field is and its corresponding integer ring is Most of the cryptographic schemes based on ideal lattices or module lattices are based on the cyclotomic polynomial ring of 2-power order, corresponding to and where n = 2 e satisfies x n + 1 is a 2 e+1 cyclotomic polynomial. The LTRU scheme adopts the non-2-power cyclotomic polynomial ring and where n = 3 l · 2 e , l ≥ 0, e ≥ 1, is a 3 l+1 · 2 e cyclotomic polynomial.

[0026] Modular reduction: We extend the definition of modular reduction from to For a positive number q, r' = r mod ± q denotes that r' is the representative element of r in We let r' = r mod q denote the representative element of r in [0, q).

[0027] Element size: Let q be a positive number. For any its norm is defined as ∞ ||w|| q，∞ = |w mod ± q |. If w is an n-dimensional vector, its norm l2 is defined as For any ||w|| q，2 = ||w|| q，∞ .

[0028] For a set D, define to denote uniform random sampling x from the set D. If D is a probability distribution, then x ← D means that x is chosen according to the distribution of D. The central binomial distribution B η η is a positive integer defined as follows: sample and output The distribution is: sample (a1,..., a η , b1,..., b η ) ← ${0, 1} 2η and output Sampling a polynomial f ← B η means that each coefficient in f is sampled from the central binomial distribution B η . The distributions Ψ f′ , Ψ g , Ψ r , Ψ e are distributions over the ring Sampling a polynomial f' ← Ψ f′ means that each coefficient in f is sampled from the distribution Ψ f′ . Sampling a polynomial g ← Ψ g means that each coefficient in g is sampled from the distribution Ψ g . Sampling a polynomial r ← Ψ r means that each coefficient in r is sampled from the distribution Ψ r . Sampling a polynomial e ← Ψ e means that each coefficient in e is sampled from the distribution Ψ e . SUMMARY

[0029] The application aims to provide a NTRU lattice-based key encapsulation and public key encryption and decryption method without error code compression ciphertext, which is fast, efficient and strong in security, so as to resist quantum computer attacks.

[0030] The NTRU lattice-based key encapsulation and public key encryption and decryption method provided by the application is briefly denoted as LTRU, which comprises the following steps: selecting a plaintext security public key encryption method and selecting a ciphertext security key encapsulation method.

[0031] The application firstly proposes an extensible key compression technology, constructs ciphertext based on the NTRU-OW assumption, and compresses the ciphertext as much as possible without using error code to recover the plaintext. In addition, the method has the advantages of provable security, strong security in traditional and quantum models, reduction advantage, etc., and provides a fast and efficient public key encryption method and key encapsulation method.

[0032] The NTRU lattice-based key encapsulation and public key encryption and decryption method provided by the application comprises the following specific steps:

[0033] (1) The public key encryption method comprises the following specific steps:

[0034] (1.1) Generating a public and private key pair, comprising the following steps:

[0035] Let Ψ be a distribution on , and let R be a ring. p is a plaintext space modulus, and M={0,1} n / 2 is a plaintext space. Sample a polynomial f'←Ψ f′ , which means that each coefficient in f is sampled from the distribution Ψ f′ . Sample a polynomial g←Ψ g , which means that each coefficient in g is sampled from the distribution Ψ g . Sample a polynomial r←Ψ r , which means that each coefficient in r is sampled from the distribution Ψ r . Sample a polynomial e←Ψ e , which means that each coefficient in e is sampled from the distribution Ψ e .

