A post-quantum secure voprf protocol, anonymous token authentication method and system

Abstract

The application belongs to the technical field of information security, and provides a post-quantum secure VOPRF protocol, an anonymous token authentication method and system, the VOPRF protocol comprising the following steps: a public parameter setting stage, an encoding and requesting stage, a re-encoding and responding stage, and a decoding stage; the anonymous token authentication method comprising the following steps: an initialization stage, a trusted third party generating a CRS; a key generation stage; a signature stage, the client and the server side jointly executing the above-mentioned VOPRF protocol to generate an anonymous token; and a token redemption stage, the client taking the token from a local list and sending it to the server side for verification. The application realizes the post-quantum secure VOPRF protocol and the anonymous token authentication method and system, and can still guarantee the security of the algorithm and the protocol under the threat of powerful computing power of a quantum computer.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and relates to an identity authentication technology in cryptography, in particular to a post-quantum secure VOPRF protocol, an anonymous token authentication method and system. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute prior art.

[0003] With the development of the Internet, people's demand for security is increasingly strong, and network identity security authentication technology has become increasingly important. Identity authentication technology is widely used in the Internet field, and its main role is to ensure identity authenticity, protect data security, prevent identity theft and fraud, and meet compliance requirements. Identity authentication technology can prevent illegal users from obtaining access to resources, thereby protecting the legitimate interests of authorized access. In general Internet scenarios, Internet websites can also authenticate ordinary users by using token authentication technology in identity authentication technology, thereby improving the security of the website and avoiding DDoS attacks.

[0004] Identity authentication is considered the most advanced line of defense in information security, and other security services depend on it. Existing identity authentication technologies are usually divided into password authentication, certificate authentication, biometric authentication, token authentication, etc. These different identity authentication technologies can be combined to form multi-factor authentication, thereby enhancing security.

[0005] Currently, quantum computing technology is developing rapidly, and the quantum computing industry is developing well. Quantum computing uses quantum bits as the basic unit, uses quantum superposition and interference principles to realize parallel computing, and can provide exponential acceleration on some computationally complex problems, enabling a leap in computing power. For some traditional cryptography algorithms, some cracking algorithms running on quantum computers have emerged, such as shor quantum algorithm, Grover algorithm, etc.

[0006] The existing token authentication has the following problems:

[0007] 1. Existing token authentication methods are all constructed based on operators of traditional cryptographic algorithms. These number theory-based cryptographic algorithms are not resistant to quantum computer cracking algorithms. Therefore, how to construct new post-quantum secure cryptographic algorithms has become a hot topic in academia. Research on post-quantum cryptography mainly revolves around how to utilize the advantages of quantum computers to build more secure and efficient cryptographic systems. Given the vulnerability of traditional cryptography, research on post-quantum cryptography is particularly important. A major drawback of existing anonymous token authentication protocols is that their underlying hard problems are easily cracked by quantum computers. Taking Privacy Pass as an example, its security is based on the discrete logarithm problem on elliptic curves. Currently, Shor's algorithm can theoretically break classical public-key cryptographic algorithms such as RSA and ECDSA. Moreover, compared to the RSA algorithm, cryptographic algorithms based on elliptic curves have shorter key lengths and require fewer qubits in quantum attacks, meaning they are easier to crack.

[0008] 2. Currently, post-quantum cryptographic algorithms are mainly constructed based on lattice-based difficult problems, including the Learning with Errors (LWE) problem and the Ring Learning with Errors (RLWE) problem. These difficult problems can then be used to design a post-quantum-secure Oblivious Pseudo Random Function (OPRF) protocol for token generation. In specific implementations, to increase token verifiability, the Zero-Knowledge Proof (ZKP) protocol needs to be combined with OPRF to form a Verifiable Oblivious Pseudo Random Function (VOPRF) protocol, along with key-related hash-based Message Authentication Code (HMAC) technology.

[0009] Most current anonymous token technologies are constructed using the VOPRF protocol. The existing VOPRF protocol on the lattice is the one proposed by Albrecht et al. in 2019. Their protocol requires three rounds of interaction to generate the final pseudo-random function output. Summary of the Invention

[0010] In order to solve at least one technical problem in the above background art, the present application provides a post-quantum secure VOPRF protocol, an anonymous token authentication method and system, which can solve the shortcomings that the anonymous token generated by the traditional cryptography algorithm cannot resist quantum computer attacks, realize post-quantum security, and enrich the existing post-quantum cryptography technology. At the same time, the lattice VOPRF protocol constructed only needs two rounds of interaction, reduces the communication rounds, and realizes the round-optimal post-quantum secure VOPRF protocol. In order to achieve the above purpose, the technical scheme is as follows:

