An n-choose-k oblivious transfer method based on RSA

Abstract

The invention discloses an RSA-based n-choose-k oblivious transmission method, comprising: a sender generates a pair of RSA public and private keys, and sends the public key to a receiver; the receiver generates a modular equation group according to a selection bit, and sends the coefficients of the modular equation group to the sender; the receiver generates k random numbers, and uses a public key to encrypt the k random numbers, obtains k ciphertexts and enters them into the modular equation group, calculates the remaining ciphertexts, and arranges the obtained n ciphertexts and sends them to the sender; uses the modular equation group to verify the n ciphertexts, and rank verification; after verification, uses a private key to decrypt the n ciphertexts; uses the decryption result to encrypt n messages, obtains n symmetric ciphertexts and sends them to the receiver; the receiver uses k random numbers to decrypt the symmetric ciphertexts corresponding to the k selection bits, and obtains k messages. The method combines RSA public key encryption with the modular equation group to achieve safe and efficient n-choose-k oblivious transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of ciphertext data transmission, and more particularly to an RSA-based n-choose-k oblivious transmission method. Background Art

[0002] The leakage of various private information today has gradually enhanced people's privacy awareness. Many cryptographic protocols have begun to be used to protect data security, and technologies such as secure multi-party computing, homomorphic encryption, and federated learning have developed rapidly. The oblivious transfer protocol is an important basic protocol for secure multi-party computing, which is used to protect data privacy and security. The protocol was first proposed by Rabin, and later improved by Naor to propose the first practical 2-choose-1 and n-choose-1 protocols. The correctness of the n-choose-1 protocol requires that a sender transmits one of n messages to the receiver, and the receiver can only obtain one message. The security requires that the sender does not know which message the receiver has obtained and the receiver cannot obtain other additional messages.

[0003] RSA encryption algorithm is a classic asymmetric encryption algorithm and the most commonly used public key encryption algorithm. Its security is proportional to the key length, that is, the longer the key, the more difficult it is to crack and the higher the security. It is often used for key exchange in cryptographic protocols. The characteristics of oblivious transmission make it widely used in many fields, such as private information retrieval, outsourced computing, digital election voting, privacy set intersection, etc.

[0004] However, in some scenarios, the application of 2-out-of-1 and n-out-of-1 oblivious transfer protocols is limited and inefficient. The emergence of the n-out-of-k scheme fills the gap. The n-out-of-k scheme means that the sender has n messages, and the receiver can only obtain k of them and cannot obtain other additional messages. The sender does not know which k messages the receiver has obtained. The existing n-out-of-k scheme may require a third-party trusted center, but this does not meet security requirements; or it may require the use of public key encryption technology based on elliptic curves, but this involves problems such as scheme calculation and large communication volume. Specifically, the existing n-out-k scheme has the following defects:

[0005] 1. In the existing oblivious transfer protocol, the public key-based n-choose-k scheme requires n pairs of public and private keys, which is very expensive and has great limitations on its application.

[0006] 2. In the n-choose-k scheme based on elliptic curve, there are many rounds of data transmission, large amount of calculation, and a large amount of data that needs to be transmitted to each other.

[0007] 3. Based on the scheme of public key provided by a trusted third party, the application of the protocol is greatly limited because it is difficult to find a trusted third party.

[0008] Therefore, how to improve the security of data transmitted inadvertently by n-choose-k while increasing the encryption speed and reducing the amount of calculation is an urgent problem to be solved by those skilled in the art. Summary of the invention

[0009] In view of the above problems, the present invention focuses on the classic public key encryption algorithm and, in combination with a modular equation group, provides an RSA-based n-choose-k oblivious transmission method to at least solve some of the technical problems mentioned in the above background technology.