[0036] Sample a polynomial f' from the Ψ f′ distribution, and sample a polynomial g from the Ψ g distribution, wherein The subscript q is the modulus of , and is a positive integer (the same below); calculate p and θ are integers; if f is not reversible in , repeat the above two steps; otherwise, calculate or or or the public key h is obtained by removing some bits from the low bits of g / f in each dimension, where q1≤q is an integer, is a small noise polynomial; output h as part of the public key and f as the private key;

[0037] (1.2) Encryption with the public key, including the following steps:

[0038] Input public key pk = h, plaintext m e M; from Ψ r distribution to generate a polynomial or from Ψ e distribution to generate a polynomial or Let or Calculate ciphertext Calculate Output ciphertext ct: = (c, u); where Compress q is a compression function; F is a hash function; d is a compression parameter;

[0039] (1.3) Decryption with the private key, including the following steps:

[0040] Input private key sk = f, ciphertext ct: = (c, u); Calculate c' = Decompress q (c, d); Calculate e' = Compress q (c'f mod ±q, θ'); Calculate Output plaintext m. Where Decompress is a decompression function, θ' is an integer.

[0041] Further, in step (1.1) is a polynomial ring, and the ring is denoted as a general ring, then is its quotient ring and where q is a positive integer; for the ring one of the following polynomial rings can be selected:

[0042]

[0043] where,

[0044] F2[T][x] / (x n -1), where F2 is a binary finite field;

[0045] where the polynomial ring is a k x k matrix;

[0046] in,

[0047] Wherein, the polynomial ring is in matrix form; D[x] / (x n -1), D is the Dedekind field;

[0048] Among them, the polynomial ring is a binary truncated polynomial of dual special type with positive integer coefficients;

[0049] in,

[0050] A[x] / (x n -1), where A={a+bi+cj+dk|a, b, c, d∈K, i 2 =a,j 2 =b,ij=k}; n is the parameter of the polynomial ring, n is an integer representing the degree of the polynomial.

[0051] Furthermore, in step (1.1), p is the plaintext space modulus, satisfying gcd(q, p) = 1, and in this scheme, p = 2 or 3 is selected; Ψ f′ and Ψ g All are rings or The distributions on M, where each distribution can be obtained by combining two or more distributions; each plaintext m∈M can be considered as A polynomial in the polynomial ring, wherein the polynomial coefficients are in {0, 1} or {0, 1, 2} or {-1, 0, 1}; for the multiplications and additions involved in f = pf′ + θ, both are in the polynomial ring. or Operations on.

[0052] Furthermore, in steps (1.2) and (1.3), Ψ r Ψ e For ring or The distribution on; where The multiplication and addition involved are all performed within a polynomial ring. or Operations on; Let F: {0, 1} * →M is a hash function, and M is the plaintext space encrypted with the LTRU public key; for the compression function Compress and decompression function Decompress used in steps (1.2) and (1.3), one of the following can be selected:

[0053] For positive integers q and d, define a compression function. and the decompression function

[0054] For positive integers q and d, define the compression function and the decompression function

[0055] Further, for the public key encryption method (LTRU.PKE), the ring dimension n optional parameters include {512, 576, 648, 701, 768, 864, 972, 1024, 1152, 1296, 1373}, the ring modulus q optional parameters include {7681, 3457, 2917} or power of 2, the ciphertext compression parameter d optional parameters include {10, 11, 12, 13};Ψ g For the ring Or Synthesized by two or more small coefficient polynomials, or synthesized by a small coefficient polynomial and a constant polynomial, or the sum of 1 small coefficient polynomial with each coefficient subject to central binomial distribution and 1 small coefficient polynomial with each coefficient subject to small interval uniform distribution; p is 2 or 3, θ=1, θ'=1.

[0056] In the present application, the public key encryption method (denoted as LTRU.PKE) can be further extended to a key encapsulation method (denoted as LTRU.KEM).

[0057] (2) Key encapsulation method, the specific steps are:

[0058] (2.1) Generating a public-private key pair of key encapsulation, including the following steps:

[0059] Deriving the public key pk and the private key sk through the key generation of LTRU.PKE as the public key pk' and the private key sk' of the key encapsulation.

[0060] (2.2) Key encapsulation, including the following steps:

[0061] Input the public key pk, randomly sample to generate plaintext m in the plaintext space M, and pass into LTRU.PKE.Enc to obtain ciphertext ct through Deriving (K, coin). Pass the public key pk, plaintext m, and random number coin into LTRU.PKE.Enc to obtain ciphertext ct. Return ciphertext ct and random number K.