[0011] The first aspect of the present application provides a post-quantum secure VOPRF protocol, comprising the following steps:

[0012] The public parameter setting stage: the trusted third party generates a public reference string and sends it to the participants in the system;

[0013] The encoding and request stage: the client generates a random message, a secret factor, an error factor and a blind factor in combination with the public reference string, encodes the random message, blind processes the encoded random message in combination with the secret factor, the error factor and the blind factor, and generates a client proof file, and sends the blind processing result and the client proof file to the server as a request;

[0014] The re-encoding and response stage: the server verifies the client proof file, if the verification is passed, the server signs the blind processing result of the message and generates a server proof file, and the server sends the proof file and the signed blind processing result to the client;

[0015] The decoding stage: the client verifies the server proof file, if the verification is passed, the signature of the blind processing result is de-blinded, and the signature value is calculated.

[0016] The second aspect of the present application provides a post-quantum secure anonymous token authentication method, comprising the following steps:

[0017] The initialization stage: the trusted third party generates a public reference string;

[0018] The key generation stage: the client generates a key locally;

[0019] The signature stage: the client generates a random message in batches and encodes the message, and then the client and the server execute a post-quantum secure VOPRF protocol as described in the first aspect to generate a signature value and store locally;

[0020] The token redemption stage: the client takes out the local signature value and generates an HMAC value, and then sends the message and the HMAC value to the server, and the server verifies whether it has been used and whether it is valid.

[0021] A third aspect of the present application provides a post-quantum secure anonymous token authentication system, comprising:

[0022] An initialization module configured to generate a public reference string by a trusted third party;

[0023] A key generation module configured to generate a key locally by a client;

[0024] A signature stage module configured to generate random messages in batches and encode the messages by the client, and then the client and the server execute a post-quantum secure VOPRF protocol to generate a signature value and store locally;

[0025] A token redemption stage module configured to take out the signature value locally by the client and generate an HMAC value, and then send the message and the HMAC value to the server, and the server verifies whether it has been used and whether it is valid.

[0026] Compared with the prior art, the present application has the following advantages:

[0027] 1. Compared with the traditional oblivious pseudo-random function protocol, the protocol of the present application is constructed based on the decision RLWE problem, and the underlying pseudo-random function is constructed based on the 1D-SIS assumption on the lattice, so it has post-quantum security, and the secret factor, the error factor and the blind factor are combined to blind the encoded random message, which can resist the computing power of quantum machines in the future, so as to realize the security of protecting sensitive information in the quantum era.

[0028] 2. The protocol of the present application is optimized in rounds. Compared with the lattice-based verifiable oblivious pseudo-random function proposed by Albrecht et al., the present protocol reduces the interaction between the sender and the receiver by one round, reduces the three-round interaction to two rounds, and thus reduces the communication overhead.

[0029] The advantages of the additional aspects of the present application will be partially given in the following description, partially become obvious from the following description, or be understood through the practice of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0030] The drawings accompanying the specification of the present application form a part thereof, serve to provide further understanding of the present application, and together with the description of the exemplary embodiments of the present application and their description serve to explain the present application, and do not constitute an improper limitation of the present application.

[0031] Figure 1 is the principle diagram of the post-quantum secure VOPRF protocol provided by the embodiment of the present application;

[0032] Figure 2is the principle diagram of the post-quantum secure anonymous token authentication method provided by the embodiment of the application;

[0033] Figure 3 is the overall framework diagram of the post-quantum secure anonymous token authentication method provided by the embodiment of the application;

[0034] Figure 4 is the overall framework diagram of the post-quantum secure anonymous token authentication system provided by the embodiment of the application. DETAILED DESCRIPTION

[0035] The application will be further described below in conjunction with the accompanying drawings and embodiments.

[0036] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the application. Unless otherwise indicated, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the application pertains.

[0037] It should be noted that the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the exemplary embodiments according to the application. As used herein, the singular form is intended to include the plural form unless the context clearly indicates otherwise, and furthermore, it should be understood that when the terms "comprise" and / or "include" are used in the specification, there is a presence of the features, steps, operations, devices, components and / or combinations thereof.

[0038] Term Explanation

[0039] A token is a kind of credential for identity authentication and authorization, usually a string of characters. Currently, tokens are generally generated by combining a hash algorithm and a traditional encryption algorithm in an encrypted or signed manner. In web applications, tokens are usually used to protect the security of API interfaces, and their role is to serve as a credential for the server to verify client information to distinguish whether the client has the right to access specific resources.

[0040] In view of the current anonymous token technology mentioned in the background art, most of which is constructed by VOPRF protocol, three rounds of interaction are needed to generate the final output of the pseudo-random function, the present application constructs a new round-optimal post-quantum VOPRF protocol, and the lattice VOPRF protocol proposed in the present application has lower rounds than the previous lattice VOPRF protocol;

[0041] In view of the shortcoming that the existing anonymous token protocol in the background art cannot resist quantum computers, the present application constructs a post-quantum secure anonymous token protocol based on the VOPRF protocol.

