Multi-hop proxy re-encryption method

Abstract

The present application relates to the field of cryptography technology and discloses a multi-hop proxy re-encryption method for a set of fine-grained proxy functions, comprising the following steps: key generation; public key encryption; fine-grained proxy key generation, wherein the public and private keys of the principal, the public key of the delegate, and the fine-grained proxy function are input into a fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the delegate; proxy re-encryption, wherein the ciphertext for the principal and the fine-grained proxy key are input into the re-encryption algorithm to generate a re-encrypted ciphertext for the delegate; and ciphertext decryption, wherein the ciphertext and the corresponding private key are input into a decryption algorithm to obtain the plaintext corresponding to the ciphertext. This multi-hop proxy re-encryption method has higher security and encryption efficiency, and implements fine-grained authorization of ciphertext decryption rights.

Description

Technical Field

[0001] This application relates to the field of cryptography, and in particular to a multi-hop proxy re-encryption method and a multi-hop proxy re-encryption method for fine-grained proxy function sets. Background Technology

[0002] In traditional public-key encryption schemes, plaintext information is encrypted into ciphertext using a public key. The ciphertext can be transmitted over a public channel, and only the owner of the corresponding private key can decrypt it to obtain the plaintext information. In this process, each ciphertext uniquely corresponds to a set of public and private keys; ciphertext C intended for user A cannot be decrypted by user B. If the plaintext information C intended for user A is to be securely transmitted to user C, user A needs to perform a "decryption-re-encryption" process to convert the ciphertext. However, this method has drawbacks: it requires real-time participation from user A, involves significant computational costs, and carries the risk of plaintext leakage during the decryption process.

[0003] Proxy re-encryption avoids the drawbacks of the aforementioned ciphertext conversion methods. Users can generate their own conversion keys for communication with other users and then provide these keys to the proxy. The proxy then uses a proxy re-encryption algorithm to efficiently convert ciphertext C destined for user A. A Converted into ciphertext C for user B B When the proxy re-encryption scheme converts ciphertext between users, the original ciphertext C is... A and the converted ciphertext C B Both encryptions are of the same plaintext. The key conversion between user A and user B does not reveal their private key information. For example, if a company manager encounters encrypted emails while on a business trip / vacation and wants to delegate them to his secretary, he can, with the help of an agent, convert the received encrypted emails into encrypted emails using the secretary's public key, and then directly forward them to the secretary for decryption and processing.

[0004] Proxy re-encryption can be viewed as an authorization of the right to decrypt ciphertext. The effect of ordinary proxy re-encryption authorization is either that the user (unauthorized user) cannot decrypt the re-encrypted ciphertext, or the user (authorized user) can decrypt the re-encrypted ciphertext and obtain all the information from the original plaintext. This decryption authorization is coarse-grained. However, the above proxy re-encryption scheme cannot perform finer-grained operations on the ciphertext; it can only guarantee that the ciphertext before and after the conversion is the same plaintext encrypted.

[0005] Currently, quantum computing technology is developing rapidly, and traditional proxy re-encryption techniques do not possess resistance to quantum attacks. Furthermore, when deploying cryptographic algorithms in practical applications, the encryption efficiency of the scheme should be considered to ensure the algorithm's high performance.

[0006] Therefore, there is an urgent need for a new proxy re-encryption method that is post-quantum secure, encrypts multi-bit plaintext, has higher security, higher encryption efficiency, and can achieve fine-grained ciphertext decryption authorization. Summary of the Invention

[0007] The purpose of this application is to provide a multi-hop proxy re-encryption method with post-quantum security that encrypts multiple bits of plaintext, which has higher security, higher encryption efficiency, and can achieve fine-grained ciphertext decryption authorization.

[0008] To address the aforementioned technical problems, this application discloses a multi-hop proxy re-encryption method, comprising the following steps:

[0009] Key generation involves inputting security parameters into a key generation algorithm to generate a public-private key pair.

[0010] Public key encryption involves inputting the public key and plaintext into an encryption algorithm to generate ciphertext corresponding to the plaintext.

[0011] The proxy key generation process involves inputting the principal's public and private keys and the agent's public key into the proxy key generation algorithm to generate a proxy key from the principal to the agent.

[0012] The proxy re-encryption algorithm takes the ciphertext intended for the principal and the proxy key and inputs them into the re-encryption algorithm to generate re-encrypted ciphertext intended for the proxy.

[0013] To decrypt the ciphertext, input the ciphertext and the corresponding private key into the decryption algorithm to obtain the plaintext corresponding to the ciphertext.

[0014] The key generation algorithm is expressed as: (sk,pk)←KeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, generate a public-private key pair (sk, pk);

[0015] The key generation steps specifically include:

[0016] The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q;

[0017] Randomly generated The public key is obtained by concatenating the matrices: Set the private key to sk = T and output the public-private key pair (sk, pk);

[0018] The encryption algorithm is expressed as follows: The encryption algorithm takes the public key pk and the plaintext m as input and outputs the ciphertext ct corresponding to the plaintext m. (pk) plaintext space Cipherspace

[0019] The public key encryption steps specifically include:

[0020] Randomly select s←χ n , Where χ is The plaintext m is output as ciphertext ct using a discrete Gaussian distribution on the given surface. (pk) for:

[0021]

[0022] The formula for the proxy key generation algorithm is as follows:

[0023] The proxy key generation algorithm uses the principal's public and private keys (pk) to generate the key. (1) ,sk (1) PK with the entrusted person's public key (2) As input, generate the proxy key rk from principal to agent. 1→2 ;

[0024] The steps for generating the proxy key specifically include:

[0025] Random selection

[0026] Call the preimage generation algorithm SamplePre to calculate R; where the formula for the preimage generation algorithm SamplePre is expressed as: in I am A dimensional identity matrix, set rk 1→2 =R, and output the proxy key rk 1→2 ;

[0027] The formula for the re-encryption algorithm is expressed as: ct (2) ←ReEnc(rk 1→2 =R,ct (1) This re-encryption algorithm uses the proxy key rk from the principal to the agent. 1→2 and client-facing encrypted CT (1)The input is the entrusted party's re-encrypted ciphertext ct. (2) ;

[0028] The specific steps of the proxy re-encryption include:

[0029] Based on the input R, obtain the matrix. Its dimensions are

[0030] According to the formula Calculate and output the re-encrypted ciphertext ct for the client. (2) ;

[0031] The decryption algorithm is expressed as: m←Dec(sk=T,ct), which takes the ciphertext ct and the corresponding private key sk as input and outputs the plaintext m, dividing the ciphertext ct into two parts:

[0032] in

[0033] The specific steps for decrypting the ciphertext include:

[0034] The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows:

[0035] calculate

[0036] for Each component judge Is it true? If so, then set m. i := 1, otherwise m i = 0, and output plaintext m.

[0037] In another preferred embodiment, the ciphertext for the principal is either ciphertext generated by public key encryption or re-encrypted ciphertext generated by proxy re-encryption.

[0038] In another preferred embodiment, the proxy key generation step further includes: inputting the principal's public and private keys and the agent's public and private keys into the proxy key generation algorithm to generate a proxy key from the principal to the agent.

[0039] The embodiments of the present invention also disclose a multi-hop proxy re-encryption method for fine-grained proxy function sets, comprising the following steps:

[0040] Key generation involves inputting security parameters into a key generation algorithm to generate a public-private key pair.

[0041] Public key encryption involves inputting the public key and plaintext into an encryption algorithm to generate ciphertext corresponding to the plaintext.

