Estimation Method for Decryption Error Rate of Lattice-Based Encryption Algorithm with Error-Correcting Code

Abstract

The present invention discloses a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error correction code, which includes: detecting the error correction ability of the error correction code, that is, measuring the number of error bits allowed to occur in a complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm; respectively for each data unit loading the plaintext, detecting the number of encrypted plaintext bits therein, and measuring the probability that at least one bit error occurs in the high-order necessary plaintext in the decryption of each data unit; estimating the upper bound of the number of data units with decryption errors allowed by the error correction code; counting the total number of data units used in a complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm, and calculating the upper bound of the decryption error rate of the lattice-based encryption algorithm. The present invention quickly estimates the decryption error rate of such lattice-based encryption algorithms and measures the upper bound of the decryption error rate.

Description

Technical Field

[0001] The present invention relates to the technical field of quantum computing, and in particular to a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error correction code. Background Art

[0002] Quantum computing is an important development direction for the next generation of computers. In 1994, the Shor quantum algorithm was able to quickly and completely break existing public-key cryptosystems such as RSA, DSA, and those based on elliptic curve point groups. In 1997, the Grover quantum algorithm for breaking symmetric cryptosystems could achieve a speedup of the square level. Therefore, currently in the academic community, anti-quantum public-key cryptosystems are designed based on problems such as lattices, coding, hash functions, multivariate equations, and curve isogenies. Among them, lattice cryptography has the greatest impact.

[0003] The existing Lindner-Peikert-Regev lattice-based encryption algorithm has good properties and wide applications, and its framework is as follows:

[0004]

[0005] Among them, is the residue class ring modulo q, χ s and χ e respectively represent the distributions of the secret vector and the coordinates of the error vector. If χ is a probability distribution on the set S, then x←χ means sampling according to χ on the set S, m represents the plaintext, Encode(m) represents the encoding method of the plaintext, and Decode is the decoding method corresponding to Encode.

[0006] There is a possibility of decryption errors in such lattice-based encryption algorithms. On the one hand, it affects the normal encryption and decryption functions of the cryptographic algorithm, and on the other hand, the decryption error probability affects the security of the cryptographic algorithm to a certain extent. In this regard, some algorithms use error correction codes to reduce the decryption error rate, including Round5, LAC, Scloud, etc. However, how to accurately and quickly estimate the decryption error rate of such lattice-based encryption algorithms when using error correction codes has not been fully solved. Summary of the Invention

[0007] In view of this, the present invention provides a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error correction code, especially for each data unit z using a Hamming distance code q in the case of containing multi-bit plaintext information, quickly estimating the decryption error rate of the lattice-based encryption algorithm and calculating the upper bound of the decryption error rate.

[0008] The present invention discloses a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error correction code, which includes:

[0009] Detect the error correction ability of the error correction code, that is, calculate the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm;

[0010] For each data unit z loaded with the plaintext respectively q , detect the number w of encrypted plaintext bits therein, and calculate the probability δ that at least one bit error occurs in the w high-order plaintext bits in decrypting each data unit z q ; w ;

[0011] Estimate the upper bound of the number of data units z for which the error correction code allows decryption errors q ; wherein, w represents the maximum value of the number of encrypted plaintext bits of each data unit z q ;

[0012] Count the total number of data units z used in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm q , and calculate the upper bound of the decryption error rate of the lattice-based encryption algorithm.