[0042] Embodiment one

[0043] AsFigure 1 As shown, the embodiment provides a post-quantum secure verifiable oblivious pseudo-random function protocol, comprising the following steps:

[0044] S101: Deterministic ring fault-tolerant learning assumption

[0045] Given a security parameter λ; Let the integral coefficient polynomial ring be R q = Z q [x] / f(x), where the integer q=q(λ)≥2, the irreducible polynomial f(x) is a cyclotomic polynomial N is a power of 2; R q The coefficients of the polynomials in R q are taken from Z q , the operations of the coefficients are modulo q addition and modulo q multiplication, and the highest order term of the polynomial in R q is N-1; The operations of the polynomials in R q are polynomial addition, subtraction, and polynomial multiplication modulo the irreducible polynomial f(x); The discrete Gaussian distribution on the ring R is denoted as R(χ(σ)), and σ is the standard deviation. The coefficients of the polynomials in R(χ(σ)) satisfy the discrete Gaussian distribution χ(σ); We denote the left arrow symbol "a←b" as an element a uniformly randomly selected from a set b. Let the left arrow symbol "a←b" represent an element a uniformly randomly selected from a set b.

[0046] For the following two distributions:

[0047] (1)

[0048] (2) Uniform distribution For example, {a, b: a←R q , b←R q}.

[0049] If the probability of anyone distinguishing the uniform distribution from the independent sample distribution is negligible, then the two distributions can be said to be computationally indistinguishable;

[0050] S102: Public parameter setting stage

[0051] A trusted third party generates a public reference string CRS and sends the above elements to the participants in the system, including the client and the server;

[0052] Wherein, the public reference string CRS includes: an auxiliary factor a uniformly randomly selected from , two information encoding factors a0, a1; denotes the space composed of all l-long polynomial vectors, and the vector is composed of l Rq The polynomials on the surface are composed of [a].

[0053] S103: Encoding and Requesting Phase

[0054] The client generates a random message and encodes it, then performs blinding processing and generates a client-side proof file. Finally, the blinding processing result and the client-side proof file are sent to the server as a request.

[0055] Specifically:

[0056] The client generates random messages m∈{0,1} L In addition to the secret factor s, error factor e, error factor e0, error factor e1, and blind factor r, the message m is first encoded as... element a in F (m), and then the encoded message a F (m) is blinded to obtain (c0,c1), and a client proof file is generated using non-interactive zero-knowledge proof technology. Finally, the blinded result (c0,c1) and the client proof file are sent to the server as a request.

[0057] In this embodiment, the secret factor s and the blind factor r are uniformly and randomly selected from R(χ(σ)), and the error factors e, e0, and e1 are all selected from R(χ(σ)). l The samples were randomly selected evenly from the middle.

[0058] Where R(χ(σ)) is a discrete Gaussian distribution on the ring R, σ is the standard deviation, and the elements in R(χ(σ)) are of the form a0+a1x 1 +a2x 2 +…+a N x N-1 An integer polynomial of degree N-1, the coefficients of which take the values ​​of a discrete Gaussian distribution χ(σ);

[0059] R(χ(σ)) l Let R(x(σ)) represent a set of polynomial vectors, where each element is a vector consisting of l polynomials over R(x(σ)).

[0060] The encoding and request phase specifically includes the following steps:

[0061] S301: The client uses a special function a F Convert the message element a in F (m);

[0062] Among them, the special function a F For a PRF on a lattice, the specific processing procedure is as follows:

[0063] By calculating The message m∈{0,1} L is converted into a vector composed of l polynomials Where m i , i∈{1,2,…,L} represents the value of the i-th bit of the message, L represents the length of the message, i∈{1,2,…,L} corresponds to two information encoding factors a0 and a1, G -1 is mapped to a binary decomposition operation.

[0064] Where G -1 The specific process of mapping is: let Given a vector composed of l polynomials Then is an lxl size matrix composed of polynomials, the process is to perform binary decomposition on all coefficients of the l polynomials in a0, let the low bits be on the top and the high bits be on the bottom, and if the decomposition is less than l bits, fill 0 to make it l bits; then the bit values of each polynomial decomposition are regarded as new polynomial coefficient to form new polynomials, each polynomial can be decomposed into l new polynomials, where the new polynomial coefficient is 0 or 1.

[0065] S302: The client performs blind processing on the encoded message: the client first calculates the secret auxiliary factor Then calculate the blind processing results c0 and c1 through the secret auxiliary factor b.