[0042] Fine-grained proxy key generation involves inputting the principal's public and private keys, the agent's public key, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent.

[0043] The proxy re-encryption algorithm takes the ciphertext intended for the principal and the fine-grained proxy key and inputs them into the re-encryption algorithm to generate re-encrypted ciphertext intended for the proxy.

[0044] To decrypt the ciphertext, input the ciphertext and the corresponding private key into the decryption algorithm to obtain the plaintext corresponding to the ciphertext.

[0045] In another preferred embodiment, the fine-grained proxy function is an information deletion proxy function f. pos ;

[0046] The multi-hop proxy re-encryption method for fine-grained proxy function sets specifically includes:

[0047] Let plain text space Cipherspace Where 0 and 1 represent normal information bits, and * represents invalid information bits, a family of functions is defined. For any input The information deletion proxy function f pos Defined as

[0048]

[0049] That is, when i∈pos, m i ′:=*; otherwise, m i ′:=m i The above function set is a set of information deletion proxy functions. The information bit with the index in the set pos will be deleted, that is, set to an invalid information bit.

[0050] The key generation algorithm is expressed as: (sk,pk)←fgKeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, generate a public-private key pair (sk, pk);

[0051] The key generation steps specifically include:

[0052] The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q;

[0053] Randomly generated The public key is obtained by concatenating the matrix: Set the private key to sk = T and output the public-private key pair (sk, pk);

[0054] The encryption algorithm is expressed as follows: The encryption algorithm takes the public key pk and the plaintext m as input and outputs the ciphertext ct corresponding to the plaintext m. (pk) ;

[0055] The public key encryption steps specifically include:

[0056] Encode the plaintext m, where the encoding algorithm is expressed by the formula: m E ←Encode(m) is an encoding algorithm that takes plaintext m as input and outputs the encoded value m. E ;

[0057] The encoding steps specifically include:

[0058] by Input, output encoded value For m E The (2i-1)th and 2ith bits, where The encoding rules are as follows:

[0059]

[0060] Output

[0061] Randomly select s←χ n , Where χ is The plaintext m is output as ciphertext ct using a discrete Gaussian distribution on the given surface. (pk) for:

[0062]

[0063] The formula for the fine-grained proxy key generation algorithm is expressed as follows:

[0064] This fine-grained proxy key generation algorithm uses the principal's public and private keys (pk) (1) ,sk (1) PK with the entrusted person's public key(2) and the information deletion proxy function f pos As input, output a fine-grained proxy key from principal to agent.

[0065] The steps for generating the fine-grained proxy key specifically include:

[0066] According to f pos Function, setting matrix for and The settings rules are as follows:

[0067]

[0068] In addition to the above-mentioned locations, I pos All other positions are set to 0;

[0069] Random selection Call the preimage generation algorithm SamplePre to calculate R; where the formula for the preimage generation algorithm SamplePre is expressed as:

[0070]

[0071] The dimension of the R matrix is Output proxy key

[0072] The formula for the re-encryption algorithm is expressed as follows: This re-encryption algorithm uses a fine-grained proxy key from the principal to the agent. and client-facing encrypted CT (1) The input is the entrusted party's re-encrypted ciphertext ct. (2) ;

[0073] The specific steps of the proxy re-encryption include:

[0074] calculate It also outputs a re-encrypted ciphertext ct to the client. (2) ;

[0075] The decryption algorithm is expressed as: m←fgDec(sk=T,ct), which takes the private key sk and the ciphertext ct as input and outputs plaintext m, dividing the ciphertext ct into two parts:

[0076] in

[0077] The specific steps for decrypting the ciphertext include:

[0078] The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows:

[0079] calculate

[0080] for Each component judge Is it true? If so, then set the i-th component m′. i ′:=1, otherwise m i ′:=0;

[0081] Decode m′ and output m←Decode(m′); where the decoding algorithm is expressed as: m D ←Decode(m E The decoding algorithm uses the encoded value m E The input is the decoded value m, and the output is the decoded value m. D ;

[0082] The decoding steps specifically include:

[0083] by Input is the decoded value. For m D The j-th component, The following mapping relationship exists:

[0084]

[0085] Output

[0086] In another preferred embodiment, the fine-grained surrogate function is a linear surrogate function f. M ;

[0087] The multi-hop proxy re-encryption method for fine-grained proxy function sets specifically includes:

[0088] Choose parameter p such that q = p 2 ;Let plaintext space If the norm of the plaintext is small, fine-grained surrogate re-encryption can be performed; assuming the norm of the plaintext does not exceed Δ, define a set of linear surrogate functions. as follows:

[0089]

[0090] Plaintext space Cipherspace is

[0091] The key generation algorithm is expressed as: (sk,pk)←fgKeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, output public-private key pair (sk, pk);

[0092] The key generation steps specifically include:

[0093] The trapdoor generation algorithm TrapGen is called to generate a matrix. and the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q;

[0094] Randomly generated The public key is obtained by concatenating the matrix: Set the private key to sk = T and output the public-private key pair (sk, pk);

[0095] The encryption algorithm is expressed as follows: The encryption algorithm takes the public key pk and the plaintext m as input and outputs the ciphertext ct corresponding to the plaintext m. (pk) ;

[0096] The public key encryption steps specifically include:

[0097] Randomly select s←χ n , Where χ is The plaintext m is output as ciphertext ct using a discrete Gaussian distribution on the given surface. (pk) for:

[0098]

[0099] The formula for the fine-grained proxy key generation algorithm is expressed as follows:

[0100]

[0101] This fine-grained proxy key generation algorithm uses the principal's public and private keys (pk) (1) , sk (1) PK with the entrusted person's public key (2) and the linear surrogate function f MAs input, generate a fine-grained proxy key from principal to agent.

[0102] The steps for generating the fine-grained proxy key specifically include:

[0103] Random selection Call the preimage generation algorithm SamplePre to calculate R, and then f M Using the matrix as input embedding, the formula for the preimage generation algorithm SamplePre is expressed as:

[0104]

[0105] The dimension of the R matrix is set up Its dimensions are

[0106] The formula for the re-encryption algorithm is expressed as follows: This re-encryption algorithm uses a fine-grained proxy key from the principal to the agent. And encrypted CT scans for clients (1) The input is the entrusted party's re-encrypted ciphertext ct. (2) ;

[0107] The specific steps of the proxy re-encryption include:

[0108] calculate It also outputs a re-encrypted ciphertext ct to the client. (2) ;

[0109] The decryption algorithm is expressed as: m←fgDec(sk=T,ct), which takes the private key sk and the ciphertext ct as input and outputs plaintext m, dividing the ciphertext ct into two parts:

[0110] in

[0111] The specific steps for decrypting the ciphertext include:

[0112] The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows:

[0113] calculate

[0114] for Each component judge Is it true? If so, then set the i-th component of m. otherwise Output

[0115] In another preferred embodiment, the ciphertext for the principal is either ciphertext generated by public key encryption or re-encrypted ciphertext generated by proxy re-encryption.

[0116] In another preferred embodiment, the fine-grained proxy key generation step further includes: inputting the principal's public and private keys, the agent's public and private keys, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent.

[0117] The main differences and effects of the embodiments of the present invention compared with the prior art are as follows:

[0118] A multi-hop proxy re-encryption method with post-quantum security for encrypting multi-bit plaintext is provided, which has higher security, higher encryption efficiency, and can achieve fine-grained ciphertext decryption authorization.