[0013] Furthermore, the calculation formula for the upper bound of the decryption error rate of the lattice-based encryption algorithm is:

[0014]

[0015] wherein, δ is the probability of error in running the lattice-based encryption algorithm with an error correction code once, and δ w is the probability that at least one bit error occurs in decrypting the w high-order plaintext bits in a single data unit z q , and d is the total number of data units loaded with plaintext used in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm ;

[0016] The present invention also discloses a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error correction code, which includes:

[0017] Detect the error correction ability of the error correction code, that is, calculate the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm;

[0018] Estimate the upper bound of the number of data units z for which the error correction code allows decryption errors q ; where w represents the maximum value of the number of encrypted plaintext bits of each data unit z q ;

[0019] Count the total number d of data units z loaded with plaintext used in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm q ;

[0020] For a single data unit z loaded with plaintext q , detect the number of encrypted plaintext bits w therein i , and measure the probability that at least one bit error occurs in the w high-order bits of the decrypted data unit z q ; i For all d data units z

[0021] calculate the convolution of the corresponding sequences; in the sequence obtained during the calculation process, only keep the first 1 + g numbers; q ; accumulate the first 1 + g sequences of the finally obtained convolution sequence and sum them to obtain s, and output δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

[0022] The present invention also discloses a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error correction code, which includes:

[0023] Detect the error correction ability of the error correction code, that is, measure the number τ of allowable error bits in one complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm;

[0024] Estimate the upper bound of the number of data units z of the decryption error allowed by the error correction code

[0025] where w represents the maximum value of the number of encrypted plaintext bits of each data unit z q ; q ;

[0026]

[0027] q ;

[0028] q For each data unit z loaded with plaintext, detect the number of encrypted plaintext bits w therein i , and measure the probability that at least one bit error occurs in the w high-order bits of the decrypted data unit i ;

[0029] Calculate the product of polynomials , and in the polynomials obtained during the calculation process and finally, only keep the terms with degrees not exceeding g, and denote the final polynomial as f(x) = γ0 + γ1x + … + γ g x g ;

[0029] Sum the 1 + g coefficients of f(x): s = γ0 + γ1 + … + γ g, output δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm with error correction code.

[0030] The present invention also discloses a method for estimating the decryption error rate of a lattice-based encryption algorithm with error correction code, which includes:

[0031] Detect the error correction ability of the error correction code, that is, measure the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm;

[0032] Statistically measure the total number d of data units z for loading plaintext used in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm q ;

[0033] For each data unit z for loading plaintext q , detect the number of plaintext bits w encrypted therein i , and measure the probability that at least one bit error occurs in the decryption of the w q bits of plaintext located at the high position in the data unit z i ;

[0034] Calculate the convolution of the sequences corresponding to the d data units z q ; in the sequence obtained during the intermediate calculation process, only keep the first 1 + τ numbers; Accumulate and sum the first 1 + τ numbers of the finally obtained convolution sequence to get s, and output δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

[0035]

[0036] The present invention also discloses a method for estimating the decryption error rate of a lattice-based encryption algorithm with error correction code, which includes:

[0037] Detect the error correction ability of the error correction code, that is, measure the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm;

[0038] Statistically measure the total number d of data units z for loading plaintext used in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm q ;

[0039] For each data unit z for loading plaintext q , detect the number of plaintext bits w encrypted therein i , and measure the probability that at least one bit error occurs in the decryption of the w q bits of plaintext located at the high position in the data unit z i ;

[0040] Calculate the polynomial The product, and in the intermediate calculation process and the finally obtained polynomial, only the terms with degrees not exceeding τ are retained, that is, we get f(x) = γ0 + γ1x + … + γ τ x τ ;

[0041] Sum the 1 + τ coefficients of f(x) to obtain s = γ0 + γ1 + … + γ τ , and output δ = 1 - s as the upper bound of the decryption error rate of the lattice basis encryption algorithm.

[0042] Due to the adoption of the above technical solution, the present invention has the following advantages:

[0043] The present invention encrypts multiple plaintext bits for each modulus data unit and uses an encryption algorithm with error correction codes, and gives several upper bound estimates of the decryption error rate of the algorithm by using multiple convolution calculation modes. The given estimation method can truncate and save a fixed length during calculation, and has a low space complexity; when the number of bits encrypted by a large number of data units is the same, the square-and-multiplication technique can be used to accelerate the operation, and the calculation time efficiency is high. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings.