[0066] The secret auxiliary factor b = a·s + e, and then calculate c0 = a·r + e0, c1 = b·r + e1 + a F (m) to obtain the blind processing results c0 and c1.

[0067] S303: The client generates a client proof file, which includes the client proof π C , challenge polynomial ch1 and auxiliary proof data c'0 and c'1.

[0068] Where, the client proof π C = zkProve C (stmt C = (c0, c1, a, a0, a1, b): wits C = (r, e0, e1, m)), zkProve C represents the client proof system; stmt C is the client's statement (Statement), which is composed of message blind processing results c0, c1, auxiliary factor a, information encoding factors a0 and a1, and secret auxiliary factor b; wits CIt is the client's Witness, which consists of the blind factor r, the error factor e0, the error factor e1, and the message m; the colon ":" represents the separator, the part before the colon is the statement, and the part after the colon is the Witness;

[0069] The client's proof system satisfies the following relation:

[0070]

[0071] Specifically, it includes:

[0072] S3031: The client generates r′, e′0, e′1 and a random message m′∈{0,1}. L a is calculated by applying the calculation method in S301. F (m′);

[0073] Where r′ is uniformly and randomly selected from R(χ(σ)), and e′0 and e′1 are selected from R(χ(σ)). l The samples were randomly selected evenly from the middle.

[0074] S3032: The client calculates the data c′0, c′1 for the auxiliary proof;

[0075] Where c′0=a·r′+e′0, c′1=b·r′+e′1+a F (m′);

[0076] S3033: Client-side sampling challenge polynomial ch1;

[0077] The coefficients of ch1 are selected from {-1,0,1}, with probabilities Pr(0)=1 / 2 and Pr(-1)=pr(1)=1 / 4 respectively. Alternatively, they can be generated in a non-interactive way, ch1=H(c′0,c′1,c0,c1), where H is a hash function. The following steps use ch1 generated in a non-interactive way.

[0078] S3034: Client generates client proof

[0079] Where π r =ch1·r+r′, π m =ch1·a F (m)+a F (m′);

[0080] S3035: The client sends data to the server, specifically including the results of the blinding process c0 and c1, the auxiliary proof data c′0 and c′1, and the client's proof. And the challenge polynomial ch1.

[0081] S104: Recoding and Response Phase

[0082] The server verifies the client's authentication document sent by the client. If the client's authentication document passes verification, the server signs the blind processing result (c0, c1) of the message and generates a server-side authentication document using zero-knowledge proof technology. The server then combines the authentication document with the signed blind processing result. Send to the client;

[0083] The recoding and response phase specifically includes the following steps:

[0084] S401: The server generates the server signature key k and error factor. and

[0085] Where k is randomly selected uniformly from R(χ(σ)), and It is from R(χ(σ)) l Uniformly and randomly selected from the middle;

[0086] S402: Server-side verification of client-side verification documents;

[0087] The client-side proof is π. C , with b v This indicates the verification result; the verification process involves judgment. and If both equations are true, then the verification passes. v If the value is 1, then the verification fails. v =0; where π r , and π m From π C c′0 and c′1 are parameters from the auxiliary proof calculated in S203.

[0088] S403: The server signs the result of blind processing: If the client's verification of the proof document passes, the server signs the received blind processing result to obtain...

[0089] in

[0090] S404: Server-side generation of server-side verification documents: The server-side verification documents include server-side verification π S Challenge polynomial ch2 and data for auxiliary proof and

[0091] wherein

[0092] zkProve S represents the server-side proof system; stmt S is the server-side statement (Statement) composed of the signature result ; wits C is the server-side witness (Witness) composed of the server signature key k, error factor and ; the colon “:” represents the separation, and the part before the colon is the statement (Statement), and the part after the colon is the witness (Witness); the server-side proof system satisfies the following relation (Relation):

[0093]

[0094] Specifically includes:

[0095] S4041: The server side generates k′, and

[0096] wherein k′ is uniformly randomly selected from R(χ(σ)), and are uniformly randomly selected from R(χ(σ)) l ;

[0097] S4042: The server side calculates the data of the auxiliary proof and

[0098] wherein

[0099] S4043: The server side samples the challenge polynomial ch2: The coefficients of ch2 are selected from {-1, 0, 1}, and the selection probabilities are Pr(0) = 1 / 2, Pr(-1) = pr(1) = 1 / 4, or it can be generated in a non-interactive manner, wherein H is a hash function, and the following steps use the non-interactive generated ch2;

[0100] S4044: The server side generates the server-side proof

[0101] wherein π k = ch2·k+k′,

[0102] S4045: The server side sends data to the client, specifically including the signature result Data of auxiliary proof and Server-side proof and challenge polynomial ch2.

