A lightweight lattice-based quantum-resistant encryption method

Abstract

The present invention discloses a lightweight lattice-based quantum-resistant encryption method. The method comprises the following steps: 1) generating a public key h and a private key (f, g, F′, G′) using a key generation algorithm; 2) using an encryption algorithm to generate a public key h and a private key (f, g, F′, G′) according to n, k, q, σ f 1) Encrypt plaintext m using γ to generate ciphertext c; 2) Decrypt ciphertext c using an encryption algorithm based on n, q, q′, f, g, F, G, γ, k to obtain ciphertext m. This invention better balances the relationship between decryption error rate and ciphertext size. By combining the decryption trapdoor technology from BAT with ternary NTT, more flexible parameters are selected. At the cost of increasing the decryption error rate, the size of the ciphertext is further reduced. It can provide extremely small ciphertext size with a ciphertext expansion rate of less than 20 times, making it suitable for some high-fault-tolerant scenarios.

Description

Technical Field

[0001] This invention relates to cryptographic scheme design techniques and lattice cryptography, and more particularly to a lightweight lattice-based quantum-resistant encryption method. Background Technology

[0002] Since it was realized that quantum computers can solve large integer factorization and discrete logarithm problems in polynomial time, existing public-key cryptography and signature schemes (such as RSA, Rabin, and ECDSA) have been greatly threatened, including the security level of symmetric cryptography, which has been halved. Therefore, cryptographers, in order to cope with the different capabilities of quantum computers compared to classical computers, began to study quantum-resistant cryptographic systems, that is, cryptographic schemes that can maintain exponential complexity under quantum computing. Broadly speaking, there are currently five main types of quantum-resistant cryptographic schemes: cryptosystems based on lattice difficulties, cryptosystems based on encoding problems, cryptosystems based on multivariable equations, cryptosystems based on elliptic curve homology problems, and traditional symmetric cryptosystems. Lattice cryptography, as the most widely used and currently best-performing type of quantum-resistant scheme, has attracted much attention because it can be used not only for encryption but also for signatures and even fully homomorphic operations, among other cryptographic applications.

[0003] Lattice cryptography is a cryptosystem based on lattice-hard problems, where a lattice is a set of cryptosystems defined on lattices. The discrete additive group on can be viewed as a linear space with integer coefficients, formally expressed as: Matrix B is called a lattice basis for this lattice. In the average case, solving the shortest vector problem (SVP, i.e., finding the shortest non-zero vector in a lattice) and the nearest vector problem (CVP, i.e., finding the nearest vector to any point in space) is considered NP-hard. However, practical cryptographic schemes are not directly designed based on the SVP / CVP problems; most are based on the LWE (Learning With Error) or SIS (Short Integer Solution) problems. These problems can only be reduced to approximate SVP (using a given approximation factor to limit the ratio between the length of the shortest vector and the length of the shortest vector in the lattice) / approximate CVP (using a given approximation factor to limit the ratio between the distance of the calculated vector to the target point and its distance to the nearest vector in the lattice), essentially weakened SVP / CVP problems. Currently, mainstream lattice cryptography is generally based on the LWE problem, adding different algebraic structures to generate problems such as NTRU, Ring-LWE, and Module-LWE.

