A gadget matrix-based lattice cryptogram original image sampling method

Abstract

The application provides a gadget matrix-based lattice cryptogram original image sampling method, and relates to the field of lattice cryptogram, and the method comprises the following steps: inputting the parameters of a trapdoor and a target discrete Gaussian distribution; calculating a perturbation vector for subsequent concealment of trapdoor information; updating the center parameter of the target discrete Gaussian distribution; sampling a discrete Gaussian distribution with a new center in a gadget matrix; mapping the sampling result of the gadget matrix with the trapdoor and combining the perturbation to obtain an original image vector. The application makes the gadget sampling output a spherical Gaussian distribution by adding a secondary perturbation, and designs an integer discrete Gaussian sampler based on a lookup table method, which takes into account the efficiency of gadget matrix sampling and original image sampling. In the online phase, only one rejection sampling and k-1 lookup table methods are required, which effectively makes up for the insufficient efficiency of the existing gadget matrix sampling, improves the performance of the lattice cryptogram original image sampling, and provides a more practical and flexible solution for distributed cryptographic systems and computing-restricted devices.

Description

Technical Field

[0001] This invention relates to the field of lattice cryptography, specifically to a lattice cryptographic preimage sampling method based on Gadget matrices. Background Technology

[0002] With the rapid development of quantum computing technology, traditional cryptography is facing increasing challenges and limitations. Lattice cryptography, as an emerging branch of cryptography, has attracted widespread attention due to its unique mathematical structure and strong security properties. First, lattice cryptography performs exceptionally well against quantum computer attacks. Second, it possesses algorithmic simplicity and parallel computability. Finally, lattice cryptography offers a rich variety of cryptographic schemes and applications, such as digital signatures, fully homomorphic encryption, and attribute-based encryption.

[0003] Preimage sampling can be used to construct lattice cryptographic digital signatures of the Hash-and-Sign type. This digital signature applies the one-way principle, using a private key (trapdoor) to generate the signature and a public key to verify it. In the signature generation process, the message is hashed to a target point in the space spanned by the lattice basis, and then a trapdoor is used to invoke preimage sampling to obtain nearby lattice points, thus obtaining the signature.

[0004] Existing preimage sampling methods fall into two distinct approaches: one involves calling the nearest-plane algorithm on a short lattice basis, while the other samples from a Gadget matrix and then adds perturbations to obtain the preimage. The former places strict requirements on the lattice basis, posing a significant challenge to the key generation stage; the latter, utilizing the specially structured Gadget matrix, significantly improves efficiency, and its independence from short lattice basis makes it more suitable for various high-level lattice cryptographic schemes. Since the integer discrete Gaussian sampler is the core component of preimage sampling, its implementation and the number of calls directly affect the efficiency of the upper-level cryptographic scheme, and existing Gadget matrix-based methods suffer from performance bottlenecks in sampler invocation. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide a lattice cipher preimage sampling method based on Gadget matrices to solve the problems mentioned in the background. The present invention combines perturbation techniques to obtain an efficient lattice cipher preimage sampling method, which can significantly improve the efficiency of lattice cipher schemes.

[0006] To achieve the above objectives, the present invention provides a lattice cipher preimage sampling method based on the Gadget matrix, comprising the following steps:

[0007] Step 1: Input the parameters of the trapdoor and the discrete Gaussian distribution of the target;

[0008] Step 2: Calculate the perturbation vector for subsequent masking of trapdoor information;

[0009] Step 3: Update the central parameters of the target discrete Gaussian distribution using the perturbation vector;

[0010] Step 4: Sampling from the Gadget matrix yields a discrete Gaussian distribution with a new center;

[0011] Step 5: Map the result of Step 4 using a trapdoor and combine it with the perturbation from Step 2 to obtain the original image vector.

[0012] Furthermore, the calculation of the perturbation vector in step two is independent of the central parameter of the target distribution, and therefore can be pre-calculated and stored as an offline stage.