[0103] S105: Decoding stage, the client verifies the server-side proof file sent by the server, if the server-side proof file is verified, the client performs unblinding operation on the signature of the blind processing result, calculates the signature value y;

[0104] The decoding stage specifically includes the following steps:

[0105] S501: The client verifies the server-side proof file;

[0106] Wherein the server-side proof is π S , b v represents the verification result, and the verification process is to judge whether the following two equations are established at the same time: and If they are established at the same time, the verification is passed, b v is 1, otherwise the verification is failed, b v is 0; Wherein π k , and come from π C , and come from the parameters of the auxiliary proof calculated in S3045;

[0107] S502: The client performs unblinding operation: if the verification of the server-side proof file is passed, the client performs unblinding operation on the received signature to obtain the final random number polynomial

[0108] Wherein y represents the signature value, p represents an integer less than q selected, represents rounding a rational number to its nearest natural number, can convert the elements in Z q to the elements in Z p .

[0109] Embodiment two

[0110] The embodiment provides a post-quantum secure anonymous token authentication method, as shown in the following figure, specifically comprising the following steps: Figures 2-3

[0111] ​​S101: initialization phase: a trusted third party generates a public reference string CRS and sends the CRS to the participants in the system, including the client and the server;

[0112] wherein the CRS includes an auxiliary factor a, two information encoding factors a0, a1, which are uniformly randomly selected from ; and a polynomial vector space , where the vector is composed of l polynomials on q ; and a polynomial vector space

[0113] S102: key generation phase: the client generates a key locally, including a public key b and a secret key s, and then sends the public key b to the server and privately saves the secret key s locally;

[0114] wherein the public key b of the client is uniformly randomly selected from ; and the secret key s of the client is uniformly randomly selected from l .

[0115] S103: signature phase: the client generates random messages in batches and encodes the messages, and then the client and the server execute the verifiable oblivious pseudo-random function protocol described in embodiment one to generate a signature value and store it locally;

[0116] The client first performs blind processing on the messages, and then sends the blind-processed messages and the client's proof file to the server; the server first verifies the client's proof file, and if it passes, it signs the blind-processed result, and then sends the blind signature and the server's proof file to the client, and if it does not pass, it stops executing; the client first verifies the server's proof, and if it passes, it performs de-blinding on the blind signature to obtain the final signature result, and if it does not pass, it stops executing;

[0117] Specifically, the following steps are included:

[0118] S301: the client generates random messages, error factors, and blind factors in batches, and uses a special function a F to convert all the messages into elements in , and then performs blind processing on all the converted messages to obtain n pairs of processed results, and generates a client batch proof file through zero-knowledge proof technology, and finally the client sends all the blind-processed results and the client batch proof file to the server;

[0119] The following will be described in detail in the form of embodiments:

[0120] S3011: the client generates n messages {m i}i∈[n] n blind factors {r i} i∈[n] n error factors {x i} i∈[n] and n error factors {y i} i∈[n] ;

[0121] Each message m i For each string i ∈ {1, 2, ..., n}, it is a binary string of length L, i.e., m i ∈{0,1} L , where m i,j ∈{0,1}, j∈{1,2,…,L}, for m i The j-th bit value; each blind factor r i The values ​​of i ∈ {1,2,…,n} are all uniformly and randomly selected from R(χ(σ)); each error factor x i , i∈{1,2,…,n}, are all derived from R(χ(σ)). l The error factor y is obtained by uniform random selection; i , i∈{1,2,…,n}, are all derived from R(χ(σ)). l The elements are obtained by uniform random selection; R(χ(σ)) is a discrete Gaussian distribution on the ring R, σ is the standard deviation, and the elements in R(χ(σ)) are of the form a0+a1x 1 +a2x 2 +…+a N x N-1 An integer polynomial whose coefficients take values ​​that satisfy a discrete Gaussian distribution χ(σ); R(χ(σ)) l Let R represent the space consisting of polynomial vectors, where each vector consists of l polynomials over R(χ(σ));

[0122] Here, [n] represents the set {1,2,…,n}, and {x} represents the set {x}. i} i∈[n] Let the set {x1, x2, ..., x} represent... n}, using {(x i ,y i )} i∈[n] Let the set {(x1,y1),(x2,y2),…,(x...} represent the set {x1,y1),(x2,y2),…,(x...}. n ,y n The representation of other sets consisting of tuples with more elements follows the same pattern.