[0062] (2.3) Key decapsulation, including the following steps:

[0063] Pass in the private key sk', ciphertext ct, and decrypt to obtain plaintext m' by calling LTRU.PKE.Dec, passing in sk and ct. Pass into Derive(K', coin'). If decryption is successful m' ≠ and ct = LTRU.PKE.Enc(pk, m'; coin') then return K', otherwise return.

[0064] The key encapsulation method in the present application is to convert the public key encryption method LTRU.PKE which is chosen-plaintext secure into the key encapsulation method LTRU.KEM which is chosen-ciphertext secure by using FO ⊥ The conversion method converts the public key encryption method LTRU.PKE which is chosen-plaintext secure into the key encapsulation method LTRU.KEM which is chosen-ciphertext secure by using FO ⊥ The conversion method converts the public key encryption method LTRU.PKE which is chosen-plaintext secure into the key encapsulation method LTRU.KEM which is chosen-ciphertext secure by using FO

[0065] Further, in steps (2.2) and (2.3), let be a hash function, where is the shared key space of LTRU.KEM, and COINS is the randomness space of LTRU.PKE.Enc.

[0066] The public key encryption method (LTRU.PKE) and the key encapsulation method (LTRU.KEM) as described above, for a distribution ψ, a positive integer d and q, let f', g, r <- ψ, and ε <- χ, where χ is a distribution that samples r <- ψ, e <- {0, 1} n , output where Let then the error rate of LTRU is δ.

[0067] The public key encryption method (LTRU.PKE) as described above is IND-CPA secure under the NTRU one-way hardness assumption, where for any probabilistic polynomial time adversary there exists a probabilistic polynomial time adversary whose running time is comparable to such that: where is a classical adversary, and the hash function is modeled as a classical random oracle; where is a quantum adversary, and the hash function is modeled as a quantum random oracle, and d F is the depth of the query .

[0068] The public key encryption method (LTRU.PKE) as described above, let γ and δ be the weak spread parameter and the decryption error rate of LTRU.PKE respectively. For any probabilistic polynomial time adversary There exists a probabilistic polynomial time adversary attacking the IND-CPA security of LTRU.PKE So that: in the classical random oracle model, Is modeled as a classical random oracle, Query at most Times Query at most q D Times to unpack the oracle, The running time of And In the quantum random oracle model, at this time And The quantum adversary, and Is modeled as a quantum random oracle, Query at most Times Query at most q D Times to unpack the oracle in a classical way, then Where And

[0069] Compared with the prior art, the positive effects of the present application are:

[0070] 1. More compact and efficient: the key generation, encryption and decryption algorithm structure of LTRU is simple, and only one polynomial multiplication is needed in the encryption / decryption process, so the sampling of public key and private key is very efficient. Changing the LTRU parameter set only needs to change the ring parameters: ring dimension n, ring modulus q, and ciphertext compression parameter d.

[0071] 2. Shorter ciphertext length: the LTRU key encapsulation scheme compresses each coefficient from To And d is adjustable, depending on how many bits of the ciphertext need to be discarded. Compared with other NTRU-based schemes, the LTRU scheme has a shorter key length. For example, compared with NTRU-HRSS, LTRU-768 can reduce the ciphertext size by 7% and 15% respectively, corresponding to the case of taking d as 11 and 10.

[0072] 3. No error correction code is needed: the present application first raises the plaintext to times the plaintext, which is equivalent to encoding the plaintext into the ciphertext with a higher bit. Then, in the decryption algorithm, only the norm of the remainder is required to be less than 1 / 2, instead of being a multiple of p. It can also be seen that LTRU does not use error-correcting codes to recover the plaintext. Although error-correcting codes can efficiently implement error correction to recover the plaintext, error-correcting codes make the code implementation more complex and increase the risk of encountering side-channel attacks (such as effective side-channel attacks against error-correcting codes). Specifically, when compressing the ciphertext by 1 bit and 2 bits, the error rate is about 2 -154 .