[0119] The specification of this application contains numerous technical features distributed across various technical solutions. Listing all possible combinations of these technical features (i.e., technical solutions) would make the specification excessively lengthy. To avoid this problem, the various technical features disclosed in the above-described invention, the various technical features disclosed in the following embodiments and examples, and the various technical features disclosed in the accompanying drawings can be freely combined to form various new technical solutions (all of which are considered to have been described in this specification), unless such a combination of technical features is technically infeasible. For example, one example discloses feature A+B+C, and another example discloses feature A+B+D+E. Features C and D are equivalent technical means that serve the same function, and technically only one needs to be used; they cannot be used simultaneously. Feature E can technically be combined with feature C. Therefore, the solution A+B+C+D should not be considered as described because it is technically infeasible, while the solution A+B+C+E should be considered as described. Attached Figure Description

[0120] Figure 1 This is a flowchart illustrating a multi-hop proxy re-encryption method according to the first embodiment of this application;

[0121] Figure 2 This is a flowchart illustrating a multi-hop proxy re-encryption method for a fine-grained proxy function set according to the second embodiment of this application. Detailed Implementation

[0122] In the following description, many technical details are presented to help the reader better understand the present application. However, those of ordinary skill in the art can understand that the technical solutions claimed in the claims of the present application can be implemented even without these technical details and various changes and modifications based on the following embodiments.

[0123] Explanation of some concepts:

[0124] I. Explanation of mathematical symbols:

[0125] If x is defined by y or the value of y is assigned to x, we write x := y. For Define [μ] := {1, 2,..., μ}, [a, b] := {a, a + 1,..., b}. Use to denote that x is uniformly randomly selected from the set If is a distribution, denote that x is sampled from We use to define the random variable y output by the algorithm when taking x as the input; if is deterministic, we write We use to denote that y is in the support set of We represent matrices by bold uppercase letters, such as A, A i,j denote the element in the i-th row and j-th column of matrix A; bold lowercase letters represent column vectors, such as a, a i denote the i-th element of vector a. We use ||x|| to denote the 1-norm of x, ||x||2 to denote the 2-norm of x, and ||x|| ∞ to denote the infinity norm of x.

[0126] represents the set of natural numbers, represents the set of real numbers, represents the set of integers, represents the set of residue classes of the set of integers modulo q.

[0127] II. Related terms of lattices:

[0128] Let An m-dimensional lattice is a discrete additive subgroup of the m-dimensional real space Given k (k ≤ m) linearly independent vectors on, set the matrix Define the lattice generated by A [[ID=<<MASK_B>>68]]

[0129] In this application, we primarily use a special type of integer lattice, namely the q-ary lattice; the m-dimensional q-ary lattice Λ q satisfy Given a matrix Define q-cell lattice Define q-order orthogonal lattice and its relationship to any vector The accompanying

[0130] 1. Discrete Gaussian distribution

[0131] definition The above uses s as the (scale) parameter, and... Gaussian distribution centered on For any

[0132] ρ s,c (x):=exp(-π||xc|| 2 / s 2 ).

[0133] make For a countable set, define The above uses s as a parameter and a vector. Discrete Gaussian distribution centered at For any

[0134]

[0135] If s = 1, we will abbreviated as If c = 0, we will abbreviated as

[0136] In this application, we use χ to represent a bounded discrete Gaussian distribution, and its bound is represented by B. Therefore, the range of values ​​for χ is [-B, B].

[0137] 2. Trapdoor Generation Algorithm

[0138] The algorithm is denoted by TrapGen, and its inputs are parameters n, m, and q, where... The output is a matrix that satisfies q≥2 and m=O(nlogq). and trapdoor The formula is expressed as (A,T) A )←TrapGen(1 n ,1 m ,q).

[0139] Wherein, the distribution of matrix A is... A uniform distribution on the matrix T is statistically close to the matrix T. A A q-ary orthogonal lattice defined by A A set of short lattice bases (abbreviated as T) A (It is a trapdoor of A) that satisfies T A A = 0 and

[0140] 3. Preimage Sampling Algorithm

[0141] The algorithm is denoted by SamplePre, and its input is a matrix. Trapdoor parameter and arbitrary vectors Output is the preimage Make The formula is expressed as x←SamplePre(A,T) A ,u,γ).

[0142] in And it satisfies q≥2. Furthermore, the preimage x follows the distribution... This algorithm can expand the input u into a matrix U, and then perform preimage sampling column by column to obtain the output matrix X.

[0143] 4. The difficulty of fault-tolerant learning problems

[0144] make χ is The discrete Gaussian distribution on [a] is used. The difficulty of the error-tolerant learning problem (Learning With Error) lies in the fact that for any polynomial-time adversary... Given a matrix A, it cannot distinguish between As + emodq (which can also be called an LWE instance) and a uniformly random value u, where e←χ m ,

[0145] 5. Fault-tolerant learning inverse algorithm

[0146] The algorithm, denoted by lnvert, takes a trapdoor T as its input, given a public matrix A. A And the LWE instance As+e corresponding to matrix A, the output is (s,e) in that instance. The formula is expressed as (s,e)←lnvert(T) A ,As+e).

[0147] III. Terminology related to proxy re-encryption:

[0148] This includes relevant terminology used in the description of proxy re-encryption scenarios and solutions, with the specific definitions as follows:

[0149] 1. Plaintext refers to information that has not been processed by encryption algorithms, and it is usually expressed in the form of data, natural language, etc.

[0150] 2. A key refers to the secret information required for encryption and decryption algorithms to run. In public-key encryption schemes, keys are typically divided into public keys and private keys.

[0151] 3. Ciphertext refers to information that cannot be directly read or recognized after being converted from text using an encryption algorithm.

[0152] 4. Ciphertext intended for user A refers to ciphertext sent to user A and intended to be decrypted using user A's private key.

[0153] 5. Delegator: In a proxy re-encryption scenario, this refers to a user who wishes to delegate their decryption rights to another user.

[0154] 6. Proxy: In a proxy re-encryption scenario, the proxy assists the principal in delegating the decryption right.

[0155] 7. The delegate (Delegetee) refers to the role that receives the decryption right in a proxy re-encryption scenario.

[0156] 8. Proxy key: In a proxy re-encryption scenario, this refers to the secret information held by the proxy. It is usually related to the key information of both the principal and the proxy, and its function is to assist the proxy in delegating the decryption authority.

[0157] 9. Plaintext space refers to the set to which the plaintext belongs, expressed in terms of... To express.

[0158] 10. Cipherspace refers to the set to which the ciphertext belongs, expressed in words such as ciphertext space. To express.

[0159] 11. A set of fine-grained surrogate functions refers to a collection of a specific type of function. This is used to represent the domain and range of this type of function. A subset of, a function within the set Function in plaintext The function value f(m) is obtained from this, which can be regarded as a fine-grained operation on m. Here, both m and f(m) are considered as plaintext.

[0160] IV. Proxy Re-encryption Scheme:

[0161] Let set These are the plaintext space and the ciphertext space, respectively. The proxy re-encryption scheme includes five algorithms PRE = (KeyGen, ReKeyGen, Enc, ReEnc, Dec), defined as follows:

[0162] 1. The key generation algorithm is denoted by KeyGen. Its input is the security parameter λ, and its output is a public-private key pair (pk) for user i. i ,sk i The formula is expressed as (pk) i ,sk i )←KeyGen(1 λ ).

[0163] 2. The proxy key generation algorithm is represented by ReKeyGen, and its input is the public and private keys (pk) of the principal i. i ,sk i ) and the public and private keys (pk) of the entrusted person j j ,sk j The output is the proxy key rk from i to j. i→j .