[0123] S3012: The client encodes all messages: the client uses a special function a F Each message m i ∈{0,1}L , i e {1, 2,..., n}, is converted into the element in i e {1, 2,..., n};

[0124] where the special function a F is a PRF on a lattice, and the specific processing process is: by calculating the message m i e {0, 1} L is converted into a vector composed of l polynomials where m i,j e {0, 1}, i e {1, 2,..., L}, j e {1, 2,..., L}, represents the value of the jth bit of the ith message, corresponding to the two information encoding factors a0 and a1 in S1, G -1 is mapped to a binary decomposition operation;

[0125] where G -1 The specific process of mapping is: let Given a vector composed of l polynomials then is an lxl matrix composed of polynomials, and the process is to perform binary decomposition on all coefficients of the l polynomials in a0, let the low bits be on the top and the high bits be on the bottom, and if the decomposition is less than l bits, fill 0 to make it l bits. Then the bit values of each polynomial after decomposition are regarded as new polynomial coefficient groups to form new polynomials, and each polynomial can be decomposed into l new polynomials, where the new polynomial coefficients are 0 or 1.

[0126] S3013: The client performs blind processing on each encoded message i e {1, 2,..., n} to obtain n pairs of blind processing results btk = {(c i , d i )} i∈[n] ;

[0127] where

[0128] S3014: The client generates a client batch proof file, and the client proof file includes the client batch proof π C , the challenge polynomial ch, and the auxiliary proof data c' and d';

[0129] where π C = zkProve C (stmt C = (btk, a, a0, a1, b): wits C = ({r i , x iy i ,m i} i∈[n] zkProve C represents the client batch proof system; stmt C is the statement generated by the client (Statement), which is processed by the message blind btk = {(c i ,d i} i∈[n] , auxiliary factor a, information encoding factors a0 and a1, and client public key b; wits C is the witness generated by the client (Witness), wits C is composed of n blind factors {r i} i∈[n] , n error factors {x i} i∈[n] , n error factors {y i} i∈[n] , and n messages {m i} i∈[n] ; the colon “:” represents the separation, and the part before the colon is the statement (Statement) and the part after the colon is the witness (Witness);

[0130] S30141: the client generates r', x', y' and a random message m' ∈ {0,1} L , and calculates a F (m') by applying the calculation method in S3012;

[0131] where r' is uniformly randomly selected from R(χ(σ)), x' and y' are uniformly randomly selected from R(χ(σ)) l ;

[0132] S30142: the client calculates the data c' and d' of the auxiliary proof;

[0133] where c' = a·r' + x', d' = b·r' + y' + a F (m');

[0134] S30143: the client samples the challenge polynomial ch1: the coefficients of ch1 are selected from {-1,0,1} with probabilities Pr(0) = 1 / 2, Pr(-1) = pr(1) = 1 / 4, or can be generated in a non-interactive manner, ch1 = H(c', d', c1, c2, …, c n ,d1, d2, …, d n ), where H is a hash function, and the following steps use the non-interactive generated ch1;

[0135] S30144: Client generates client proof π C =(π) r ,π x ,π y ,π m );

[0136] Where π r =ch1·(r1+r2+…+r) n )+r′,π x =ch1·(x1+x2+…+x) n )+x′,π y =ch1·(y1+y2+…+y n )+y′,π m =ch1·(a F (m1)+a F (m2)+…+a F (m n ))+a F (m′);

[0137] S30145: The client sends data to the server, specifically including the result of the blinding process: btk = {(c i ,d i )} i∈[n] , auxiliary proof data c′ and d′, and client-side batch proof π C =(π) r ,π x ,π y ,π m And the challenging polynomial ch1;

[0138] S302: The server verifies the client's batch verification file sent by the client. If the client's batch verification file passes, the server-side key k is used to process all blind processing results btk = {(c i ,d i )} i∈[n] Sign to obtain all blinded tokens Zero-knowledge proof technology is used to generate batch server-side proof files, and finally all blinded tokens (OTKs) and their associated server-side proof files are sent to the client.

[0139] S3021: Server-side generation of server signature key k, error factor and

[0140] Where k is randomly selected uniformly from R(χ(σ)), and i∈{0,1,….,n}, all are from R(χ(σ)) lare uniformly and randomly selected from R(χ(σ));

[0141] S3022: Server-side verification of the client's proof file: the client's batch proof is π C , where b v represents the verification result, and the verification process is to judge whether and the two equations are simultaneously established, and if so, the verification is passed, b v is 1, otherwise the verification is failed b v is 0; where π r , π x , π y and π m come from π C , c' and d' come from the parameters of the auxiliary proof calculated in S30142;

[0142] S3023: Server-side signature of the results of blind processing: if the verification of the client's batch proof file is passed, the server-side signs all the received blind processing results btk to obtain

[0143] where

[0144] S3024: Server-side generation of the server-side batch proof file, which includes the server-side batch proof π S , the challenge polynomial ch2 and the data of the auxiliary proof and