[0013] Furthermore, in step four, the addition of a perturbation vector to the Gadget matrix sampling is for the purpose of subsequently correcting the covariance of the discrete Gaussian distribution, thereby reducing the computational complexity of step two; the perturbation vector in step two is to prevent the leakage of the trapdoor mapping results, so the purposes of the two perturbation vector samplings are different.

[0014] Furthermore, the perturbation vector in step four requires matrix decomposition and rejection sampling to obtain a discrete Gaussian distribution with complementary covariances. Since the Gadget matrix is ​​pre-set and has special characteristics, the covariance matrix of the perturbation vector in step four can be pre-calculated. After obtaining the covariance matrix, the process of calculating the perturbation vector includes: sampling from a normal continuous Gaussian distribution and sampling from an integer discrete Gaussian distribution.

[0015] Furthermore, the core algorithm for Gadget matrix sampling in step four involves one rejection sampling and k-1 table lookup operations. The table lookup method is limited to fixed Gaussian distribution parameters, that is, the probability of each integer is pre-calculated and stored in a table based on the parameters of the discrete Gaussian distribution, and finally the corresponding integer is returned by looking up the table.

[0016] Furthermore, the rejection sampling algorithm includes the Karney or COSAC algorithm; the process of calling the rejection sampling method once and the k-1 lookup method is related to the target center and must be calculated in real time, which is an online process.

[0017] Furthermore, after calling the rejection sampling method once and the table lookup method k-1 times in the Gadget matrix sampling, the output discrete Gaussian distribution has a covariance Σ0. Therefore, the Gaussian distribution to which the perturbation vector belongs has a covariance Σ. p′ ,in

[0018] Furthermore, the sampling result of the Gadget matrix, after adding perturbation, has covariance. This allows the calculation of the perturbation vector in step two of claim 1 to avoid two large matrix operations, and a fast algorithm based on polynomial rings can be used.

[0019] Furthermore, the table lookup method is used to obtain data from the discrete Gaussian distribution. Sample k-1 integers, where the set of integers is v is used as the central parameter, and σ is used as the standard deviation parameter.

[0020] Furthermore, the process of sampling k-1 integers is achieved through sampling... We obtain that, in this process, a fixed discrete Gaussian distribution centered at 0 and with σ as the standard deviation is then shifted to the center v.

[0021] The beneficial effects of this invention are:

[0022] 1. The lattice cipher preimage sampling method based on Gadget matrix uses the lookup table method for integer discrete Gaussian samplers as a key step. Compared with the general sampler based on rejection sampling, the lookup table method sampler has a significant efficiency advantage and requires only a small pre-storage cost.

[0023] 2. This Gadget matrix-based lattice cipher preimage sampling method introduces a perturbed Gadget matrix sampling process, which can be divided into an online stage and an offline stage. The main step in the online stage is to call the table lookup sampler proposed in this invention; while in the offline stage, perturbation is added to ensure that the Gadget matrix sampling outputs a spherical Gaussian distribution. This perturbated Gadget matrix sampling still outperforms existing schemes, and its advantages are even more pronounced when applied to preimage sampling. Attached Figure Description

[0024] Figure 1 This is a flowchart of a lattice cipher preimage sampling method based on a Gadget matrix according to the present invention. Detailed Implementation

[0025] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0026] Please see Figure 1 This invention provides the following technical solution: a lattice cipher preimage sampling method based on Gadget matrix. First, the existing technology used in this embodiment is described in detail:

[0027] 1. Latent Discrete Gaussian Distribution

[0028] Definition 1 Let Let be a set of linearly independent vectors, and define an n-dimensional lattice as:

[0029]

[0030] That is, lattice Λ is all column vectors {b1,…,b} n The set of linear combinations of integers}. Here, B is called the lattice basis, and n is the dimension or rank of the lattice. In this invention, only lattices of full rank are considered.

