Quantum Forgery Attack Method, Device and Storage Medium for OTR Structure

Abstract

The present invention discloses a quantum forgery attack method, device and storage medium for OTR structure, which relates to the technical fields of quantum computing and quantum security, and includes the following steps: setting a plaintext block division rule, and using the plaintext blocks to calculate a tag generation formula; encrypting the plaintext blocks into ciphertexts, substituting the ciphertexts into the tag generation formula, and generating a function according to the tag generation formula after substituting the ciphertexts; setting a 2n-bit quantum state, applying a Hadamard transform to the first n qubits of the 2n-bit quantum state to obtain a quantum superposition; substituting the quantum superposition into the generated function to obtain a first state, and applying a Hadamard transform to the first n qubits to obtain a second state; substituting all qubits into the function for measurement, performing multiple experiments on this quantum circuit to obtain n different states, obtaining a period by using Gaussian elimination according to the inner product of the obtained states and the period being 0; forging ciphertexts according to the obtained period.

Description

Technical Field

[0001] The present invention relates to the technical fields of quantum computing and quantum security, and specifically to a quantum forgery attack method, device, and storage medium for an OTR structure. Background Art

[0002] In the research on cryptographic security, authenticated encryption algorithms can simultaneously achieve the confidentiality and integrity verification of information, and are widely used in various network security systems. The authenticated encryption working mode is a cryptographic scheme that solves practical problems such as the privacy and authenticity of user information by encrypting information to generate ciphertext and calculating an authentication tag. Currently, a large amount of information not only needs to be kept confidential during transmission, but also needs to be authenticated after the recipient receives the information to ensure the confidentiality, integrity, and authenticity of the information during transmission. Therefore, it is very necessary to design and study authenticated encryption algorithms. The goal of the CAESAR competition is to determine a set of authenticated encryption algorithms that are reliable, efficient, secure, and have unique properties for different application scenarios. In the initial stage of this encryption competition, a total of 57 algorithms were collected.

[0003] On the other hand, in the quantum world, since the Shor algorithm was proposed, it has been announced that quantum computers will pose a serious threat to public-key cryptography. More and more researchers have started using quantum algorithms to break symmetric cryptographic systems, such as the Simon algorithm and the Bernstein-Vazirani algorithm. In addition, they have also proposed some new quantum algorithms and even extended classical cryptographic analysis methods to the quantum field. Among them, the Simon algorithm was first used to break a 3-round Feistel construction and proved that the Even-Mansour construction is insecure under superposition queries. Inspired by them, Kaplan et al. demonstrated several classical attacks based on finding collisions, and using the Simon algorithm can greatly accelerate the attack speed. Shi et al. also adopted a similar method and achieved a collision attack on the authenticated encryption AEZ in the CAESAR competition.

[0004] The OTR structure is an authenticated encryption structure that can simultaneously ensure the confidentiality and integrity of information and has certain research significance. Many scholars have also been continuously researching forgery attacks on the OTR structure. The research by Hassan et al. shows that some original polynomials will cause collisions between the mask coefficients used in the current instantiation, thus achieving forgery. Zhen et al. proposed a forgery attack on AES-OTR under the condition of known plaintext when the relevant data and public information numbers are reused. However, as far as we know, these forgery attacks have harsh limiting conditions, making the scenarios relatively strict. And currently, there is no quantum attack method for the OTR algorithm, and the existing quantum attack methods cannot solve this problem either. Summary of the Invention

[0005] To address the deficiencies mentioned in the above background art, the purpose of the present invention is to provide a quantum forgery attack method, device, and storage medium for the OTR structure, to solve the problem that the existing technology cannot meet the requirement of quantum forgery attack on the OTR structure in a quantum environment; and to achieve the purpose of forgery attack on block cipher modes of operation.