[0164] The formula is expressed as rk i→j ←ReKeyGen(pk i ,sk i ,pk j ,sk j ).

[0165] When considering non-interactive proxy re-encryption schemes, the algorithm does not require input sk. j .

[0166] The formula is expressed as rk i→j ←ReKeyGen(pk i ,sk i ,pk j ).

[0167] 3. The encryption algorithm is denoted by Enc, and its input is the user's public key pk. i and plain text messages The output is ciphertext directed to user i. The formula is expressed as c i ←Enc(pk i ,m).

[0168] 4. The re-encryption algorithm is denoted as ReEnc, and its input is the proxy key rk. i→j And the encrypted c for user i i The output is a re-encrypted ciphertext for user j. Or the failure symbol ⊥.

[0169] The formula is expressed as c j / ⊥←ReEnc(rk i→j ,c i ).

[0170] 5. The decryption algorithm is denoted by Dec, and the input is the decryption key sk. i and ciphertext c i The output is Alternatively, the failure symbol ⊥, the formula is represented as m / ⊥←Dec(sk i ,c i ).

[0171] The correctness of the proxy re-encryption scheme PRE refers to the fact that for any (pk i ,sk i )←KeyGen(1 λ ), (pk j ,sk j )←KeyGen(1 λ ), rk i→j ←ReKeyGen(pk i ,sk i ,pk j ,sk j (If it is a non-interactive agent, then rk) i→j ←ReKeyGen(pk i ,sk i ,pk j )), c i ←Enc(pk i ,m) and c j ←ReEnc(c i ,rk i→j ), has Dec(sk) i ,c i ) = Dec(sk j ,c j ) = m.

[0172] The following is a brief summary of some of the innovative aspects of this application:

[0173] I. Set of Fine-Grained Proxy Functions Proxy re-encryption scheme:

[0174] Fine-grained proxy re-encryption schemes can achieve fine-grained decryption authorization. Fine-grained implementation uses a set of functions. To embody. Transformation key and set A function f in the code is bound, represented as User A is targeting the function Generate the conversion key between user A and user B Transform key The message is handed over to an agent. The agent efficiently re-encrypts the ciphertext C intended for user A using a proxy re-encryption algorithm. A Convert to ciphertext for user B If C A If user A's public key encrypts plaintext m, then user B's ciphertext... After decryption, the function value f(m) of the plaintext m can be obtained. Similarly, the conversion key between user A and user B... The private key information of users A and B will not be leaked. Through [the following]... By granting different functions, user A can achieve fine-grained authorization of the right to decrypt ciphertext.

[0175] For example, if principal A only wants agent B to know the result of a certain election vote, then principal A only needs to generate a transformation key using an accumulation function. All votes are encrypted using principal A's public key to obtain ciphertext C. A The agent can use the conversion key generated against the accumulation function to convert the ciphertext C A Convert to And It is handed over to the agent. The agent has the right to... Decryption will yield the sum of all votes, thus providing the voting result.

[0176] Let set These represent the plaintext space, ciphertext space, and a set of fine-grained proxy functions. The fine-grained proxy re-encryption scheme includes five algorithms: fgPRE = (fgKeyGen, fgReKeyGen, fgEnc, fgReEnc, fgDec), defined as follows:

[0177] 1. The key generation algorithm is denoted by fgKeyGen. The input is the security parameter λ, and the output is a public-private key pair (pk) for user i. i ,sk i The formula is expressed as (pk) i ,sk i )←fgKeyGen(1 λ ).

[0178] 2. The fine-grained proxy key generation algorithm is represented by fgReKeyGen, and the input is the public and private keys (pk) of the principal i. i ,sk i ), the public and private keys of the entrusted person j (pk) j ,sk j ) and functions Generate fine-grained proxy keys from i to j

[0179] The formula is expressed as

[0180] When considering non-interactive, fine-grained proxy re-encryption schemes, the algorithm does not require input sk. j .

[0181] The formula is expressed as

[0182] 3. The encryption algorithm is denoted by fgEnc, and the input is the public key pk of user i. i and plain text messages Output ciphertext for user i The formula is expressed as c i ←fgEnc(pk i ,m).

[0183] 4. The re-encryption algorithm is denoted by fgReEnc, and the input is a fine-grained proxy key. And the encrypted c for user i i The output is a re-encrypted ciphertext for user j. Or the failure symbol ⊥.

[0184] The formula is expressed as

[0185] 5. The decryption algorithm fgDec uses the decryption key sk i and ciphertext c i Input, Output Alternatively, the failure symbol ⊥ can be used, and the formula is represented as m / ⊥←fgDec(sk i ,c i ).

[0186] The correctness of the fine-grained proxy re-encryption scheme fgPRE refers to the fact that for any (pk i ,sk i )←KeyGen(1 λ ), (pk j ,sk j )←fgKeyGen(1 λ ), (If it is a non-interactive agent, then) c i ←fgEnc(pk i ,m) and The following equation holds true:

[0187] fgDec(sk i ,ci =m,fgDec(sk) j ,c j )=f(m).

[0188] It should be noted that those skilled in the art will understand that in the various embodiments of this application, the plaintext message m and the fine-grained proxy function f(m) are both considered plaintext.

[0189] When the fine-grained proxy function f takes the identity function, the scheme degenerates into a regular proxy re-encryption scheme.

[0190] II. The nature of proxy re-encryption:

[0191] 1. Multi-hop nature.

[0192] In a proxy re-encryption scheme (PRE), if ciphertext intended for one user is re-encrypted by a proxy into ciphertext intended for another user, and this new ciphertext can then be re-encrypted by a proxy into ciphertext intended for a third user, then this proxy re-encryption scheme possesses the property of multi-hop proxy re-encryption. For example, through proxy re-encryption, ciphertext intended for user A is converted into ciphertext intended for user B, and can then be converted into ciphertext intended for user B into ciphertext intended for user C. Therefore, this proxy re-encryption scheme is multi-hop.

[0193] 2. Unidirectionality.

[0194] In the proxy re-encryption scheme PRE, if the proxy key from i to j is rk i→j Using this proxy key and the proxy re-encryption algorithm, it can only re-encrypt decryptable ciphertext for user i into decryptable ciphertext for user j, but it cannot re-encrypt decryptable ciphertext for user j into decryptable ciphertext for user i. This property is known as the unidirectionality of the proxy re-encryption scheme.

[0195] 3. Non-interactive.

[0196] In the proxy re-encryption scheme PRE, if the proxy key rk from principal i to proxy j... i→j If the principal can generate the encryption independently, that is, without the participation of an agent or interaction with the principal, then such a proxy re-encryption scheme is non-interactive.

[0197] 4. Inability to link.

[0198] In the proxy re-encryption scheme PRE, given a ciphertext sequence on a multi-hop proxy chain (e.g., ct1→ct2→ct3→…→ct), n , of which ct i →cti+1 This indicates the ciphertext ct i In the proxy key rk i→i+1 Under its influence, it is re-encrypted into ct. i+1 ), and a ciphertext sequence ({ct) independently generated by the encryption algorithm. i ′} i∈[n] The adversary cannot distinguish between the two sequences mentioned above. Such a proxy re-encryption scheme is unlinkable.

[0199] 5. Anti-collusion security.

[0200] In the proxy re-encryption scheme PRE, if the proxy and the principal j cannot obtain the principal's private key through collusion, i.e., sk is known... j rk i→j Calculate sk i Therefore, the proxy re-encryption scheme is collusion-safe.

[0201] 6. Semantic security.