[0010] In order to achieve the above object, the present invention adopts the following technical solution:

[0011] The present invention provides an RSA-based n-choose-k oblivious transmission method, comprising the following steps:

[0012] S1, generating a pair of RSA public and private keys at the sender end, and sending the RSA public key to the receiver end; generating a modular equation group based on k selected bits at the receiver end, and sending the coefficients of the modular equation group to the sender end;

[0013] S2, generating k random numbers at the receiving end, and using the RSA public key to encrypt the k random numbers respectively to obtain corresponding k ciphertexts;

[0014] S3, substituting the k ciphertexts into the modular equation group, calculating the remaining (nk) ciphertexts, and obtaining a total of n ciphertexts; and sending the arranged n ciphertexts to the sending end;

[0015] S4, at the sender end, verify whether the n ciphertexts satisfy the modular equation group, and verify whether the rank of the modular equation group meets the preset requirements; after the verification is passed, use the RSA private key to decrypt the n ciphertexts respectively to obtain n random numbers; use the n random numbers as n first symmetric keys to encrypt n messages respectively, obtain n symmetric ciphertexts and send them to the receiver end;

[0016] S5. At the receiving end, use the k random numbers as the second symmetric key to decrypt the symmetric ciphertexts corresponding to the k selected bits respectively to obtain k messages.

[0017] Furthermore, the modular equations are expressed as:

[0018]

[0019] Where (nk) represents the (nk)th equation in the modular equation system; a (n-k)n represents the coefficient of the (nk)th row and nth column in the coefficient matrix corresponding to the modular equation system; C n represents the variable corresponding to the coefficient; bn-k Represents the constant term corresponding to the coefficient of the (nk)th row; N represents the modulus of the RSA public key; mod represents the remainder operation.

[0020] Furthermore, the modular equations satisfy the following requirements:

[0021] The modular equation group includes (nk) n-dimensional equation groups;

[0022] The coefficient matrix rank of the modular equation system is (nk);

[0023] The coefficient matrix of the modular equation system does not contain zero elements;

[0024] Any (nk) variables can be represented by the remaining k variables, that is, any (nk)×(nk) coefficient matrix is ​​a full-rank matrix;

[0025] When k variables are used to represent (nk) variables, the coefficients represented are all integers.

[0026] Furthermore, the step S4 also includes: if the verification fails, it is determined that the receiving end attempts to obtain additional information, and the sending end terminates the protocol.

[0027] Furthermore, in step S4, the n random numbers are used as n first symmetric keys to encrypt n messages respectively, which is specifically expressed as:

[0028]

[0029] Among them, m i represents the i-th message; y i represents the i-th symmetric ciphertext, ; H(·) represents a secure hash function; key i Indicates m i The corresponding first symmetric key; ⊕ represents the XOR operation.

[0030] Furthermore, in step S5, the k random numbers are used as the second symmetric key to decrypt the symmetric ciphertexts corresponding to the k selected bits respectively, which is specifically expressed as:

[0031]

[0032] Among them, m i represents the i-th message; r i represents the i-th random number generated by the receiver; H(·) represents a secure hash function; y i Represents the i-th symmetric ciphertext.

[0033] Furthermore, it can be seen from the above technical solution that, compared with the prior art, the present invention discloses an RSA-based n-choose-k oblivious transmission method, which has the following beneficial effects:

[0034] The present invention combines RSA public key encryption with modular equations. By constructing the connection between ciphertexts, it is ensured that only k RSA ciphertexts are real ciphertexts, so that the remaining (nk) messages on the sender's end can be protected from leakage. The characteristics of the RSA ciphertext domain protect the selection vector k on the receiver's end from leakage. The scheme has the characteristics of small computational complexity and small communication volume, and realizes a practical n-select-k non-transmission scheme.

[0035] Other features and advantages of the present invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the present invention.

[0036] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0038] Figure 1 A schematic flow chart of an RSA-based n-select-k oblivious transfer method provided in an embodiment of the present invention.

[0039] Figure 2 A schematic diagram of an algorithm flow provided by an embodiment of the present invention.