[0006] The purpose of the present invention can be achieved by the following technical solutions: A quantum forgery attack method for the OTR structure, the method comprising the following steps:

[0007] Set the plaintext block rule and calculate the tag generation formula using the plaintext blocks;

[0008] Encrypt the plaintext blocks into ciphertext, substitute the ciphertext into the tag generation formula, and generate a function according to the tag generation formula after substituting the ciphertext;

[0009] Set a 2n-bit quantum state, apply the Hadamard transform to the first n qubits of the 2n-bit quantum state to obtain a quantum superposition;

[0010] Substitute the quantum superposition into the generated function to obtain a first state, and perform the Hadamard transform on the first n qubits to obtain a second state;

[0011] Substitute all qubits into the function for measurement, conduct multiple experiments on this quantum circuit to obtain n different states, and use Gaussian elimination to obtain the period based on the inner product of the obtained states and the period being 0;

[0012] Forgery the ciphertext according to the obtained period.

[0013] Preferably, the plaintext block rule is:

[0014] M = M[1]||M[2]||M[3]||M[4]||...||M[d];

[0015] M represents the plaintext string, and M[d] represents the d-th plaintext block.

[0016] Preferably, the tag generation formula is:

[0017] TE = E(3L * ⊕δ⊕M[2]⊕M[4]⊕...⊕M[d]);

[0018] In the formula, E represents the encryption algorithm, L* represents the secret parameter, and δ represents the number after encrypting the random number by E. δ = E(N), where N is a random number.

[0019] Preferably, after substituting the ciphertext into the tag generation formula, it becomes:

[0020] TE = E(3L* ⊕δ⊕E(4δ⊕E(5δ⊕C[1])⊕C[2])⊕C[1]⊕E(8δ⊕E(9δ⊕C[3])⊕C[4])⊕C[3]⊕...⊕C[d]);

[0021] C[i] represents the i-th block of ciphertext, L * = L⊕δ, L = 4δ.

[0022] Preferably, the generation process of the function is as follows:

[0023] Select x, θ = C[1]⊕C[3], α, β as inputs, and construct the function f according to the label generation formula:

[0024] f = E(3L * ⊕δ⊕E(4δ⊕E(5δ⊕x)⊕α)⊕E(8δ⊕E(9δ⊕x⊕θ)⊕β)⊕θ⊕...⊕C[d]) as the output, where α is the constant C[2] and β is the constant C[4].

[0025] Preferably, the process of obtaining the quantum superposition is as follows:

[0026] Prepare a 2n-bit quantum state representing n 0 states, apply the Hadamard transformation to the first n qubits to obtain the quantum superposition The first state is

[0027] x is an n-bit string composed of 0 or 1.

[0028] Preferably, the second state is:

[0029]

[0030] where z is an n-bit string composed of 0 or 1. x·z represents multiplying the i-th bit of x and the i-th bit of z in sequence and then adding them up.

[0031] Preferably, the forged ciphertext C' = C[1]⊕s||C[2]||C[3]⊕s||C[4]||...||C[d], where s is the obtained period.

[0032] Preferably, a device includes:

[0033] One or more processors;

[0034] A memory for storing one or more programs;

[0035] When one or more of the said programs are executed by one or more of the said processors, such that one or more of the said processors implement the quantum forgery attack method for the OTR structure as described above.

[0036] Preferably, a storage medium containing computer-executable instructions, the computer-executable instructions being used to execute the quantum forgery attack method for the OTR structure as described above when executed by a computer processor

[0037] Advantages of the present invention:

[0038] The present invention meets the requirements of the quantum forgery attack scheme for the OTR structure in the quantum environment, and meets the purpose of conducting a quantum forgery attack on the block cipher mode of operation; compared with classical attacks, it can reduce the query complexity through the mechanism of quantum mechanics and increase the success probability m. Description of the drawings

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings;

[0040] Figure 1 is a schematic diagram of the OTR encryption process of the present invention excluding the last group of plaintext;

[0041] Figure 2 is a schematic diagram of the encryption process of the last group of plaintext and the tag generation process of OTR of the present invention. Detailed implementation manners

[0042] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0043] As Figure 1 shown, the quantum forgery attack method for the OTR structure includes the following steps:

[0044] Set the plaintext block division rule and calculate the tag generation formula using the plaintext blocks;