[0202] The proxy re-encryption scheme PRE possesses semantic security, meaning that for any probabilistic, multinomial-time legitimate adversary, it is impossible to distinguish whether the ciphertext is a message. as well as The encryption allows adversaries to perform key generation queries, private key theft queries, and proxy key generation queries.

[0203] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0204] The first embodiment of this application relates to a multi-hop proxy re-encryption method. Figure 1 This is a flowchart illustrating the multi-hop proxy re-encryption method.

[0205] Plaintext space of multi-hop proxy re-encryption scheme PRE = (KeyGen, ReKeyGen, Enc, ReEnc, Dec) Cipherspace

[0206] Specifically, such as Figure 1 As shown, this multi-hop proxy re-encryption method includes the following steps:

[0207] In step 101, key generation involves inputting security parameters into the key generation algorithm to generate a public-private key pair.

[0208] Then proceed to step 102, public key encryption, where the public key and plaintext are input into the encryption algorithm to generate the ciphertext corresponding to the plaintext.

[0209] Then proceed to step 103, proxy key generation, where the principal's public and private keys and the agent's public key are input into the proxy key generation algorithm to generate a proxy key from the principal to the agent.

[0210] It should be noted that there is no order between steps 102 and 103. You can execute step 102 first and then step 103, or you can execute step 103 first and then step 102.

[0211] Then proceed to step 104, agent re-encryption, where the ciphertext for the principal and the agent key are input into the re-encryption algorithm to generate the re-encrypted ciphertext for the agent.

[0212] Then proceed to step 105, ciphertext decryption, by inputting the ciphertext and the corresponding private key into the decryption algorithm to obtain the plaintext corresponding to the ciphertext.

[0213] This process will then end.

[0214] In this embodiment, preferably,

[0215] In step 101 above, the formula for the key generation algorithm is expressed as: (sk,pk)←KeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, generate a public-private key pair (sk, pk);

[0216] Furthermore, step 101 specifically includes the following sub-steps:

[0217] The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q;

[0218] Randomly generated The public key is obtained by concatenating the matrices: Set the private key to sk = T and output the public-private key pair (sk, pk).

[0219] In step 102 above, the encryption algorithm is expressed as follows: The encryption algorithm takes the public key pk and the plaintext m as input and outputs the ciphertext ct corresponding to the plaintext m. (pk) plaintext space Cipherspace

[0220] Furthermore, step 102 specifically includes the following sub-steps:

[0221] Randomly select s←χ n , Where χ is The plaintext m is output as ciphertext ct using a discrete Gaussian distribution on the given surface. (pk) for:

[0222]

[0223] In step 103 above, the formula for the proxy key generation algorithm is expressed as:

[0224] The proxy key generation algorithm uses the principal's public and private keys (pk) to generate the key. (1) ,sk (1) PK with the entrusted person's public key (2) As input, generate the proxy key rk from principal to agent. 1→2 ;

[0225] It should be noted that the above-mentioned proxy key generation algorithm is a non-interactive proxy key generation algorithm.

[0226] Furthermore, step 103 specifically includes the following sub-steps:

[0227] Random selection

[0228] Call the preimage generation algorithm SamplePre to calculate R; where the formula for the preimage generation algorithm SamplePrN is expressed as: in I am A dimensional identity matrix, set rk 1→2 =R, and output the proxy key rk 1→2 .

[0229] In step 104 above, the formula for the re-encryption algorithm is expressed as: ct (2) ←ReEnc(rk 1→2 =R,ct (1) This re-encryption algorithm uses the proxy key rk from the principal to the agent. 1→2 and client-facing encrypted CT (1) The input is the entrusted party's re-encrypted ciphertext ct.(2) ;

[0230] Furthermore, step 104 specifically includes the following sub-steps:

[0231] Based on the input R, obtain the matrix. Its dimensions are

[0232] According to the formula Calculate and output the re-encrypted ciphertext ct for the client. (2) .

[0233] In step 105 above, the decryption algorithm is expressed as: m←Dec(sk=T,ct). This decryption algorithm takes the ciphertext ct and the corresponding private key sk as input and outputs the plaintext m, dividing the ciphertext ct into two parts:

[0234] in

[0235] Furthermore, step 105 specifically includes the following sub-steps:

[0236] The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows:

[0237] calculate

[0238] for Each component judge Is it true? If so, then set m. i := 1, otherwise m i = 0, and output plaintext m.

[0239] The following demonstrates the correctness of the above-mentioned multi-hop proxy re-encryption method:

[0240] 1. Basic encryption / decryption correctness:

[0241] If the ciphertext ct is the output of the encryption algorithm (step 102), then it can be considered as:

[0242]

[0243] The upper part is one The fault-tolerant learning example is solved using T. calculate make Let be the upper bound of the discrete Gaussian χ. Clearly, the above decryption method can correctly decrypt and recover m.

[0244] 2. Correctness of re-encryption and decryption in multi-hop proxy re-encryption schemes:

[0245] For the ciphertext ct obtained through the encryption algorithm (step 102) (1) Or for the ciphertext ct obtained through the re-encryption algorithm (step 104) (1) Perform a single re-encryption on it, and the resulting ciphertext ct (2) for:

[0246]

[0247] because Therefore there is Therefore, there is

[0248]

[0249] It can be seen that the ciphertext after re-encryption (step 104) has the same format as the ciphertext obtained by ordinary encryption (step 102). Since matrix R is generated by the TrapGen algorithm, its norm does not exceed B. Assuming that the absolute values ​​of the ciphertext noise e and random quantity s components before re-encryption do not exceed B′ (when the ciphertext before re-encryption is directly generated by the encryption algorithm (step 102) instead of the re-encrypted ciphertext (step 104), we have B′=B), for each dimension component e′ of the new noise e′, we have |e′|≤(nB+NB+1)B′, and for each dimension component s′ of s′, we have |s′|≤nBB′<|e′|. Without loss of generality, when a total of k re-encryption operations are performed, if At that time, the above decryption algorithm can correctly decrypt and recover m.

[0250] Further, preferably,

[0251] In some embodiments, the client-oriented encrypted ct (1) The ciphertext generated by encrypting the public key (step 102) or the re-encrypted ciphertext generated by proxy re-encryption (step 104).

[0252] In some embodiments, step 103 further includes: PKing the principal's public and private keys. (1) ,k (1) PK with the entrusted person's public and private keys (2) ,k (2) The input is fed into the proxy key generation algorithm to generate the proxy key rk from the principal to the proxy. 1→2 .

[0253] The second embodiment of this application relates to a multi-hop proxy re-encryption method for fine-grained proxy function sets. Figure 2This is a flowchart illustrating the multi-hop proxy re-encryption method for a set of fine-grained proxy functions.

[0254] Specifically, such as Figure 2 As shown, this multi-hop proxy re-encryption method for fine-grained proxy function sets includes the following steps:

[0255] In step 201, key generation involves inputting security parameters into the key generation algorithm to generate a public-private key pair.

[0256] Then proceed to step 202, public key encryption, where the public key and plaintext are input into the encryption algorithm to generate the ciphertext corresponding to the plaintext.

[0257] Then proceed to step 203, fine-grained proxy key generation, where the principal's public and private keys, the agent's public key, and the fine-grained proxy function are input into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent.

[0258] It should be noted that there is no order between steps 202 and 203. You can execute step 202 first and then step 203, or you can execute step 203 first and then step 202.

[0259] Then proceed to step 204, agent re-encryption, where the ciphertext for the principal and the fine-grained agent key are input into the re-encryption algorithm to generate the re-encrypted ciphertext for the agent.