[0040] Figure 3 A schematic diagram for summarizing the n-select-k protocol provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] See also Figure 1 , Figure 2 and Figure 3 As shown, the embodiment of the present invention discloses an RSA-based n-choose-k oblivious transmission method, comprising the following steps:

[0043] S1. Generate a pair of RSA public and private keys at the sender end, and send the RSA public key to the receiver end; generate a modular equation group based on k selected bits at the receiver end, and send the coefficients of the modular equation group to the sender end;

[0044] S2. Generate k random numbers at the receiving end, and use the RSA public key to encrypt the k random numbers respectively to obtain corresponding k ciphertexts;

[0045] S3, substituting the k ciphertexts into the modular equation group, calculating the remaining (nk) ciphertexts, and obtaining a total of n ciphertexts; and sending the arranged n ciphertexts to the sender end;

[0046] S4. At the sender end, verify whether the n ciphertexts satisfy the modular equation group, and verify whether the rank of the modular equation group meets the preset requirements; after the verification is passed, use the RSA private key to decrypt the n ciphertexts respectively to obtain n random numbers; use the n random numbers as n first symmetric keys to encrypt the n messages respectively, obtain n symmetric ciphertexts and send them to the receiver end;

[0047] S5. At the receiving end, k random numbers are used as the second symmetric key to decrypt the symmetric ciphertexts corresponding to the k selected bits respectively to obtain k messages.

[0048] The present invention provides an RSA-based n-choose-k oblivious transmission method, which adopts RSA public key encryption and symmetric encryption technology, and only generates a pair of RSA public and private keys. The present invention uses a pair of RSA public and private keys and a modular equation group to perform key exchange, ensuring that there are only k valid symmetric keys; at the same time, the modular equation group is used to make the n ciphertexts have a connection, ensuring the data security of both parties; in addition, due to the fast symmetric encryption speed, the protocol has the characteristics of small calculation amount and small transmission amount, and has a large application space.

[0049] Next, each of the above steps will be described respectively.

[0050] In the above step S1, during the initialization phase, a set of secure RSA public and private keys (key length is more than 2048 bits) is generated at the sender end, expressed as: (pk, sk) = KGen({0,1} λ );where KGen(·) represents the RSA public and private key generation algorithm; λ represents the security parameter; pk represents the RSA public key; sk represents the RSA private key; then, the sender sends the RSA public key to the receiver;

[0051] A modular equation group is generated based on k selected bits at the receiving end, and the coefficients of the modular equation group are sent to the sending end; specifically:

[0052] (1) The selection vector corresponding to the above k selection bits can be expressed as:

[0053]

[0054] Among them, k1, k2, ..., k k Represents the selection bit, and its value is a subset of {0,1,...n-1};

[0055] (2) The above modular equations are a (nk)×n-dimensional multivariate equations, which are in the form of ;in, The coefficient matrix representing the modular equation system; A vector representing n variables; represents the constant term vector; the specific expansion can be expressed as:

[0056]

[0057] Where (nk) represents the (nk)th equation in the modular equation system; a (n-k)n represents the coefficient of the (nk)th row and nth column in the coefficient matrix corresponding to the modular equation system; C n represents the variable corresponding to the coefficient; b n-k Represents the constant term corresponding to the coefficient of the (nk)th row; N represents the modulus of the RSA public key; mod represents the remainder operation.

[0058] (3) The above modular equations must satisfy the following property requirements:

[0059] ① The modular equations include (nk) n-variable equations;

[0060] ②The coefficient matrix rank of the modular equation system is (nk);

[0061] ③The coefficient matrix of the modular equations does not contain zero elements;

[0062] ④ Any (nk) variables can be represented by the remaining k variables, that is, any (nk)×(nk) coefficient matrix is ​​a full-rank matrix;

[0063] ⑤When k variables are used to represent (nk) variables, the coefficients represented are all integers.