[0004] The formal description of the LWE problem is: for a matrix A secret vector A noise vector Calculate b ≡ A·s + e (mod q). Given (A, b), find the secret vector s. The difficulty stems from the added noise vector; when the standard deviation of the noise vector is large, solving the LWE problem becomes difficult. Currently, there are two main algorithms for solving the LWE problem: primal attack and dual attack. The primal attack treats the LWE as an approximate CVP problem and then constructs an m+n+1 dimensional embedding lattice. Then there exists a short vector [e -s 1] on it. The short vector is obtained by solving the approximate SVP problem on the embedding lattice, and then the LWE problem is solved. Currently, the best algorithm for solving the SVP problem is the BKZ lattice basis reduction algorithm that uses sieves at the bottom layer, and the complexity is still O(2^3). 0.292n (Exponential.) Another attack method, dual attack, targets A in... The corresponding dual cell above: Let A1 be a matrix consisting of the first n1 columns of matrix A, resulting in a short vector [wv] such that vA1 ≡ w (mod q). Then the original expression can be rewritten as vb ≡ vA·s + ve ≡ ws1 + vA2s2 + ve (mod q), where w, s1, v, and e are all short vectors. Therefore, the result after the inner product is still relatively small, and can be considered a sub-Gaussian distribution. The secret value of the s2 part can be guessed by brute force, combined with a discriminator to distinguish between the sub-Gaussian distribution and the others. The algorithm uses a uniform random distribution to determine whether the correct s2 has been guessed. However, its actual complexity estimation is limited by the fact that the key independence assumption in the algorithm is wrong. Currently, there is no algorithm that can outperform the primal attack. Therefore, when estimating security, we can focus on the attack complexity estimated by the primal attack, i.e., the uSVP attack.

[0005] Typically, solutions based on the LWE problem require balancing the dimension and the standard deviations of s and e to achieve the desired security level. Security level assessment is generally performed using the estimation model proposed by Martin R. Albrecht, Rachel Player, and Sam Scott in 2015, or a more accurate simulation model based on hidden information in the measurement channel proposed by Dana Dachman-Soled, Léo Ducas, Huijing Gong, and Mélissa Rossi in 2020.

[0006] The earliest lattice cipher scheme was the NTRU encryption scheme proposed by Hoffstein, Pipher, and Silverman in 1996. Its difficulty is mainly based on the validity of the NTRU assumption and the difficulty of the Shortest Vector Problem (SVP) on a lattice. The original NTRU assumption is: for a polynomial quotient ring... Where n is a prime number, q is a large modulus, and a distribution with a small standard deviation is given. Extracting elements from this polynomial as coefficients generates polynomials f and g, where f must have inverses in R. Then, the NTRU assumption states that the polynomial adversary cannot distinguish h ≡ g · f. -1 The multinomial distribution formed by (mod q) and R q The most direct method to attack the NTRU hypothesis is to transform h into an inverse circular matrix and construct a uniform random distribution on the matrix. 2D grid correspond The previous 2n-dimensional lattice has a 1-dimensional dense sublattice [gf], corresponding to The previous n-dimensional lattice has n linearly independent and short lattice bases. We then use the BKZ lattice basis reduction algorithm to directly find f and g. This can be viewed as a LWE problem where b is a zero vector. However, when the standard deviation of q relative to f and g is too large, the advantage of dense sublattices makes it easier to solve than a regular LWE. When the standard deviation of f and g is 1, there exists an easier upper bound for q with O(n) values. 2.484 Conversely, when q is less than this limit, the difficulty of analyzing the approximate SVP problem using LWE is still applied to NTRU.

[0007] The most basic NTRU scheme provides a natural one-way trapdoor: using Polynomials f and g are used as private keys, h ≡ g·f -1 (mod q) is used as the public key for the plaintext polynomial m (where all coefficients of the plaintext polynomial are less than p, i.e., ...). During encryption, the ciphertext c = p·h·r + m is calculated, where p is a small prime number, usually 3, and r is R. q The coefficients of the above polynomial are drawn from a distribution with a small standard deviation. During decryption, first in Calculate a≡c·f≡p·g·r+f·m(mod q), where g, m, f, and r are all polynomials with small coefficients. When the coefficients of their polynomial product are less than q... When the polynomial a = p·g·r + f·m is used, there is no modular arithmetic. Then, calculating m≡a· in For polynomial f in The inverse of f. The advantage of this trapdoor is its simplicity and speed of calculation, and it is widely used in many schemes. There are many modifications, such as rewriting f as f′=p·f+1, then decryption only requires calculating c·f′≡(p·g·r+p·f·m+m)≡m≡(mod p) once. However, these variations do not change the conditions for correct decryption of the trapdoor, namely… This constraint, which also resulted in the non-uniformity of the standard deviations of m and r when the standard deviations of f and g are the same, limited the selection of parameters, leading to subsequent improvements.