[0260] Then proceed to step 205, ciphertext decryption, by inputting the ciphertext and the corresponding private key into the decryption algorithm to obtain the plaintext corresponding to the ciphertext.

[0261] This process will then end.

[0262] In a preferred embodiment of this implementation, the fine-grained proxy function is an information deletion proxy function f. pos The multi-hop proxy re-encryption method oriented towards a fine-grained proxy function set is a method oriented towards an information deletion proxy function set. A fine-grained proxy re-encryption method.

[0263] Accordingly, the multi-hop proxy re-encryption method fgPRE = (fgKeyGen, fgReKeyGen, fgEnc, fgReEnc, fgDec) for fine-grained proxy function sets specifically includes:

[0264] Let plain text space Where 0 and 1 represent normal information bits, and * represents invalid information bits, a family of functions is defined. For any input The information deletion proxy function f posDefined as:

[0265]

[0266] That is, when i∈pos, m i ′:=*; otherwise, m i ′:=m i The above function set is a set of information deletion proxy functions. The information bit with the index in the set pos will be deleted, that is, set to an invalid information bit.

[0267] In step 201 above, the formula for the key generation algorithm is expressed as: (sk,pk)←fgKeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, generate a public-private key pair (sk, pk);

[0268] Furthermore, step 201 specifically includes the following sub-steps:

[0269] The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q;

[0270] Randomly generated The public key is obtained by concatenating the matrix: Set the private key to sk = T and output the public-private key pair (sk, pk).

[0271] In step 202 above, the encryption algorithm is expressed as follows: The encryption algorithm takes the public key pk and the plaintext m as input and outputs the ciphertext ct corresponding to the plaintext m. (pk) Among them, plaintext space Cipherspace

[0272] Furthermore, step 202 specifically includes the following sub-steps:

[0273] Encode the plaintext m, where the encoding algorithm is expressed by the formula: m e ←Encode(m) is an encoding algorithm that takes plaintext m as input and outputs the encoded value m. E ;

[0274] The encoding steps specifically include:

[0275] by Input, output encoded value For m E The 2i-1 and 2 bits, where The encoding rules are as follows:

[0276]

[0277] Output

[0278] Randomly select s←χ n , Where χ is The plaintext m is output as ciphertext ct using a discrete Gaussian distribution on the given surface. (pk) for:

[0279]

[0280] In step 203 above, the formula for the fine-grained proxy key generation algorithm is expressed as follows:

[0281] This fine-grained proxy key generation algorithm uses the principal's public and private keys (pk) (1) ,sk (1) PK with the entrusted person's public key (2) and the information deletion proxy function f pos As input, output a fine-grained proxy key from principal to agent.

[0282] It should be noted that the above-mentioned fine-grained proxy key generation algorithm is a non-interactive proxy key generation algorithm.

[0283] Furthermore, step 203 specifically includes the following sub-steps:

[0284] According to f pos Function, setting matrix for and The settings rules are as follows:

[0285]

[0286] In addition to the above locations, I pos All other positions are set to 0;

[0287] Random selection Call the preimage generation algorithm SamplePre to calculate R; where the formula for the preimage generation algorithm SamplePre is expressed as:

[0288]

[0289] The dimension of the R matrix is Output fine-grained proxy key

[0290] In step 204 above, the formula for the re-encryption algorithm is expressed as: This re-encryption algorithm uses a fine-grained proxy key from the principal to the agent. and client-facing encrypted CT (1) The input is the entrusted party's re-encrypted ciphertext ct. (2) ;

[0291] Furthermore, step 204 specifically includes the following sub-steps:

[0292] calculate It also outputs a re-encrypted ciphertext ct to the client. (2) .

[0293] In step 205 above, the decryption algorithm is expressed as: m←fgDec(sk=T,ct). This decryption algorithm takes the private key sk and the ciphertext ct as input and outputs the plaintext m, dividing the ciphertext ct into two parts:

[0294] in

[0295] Furthermore, step 205 specifically includes the following sub-steps:

[0296] The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows:

[0297] calculate

[0298] for Each component judge Is it true? If so, then set the i-th component m′. i ′:=1, otherwise m i ′:=0;

[0299] Decode m′ and output m←Decode(m′); the decoding algorithm is expressed as follows:

[0300] D ←Decode(m E The decoding algorithm uses the encoded value m E The input is the decoded value m, and the output is the decoded value m. D ;

[0301] The decoding steps specifically include:

[0302] by Input is the decoded value. For m D The j-th component, The following mapping relationship exists:

[0303]

[0304] Output

[0305] The following discussion will examine the aforementioned set of information deletion proxy functions. The correctness of the fine-grained proxy re-encryption method:

[0306] 1. Correctness of encoding and decoding:

[0307] Based on the above encoding and decoding algorithms, it can be obtained that for any have:

[0308] Decode(Encode(m)) = m;

[0309] Decode(I pos ·Encode(m))=f pos (m).

[0310] 2. Basic encryption / decryption correctness: For the ciphertext ct obtained through the encryption algorithm (step 202) (1) The encrypted ct can be regarded as:

[0311]

[0312] The upper part is one The fault-tolerant learning example is solved using T. calculate when At that time, the above decryption method can correctly decrypt and recover m E This leads to the correct m←Decode(m) E ).

[0313] 3. Correctness of re-encryption and decryption:

[0314] For the ciphertext ct obtained through the encryption algorithm (step 202) (1)Or for the ciphertext ct obtained through the re-encryption algorithm (step 204) (1) It performs a single re-encryption of the ciphertext ct (2) for:

[0315]

[0316] because Therefore there is Therefore, there is

[0317]

[0318] because Therefore, the ciphertext after re-encryption (step 204) has the same format as the ciphertext obtained by normal encryption (step 202), and the matrix R is generated by the TrapGen algorithm, so its norm does not exceed B. Assume that the absolute values ​​of the components of the ciphertext noise e and random quantity s before re-encryption do not exceed B′ (when the ciphertext before re-encryption is directly generated by the encryption algorithm, rather than the re-encrypted ciphertext, then B′=B). For each dimension of the new noise e′, |e′|≤(nB+NB+1)B′, and for each dimension of s′, |s′|≤nBB′<|e′|. Without loss of generality, when a total of k re-encryption operations are performed, if... If the plaintext information corresponding to the ciphertext before the last re-encryption is m, the above decryption algorithm can correctly decrypt and recover I. pos m E Thus, f pos (m)←Decode(I pos m E ).

[0319] In another preferred embodiment of this implementation, the fine-grained surrogate function is a linear surrogate function f. M Therefore, the multi-hop proxy re-encryption method for fine-grained proxy function sets is a fine-grained proxy re-encryption method for linear proxy function sets.

[0320] Accordingly, the multi-hop proxy re-encryption method fgPRE = (fgKeyGen, fgReKeyGen, fgEnc, fgReEnc, fgDec) for fine-grained proxy function sets specifically includes:

[0321] Choose parameter p such that q = p 2 ;Let plaintext space If the norm of the plaintext is small, fine-grained surrogate re-encryption can be performed; assuming the norm of the plaintext does not exceed Δ, define a set of linear surrogate functions. as follows:

[0322]

[0323] Plaintext space Cipher space is

[0324] It should be noted that if M is an identity matrix, then f M If it is an identity function, then the scheme degenerates into a regular (non-fine-grained) proxy re-encryption scheme. At this point, the plaintext space is...