[0145] where zkProve S represents the server-side proof system; stmt S is the server-side statement (Statement), which is composed of the signature result otk and btk; wits C is the client's witness (Witness), which is composed of the server-side signature key k, the error factor and the error factor ; the colon ":" represents the separation, and the part before the colon is the statement (Statement), and the part after the colon is the witness (Witness);

[0146] S30241: Server-side generation of k', and

[0147] where k' is uniformly and randomly selected from R(χ(σ)), and are uniformly randomly selected from R (χ (σ)) l ;

[0148] S30242: Server-side computing auxiliary proof data and

[0149] wherein

[0150] S30243: Server-side sampling challenge polynomial ch2: the coefficients of ch2 are selected from {-1, 0, 1}, and the selection probabilities are Pr(0) = 1 / 2, Pr(-1) = pr(1) = 1 / 4, or can be generated in a non-interactive way, wherein H is a hash function, and the following steps use a non-interactive way to generate challenge polynomial ch2;

[0151] S30244: Server-side generating server-side proof

[0152] wherein

[0153] S30245: Server-side sending data to the client, specifically including the signed result otk, auxiliary proof data and server-side proof and challenge polynomial ch2;

[0154] S303: The client verifies the server-side batch proof file sent by the server side, if the server-side batch proof file is verified, the client performs the de-blinding operation on the signature otk of the blind processing result, calculates all tokens utk = {z i} i∈[n] , and stores the user identity uid, all messages and the tokens {(m i , z i )} i∈[n] in the local list , a total of n records;

[0155] Server-side batch proof file verification: the server-side batch proof is π S , and b v represents the verification result, and the verification process is to judge and whether the two equations are simultaneously established, if they are simultaneously established, the verification is passed b v is 1, otherwise the verification is not passed b v is 0; wherein π k , and From π C , and Parameters from the auxiliary proof calculated in S3024;

[0156] S304: If the verification passes, the client performs a deblinding operation on the received signature otk to obtain all tokens {z i} i∈[n] and will uid, {(m i ,z i )} i∈[n] Stored in local list middle;

[0157] in y represents the signature value, and p represents the selected integer less than q. This represents rounding a rational number to its nearest natural number. Z can be q Convert the elements in to Z p The elements in.

[0158] S104: Token redemption phase: The client retrieves the local signature value and generates an HMAC value. Then, the message and the HMAC value are sent to the server. The server verifies whether it has been used and whether it is valid.

[0159] The client first starts from the local list Retrieve a valid token (uid, m) i ,z i Then generate the HMAC key k. mac And calculate the HMAC value out of the requested bound data dt. mac The client will (m i ,out mac The token is sent to the server. The server first verifies whether the token has already been used. If it has not been used, it simulates the client's process to generate the HMAC value out'. mac If they are equal, then (m) i The ,dt) is stored on the server side; otherwise, execution stops and client access is denied.

[0160] Specifically, the steps include the following:

[0161] S401: The client first retrieves a record (uid, m) from its local machine. i ,z i Then generate the HMAC key k. mac And calculate the HMAC value out of the requested bound data dt. mac The client will (m i ,out mac) to the server side;

[0162] where k mac = sKey(uid, m i , z i ), sKey is a hash function; the request binding data dt is public and can be obtained by request, and dt can be set as the content of the "Host" header and the HTTP path in the request;

[0163] S402: The server first verifies whether the message m i used by the token exists in the list locally on the server side, if not, the verification is passed, and the token and out' are generated by simulating the process of the client, if exists, the execution is terminated; mac

[0164] where the generation process is: first, calculate a F (m i ) by the calculation method in S3.1.2, then calculate the token key k' mac = sKey(uid, m i , utk'), Finally, judge whether out' mac is equal to out mac , if equal, the token is valid, and (m i , dt) is stored in , otherwise, the token is invalid, and the execution is terminated.

[0165] Embodiment three

[0166] As shown in Figure 4 , the embodiment provides a post-quantum secure anonymous token authentication method system, comprising:

[0167] An initialization module configured to generate a public reference string by a trusted third party;

[0168] A key generation module configured to generate a key locally by a client;

[0169] A signature stage module configured to generate random messages in batches and encode the messages by a client, and then the client and the server side execute the post-quantum secure VOPRF protocol of embodiment one to generate a signature value and store locally;

[0170] A token redemption stage module configured to take out the local signature value and generate an HMAC value by a client, and then send the message and the HMAC value to the server side, and the server side verifies whether it has been used and whether it is valid.​

[0171] The above description is only the preferred embodiment of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A post-quantum-safe VOPRF protocol, characterized in that, Includes the following steps: Public parameter setting phase: A trusted third party generates a public reference string and sends it to the participants in the system; Encoding and Requesting Phase: Combining the common reference string, the client generates a random message, a secret factor, an error factor, and a blind factor, and encodes the random message. Combining the secret factor, error factor, and blind factor, the client performs blinding processing on the encoded random message and generates a client-side proof file. The blinding processing result and the client-side proof file are sent to the server together as a request. Re-encoding and response phase: The server verifies the client's proof document. If the verification passes, the server signs the blind processing result of the message and generates a server-side proof document. The server then sends the proof document and the signed blind processing result to the client. Decoding phase: The client verifies the server-side proof document. If the verification passes, the client performs a deblinding operation on the signature of the blind processing result and calculates the signature value.