[0073] 4. Only based on NTRU-related assumptions without additional assumptions: LTRU is only based on the NTRU-OW assumption and can only compress the ciphertext, without additional difficulty assumptions. However, other NTRU-based ciphertext compression schemes all construct a key encapsulation scheme based on multiple difficulty assumptions: based on the NTRU assumption and the RLWE assumption, or based on the NTRU assumption and the RLWR assumption. The introduction of too many difficulty assumptions will cause the scheme to be based on more idealized assumptions. At the same time, analyzing the security strength of them requires analyzing the security strength of two difficulty problems, and taking the minimum value of the two security strengths. Therefore, the security of the scheme depends largely on the difficulty problem with lower security strength. RLWE and RLWR are newer problems that require further cryptographic analysis and verification; the security of the NTRU-related difficulty problem has been safe for more than 20 years of cryptographic analysis and is still safe today, and the key encapsulation scheme designed based on only the NTRU-related difficulty problem does not depend on the difficulty of other assumptions.

[0074] 5. Stronger security against some existing attacks: LTRU has stronger security in both classical and quantum models compared to other NTRU-based schemes. For NTRU attacks, LTRU-648 recommends a security bit of 142 and 129, while NTRU-HRSS only has 136 and 124. BRIEF DESCRIPTION OF DRAWINGS

[0075] Figure 1 Flowchart of key generation in the public key encryption method (LTRU.PKE).

[0076] Figure 2 Flowchart of encryption in the public key encryption method (LTRU.PKE).

[0077] Figure 3 Flowchart of decryption in the public key encryption method (LTRU.PKE).

[0078] Figure 4 Flowchart of key generation in the key encapsulation method (LTRU.KEM).

[0079] Figure 5Flow chart for encapsulation in a key encapsulation method (LTRU.KEM).

[0080] Figure 6 Flow chart for decapsulation in a key encapsulation method (LTRU.KEM).

[0081] Figure 7 Flow chart for the method of the present invention. DETAILED DESCRIPTION

[0082] In order to further illustrate the technical solutions of the present invention, the following further detailed description of the cryptographic system of the present invention is given in connection with specific parameters. The present embodiment can provide a quantum 128-bit target security strength. The dimension n of the polynomial ring can be set to 648, the modulus q can be set to 2917, the compression parameter is d, and the plaintext space modulus p = 2. The underlying polynomial ring Ψ is a probability distribution, is a central binomial distribution mod 3. The public key size is |pk|, the ciphertext size is |ct|, and the B.W. is the communication bandwidth. "C" and "Q" represent the estimated security level in bits in the classical and quantum settings, respectively, and δ represents the error rate. The present invention provides the parameters shown in Table 1 below for reference, but is not limited to the selection of the parameters in the following table.

[0083] Table 1

[0084]

[0085] The present invention is not limited to the above embodiments, and those skilled in the art can make several improvements or modifications without departing from the principles and methods of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention. The contents not described in detail in the specification are the existing technology known to those skilled in the art.