[0064] For the n-choose-k protocol (such as n=4, k=2), the matrix can be set as follows:

[0065]

[0066] Among them, b1 and b2 are large random numbers, which satisfy the rank of the augmented matrix equal to the rank of the coefficient matrix. Using Gaussian elimination method, we can get the following after simplification:

[0067]

[0068] Arbitrarily take two 2×2 coefficient matrices, for example , , , , , , all of which are full-rank matrices.

[0069] As can be seen from the above, any two variables can be expressed in terms of the remaining two variables. At the same time, since the ciphertext domain of RSA is , the calculated ciphertext through the modulo operation ensures that in the field Z N , it is ensured that the real RSA ciphertext and the ciphertext calculated through steps S2 and S3 later are indistinguishable. Therefore, the sender cannot infer which is the real RSA ciphertext and which is the ciphertext obtained through the system of equations. Therefore, the security of the selection bits at the receiver end is guaranteed.

[0070] In the above step S2, at the beginning of the n choose k protocol, at the receiver end, according to the selection vector k random numbers are generated, denoted as: r i =G(τ); where r i represents the i-th random number generated by the receiver end, where ; G(·) represents a pseudorandom number generator; τ represents a random number seed;

[0071] After that, the k random numbers are encrypted respectively using the RSA public key to obtain the corresponding k ciphertexts; denoted as: C i =Enc pk (r i ); where C i represents the ciphertext corresponding to the i-th random number; Enc(·) represents the encryption operation;

[0072] Assume that the k selection bits are the first k message bits, that is, the corresponding selection vectors are respectively expressed as , where k < n; that is, the receiver end wants to obtain the messages at the 0th, 1st, 3rd, 4th,..., k - 1 positions, and obtain the RSA ciphertext , and the ciphertext space of RSA is ; it should be noted here that in a computer, usually the subscript 0 is used to represent the first message. Therefore, in the embodiments of the present invention, 0 is used to represent the first message.

[0073] In the above step S3, the k ciphertexts are substituted into the modulo system of equations to calculate the remaining (n - k) forged ciphertexts, obtaining , so a total of n ciphertexts are obtained; and the arranged n ciphertexts Send to the sender end;

[0074] In this step, k ciphertexts are substituted into the modular equation group to calculate the remaining (nk) ciphertexts, that is, the remaining (nk) ciphertexts are represented by the obtained k ciphertexts; assuming that the k positions are {0, 1, ..., k-1}, that is, the receiver wants to obtain the message at the 0th, 1st, 2nd, ..., k-1th position; according to the above equation group, the expression of the remaining (nk) ciphertexts can be obtained as follows:

[0075]

[0076] In the above (nk) equations, according to the property requirements of the coefficient matrix in step S1, it can be known that all coefficients of the expression are integers; arranging n ciphertexts means that the receiver needs to send the ciphertexts to the sender in order under the condition that the equations are satisfied. In addition, because all operations are performed in the domain Therefore, all ciphertexts are indistinguishable.

[0077] In the above step S4, the sender receives Substitute the ciphertexts into the equation group for verification. If the requirements of the modular equation group are met and the rank of the modular equation group, that is, the rank of the coefficient matrix of the arbitrary form (nk)×(nk) is full rank, it means that the verification is successful. At this time, the sender uses the RSA private key to decrypt the n ciphertexts respectively and obtain n random numbers. The process is expressed as: key i =Des sk (C i ); wherein Des(·) represents a decryption operation; then, the n random numbers obtained by decryption are used as n first symmetric keys to decrypt the n messages above. Encryption is performed to obtain n encrypted symmetric ciphertexts, and the encrypted ciphertexts are sent to the receiving end;

[0078] The above method of using the first symmetric key to encrypt n messages is specifically expressed as:

[0079]

[0080] Among them, m i represents the i-th message; y i represents the i-th symmetric ciphertext, ; H(·) represents a secure hash function; key i Indicates m i The corresponding first symmetric key; ⊕ represents an exclusive OR operation;

[0081] if If the ciphertext does not meet the requirements of the modular equation group, or the rank of the optional coefficient matrix of the form (nk)×(nk) is not full rank, it means that the verification fails and the receiver is judged to be trying to obtain additional information. At this time, the sender terminates the protocol;

[0082] For the verification of the modular equations in this step, it is in the integer domain That is, all RSA ciphertexts are guaranteed to be indistinguishable. In addition, if the ciphertext fails to be verified by substituting it into the modular equation group, it proves that the sender is suspected of cheating, and the sender terminates the protocol, which can effectively avoid the leakage of private information.