2. The post-quantum-secure VOPRF protocol as described in claim 1, characterized in that, The public reference string includes: from Auxiliary factors selected uniformly and randomly and two information encoding factors ;in, all The space consisting of long polynomial vectors, where the vectors are... indivual The polynomials on the surface are composed of [a].

3. The post-quantum-secure VOPRF protocol as described in claim 2, characterized in that, The method for encoding random messages is as follows: using a special function. Convert the message elements in ; in, , will message Convert to A vector composed of polynomials ,in The message indicates the first The value of the bit, L Indicates the length of the message. , Corresponding to two information encoding factors and , The mapping is a binary decomposition operation.

4. The post-quantum-secure VOPRF protocol as described in claim 1, characterized in that, The process of blinding the encoded random message by combining a secret factor, an error factor, and a blinding factor includes: Combining auxiliary factors from a common reference string and randomly generated secret factors The secret auxiliary factor is calculated from the first error factor; The first blinding result is calculated based on the auxiliary factor of the public reference string, the randomly generated second error factor, and the blinding factor; The second blinding result is obtained by combining the secret auxiliary factor, the randomly generated third error factor, the blinding factor, and the blinding of the encoded message.

5. A post-quantum-secure VOPRF protocol as described in claim 1, characterized in that, The server-side verification of the client's supporting documents includes: Client proof document is ,by This indicates the verification result; the verification process involves judgment. and Check if both equations are true. If both are true, the verification passes. The value should be 1; otherwise, the verification will fail. =0, where , , as well as From , As an auxiliary factor, As a secret auxiliary factor, and This is the result of message blind processing. and Parameters from the auxiliary proof in the client's proof file, To challenge polynomials; Alternatively, the client-side verification server-side proof document may include: The server-side file is proven to be... ,by This indicates the verification result; the verification process involves judgment. as well as If both equations are true, then the verification passes. The value should be 1; otherwise, the verification will fail. =0; where as well as From , and This is the result of message blind processing. and The result of blind processing of the signature. and Parameters from the auxiliary proof in the server-side proof file. To challenge polynomials.

6. A post-quantum-secure VOPRF protocol as described in claim 1, characterized in that, The protocol also includes a fault-tolerant learning phase on a decision ring to substantiate the protocol's post-quantum security, including whether anyone can distinguish uniform distributions. and independent sample distribution The probabilities of both distributions can be ignored, so the probabilities of the two distributions mentioned above... and They are indistinguishable in terms of calculation.

7. A post-quantum secure anonymous token authentication method, characterized in that, Includes the following steps: Initialization phase: A trusted third party generates a public reference string; Key generation phase: The client generates the key locally; Signature phase: The client generates random messages in batches and encodes the messages. Then, the client and server execute a post-quantum-safe VOPRF protocol as described in any one of claims 1-6 to generate signature values ​​and store them locally. Token redemption phase: The client retrieves the local signature value and generates an HMAC value, then sends the message and the HMAC value to the server. The server verifies whether it has been used and whether it is valid.

8. A post-quantum secure anonymous token authentication method as described in claim 7, characterized in that, During the key generation phase, the client generates a key locally, including a public key. and secret key Then the public key Send to the server, with the secret key Stored locally and privately.

9. A post-quantum secure anonymous token authentication method as described in claim 7, characterized in that, The client first retrieves a valid token from the local list. Then, generate the HMAC key and calculate the requested binding data. HMAC value The client will The token is sent to the server. The server first verifies whether the token has already been used. If it has not been used, it simulates the client's process to generate an HMAC value. If they are equal, then... Stored on the server side; otherwise, execution stops and client access is denied. uid For user identity.

10. A post-quantum secure anonymous token authentication system, characterized in that, include: The initialization module is configured to: generate public reference strings by a trusted third party; The key generation module is configured so that the client generates keys locally; The signature phase module is configured to: generate random messages in batches and encode the messages, and then the client and server execute a post-quantum-safe VOPRF protocol as described in any one of claims 1-6 to generate signature values ​​and store them locally; The token redemption phase module is configured as follows: the client retrieves the local signature value and generates an HMAC value, and then sends the message and the HMAC value to the server. The server verifies whether the message has been used and whether it is valid.

Images