[0325] In step 201 above, the formula for the key generation algorithm is expressed as: (sk,pk)←fgKeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, output public-private key pair (sk, pk);

[0326] Furthermore, step 201 specifically includes the following sub-steps:

[0327] The trapdoor generation algorithm TrapGen is called to generate a matrix. and the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q;

[0328] Randomly generated The public key is obtained by concatenating the matrix: Set the private key to sk = T and output the public-private key pair (sk, pk).

[0329] In step 202 above, the encryption algorithm is expressed as follows: The encryption algorithm takes the public key pk and the plaintext m as input and outputs the ciphertext ct corresponding to the plaintext m. (pk) ;

[0330] Furthermore, step 202 specifically includes the following sub-steps:

[0331] Randomly select s←χ n , Where χ is The plaintext m is output as ciphertext ct using a discrete Gaussian distribution on the given surface. (pk) for:

[0332]

[0333] In step 203 above, the formula for the fine-grained proxy key generation algorithm is expressed as follows:

[0334]

[0335] This fine-grained proxy key generation algorithm uses the principal's public and private keys (pk) (1) ,sk (1) PK with the entrusted person's public key (2) and the linear surrogate function f M As input, generate a fine-grained proxy key from principal to agent.

[0336] It should be noted that the above-mentioned fine-grained proxy key generation algorithm is a non-interactive proxy key generation algorithm.

[0337] Furthermore, step 203 specifically includes the following sub-steps:

[0338] Random selection Call the preimage generation algorithm SamplePre to calculate R, and then f M Using the matrix as input embedding, the formula for the preimage generation algorithm SamplePre is expressed as:

[0339]

[0340] The dimension of the R matrix is set up Its dimensions are

[0341] In step 204 above, the formula for the re-encryption algorithm is expressed as: This re-encryption algorithm uses a fine-grained proxy key from the principal to the agent. And encrypted CT scans for clients (1) The input is the entrusted party's re-encrypted ciphertext ct. (2) ;

[0342] Furthermore, step 204 specifically includes the following sub-steps:

[0343] calculate It also outputs a re-encrypted ciphertext ct to the client. (2) .

[0344] In step 205 above, the decryption algorithm is expressed as: m←fgDec(sk=T,ct). This decryption algorithm takes the private key sk and the ciphertext ct as input and outputs the plaintext m, dividing the ciphertext ct into two parts:

[0345] in

[0346] Furthermore, step 205 specifically includes the following sub-steps:

[0347] The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows:

[0348] calculate

[0349] for Each component judge Is it true? If so, then set the i-th component of m. otherwise Output

[0350] The following demonstrates the correctness of the fine-grained proxy re-encryption method for the aforementioned set of linear proxy functions:

[0351] 1. Basic encryption / decryption correctness:

[0352] The encrypted CT can be regarded as:

[0353]

[0354] The upper part is one The fault-tolerant learning example is solved using T. calculate when At that time, the above decryption method can correctly decrypt and recover m.

[0355] 2. Correctness of re-encryption and decryption:

[0356] Consider the ciphertext ct after re-encryption (step 204) (2) ,have:

[0357]

[0358] because Therefore there is Therefore, there is

[0359]

[0360] It can be seen that the re-encrypted ct (2) It is indeed A (2) The encryption of Mm under the public key, according to By definition, we know ||Mm|| ∞ ≤p-1. Meanwhile, the infinite normal form of the new noise e′ does not exceed p-1. if only The above decryption method can correctly decrypt and recover Mm. It is easy to see that the infinite normal forms of s′ and e′ in the ciphertext after the first re-encryption do not exceed [a certain value]. if only This allows for a second round of proxy re-encryption. Similar analysis shows that as long as... This allows for the τth proxy re-encryption, thus enabling multi-hop proxy re-encryption.

[0361] Further, preferably,

[0362] In some embodiments, the client-oriented encrypted ct (1) The ciphertext generated by public key encryption (step 202) or the re-encrypted ciphertext generated by proxy re-encryption (step 204).

[0363] In some embodiments, step 203 further includes: PKing the principal's public and private keys. (1) ,k (1) PK with the entrusted person's public and private keys (2) ,sk (2) The fine-grained proxy function is input into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the proxy.

[0364] In summary, this application provides three multi-hop proxy re-encryption methods for encrypted multi-bit plaintext with post-quantum security: a basic proxy re-encryption scheme, a proxy re-encryption method with information deletion properties, and a proxy re-encryption method for linear proxy function sets. These methods offer higher security, higher encryption efficiency, and can achieve fine-grained ciphertext decryption authorization.

[0365] The three proxy re-encryption methods described above all possess numerous desirable properties, including multi-hop capability, one-way communication, non-interactive nature, unlinkability, collusion resistance, and post-quantum semantic security. Furthermore, a single encryption operation can encrypt multiple bits of plaintext simultaneously, resulting in high encryption efficiency. The analysis and reasons are as follows:

[0366] 1. Multi-hop nature.

[0367] Of the three methods described above, based on the correctness of the proxy re-encryption method, the format of the re-encrypted ciphertext is consistent with that of the directly encrypted ciphertext, only the noise value has changed. Therefore, as long as the noise of the re-encrypted ciphertext remains within a reasonable range that does not affect the correctness of decryption, the ciphertext can be re-encrypted again.

[0368] 2. Unidirectionality.

[0369] Given user 1's public key pk (1) =A (1) User 2's public key pk (2) =A (2) It can be known that the proxy key rk obtained by the proxy party 1→2 Only with A (1) Related trapdoor T (1) and A (2) Related. The agent only has the agent key rk. 1→2 And without rk 2→1 In this case, due to the difficulty of fault-tolerant learning problems, the encrypted data for user 2... It exhibits pseudo-randomness for the agent. Therefore, the agent has a pseudo-randomness for 1t. (2) Since the plaintext information m hidden within is unknown, it is impossible to generate a valid ciphertext that is directed to user 1 and encrypts m. Therefore, one-way communication is achieved.

[0370] 3. Non-interactive.

[0371] In all three methods described above, the proxy key calculation from user 1 to user 2 does not require user 2's private key as input; therefore, these methods are non-interactive.

[0372] 4. Inability to link.

[0373] Of the three methods mentioned above, based on the correctness of the proxy re-encryption method, the re-encrypted ciphertext has the same format as the ciphertext generated by direct encryption, and both are LWE sampling instances. Due to the difficulty of fault-tolerant learning problems, both types of ciphertext mentioned above are indistinguishable from uniform distributions, thus the three methods mentioned above are not linked.

[0374] 5. Anti-collusion security.

[0375] The proxy key is generated in the following way: Based on the difficulty of fault-tolerant learning problems, A (2) S+E has pseudo-random properties, and therefore It exhibits pseudo-random characteristics. Based on the properties of the SamplePre preimage algorithm, preimages are taken from uniformly distributed elements. The preimage distribution is an independent Gaussian distribution, unrelated to the public and private keys of users 1 and 2. Therefore, rk 1→2 It will also not leak any information about User 1's private key. Therefore, even if the agent colludes with User 2, they will not obtain User 1's private key. Thus, collusion-resistant security can be achieved.

[0376] 6. Post-quantum semantic security.

[0377] In all three methods described above, the ciphertext format is... Due to the difficulty of the fault-tolerant learning problem, the ciphertext distribution is indistinguishable from a uniform distribution. Therefore, the ciphertext can perfectly mask the information of m. In this way, the security of the method can be reduced to the difficulty of the fault-tolerant learning problem. Since the fault-tolerant learning problem is a post-quantum difficult problem, our proxy re-encryption methods all possess post-quantum security properties resistant to quantum attacks.