[0031] Definition 2 For any The Gaussian function is defined as

[0032] Definition 3 For any center and Set of Integers The discrete Gaussian distribution is:

[0033]

[0034] in

[0035] Definition 4 For any vector and the invertible linear transformation B n×n The n-dimensional Gaussian function is defined as follows:

[0036] in B is the square root of Σ, written as Σ. Because ρ B,c (x) is determined only by Σ, therefore it is written as Similarly, one can obtain grids. The discrete Gaussian distribution on the surface.

[0037] Definition 5 For any center In Ge The discrete Gaussian distribution on is defined as

[0038]

[0039] In this invention, Σ is called the covariance of the discrete Gaussian distribution. Specifically, if the covariance is σ... 2 I, then the discrete Gaussian distribution on the lattice is denoted as D. Λ,c,σ The spherical Gaussian distribution is called the spherical Gaussian distribution; the discrete Gaussian distribution is called the discrete Gaussian distribution. It has a non-spherical Gaussian distribution.

[0040] 2. Gadget Matrix

[0041] The Gadget matrix is ​​composed of vector g t =[1,2,…,2 k-1 Composed of, among which Vector g t A lattice can be generated, that is Λ ⊥ (g t The corresponding lattice basis Sk It is expressed as follows:

[0042]

[0043] Where [q0,…,q k-1 ]∈{0,1} k It is the binary expansion of q. Because g t ·S k =0 mod q and |S k |=q, therefore S k It is Λ⊥(g t The Gadget matrix and its lattice basis are defined as follows:

[0044]

[0045] 3. Preimage sampling based on Gadget matrix

[0046] Miccianio and Peikert first proposed sampling on the Gadget matrix, that is, given a target integer... From the collection of Ge Sampling a vector that follows a discrete Gaussian distribution is denoted as . Since the Gadget matrix is ​​composed of vector g t The result is obtained by multiplying the matrix n times with the identity matrix, within the lattice Λ generated by the Gadget matrix. ⊥ (G) upsampling only requires n calls. Sampling is sufficient. Therefore, this algorithm is simple, efficient, and friendly to parallel optimization.

[0047] But when q≠2 k hour, The sampling algorithm will use the following nearest-plane algorithm, namely:

[0048] (1) Let v k ←0 and For i = k, ..., 1:

[0049] 1) Calculate the projection coefficient and sampling parameters

[0050] 2) Sample an integer,

[0051] 3) Update the next plane, c i-1 ←c i -z i s i and v i-1 ←v i +z i s i ;

[0052] (2) Output v0.

[0053] As mentioned above, the general nearest-plane algorithm requires calculating the Schmitt orthogonal basis, and also needs to calculate the vector inner product and update the next selected plane. Therefore, the total time complexity is O(k). 2 And requires O(k) 2 Spatial storage of Schmitt orthogonal basis.

[0054] Definition 6: For positive integers n, m, q, a uniformly random matrix and Gadget Matrix Define the trapdoor based on the Gadget matrix as and

[0055] For a uniformly random matrix The Inhomogeneous Small Integer Solution (ISIS) problem asks for a nonzero short integer solution to the nonhomogeneous linear equation Ae = u mod q. And |e| ≤ β. This is equivalent to a coset in a lattice. Finding a non-zero short vector, the ISIS problem has been proven to be approximately equal to the worst-case lattice-hard problem; therefore, the lattice cipher preimage sampling function is defined as follows:

[0056] (1) Let the function f A (e) = Ae = u mod q, where and

[0057] (2) Inverse the function The function is called the preimage sampling function Presample(A,T,u,σ). s ): Given a trapdoor T and a target u, return a preimage. Make Ax = u and

[0058] In this embodiment, combined with the appendix Figure 1 The present invention provides the following technical solution: a lattice cipher preimage sampling method based on Gadget matrix, which mainly includes the following three parts:

[0059] I. Calculate the disturbance vector:

[0060] Assume the result of sampling from the Gadget matrix is make As the preimage, the covariance of y at this time is Although The requirements for the preimage are met, but the covariance of y contains information about T, which can lead to trapdoor leakage. Therefore, y cannot be directly output as the preimage.