[0045] Encrypt the plaintext blocks into ciphertext, substitute the ciphertext into the tag generation formula, and generate a function according to the tag generation formula after substituting the ciphertext;

[0046] Set a 2n - bit quantum state, apply the Hadamard transformation to the first n qubits of the 2n - bit quantum state to obtain a quantum superposition;

[0047] Substitute the quantum superposition into the generated function to obtain the first state, and perform the Hadamard transformation on the first n qubits to obtain the second state;

[0048] Substitute all qubits into the function for measurement, conduct multiple experiments on this quantum circuit to obtain n different states. Based on the inner product of the obtained state and the period being 0, use Gaussian elimination to obtain the period;

[0049] Forgery of the ciphertext is carried out according to the obtained period.

[0050] It should be further noted that in the specific implementation process, assuming that the associated data is an empty string (i.e., TA = 0), the sender sends the ciphertext C and the authentication tag T (TE = TE⊕TA) to the receiver. At this time, the attacker intercepts the ciphertext and the authentication tag T, and divides the ciphertext into blocks (each block has a length of n, connected by a separator), that is, C = C[1]||C[2]||C[3]||C[4]||...||C[d] (where d>4). The attacker wants to forge the ciphertext C' so that it can pass the receiver's verification without being detected (i.e., the authentication tag T' calculated by forging the ciphertext C' = T).

[0051] The decryption formula is M[2i - 1] = E(L⊕δ⊕C[2i - 1]⊕C[2i]), M[2i] = E(L⊕M[2i - 1])⊕C[2i - 1].

[0052] It should be noted that assuming the number of blocks d = 5, the associated data is an empty string, and the intercepted ciphertext C = C[1]||C[2]||C[3]||C[4]||C[5] and the tag T are known. The attacker wants to forge the ciphertext C', and the specific process is as follows:

[0053] Calculate the tag generation formula TE: TE = E(3L * ⊕δ⊕M[2]⊕M[4]⊕E(16δ)⊕C[5]).

[0054] Express the plaintext M[2] in terms of ciphertext: M[2] = E(4δ⊕E(5δ⊕C[1])⊕C[2])⊕C[1].

[0055] Express the plaintext M[4] in terms of ciphertext: M[4] = E(8δ⊕E(9δ⊕C[3])⊕C[4])⊕C[3].

[0056] Express the tag generation formula TE in terms of ciphertext: TE = E(3L *⊕δ⊕E(4δ⊕E(5δ⊕C[1])⊕C[2])⊕C[1]⊕E(8δ⊕E(9δ⊕C[3])⊕C[4])⊕C[3]⊕E(16δ)⊕C[5])。

[0057] Let θ = C[1] ⊕ C[3], and C[2], C[4] be constants α, β respectively. Construct the following function: f : {0, 1} n →{0, 1} n

[0058] x → Tag_OTR(x||x ⊕ σ, α||β)

[0059] = E(3L * ⊕δ⊕E(4δ⊕E(5δ⊕x)⊕α)⊕E(8δ⊕E(9δ⊕x⊕θ)⊕

[0060] Prepare a 2n - bit quantum state Apply the Hadamard transform to the first n qubits to obtain a quantum superposition

[0061] Input the quantum superposition into the function f in Step 4 to get the state

[0062] Apply the Hadamard transform to the first n qubits to obtain

[0063]

[0064] Measure all qubits. The inner product of the measured state |z> and the period s is 0. Conduct multiple trials on this quantum circuit to obtain n different states |z>. Use Gaussian elimination to obtain the period s = 13δ ⊕ θ such that f(x) = f(x ⊕ s).

[0065] According to the obtained period s = 13δ ⊕ θ, forge the ciphertext C' = 13δ ⊕ C[3]||12δ ⊕ C[4]||13δ ⊕ C[1]||12δ ⊕ C[2]||…||C[d].

[0066] Based on the same inventive concept, the present invention further provides a computer device, which includes: one or more processors, and a memory for storing one or more computer programs; the program includes program instructions, and the processor is configured to execute the program instructions stored in the memory. The processor may be a Central Processing Unit (CPU), or may also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, and is used to implement one or more instructions. Specifically, it is used to load and execute one or more instructions in the computer storage medium to implement the above method.