[0045] Figure 1 It is a schematic diagram of the high-order w bits of the embodiment of the present invention;

[0046] Figure 2 It is a schematic diagram of convolution of the embodiment of the present invention;

[0047] Figure 3 It is a schematic flowchart of a method for estimating the decryption error rate of a lattice basis encryption algorithm with error correction codes according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0048] The present invention will be further described in conjunction with the drawings and embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art shall fall within the scope of protection of the embodiments of the present invention.

[0049] There is a possibility of decryption errors in a major class of existing mainstream lattice-based encryption algorithms. Accurately estimating the decryption error rate of the algorithms is of great significance for security and functionality detection. Existing estimation methods for decryption error rates mainly target the cases where error-correcting codes are not applicable or only 1 plaintext bit is encrypted for each modulus data unit when using error-correcting codes. The present invention is directed to an encryption algorithm that encrypts multiple plaintext bits for each modulus data unit and uses error-correcting codes, and gives several upper bound estimates of the decryption error rate of the algorithm using various convolution calculation modes. The given estimation methods can truncate and save a fixed length during calculation, with low space complexity; when the number of bits encrypted by a large number of data units is the same, the square-and-multiplication technique can be used to accelerate the operation, with high computational time efficiency.

[0050] See Figure 3 , the present invention provides an embodiment of a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error-correcting code, which includes:

[0051] Detect the error-correcting ability of the error-correcting code, that is, measure the number τ of error bits allowed to occur in one complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm;

[0052] For each data unit z that loads the plaintext q , detect the number w of plaintext bits encrypted therein, and measure the probability δ that at least one bit error occurs in the w high-order plaintext bits in decrypting each data unit z q ; see w ; Figure 1 ;

[0053] Estimate the upper bound of the number of data units z for which the error-correcting code allows decryption errors q where, w represents the maximum value of the number of plaintext bits encrypted by each data unit z where, w represents the maximum value of the number of plaintext bits encrypted by each data unit z q ;

[0054] Count the total number of data units z used in one complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm q , and calculate the upper bound of the decryption error rate of the lattice-based encryption algorithm.

[0055] Among them, the calculation formula for the upper bound of the decryption error rate of the lattice-based encryption algorithm is:

[0056]

[0057] where, δ is the probability of an error occurring in one execution of the lattice-based encryption algorithm with an error-correcting code, and δ w is the probability of a single data unit z qThe probability that at least one bit error occurs in the decryption of the w-bit plaintext in the high position, where d is the total number of data units for loading the plaintext used in one complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm. The total number.

[0058] The present invention also provides an embodiment of a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error-correcting code, which includes:

[0059] Detect the error-correcting ability of the error-correcting code, that is, calculate the number τ of error bits allowed to occur in one complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm;

[0060] Estimate the upper bound of the number of data units z of decryption errors allowed by the error-correcting code q The upper bound where w represents the maximum value of the number of plaintext bits encrypted for each data unit z q The maximum number of encrypted plaintext bits;

[0061] Statistically calculate the total number d of data units z for loading the plaintext used in one complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm q The total number;

[0062] For a single data unit z for loading the plaintext q , detect the number of plaintext bits w encrypted therein i , and calculate the probability that at least one bit error occurs in the w q bits of the plaintext in the high position in the decryption of this data unit z i The probability

[0063] Calculate the convolution of the corresponding sequences of all d data units z q ; In the sequence obtained during the intermediate calculation process, only keep the first 1 + g numbers; see ; Figure 2 ;

[0064] Cumulatively obtain the first 1 + g sequences of the final convolution sequence and sum them to get s, and output δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

[0065] The present invention also provides an embodiment of a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error-correcting code, which includes:

[0066] Detect the error-correcting ability of the error-correcting code, that is, calculate the number τ of error bits allowed to occur in one complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm;

[0067] Estimate the upper bound of the number of data units z of decryption errors allowed by the error-correcting code q The upper bound where w represents each data unit zq The maximum number of bits of the encrypted plaintext;