[0083] In the above step S5, at the receiving end, k random numbers are used as the second symmetric key to decrypt the symmetric ciphertexts of the corresponding selected bits respectively to obtain k messages;

[0084] The above uses the second symmetric key to decrypt the symmetric ciphertext of the corresponding selected bits, which is expressed as:

[0085]

[0086] Among them, m i represents the i-th message; r i represents the i-th random number generated by the receiver; , represents the selection vector corresponding to the selection bit; H(·) represents a secure hash function; y i Represents the i-th symmetric ciphertext.

[0087] Next, the RSA-based n-choose-k oblivious transmission method provided by the present invention is proved as follows (it should be noted that in the subsequent proof formula, To represent the above variable vector ):

[0088] Safety Proof:

[0089] Theorem 1: Given (nk) equations, containing n variables, k of which are known, and any (nk) column coefficient matrix is ​​full rank, then the remaining (nk) variables exist and are uniquely determined;

[0090] prove:

[0091] Assumptions The coefficient matrix representing the modular equation system; A vector representing n variables; represents a constant term vector; the first k variables are known and can be Divided into known and unknown parts:

[0092]

[0093] in, are k known variables; There are (nk) unknown variables.

[0094] The system of equations Rewritten as:

[0095]

[0096] in is the (nk)×k submatrix corresponding to the known variables; is the (nk)×(nk) submatrix corresponding to the unknown variables.

[0097] (1) Proof of uniqueness:

[0098] When the coefficient matrix of any (nk) columns is full rank, that is, is a full rank matrix, that is , is a (nk)×(nk) square matrix.

[0099] Full rank (nk)×(nk) matrix Has a unique inverse matrix ;

[0100] Therefore, the equation You can multiply by left Get the unique solution: ,because is a full rank matrix, so The solution is unique.

[0101] (2) Proof of existence:

[0102] because is full rank, that is .

[0103] because is full rank, so for any vector ,equation There are solutions for all.

[0104] That is, given any , there is a Make Established.

[0105] In summary, due to Full rank guarantees the existence and uniqueness of the solution.

[0106] Theorem 2: For a given (nk) equations, n variables, and any (nk) column coefficient matrix is ​​full rank, assuming that k+1 variables are known, then among the k+1 variables, there must be one variable that can be expressed by the remaining k variables.

[0107] prove:

[0108] Assume the coefficient matrix is composed of a (nk)×(nk) The matrix (containing the coefficients of the known variables) and (nk)×(n-(k+1)) Matrix (containing the coefficients of the unknown variables).

[0109] In n-choose-k oblivious transmission, since the sender has published the coefficient matrix in the pre-generation stage, it can be seen from the above proof that when k variables are known and any (nk) columns of the coefficient matrix are full rank, the remaining (nk) variables can be represented by k variables and are unique.

[0110] therefore In the matrix, among the (k+1) known variables, there must be a known variable that can be expressed by the remaining k known variables. Assuming that the (k+1) known variables are the ciphertexts obtained after RSA encryption, then when the RSA ciphertext domain is large enough, the probability that the linear combination of k RSA ciphertexts is exactly the RSA ciphertext can be ignored. Therefore, any (nk) column coefficient matrix is ​​full rank and there can only be k valid ciphertexts.

[0111] Therefore, given the coefficient matrix, it is impossible for the receiver to obtain k+1 messages by generating k+1 ciphertexts, which prevents the receiver from cheating and protects the sender's data security.