[0008] Signature schemes such as Falcon also require the use of NTRU-based one-way trapdoors. To further reduce the standard deviation of the coefficients f and g, thereby decreasing the signature size, a new trapdoor technique is employed. Polynomials f and g are used as private keys, h ≡ g·f -1 Using (mod q) as the public key, compute the ciphertext c = h·r + m for the plaintext polynomial m, where r is R. q The coefficients of the above polynomial are drawn from a distribution with a small standard deviation. Now consider the NTRU grid: This lattice has another set of lattice bases: Where G and F satisfy gF-fG=q. This is a trapdoor from the perspective of lattice basis. For an NTRU lattice generated by the public key, a shorter lattice basis can be obtained using the private key. This widens the decryption capability gap between the party knowing the private key and the party only knowing the public key. When a sufficiently good lattice basis is obtained, the approximate CVP problem on the lattice can be calculated efficiently. It is found that there exists a vector (h·r,r) on the NTRU lattice, and a vector (c,0) can be constructed from the ciphertext. (c,0)=(h·r,r)+(m,-r). The distance between the two vectors is the length of the vector (m,-r). Since m and r are coefficients from a distribution with a small standard deviation, given the vector (c,0), solving for the point closest to it on the NTRU lattice will most likely yield (h·r,r), thus decrypting m and r. The shortness of the distance between vectors solved by CVP depends on the quality of the given lattice basis (i.e., whether the length of the basis vectors is short enough). The most efficient CVP solution algorithm is the Babai Rounding Off algorithm, which can be viewed as multiplying the inverse of the lattice basis matrix onto the target vector and then rounding it. For a lattice L(B), given a point t, using the Babai Rounding Off algorithm to find the vector on L that is closest to t is equivalent to calculating... Then, when e = vt, the solution to CVP is successful if and only if ||e·B -1 || ∞<1. When using a trapdoor to solve the problem, the decryption is correct if and only if It can be noted that the constraints here have one less coefficient p compared to the previous conditions, but we need to consider ||G·r+F·m|| ∞ Even using the algorithm proposed by Thomas Pornin and Thomas Prest in 2019 to generate smaller G and F coefficients, there is still a significant difference in size between the coefficients of G and F and the coefficients of g and f. The difference in level, that is Therefore, another CVP solution algorithm, the Babai Nearest Plane algorithm, is used here. It requires calculating the Gram-Schmidt orthogonalization matrix of the given lattice basis, and then directly mapping the coordinates of the target point on the Gram-Schmidt orthogonalization matrix to the original lattice basis matrix to obtain the proximity point. Here, it is only necessary to calculate the orthogonal element G on the quotient ring R. * ,F * Without needing to expand to an inverse circular matrix calculation, the constraints for correct decryption become... The orthogonalized elements are approximately the same size as the previous g and f, therefore the condition for successful decryption can be written as: Compared to the previous The standard deviation of the coefficients of polynomial r can be reduced by a factor of p while keeping the standard deviations of g, f, and m constant. Since the difficulty of the LWE problem mainly stems from the proportion of dimension and standard deviation to the modulus, reducing the standard deviation allows for a reduction in the modulus while maintaining almost the same level of security parameters. This also ensures that the decryption error rate does not decrease significantly, thereby shortening the ciphertext size.

[0009] The trapdoor design mentioned above is primarily used in lattice-based signature schemes to compute the CVP problem on NTRU lattices. However, the new scheme BAT proposed in 2022 by Pierre-Alain Fouque, Paul Kirchner, Thomas Pornin, and Yang Yu... [6] This trapdoor was applied to NTRU-based encryption schemes, resulting in the most compact NTRU-based encryption scheme currently available. It achieves an NTRU scheme with n=512 and q=257 while maintaining the security level of a classic 128-bit computer, and has a decryption error rate of less than 2%. 128 .