[0067] It should be further noted that, based on the same inventive concept, the present invention further provides a computer storage medium, on which a computer program is stored, and the computer program, when run by a processor, executes the above method. The storage medium may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may, for example, but not be limited to, be an electrical, magnetic, optical, electro-magnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of the computer-readable storage medium include: an electrical connection having one or more wires, a portable computer disk, a hard disk, a Random Access Memory (RAM), a Read Only Memory (ROM), an Erasable Programmable Read Only Memory (EPROM or flash memory), an optical fiber, a portable compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, the computer-readable storage medium may be any tangible medium that contains or stores a program, and the program may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0068] In the description of this specification, the description referring to terms such as "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0069] The foregoing has shown and described the basic principles, main features and advantages of the present disclosure. Those skilled in the art should understand that the present disclosure is not limited by the above embodiments, and what is described in the above embodiments and the specification is only to illustrate the principles of the present disclosure. Without departing from the spirit and scope of the present disclosure, the present disclosure will have various changes and improvements, and these changes and improvements fall within the scope of the present disclosure claimed.

Claims

1. A quantum forgery attack method for OTR structures, characterized in that, The method comprises the following steps: Set the plaintext block division rule, and calculate the tag generation formula using the plaintext blocks; Encrypt the plaintext blocks into ciphertext, substitute the ciphertext into the tag generation formula, and generate a function according to the tag generation formula after substituting the ciphertext; Set a 2n-bit quantum state, and apply the Hadamard transform to the first n qubits of the 2n-bit quantum state to obtain a quantum superposition; Substitute the quantum superposition into the generated function to obtain a first state, and perform the Hadamard transform on the first n qubits to obtain a second state; Substitute all qubits into the function for measurement, conduct multiple experiments on this quantum circuit to obtain n different states, and obtain the period by using Gaussian elimination according to the inner product of the obtained states and the period being 0; Forgery the ciphertext according to the obtained period.

2. The quantum forgery attack method for the OTR structure according to claim 1, characterized in that, The plaintext block division rule is: M = M[1] || M[2] || M[3] || M[4] ||... || M[d]; M represents the plaintext string, and M[d] represents the d-th plaintext block.

3. The quantum forgery attack method for the OTR structure according to claim 1, wherein The tag generation formula is: In the formula, E represents the encryption algorithm, L* represents the secret parameter, δ represents the number after encrypting the random number by E, δ = E(N), and N is a random number.

4. The quantum forgery attack method for the OTR structure according to claim 1, characterized in that, After substituting the ciphertext into the tag generation formula, it is: C[i] represents the i-th ciphertext block, L = 4δ 。 5. The quantum forgery attack method for the OTR structure according to claim 1, characterized in that, The generation process of the function is as follows: Select x, α, β as inputs, and construct a function f according to the formula generated by the label: As the output, where α is the constant C[2] and β is the constant C[4].

6. The quantum forgery attack method for the OTR structure according to claim 1, characterized in that, The process of obtaining the quantum superposition is as follows: Prepare a 2n - bit quantum state Indicating there are n 0 - states, apply the Hadamard transformation To the first n qubits to obtain a quantum superposition The first state is where x is an n - bit string consisting of 0s or 1s.

7. The quantum forgery attack method for the OTR structure according to claim 1, characterized in that, The second state is: Where z is an n-bit string composed of 0 or 1, and x·z represents multiplying the i-th bit of x and the i-th bit of z in sequence and then adding them up.

8. The quantum forgery attack method for the OTR structure according to claim 1, characterized in that, The forged ciphertext where s is the obtained period.

9. A device, characterized in that, It includes: One or more processors; A memory for storing one or more programs; When one or more of the said programs are executed by one or more of the said processors, one or more of the said processors implement the quantum forgery attack method for the OTR structure as described in any one of claims 1-8.

10. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions are used to execute the quantum forgery attack method for the OTR structure as described in any one of claims 1-8 when executed by a computer processor.

Images