Claims

1. A method of key encapsulation and encryption and decryption of a compressed ciphertext without error correcting code based on NTRU lattice, characterized in that, A public key encryption method and a key encapsulation method are provided. The public key encryption method comprises the following steps: (1.1) generating a public key encryption public-private key pair, specifically: Let be a distribution on the ring ; let be a modulus for the plaintext space, a positive integer; let denote the plaintext space; let denote the set of all polynomials of degree at most ; let denote the set of all polynomials of degree at most ; let denote the set of all polynomials of degree at most ; let denote the set of all polynomials of degree at most ; let denote the set of all polynomials of degree at most ; let denote the set of all polynomials of degree at most ; from Sampling generator polynomials in distribution ,from Medium sampling generator polynomial ,in subscript for The modulus of is a positive integer; calculate , It is an integer; if exist If the operation is irreversible, repeat the above two steps; otherwise, calculate... ,or ,or Alternatively, the public key h can be obtained by removing several low-order bits from each dimension of g / f, where... It is an integer. It is a low-noise polynomial; output As part of the public key As a private key; (1.2) encrypting by using the public key, specifically: Input public key , plaintext from a distribution to generate a polynomial or , from a distribution to generate a polynomial or ; let , or ; compute ciphertext ; compute ; output ciphertext ; wherein is a compression function; is a hash function; is a compression parameter; (1.3) decrypting by using the private key, specifically: Input private key , ciphertext ; compute ; compute ; compute ; output plaintext ; where is a decompression function; is an integer; The key encapsulation method comprises the following steps: (2.1) generating a key encapsulation public-private key pair, specifically: Deriving a public key from a key generation of a public key encryption scheme and a private key , as a public key of a key encapsulation scheme and a private key ; (2.2) key encapsulation, specifically: Enter public key In plaintext space Plaintext generated by random sampling ,pass Export ; Public key plain text and random numbers The ciphertext is obtained by passing it into the encryption algorithm of the public-key encryption scheme. Return ciphertext and random numbers ; (2.3) key decapsulation, specifically: incoming private key , ciphertext , by calling the decryption algorithm of the public key encryption scheme, incoming and decryption, get plaintext ; by export ; if the decryption is successful and equal to the output result after the public key encryption scheme encryption algorithm is input as ), return , otherwise return empty.

2. The method of claim 1, wherein, In step (1.1), is a polynomial ring, let the ring be a general ring, then is its quotient ring, and where is a positive integer; for the ring , one of the following polynomial rings is selected: ， ， ， ； wherein ; wherein is a binary finite field; wherein the polynomial ring is a matrix; wherein ; where the polynomial ring is in the form of a matrix; where is a Dedekind domain; ; where the polynomial ring is of the dual special type of binary truncated polynomials with positive integer coefficients; wherein ; 1), wherein ; wherein is a parameter of the polynomial ring, is an integer representing the degree of the polynomial.

3. The method of claim 1, wherein, In step (1.1), The plaintext space modulus satisfies Select Or 3; and All are rings or The distributions on the surface, where each distribution is a composite of two or more distributions; each plaintext Consider it as a degree The polynomial is a polynomial whose coefficients are in {0,1} or {0,1,2} or {-1,0,1}; for which The multiplication and addition involved are all performed within a polynomial ring. or Operations on.

4. The method of claim 1, wherein, In steps (1.2) and (1.3), , is a distribution over a ring or ; where the multiplication and addition involved in are operations over the polynomial ring or .

5. The method of claim 1, wherein, in steps (1.2) and (1.3), is a hash function, is a public key encryption plaintext space, and the hash function is selected from SHA2-128, SHA2-256 of the SHA2 series, or SHA3-128, SHA3-256, SHAKE128, SHAKE256 hash functions of the SH3 series.

6. The method of claim 1, wherein, In step (1.2) and step (1.3), the compression function used select one of the following: For positive integers and , define the compression function ; For positive integers and , define the compression function 7. The method of claim 1, wherein, In step (1.2) and step (1.3), the decompression function used select one of the following: For positive integers and , define the decompression function ; For positive integers and , define the decompression function 8. The method of claim 1, wherein, The key encapsulation method is converted by employing The conversion method converts a public key encryption method that is chosen-plain-text-secure into a key encapsulation method that is chosen-cipher-text-secure, is a variant of FO conversion.

9. The method of claim 1, wherein, In steps (2.2) and (2.3), a hash function is used wherein is a key-encapsulated shared key space, is a random space of a public-key encrypted decryption algorithm.

10. The method of claim 1, wherein, In the public key encryption method, the ring dimension is selected from {512, 576, 648, 701, 768, 864, 972, 1024, 1152, 1296, 1373}, and the ring modulus is selected from is selected from ; is a polynomial with two or more small coefficients on the ring or is obtained by synthesizing one small coefficient polynomial and one constant polynomial, or is the sum of one small coefficient polynomial with each coefficient subject to a central binomial distribution and one small coefficient polynomial with each coefficient subject to a small interval uniform distribution; p is 2 or 3, = 1, .

Images