[0010] In BAT, a more efficient trapdoor form is proposed, combining the features of the Babai Rounding Off and Babai Nearest Plane algorithms, and eliminating the need for storing floating-point numbers in the Gram Schmidt matrix. Ignoring some details and scaling factors, the algorithm describes the orthogonal polynomial G calculated on the quotient ring R. * ,F * The coefficients are stored as integers with a certain precision, that is, for rational numbers... use To store, q′ is a large number controlling the precision, and G will be stored with precision q′. * ,F * Record Then we only need to solve the linear equation: That's all.

[0011] Cryptographic schemes often require a balance between security and efficiency to find an optimal equilibrium. The BAT scheme mentioned above is limited by the parameter selection of NTT fast polynomial multiplication, thus only providing the lowest parameters n=512, q=257. Since traditional binary NTT requires dimensions to be powers of 2, the next level can only choose n=256, which is insufficient to achieve a 128-bit security level. Consider combining ternary NTT techniques to select more flexible dimensions and moduli, thereby choosing parameters between 256 and 512 that achieve a 128-bit security level but are more compact.

[0012] Traditional binary NTT, in Calculate the fast polynomial multiplication above, where n = 2 k Then x n +1 is a cyclotomic polynomial, which can be expressed as a polynomial. Decomposition exists: x n +1=(x-ξ 1 (x-ξ) 3 )…(x-ξ 2n-1 When the prime number q≡1 (mod 2n), then There exist n roots of unity of power 2n on x, therefore x n +1 can also be used. The factorization is divided into n linear polynomials. Based on the CRT (Chinese Reminder Theorem), the calculation is performed. When multiplying two polynomials a and b, their values ​​can be calculated separately for the multiplication of these n linear polynomials, and then combined into a result using CRT, which can greatly speed up the calculation time. In actual calculation, a tree structure is used to decompose the calculation layer by layer.

[0013] In their 2019 NTTRU proposal, Vadim Lyubashevky and Gregor Seiler proposed applying ternary NTT technology to the NTRU design, primarily considering... In the NTRU+ scheme proposed later by Jonghyun Kim and Jong Hwan Park, the application of ternary NTT technology was extended to a more general case, namely considering 3n=2. k 3 j A cyclotomic polynomial of degree k,j≥1, in which case the corresponding cyclotomic polynomial is: It can also be decomposed layer by layer downwards; here, two isomorphisms are used for downward decomposition: Where ξ is A sixth root of unity on the , Among them α=ξ, β=ξω, γ=ξω 2 ω is A cubic root of unity on the polynomial. Through the above two isomorphisms, we can continuously layer downwards until we obtain a product of quadratic or cubic polynomials. Although it cannot be completely decomposed into a linear polynomial, it has greatly improved the computation speed.

[0014] The BAT algorithm uses trapdoors for decryption, which greatly compresses the size of the ciphertext. However, due to efficiency considerations, it is necessary to ensure that the dimension and modulus are in line with the parameters for NTT's fast calculation. The parameters cannot be flexibly selected, so it cannot well balance the relationship between the decryption error rate and the ciphertext size. Summary of the Invention

[0015] To improve the ciphertext size problem in the above schemes, this invention discloses a lightweight quantum-resistant encryption method based on NTRU, which can provide extremely small ciphertext size with a ciphertext expansion rate of less than 20 times.

[0016] The meanings of some of the symbols used in this invention are as follows:

[0017] Ring of integers;

[0018] q′: A large prime number used to control precision;

[0019] q: a prime number;

[0020] Ring of integers modulo q;

[0021] A polynomial ring on the ring of integers;

[0022] Polynomial ring on a ring;

[0023] σ f ,σ s : A real number greater than 0, describing the standard deviation of the polynomial components;

[0024] ||||: This represents calculating the L2 norm. When used on polynomials and vectors composed of polynomials, it means calculating the L2 norm of the vector formed by concatenating the components of the polynomials.

[0025] Polynomial quotient ring on;

[0026] Polynomial quotient ring on;

[0027] R n : That is, a vector consisting of n elements in R.