[0061] The solution to the above problem is to add a perturbation vector. in Then let As the preimage vector, x has the following covariance: That is, it satisfies a spherical Gaussian distribution.

[0062] It is important to note that a typical method for calculating the perturbation vector is to first sample an m-dimensional real vector from a continuous Gaussian distribution, and then use the covariance Σ p The matrix factorization is left-multiplied by the real vector, and finally the perturbation vector is obtained by random rounding. Sampling with a continuous Gaussian distribution can be performed using standard algorithms such as the Polar algorithm and the Box-Muller algorithm; while matrix factorization is typically performed using the Cholesky method, which has a time complexity of O(n^2). 3 ), and when Σ G When dealing with a general matrix, two additional matrix multiplications are required.

[0063] The perturbation sampling algorithm based on polynomial rings is described recursively, where Σ p Disassembled into

[0064]

[0065] Among them, the mapping relationship φ between the polynomial ring and the matrix n : Σ2 is represented by a 2×2 polynomial ring matrix, i.e. This algorithm achieves quasi-linear time complexity by recursively sampling in Σ2, combined with Fast Fourier Transform (FFT) techniques, and requires no preprocessing or pre-storage. While this algorithm can be implemented using existing techniques, it requires that the Gadget matrix sampling results possess covariance. This requires that the output distribution of the Gadget matrix sampling be spherical Gaussian.

[0066] II. Gadget Matrix Sampling:

[0067] The sampling method for the Gadget matrix in this invention is based on Algorithm 1, whose final output x satisfies a discrete Gaussian distribution. in

[0068]

[0069] The algorithm has a time complexity of O(k). Except for step 1, the other steps only involve integer calculations and do not include floating-point operations, which is more computer-friendly. However, the cost is that the output distribution is non-spherical Gaussian. As analyzed in the previous section on perturbation calculation, this increases the computational complexity, and perturbation sampling cannot use advanced algorithms based on polynomial rings.

[0070]

[0071] This invention improves the overall efficiency of the preimage sampling algorithm by adding a second perturbation to correct the non-spherical Gaussian output of Algorithm 1. To ensure the final output of the Gadget matrix sampling is spherical Gaussian, a perturbation vector can be added to the result of Algorithm 1. in Specifically, we can start from A continuous Gaussian vector is sampled, and then each component is randomly rounded, i.e., an integer discrete Gaussian sampler is called to obtain the final distribution, where... This is the smoothing parameter. The key step is calculating Σ. p′ -r 2 I matrix decomposition, through analysis of Σ p′ -r 2 I discovered that,

[0072]

[0073] in therefore, It has a special structure, assuming

[0074]

[0075] Then for i = 1, ..., k-1, we can solve for...

[0076]

[0077] Therefore, calculate Σ p′ -r 2 The matrix factorization of I does not require calling a function with a complexity of O(n). 3 The Cholesky decomposition method is used; all variables in the above steps can be pre-calculated. Based on the above steps, Algorithm 2 describes the calculation process of the second perturbation vector.

[0078]

[0079]

[0080] It is important to note that the key step in Algorithm 2 is calling the oracle algorithm. Instead of the absolute floor function, "floor". Oracle algorithm. This can typically be implemented using an integer discrete Gaussian sampler based on rejection sampling. Analyzing the steps of Algorithm 1 and Algorithm 2, it can be seen that the efficiency of sampling on the Gadget matrix mainly depends on the oracle algorithm. The implementation of.

[0081] Analysis of step 5 of Algorithm 1 reveals that the oracle algorithm... We expect to obtain an integer z that satisfies a discrete Gaussian distribution. Where v is an integer, and the Gaussian parameter σ is fixed. Analysis shows that this is equivalent to... (The sentence is incomplete and requires more context to translate accurately.) Sampling involves first sampling from a discrete Gaussian distribution centered at 0 with parameter σ, and then shifting the sample by an integer v to obtain the final distribution. From the distribution... Mid-range sampling can be achieved through a lookup table method, that is, pre-calculating within a certain accuracy. First, obtain the cumulative distribution table, then generate random numbers with the same precision, and finally find the last index in the table that is greater than that random number, and return that index.