[0112] In summary, in the RSA-based n-choose-k oblivious transmission method provided by the present invention, by exchanging symmetric keys through RSA, the receiver can only obtain k valid ciphertexts from n RSA ciphertexts, and the remaining (nk) ciphertexts are obtained by calculation. The sender decrypts and obtains n symmetric keys. Since all operations are performed in the integer domain Therefore, for the sender, the ciphertext and the decrypted data are indistinguishable, so when the receiver finally decrypts the message at the corresponding position using a random number, the multivariate equation generated in the initialization phase controls the number of valid ciphertexts. For the receiver, it is guaranteed that only k valid symmetric keys can decrypt the message. Therefore, in summary, given a coefficient matrix that meets the conditions, a secure and efficient n-choose-k oblivious transfer protocol can be implemented.

[0113] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0114] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A RSA-based n-choose-k oblivious transfer method, characterized in that: The steps include: S1, generating a pair of RSA public and private keys at the sender end, and sending the RSA public key to the receiver end; generating a modular equation group based on k selected bits at the receiver end, and sending the coefficients of the modular equation group to the sender end; S2, generating k random numbers at the receiving end, and using the RSA public key to encrypt the k random numbers respectively to obtain corresponding k ciphertexts; S3, substituting the k ciphertexts into the modular equation group, calculating the remaining (nk) ciphertexts, and obtaining a total of n ciphertexts; and sending the arranged n ciphertexts to the sending end; S4, at the sender end, verify whether the n ciphertexts satisfy the modular equation group, and verify whether the rank of the modular equation group meets the preset requirements; after the verification is passed, use the RSA private key to decrypt the n ciphertexts respectively to obtain n random numbers; use the n random numbers as n first symmetric keys to encrypt n messages respectively, obtain n symmetric ciphertexts and send them to the receiver end; S5. At the receiving end, using the k random numbers as second symmetric keys, respectively decrypt the symmetric ciphertexts corresponding to the k selected bits to obtain k messages; The modular equations are expressed as: Where (nk) represents the (nk)th equation in the modular equation system; a (n-k)n represents the coefficient of the (nk)th row and nth column in the coefficient matrix corresponding to the modular equation system; C n represents the variable corresponding to the coefficient; b n-k Represents the constant term corresponding to the coefficient of the (nk)th row; N represents the modulus of the RSA public key; mod represents the remainder operation.

2. The RSA-based n-choose-k oblivious transfer method according to claim 1, characterized in that: The modular equations satisfy the following requirements: The modular equation group includes (nk) n-dimensional equation groups; The coefficient matrix rank of the modular equation system is (nk); The coefficient matrix of the modular equation system does not contain zero elements; Any (nk) variables can be represented by the remaining k variables, that is, any (nk)×(nk) coefficient matrix is ​​a full-rank matrix; When k variables are used to represent (nk) variables, the coefficients represented are all integers.

3. The RSA-based n-from-k oblivious transfer method according to claim 1, characterized in that: The step S4 also includes: if the verification fails, it is determined that the receiving end attempts to obtain additional information, and the sending end terminates the protocol.

4. The RSA-based n-choose-k oblivious transfer method according to claim 1, characterized in that: In step S4, the n random numbers are used as n first symmetric keys to encrypt n messages respectively, which is specifically expressed as: Among them, m i represents the i-th message; y i represents the i-th symmetric ciphertext, i∈{0, 1, …n-1}; H(·) represents a secure hash function; key i Indicates m i The corresponding first symmetric key; ⊕ represents the XOR operation.

5. The RSA-based n-choose-k oblivious transfer method according to claim 1, characterized in that: In step S5, the k random numbers are used as the second symmetric key to decrypt the symmetric ciphertexts corresponding to the k selected bits respectively, which is specifically expressed as: Among them, m i represents the i-th message; r i represents the i-th random number generated by the receiver; H(·) represents a secure hash function; y i Represents the i-th symmetric ciphertext.

Images