[0028] The technical solution of the present invention is as follows:

[0029] A lightweight lattice-based quantum-resistant encryption method, comprising the following steps:

[0030] 1) Generate the public key h and private key (f, g, F′, G′) using a key generation algorithm; the method is as follows:

[0031] 11) Calculation

[0032] 12) From the standard deviation σ f Discrete Gaussian distribution Extract 2n elements from R to serve as the coefficients of two polynomials f and g over R;

[0033] 13) Determine whether the polynomial f is invertible on R mod q. If it is not invertible, return to step 12); if it is invertible, proceed to step 14.

[0034] 14) If Then return to step 12); otherwise proceed to step 15.

[0035] 15) Calculate h = g·f -1 (mod q);

[0036] 16) From R 2 Choose F and G such that gF-Gf = q;

[0037] 17) Calculate (F′,G′,w)=Reduce(g,f,G,F,q′,γ); Reduce() is a polynomial reduction algorithm;

[0038] 18) If Then return to step 12); otherwise output the public key.

[0039] h, private key (f, g, F′, G′); where, R is Polynomial quotient ring on, It is a polynomial ring over the ring of integers. Let n be an integer ring modulo q, where n is of the form 2^n. i 3 j A positive integer representing the degree of the polynomial, k is a parameter that generates noise in LWR, a small positive integer greater than or equal to 2, and q′ is a prime number used to control precision;

[0040] 2) Utilize encryption algorithms based on n, k, q, σ f γ encrypts plaintext m to generate ciphertext c; the method is as follows:

[0041] 21) From the standard deviation σ s Discrete Gaussian distribution Extract n elements from R as R q The coefficients of the polynomial s over R; where R q for Polynomial quotient ring on, for Polynomial ring on the ring, It is an integer ring modulo q;

[0042] 22) Calculate the ciphertext

[0043] 23) Calculate e = (hs mod q) - kc0;

[0044] 24) If Then return to step 21); otherwise proceed to step 25.

[0045] 25) Calculate ciphertext Output the ciphertext c = (c0, c1);

[0046] 3) Decrypt the ciphertext c using an encryption algorithm based on n, q, q′, f, g, F, G, γ, k to obtain the ciphertext m; the method is as follows:

[0047] 31) Use the decoding algorithm Decode(c0,f,g,F,G,q,q′,k) to calculate s,e;

[0048] 32) If The decryption calculation will terminate if the decryption is terminated; otherwise, the plaintext will be output.

[0049] Furthermore, the polynomial reduction algorithm Reduce() calculates (F′, G′, w) based on the input g, f, G, F, q′, γ as follows: First, calculate... Then calculate Then output (F′=q′F-fw,G′=q′G-gw,w); where, This represents the conjugate of f.

[0050] Furthermore, the decoding algorithm Decode(c0,f,g,F,G,q,q′,k) calculates s and e as follows: First, it calculates (F′,G′,w)=Reduce(g,f,G,F,q′,γ), c′=fc(mod q), c″=q′Fc-c′w(mod qq′); then it solves the integer ring. Linear equations on: Output (e,s).

[0051] Furthermore, And it is a prime number.

[0052] Furthermore, σ f ,σ s All are real numbers greater than 0, n is a positive integer and n has only 2 and 3 as factors.

[0053] Furthermore, the hash algorithm in step 25) is the hash algorithm shake256 from the sha3 hash function family.

[0054] Furthermore, m is a plaintext polynomial, and the coefficients of the plaintext polynomial m are all 0 or 1.

[0055] The quantum-resistant encryption scheme of the present invention is as follows: Figure 1 As shown, the algorithm consists of three parts:

[0056] 1) Key generation algorithm;

[0057] 2) Encryption algorithm;

[0058] 3) Decryption algorithm.

[0059] The specific steps of the key generation algorithm are as follows:

[0060] enter:

[0061] Output: Public key h, private key (f, g, F′, G′)

[0062] 1) Calculation

[0063] 2) From the standard deviation σ f Discrete Gaussian distribution Extract 2n elements from R to serve as the coefficients of two polynomials f and g over R;

[0064] 3) Determine if f is invertible on R mod q. If it is not invertible, return to step 2); if it is invertible, proceed to step 4.

[0065] 4) If Then return to step 2); otherwise proceed to step 5.