[0082] because Since it is centrally symmetric, only half of the cumulative distribution table needs to be stored, and the entire distribution can be obtained through the sign bit. Furthermore, in the actual implementation, the cumulative distribution table does not need to store all integers; it only needs to store integers in the interval [0, τσ], where τ is the tail tangent factor.

[0083] The method for calculating the cumulative distribution table is described below. Given the parameters σ and precision θ, the tail truncation factor τ can be determined and the probability distribution table (PDT) can be calculated. Based on the pre-calculated PDT, the cumulative distribution table (CDT) can be directly calculated. This is because the method based on the reversed cumulative distribution table (RCDT) can control the increase in relative error of the output results to approximately σ times. The detailed steps for calculating the RCDT are given below:

[0084] (1) Let The discrete Gaussian distribution in the interval {-w,…,w} is expressed as:

[0085] (2) Calculation Where i = 0, ..., w / 2;

[0086] (3) Find w such that PDT(w / 2)>0, then the tail tangent factor τ=w / σ;

[0087] (4) Let \(CDT(0)=PDT(0)\), \(CDT(j)=CDT(j - 1)+2PDT(j)\), for \(j = 1,\ldots,w / 2\); (5) Calculate \(RCDT\), where \(RCDT(k)=2 θ -CDT(k)\), for \(k = 0,\ldots,w / 2\).

[0088] According to the definition of \(CDT\), the probability of outputting an integer \(x\) satisfies \(CDT(i - 1)\leq2PDT(x)<CDT(i)\), which corresponds to the \(x\)-th number from the bottom in \(RCDT\). Therefore, only need to pre-calculate the \(RCDT\) table, then generate a random number with \(\theta\) precision. Finally, search the entire \(RCDT\), accumulate all the results less than \(RCDT(i)\), multiply the accumulated result by the sign bit and add the translation amount to obtain Algorithm 3 describes the implementation steps of the integer discrete Gaussian sampler based on the table lookup method.

[0089]

[0090] Compared with the rejection sampling method, Algorithm 3 does not need to calculate the Gaussian function, and the whole process only calls the random number generator and table lookup comparison to implement the oracle algorithm which can significantly improve the efficiency of Algorithm 1.

[0091] Combining Algorithm 1 and Algorithm 2, the complete Gadget matrix sampling is described in Algorithm 4.

[0092]

[0093]

[0094] In summary, the present invention proposes an efficient Gadget matrix sampling method for outputting a spherical Gaussian distribution. Its core steps require calling the rejection sampling algorithm \(k + 1\) times and the table lookup method \(k - 1\) times; while the existing method requires calling the rejection sampling algorithm \(2k\) times.

[0095] III. Calculate the preimage vector:

[0096] Algorithm 5 describes the detailed steps of calculating the preimage vector. From the previous analysis, the whole process of calculating the preimage vector needs to add two perturbations. The first is in step 1 of Algorithm 5, and this perturbation vector is to mask the final trapdoor information; while the second is in step 4 of Algorithm 5. The present invention makes the result of Gadget matrix sampling output a spherical Gaussian distribution by adding perturbations, and the purpose of this perturbation vector is to improve the overall efficiency of the preimage sampling algorithm.

[0097]

[0098]

[0099] For step 1 in Algorithm 5, existing technologies can be used, especially fast algorithms based on polynomial rings, which can achieve quasi-linear time complexity. For step 4 in Algorithm 5, existing technologies require 2k calls to the integer discrete Gaussian sampler based on rejection sampling in order to output a spherical Gaussian, while the technical solution of this invention can provide k+1 calls to rejection sampling, thus significantly improving the efficiency of the algorithm.

[0100] This embodiment has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention.