[0068] Statistically measure the total number d of data units z for loading the plaintext used in one complete execution of the encryption and one decryption algorithm in the lattice-based encryption algorithm q ;

[0069] For each data unit z for loading the plaintext q , detect the number of bits w of the encrypted plaintext therein i , and measure the probability that at least one bit error occurs in the decryption of the high-order w i bits in this data unit

[0070] Calculate the product of the polynomials , and in the intermediate process of the calculation and the finally obtained polynomial, only retain the terms with degrees not exceeding g, and denote the final polynomial as

[0071] Sum the 1 + g coefficients of f(x): s = γ0 + γ1 + … + γ g , and output δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

[0072] The present invention also provides an embodiment of a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error-correcting code, which includes:

[0073] Detect the error-correcting ability of the error-correcting code, that is, measure the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithm in the lattice-based encryption algorithm;

[0074] Statistically measure the total number d of data units z for loading the plaintext used in one complete execution of the encryption and one decryption algorithm in the lattice-based encryption algorithm q ;

[0075] For each data unit z for loading the plaintext q , detect the number of bits w of the encrypted plaintext therein i , and measure the probability that at least one bit error occurs in the decryption of the w q bits of the plaintext located in the high position in the data unit z i ;

[0076] Calculate the convolution of the sequences q corresponding to the d data units z ; in the sequence obtained in the intermediate process of the calculation, only retain the first 1 + τ numbers; see Figure 2 ;

[0077] Accumulate and sum the first 1 + τ numbers of the final convolution sequence obtained, to get s, and output δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

[0078] The present invention also provides an embodiment of a method for estimating the decryption error rate of a lattice-based encryption algorithm with an error-correcting code, which includes:

[0079] Detect the error-correcting ability of the error-correcting code, that is, measure the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm;

[0080] Statistically measure the total number d of data units z for loading plaintext used in one complete execution of the encryption and one decryption algorithms in the lattice-based encryption algorithm q ;

[0081] For each data unit z for loading plaintext respectively q , detect the number of encrypted plaintext bits w i , and measure the probability that at least one bit error occurs in the decryption of the w q bits of plaintext located at the high positions in the data unit z i ;

[0082] Calculate the product of polynomials , and in the intermediate process of calculation and the finally obtained polynomial, only keep the terms with degrees not exceeding τ, that is, obtain f(x) = γ0 + γ1x + … + γ τ x τ ;

[0083] Sum the 1 + τ coefficients of f(x) to get s = γ0 + γ1 + … + γ τ , and output δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

[0084] The present invention can quickly estimate the decryption error rate and give an upper bound for the lattice-based encryption algorithm using the Lindner-Peikert-Regev framework with Hamming distance code.

[0085] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: still modifications or equivalent replacements can be made to the specific embodiments of the present invention, and any modification or equivalent replacement without departing from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for estimating the decryption error rate of a lattice-based encryption algorithm with error-correcting codes, characterized in that including: detecting the error correction ability of the error correction code, that is, calculating the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithm in the lattice-based encryption algorithm; For each data unit z loaded with plaintext respectively q , detect the number of encrypted plaintext bits w therein, and measure the probability δ q that at least one bit error occurs in the w-bit plaintext at the high position in decrypting each data unit z w ; Estimate the upper bound on the number of data units z that allow decryption errors in the error-correcting code q The upper bound on the number where w represents each data unit z q The maximum number of encrypted plaintext bits; Count the total number of data units z used in one complete execution of the encryption and one complete execution of the decryption algorithms in the lattice-based encryption algorithm, and calculate the upper bound of the decryption error rate of the lattice-based encryption algorithm. q ​ 2. The method according to claim 1, wherein The formula for the upper bound of the decryption error rate of the lattice-based encryption algorithm is: where δ is the probability of an error occurring in one run of the lattice-based encryption algorithm with error correction code, and δ w is the probability that at least one bit error occurs in the decryption of the w-bit plaintext in the high-order part of a single data unit z q , and d is the total number of data units used to load the plaintext in one complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm .

3. A method for estimating the decryption error rate of a lattice-based encryption algorithm with error-correcting codes, characterized in that, including: detecting the error correction ability of the error correction code, that is, calculating the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithm in the lattice-based encryption algorithm; Estimate the upper bound on the number of data units z of decryption errors allowed by the error correction code q where w represents each data unit z and the maximum value of the number of encrypted plaintext bits; q The upper bound on the number The total number d of data units z for loading plaintext used in a complete execution of the encryption and decryption algorithms in the statistical lattice-based encryption algorithm q ; For a single data unit z loaded with plaintext q , detect the number of encrypted plaintext bits w i , and measure the probability that at least one bit error occurs in the w q high-order plaintext bits in decrypting the data unit z i ​ Compute all d data units z q corresponding to the sequence Convolution; in the sequence obtained during the intermediate calculation process, only keep the first 1 + g numbers; accumulating the first 1 + g sequences of the finally obtained convolutional sequence, summing them up to obtain s, and outputting δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

4. A method for estimating the decryption error rate of a lattice-based encryption algorithm with error-correcting codes, characterized in that, including: detecting the error correction ability of the error correction code, that is, calculating the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithm in the lattice-based encryption algorithm; Estimate the upper bound on the number of data units z of decryption errors allowed by the error correction code q where w represents each data unit z and the maximum value of the number of encrypted plaintext bits q ​ Statistically measure the total number d of data units z for loading plaintext used in a complete execution of the encryption algorithm and one decryption algorithm in the lattice-based encryption algorithm q ; For each data unit z loaded with plaintext q ,detect the number of encrypted plaintext bits w i ,and measure the probability that at least one bit error occurs in the decryption of the high-order w i bits in this data unit Calculate the product of polynomials and, in the intermediate calculation process and the resulting polynomial at the end, only keep the terms with degrees not exceeding g. Denote the final polynomial as f(x) = γ0 + γ1x + … + γ g x g ; Sum the 1 + g coefficients of f(x): s = γ0 + γ1 + … + γ g , and output δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

5. A method for estimating the decryption error rate of a lattice-based encryption algorithm with error-correcting codes, characterized in that, including: detecting the error correction ability of the error correction code, that is, calculating the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithm in the lattice-based encryption algorithm; Statistically measure the total number d of data units z for loading plaintext used in one complete execution of the encryption and one complete execution of the decryption algorithm in the lattice-based encryption algorithm q ; For each data unit z loaded with plaintext q , detect the number of encrypted plaintext bits w i , and measure the data unit z q The probability that at least one bit error occurs in decrypting the w i plaintext bits at the high positions in Calculate d data units z q The corresponding sequence For convolution; in the sequence obtained during the intermediate calculation process, only keep the first 1 + τ numbers; accumulating the first 1 + τ numbers of the finally obtained convolutional sequence and summing them up to obtain s, and outputting δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

6. A method for estimating the decryption error rate of a lattice-based encryption algorithm with error correction code, characterized in that, including: detecting the error correction ability of the error correction code, that is, calculating the number τ of error bits allowed to occur in one complete execution of the encryption and one decryption algorithm in the lattice-based encryption algorithm; Count the total number d of data units z for loading plaintext used in a complete execution of the encryption and decryption algorithms in the lattice-based encryption algorithm for statistical measurement q ; For each data unit z loaded with plaintext q , detect the number of encrypted plaintext bits w i , and measure the data unit z q The probability that at least one bit error occurs in the decryption of the w i bits of plaintext at the high position Calculate the polynomial product, and in the intermediate calculation process and the finally obtained polynomial, only keep the terms with degrees not exceeding τ, that is, we get f(x) = γ0 + γ1x + … + γ τ x τ ; Sum the 1 + τ coefficients of f(x) to obtain s = γ0 + γ1 + … + γ τ , and output δ = 1 - s as the upper bound of the decryption error rate of the lattice-based encryption algorithm.

Images