[0066] 5) Calculate h = g·f -1 (mod q);

[0067] 6) Calculate (F,G)∈R 2 This makes gF-Gf=q;

[0068] 7) Calculate (F′,G′,w)=Reduce(g,f,G,F,q′,γ); Reduce() is a polynomial reduction algorithm;

[0069] 8) If Then return to step 2); otherwise proceed to step 9.

[0070] 9) Output the public key h and the private key (f, g, F′, G′); that is, combine f, g, F′, G′ together as the private key.

[0071] Where n is of the form 2 i 3 j The positive integer represents the degree of the polynomial, k is the parameter that generates noise in the LWR, is a small positive integer greater than or equal to 2, and q′ is a large prime number for controlling precision. This step involves the client calculating and generating the key.

[0072] The specific steps of the encryption algorithm are as follows:

[0073] Input: n, k, q, σ f ,γ,m∈{0,1} 128 , m is the plaintext to be encrypted

[0074] Output: Ciphertext c

[0075] 1) From the standard deviation σ s Discrete Gaussian distribution Extract n elements from R as R q The coefficients of the polynomial s over the polynomial;

[0076] 2) Calculate the ciphertext

[0077] 3) e = (hs mod q) - kc0;

[0078] 4) If Then return to step 1); otherwise proceed to step 5.

[0079] 5) Calculate the ciphertext

[0080] 6) Output the ciphertext c = (c0, c1).

[0081] This step involves encrypting the information on the client side.

[0082] The specific steps of the decryption algorithm are as follows:

[0083] Input: n,q,q′,f,g,F,G,γ,k,c

[0084] Output: plaintext m

[0085] 1) Use the decoding algorithm Decode(c0,f,g,F,G,q,q′,k) to calculate s,e;

[0086] 2) If The output will be ⊥, indicating that decryption has failed and the decryption calculation has been terminated.

[0087] 3) Output plaintext

[0088] This step involves the user client decrypting the ciphertext.

[0089] More specifically, the hash algorithm used is shake256 from the SHA3 hash function family, with an output length of 16 bytes. The Reduce algorithm in the key generation algorithm has the following specific steps:

[0090] Input: g,f,G,F,q′,γ

[0091] Output: F′, G′, w

[0092] 1) Calculation

[0093] 2) Calculation

[0094] 3) Output (F′=q′F-fw,G′=q′G-gw,w).

[0095] in Represents the conjugate of f, i.e. The essence of the Reduce algorithm here is to use g and f to reduce G and F, and obtain approximately orthogonal elements on R.

[0096] The two checks on the norms ||g,γf|| and ||G′,γF′|| in the key generation algorithm are to avoid generating differential keys that exceed the estimated decryption error rate. The more specific decryption error rate calculation will be covered in the later section on parameter selection.

[0097] The decoding algorithm utilizes trapdoors on the lattice base for NTRU decoding. It can be viewed as a fusion of the Babai RoundingOff algorithm and the Babai Nearest Plane algorithm, consistent with the BAT scheme. Its specific steps are as follows:

[0098] Input: c0,f,g,F,G,q,q′,k

[0099] Output: e, s

[0100] 1) Calculate (F′,G′,w)=Reduce(g,f,G,F,q′,γ);

[0101] 2) c′=fc(mod q);

[0102] 3)c″=q′Fc-c′w(mod qq′);

[0103] 4) Solution Linear equations on:

[0104] 5) Output (e,s).

[0105] Compared with the prior art, the positive effects of the present invention are as follows:

[0106] This invention achieves a better balance between decryption error rate and ciphertext size. It combines the decryption trapdoor technology from BAT with the ternary NTT, selecting more flexible parameters. At the cost of increasing the decryption error rate, it further reduces the ciphertext size, making it more suitable for some high-fault-tolerant scenarios. Attached Figure Description

[0107] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0108] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below.

[0109] This invention discloses a lightweight quantum-resistant encryption scheme based on NTRU. The most significant feature of this scheme is its extremely small ciphertext size; it can use 309 bytes of ciphertext while maintaining a 128-bit security level, with a ciphertext expansion rate of less than 20 times. Furthermore, the scheme's parameter selection supports incomplete NTT technology, which can accelerate the polynomial multiplication part.