[0101] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A gadget matrix based lattice cryptogram preimage sampling method, characterized in that: The method comprises the following steps: Step one, input trapdoor matrix T, target vector u and the parameter σ of discrete Gaussian distribution s ; Step two, calculate the first perturbation vector p for subsequent cover trapdoor information, wherein p is sampled from a discrete Gaussian distribution, and the covariance matrix of p is wherein ΣGis the covariance matrix of the Gadget matrix sampling; Step three, updating the center parameter of the target discrete Gaussian distribution by using the first perturbation vector p to obtain the updated center u'= u - Ap, wherein A is a public matrix; Step four, based on the updated center u', a two-stage Gadget matrix sampling procedure is performed to obtain a vector y with a spherical Gaussian distribution, the two-stage procedure includes: a. Non-spherical sampling stage: Gadget matrix sampling is performed with u' as the center, after calling rejection sampling once and k-1 times of table lookup method in Gadget matrix sampling, the discrete Gaussian distribution output has a covariance Σ0, generating an intermediate vector x, wherein the distribution of x is a non-spherical discrete Gaussian distribution; b. Spherical correction stage: a second perturbation vector p' is calculated, and p' is added to the intermediate vector x to obtain the final output vector y = x + p'; wherein the covariance matrix of the second perturbation vector p' is configured to , the result of the Gadget matrix sampling has a covariance after adding the second perturbation, σ as the standard deviation parameter, so that the distribution of the final output vector y is corrected to a spherical discrete Gaussian distribution; Step five, map the vector y with the trapdoor matrix T to get Ty, and combine the first perturbation vector p to calculate the pre-image vector x_final .

2. The Gadget matrix based lattice cryptogram preimage sampling method according to claim 1, characterized in that: The calculation of the perturbation vector in step two is irrelevant to the center parameter of the target distribution, and can be pre-calculated and stored in the offline stage.

3. The Gadget matrix based lattice cryptogram preimage sampling method according to claim 2, characterized in that: The second perturbation vector p' in step four is used to correct the covariance of the discrete Gaussian distribution, so that the subsequent calculation of the first perturbation vector can use the fast algorithm based on the polynomial ring; the first perturbation vector p is used to prevent the leakage of trapdoor information.

4. The Gadget matrix based lattice cryptogram preimage sampling method according to claim 3, characterized in that: The second perturbation vector p' in step four needs to calculate matrix decomposition and call rejection sampling to obtain a discrete Gaussian distribution with complementary covariance; the covariance matrix of the second perturbation vector p' in step four is pre-calculated; After obtaining the covariance matrix, the process of calculating the perturbation vector includes normal continuous Gaussian distribution sampling and integer discrete Gaussian sampling.

5. The Gadget matrix based lattice cryptogram preimage sampling method according to claim 4, characterized in that: In the spherical correction stage in step four, the process of calculating the second perturbation vector p' includes calling rejection sampling once and table lookup sampling k-1 times; the table lookup sampling pre-calculates and stores the probability of each integer according to the parameters of the discrete Gaussian distribution for fixed Gaussian distribution parameters, and returns the corresponding integer by table lookup.

6. The Gadget matrix based lattice cryptogram preimage sampling method according to claim 4, characterized in that: The rejection sampling algorithm uses Karney or COSAC algorithm.

7. The Gadget matrix based lattice cryptogram preimage sampling method according to claim 1, characterized in that: The calculation of the first perturbation vector p in step two uses the fast algorithm based on the polynomial ring.

8. The Gadget matrix based lattice cryptogram preimage sampling method according to claim 5, characterized in that: The k-1 lookup table method sampling is sampling k-1 integers from a discrete Gaussian distribution where the set of integers is v as a central parameter and σ as a standard deviation parameter.

9. The Gadget matrix based lattice cryptogram preimage sampling method according to claim 8, characterized in that: From the distribution The sampling process involves first sampling from a fixed discrete Gaussian distribution centered at 0 with a standard deviation of σ. The sampling is performed by shifting the sampling result by an integer v.

Images