[0110] High-efficiency storage:

[0111] When storing, the ciphertext is grouped into 16 elements and stored with a base of 86, requiring a total of 309 bytes. The public key is grouped into 48 elements and stored with a base of 257, requiring a total of 385 bytes.

[0112] Quick calculation:

[0113] Traditional binary NTT, in Calculate the fast polynomial multiplication above, where n = 2 k Then x n +1 is a cyclotomic polynomial, which can be expressed as a polynomial. Decomposition exists: x n +1=(x-ξ 1 (x-ξ) 3 )…(x-ξ 2n-1 When the prime number q≡1 (mod 2n), then There exist n roots of unity of power 2n on x, therefore x n +1 can also be used. The factorization is divided into n linear polynomials. Based on the CRT (Chinese Reminder Theorem), the calculation is performed. When multiplying two polynomials a and b, their values ​​can be calculated separately for each of the n first-order polynomials, and then combined using a CRT to form the result. This significantly speeds up the computation time. In practice, a tree structure is used, decomposing the calculation layer by layer. The complete NTT calculation's lowest-level modular polynomial is a first-order polynomial, therefore ultimately only requires... The calculation is performed on the upper part, but the complete NTT calculation has restrictions on the modulus and dimension, requiring q≡1(mod 2n). When some more flexible parameters are selected, this condition cannot be met. For example, it may only be q≡1(mod n), which corresponds to the lowest level modulo polynomial in NTT being a quadratic polynomial.

[0114] In their 2019 NTTRU proposal, Vadim Lyubashevky and Gregor Seiler proposed applying ternary NTT technology to the NTRU design, primarily considering... In the NTRU+ scheme proposed later by Jonghyun Kim and Jong Hwan Park, the application of ternary NTT technology was extended to a more general case, namely considering 3n=2. k 3 j A cyclotomic polynomial of degree k,j≥1, in which case the corresponding cyclotomic polynomial is: It can also be decomposed layer by layer downwards; here, two isomorphisms are used for downward decomposition: Where ξ is A sixth root of unity on the , Among them α=ξ, β=ξω, γ=ξω 2 ω is A cubic root of unity on [a plane]. The encryption scheme proposed in this invention satisfies [the following condition]. Through the above two isomorphisms, we can continuously divide the data into layers, with the lowest layer being a sixth-degree polynomial. Although it cannot be completely decomposed into a first-degree polynomial, it has greatly improved the computation speed.

[0115] Security Analysis:

[0116] Regarding the security level, this invention adopts the estimation model proposed in [the paper] to evaluate the security level, which is the commonly used evaluation model in current lattice cryptography schemes. Although this scheme is based on the NTRU problem, the size of q does not reach the level of overstretched attack, so only uSVP attack is considered. The same evaluation method as LWE is used. The final key recovery complexity is 132.6, and the ciphertext recovery complexity is 132.6.

[0117] Decryption error rate analysis:

[0118] Regarding the calculation of standard deviation, this paper combines the calculation method of the ideal lattice basis distribution on the ternary modular polynomial in NTTRU with the approach of calculating error using a new decoding algorithm in BAT. Polynomials on the polynomial quotient ring Its corresponding convolution matrix can be written as:

[0119]

[0120] in:

[0121]

[0122]

[0123] When polynomials a and b are modularly multiplied, the elements of the resulting polynomial are c = ba + b′(a + a′), where a and a′ come from the coefficient distribution of polynomial a, and b and b′ come from the coefficient distribution of polynomial b. In this invention, the coefficients of polynomials f and g both come from a standard deviation of σ. f The coefficient distribution of the discrete Gaussian distribution, after reduction, of the F′ and G′ polynomials can also be considered as having a standard deviation of... For a discrete Gaussian, it is only necessary to input the distributions of G′,s and f,e to calculate the distribution of the polynomial product. Then, the error is calculated using Gaussian tail noise, and the maximum value is taken as the upper bound estimate of the decryption error corresponding to the scheme parameters. The error of this invention is less than 2 based on theoretical calculations. -28 In actual experiments, the sampling rejection technique can be used to control the sampling rejection rate to approximately 2. -30 the following.

[0124] Comparison of solution dimensions:

[0125]

[0126]

[0127] As can be seen, the proposed solution is smaller in size than existing solutions that achieve a 128-bit security level, resulting in a sacrifice in security level and decryption error rate, but it still has application scenarios.

[0128] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A lightweight lattice-based quantum-resistant encryption method, comprising the following steps: 1) Generate a public key h and a private key (f, g, F) ​​using a key generation algorithm. ′ The method is as follows: 11) Calculation σ s Discrete Gaussian distribution The standard deviation; k is the parameter that generates noise in the LWR. It is a positive integer greater than or equal to 2; 12) From the standard deviation σ f Discrete Gaussian distribution Extract 2n elements from R to serve as the coefficients of two polynomials f and g over R; 13) Determine if the polynomial f is in... Check if the above is invertible. If not, return to step 12); if it is invertible, proceed to step 14; where q is a prime modulus. For a finite field polynomial ring on, n is a positive integer whose factors are only 2 and 3 after factorization, representing the degree of the polynomial; 14) If Then return to step 12); Otherwise, proceed to step 15); 15) Calculate h = g·f -1 (mod q); 16) Calculate Two polynomials F and G on the x-axis, such that gF - Gf = q; where It is a polynomial ring over the ring of integers; 17) Calculate (F) ′ G ′ ,w)=Reduce(g,f,G,F,q ′ ,γ); Reduce() is a polynomial reduction algorithm; 18) If Then return to step 12); otherwise output the public key h. Private key (f, g, F) ′ ,G′); where, q ′ Prime numbers used to control precision; 2) Using encryption algorithms based on n, k, q, σ f γ encrypts plaintext m to generate ciphertext c; the method is as follows: 21) From the standard deviation σ s Discrete Gaussian distribution Extract n elements from R as R q The coefficients of the polynomial s over R; where R q for Polynomial quotient ring on, for Polynomial ring on the ring, It is an integer ring modulo q; 22) Calculate ciphertext 23) Calculate e = (hs mod q) - kc0; 24) If Then return to step 21); otherwise proceed to step 25. 25) Calculate the ciphertext c1 = Hash(s) ⊕ m, and output the ciphertext c = (c0, c1); 3) Use encryption algorithms based on n, q, q ′ The ciphertext c is decrypted using f, g, F, G, γ, k to obtain the ciphertext m; the method is as follows: 31) Use the decoding algorithm Decode(c0,f,g,F,G,q,q) ′ s,e is obtained by calculating k; 32) If If the decryption calculation is terminated, then the plaintext m = Hash(s) ⊕ c1 is output.

2. The method according to claim 1, characterized in that, The polynomial reduction algorithm Reduce() is based on the input g, f, G, F, q ′ ,γ was calculated to obtain (F ′ G ′ The method for calculating w is as follows: First, calculate w. Then calculate Then output (F) ′ =q ′ F-fw,G ′ =q ′ G-gw,w); where This represents the conjugate of f.

3. The method according to claim 1, characterized in that, Decoding algorithm: Decode(c0,f,g,F,G,q,q) ′ The method for calculating s and e using (f,k) is as follows: First, calculate (F ′ G ′ ,w)=Reduce(g,f,G,F,q ′ ,γ), c ′ =fc(mod q), c ″ =q ′ Fc-c ′ w(mod qq′); then solve the integer ring. Linear equations on: Output (s, e).

4. The method according to any one of claims 1, 2, or 3, characterized in that, And it is a prime number.

5. The method according to any one of claims 1, 2, or 3, characterized in that, σ f ,σ s All are real numbers greater than 0.

6. The method according to any one of claims 1, 2, or 3, characterized in that, The hash algorithm in step 25) is the hash algorithm shake256 from the sha3 hash function family.

7. The method according to any one of claims 1, 2, or 3, characterized in that, m is a plaintext polynomial, and its coefficients are all 0 or 1.

Images