[0378] For proxy re-encryption methods with information deletion properties, fine-grained decryption authorization is manifested as the deletion of the original plaintext message; for proxy re-encryption methods oriented towards a set of linear proxy functions, fine-grained decryption authorization is manifested as the computation of a linear function on the original plaintext message.

[0379] The concepts and specific methods proposed in this application expand the application scenarios of proxy re-encryption technology and provide more technical options for solving real-world problems. Depending on the specific scenario, users can flexibly choose the different methods mentioned above to achieve flexible authorization for ciphertext decryption.

[0380] It should be noted that in the claims and specification of this patent, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0381] Although this application has been illustrated and described with reference to certain preferred embodiments thereof, those skilled in the art should understand that various changes in form and detail may be made thereto without departing from the spirit and scope of this application.

Claims

1. A multi-hop proxy re-encryption method, characterized in that, Includes the following steps: Key generation involves inputting security parameters into a key generation algorithm to generate a public-private key pair. Public key encryption involves inputting the public key and plaintext into an encryption algorithm to generate ciphertext corresponding to the plaintext. The proxy key generation process involves inputting the principal's public and private keys and the agent's public key into the proxy key generation algorithm to generate a proxy key from the principal to the agent. The proxy re-encryption algorithm takes the ciphertext intended for the principal and the proxy key and inputs them into the re-encryption algorithm to generate re-encrypted ciphertext intended for the proxy. To decrypt the ciphertext, input the ciphertext and the corresponding private key into the decryption algorithm to obtain the plaintext corresponding to the ciphertext. The key generation algorithm is expressed as: (sk,pk)←KeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, generate a public-private key pair (sk, pk); The key generation steps specifically include: The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q; Randomly generated The public key is obtained by concatenating the matrices: Set the private key to sk = T and output the public-private key pair (sk, pk); The encryption algorithm is expressed as follows: The encryption algorithm takes the public key pk and the plaintext m as input and outputs the ciphertext ct corresponding to the plaintext m. (pk) plaintext space Cipherspace The public key encryption steps specifically include: Randomly select s←χ n , Where χ is The plaintext m is output as ct by a discrete Gaussian distribution on the surface. (pk) for: The formula for the proxy key generation algorithm is as follows: The proxy key generation algorithm uses the principal's public and private keys (pk) to generate the key. (1) ,sk (1) PK with the entrusted person's public key (2) As input, generate the proxy key rk from principal to agent. 1→2 ; The steps for generating the proxy key specifically include: Random selection Call the preimage generation algorithm SamplePre to calculate R; where the formula for the preimage generation algorithm SamplePre is expressed as: in I am A dimensional identity matrix, set rk 1→2 =R, and output the proxy key rk 1→2 ; The formula for the re-encryption algorithm is expressed as: ct (2) ←ReEnc(rk 1→2 =R,ct (1) This re-encryption algorithm uses the proxy key rk from the principal to the agent. 1→2 and client-facing encrypted CT (1) The input is the entrusted party's re-encrypted ciphertext ct. (2) ; The proxy re-encryption steps specifically include: Based on the input R, obtain the matrix. Its dimensions are According to the formula Calculate and output the re-encrypted ciphertext ct for the entrusted party. (2) ; The decryption algorithm is expressed as: m←Dec(sk=T,ct), which takes the ciphertext ct and the corresponding private key sk as input and outputs the plaintext m, dividing the ciphertext ct into two parts: in The specific steps for decrypting the ciphertext include: The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows: calculate for Each component judge Is it true? If so, then set m. i := 1, otherwise m i = 0, and output plaintext m.

2. The multi-hop proxy re-encryption method according to claim 1, characterized in that, The ciphertext intended for the principal is either ciphertext generated by public key encryption or re-encrypted ciphertext generated by proxy re-encryption.

3. The multi-hop proxy re-encryption method according to claim 1, characterized in that, The proxy key generation step further includes: inputting the principal's public and private keys and the agent's public and private keys into the proxy key generation algorithm to generate a proxy key from the principal to the agent.

4. A multi-hop proxy re-encryption method for fine-grained proxy function sets, characterized in that, Includes the following steps: Key generation involves inputting security parameters into a key generation algorithm to generate a public-private key pair. Public key encryption involves inputting the public key and plaintext into an encryption algorithm to generate ciphertext corresponding to the plaintext. Fine-grained proxy key generation involves inputting the principal's public and private keys, the agent's public key, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent. The proxy re-encryption algorithm takes the ciphertext intended for the principal and the proxy key and inputs them into the re-encryption algorithm to generate re-encrypted ciphertext intended for the proxy. To decrypt the ciphertext, input the ciphertext and the corresponding private key into the decryption algorithm to obtain the plaintext corresponding to the ciphertext. Wherein, the fine-grained proxy function is the information deletion proxy function f. pos ; The multi-hop proxy re-encryption method for fine-grained proxy function sets specifically includes: Let plain text space Cipherspace Where 0 and 1 represent normal information bits, and * represents invalid information bits, a family of functions is defined. For any input The information deletion proxy function f pos Defined as That is, when i∈pos, m i ′:=*; otherwise, m i ′:=m i The above function set is a set of information deletion proxy functions. The information bit with the index in the set pos will be deleted, that is, set to an invalid information bit. The key generation algorithm is expressed as: (sk,pk)←fgKeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, generate a public-private key pair (sk, pk); The key generation steps specifically include: The trapdoor generation algorithm TrapGen is called to generate a matrix. And the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q; Randomly generated The public key is obtained by concatenating the matrix: Set the private key to sk = T and output the public-private key pair (sk, pk); The encryption algorithm is expressed as follows: The encryption algorithm takes the public key pk and the plaintext m as input and outputs the ciphertext ct corresponding to the plaintext m. (pk) ; The public key encryption steps specifically include: Encode the plaintext m, where the encoding algorithm is expressed by the formula: m E ←Encode(m) is an encoding algorithm that takes plaintext m as input and outputs the encoded value m. E ; The encoding steps specifically include: by Input, output encoded value For m E The (2i-1)th and 2ith bits, where The encoding rules are as follows: Output Randomly select s←χ n , Where χ is The plaintext m is output as ct by a discrete Gaussian distribution on the surface. (pk) for: The formula for the fine-grained proxy key generation algorithm is expressed as follows: This fine-grained proxy key generation algorithm uses the principal's public and private keys (pk) (1) ,sk (1) PK with the entrusted person's public key (2) and the information deletion proxy function f pos As input, output a fine-grained proxy key from principal to agent. The steps for generating the fine-grained proxy key specifically include: According to f pos Function, setting matrix for and The settings rules are as follows: In addition to the above locations, I pos All other positions are set to 0; Random selection Call the preimage generation algorithm SamplePre to calculate R; where the formula for the preimage generation algorithm SamplePre is expressed as: The dimension of the R matrix is Output proxy key The formula for the re-encryption algorithm is expressed as follows: This re-encryption algorithm uses a fine-grained proxy key from the principal to the agent. and client-facing encrypted CT (1) The input is the entrusted party's re-encrypted ciphertext ct. (2) ; The proxy re-encryption steps specifically include: calculate It also outputs a re-encrypted ciphertext ct to the client. (2) ; The decryption algorithm is expressed as: m←fgDec(sk=T,ct), which takes the private key sk and the ciphertext ct as input and outputs plaintext m, dividing the ciphertext ct into two parts: in The specific steps for decrypting the ciphertext include: The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows: calculate for Each component judge Is it true? If so, then set the i-th component m′. i ′:=1, otherwise m i ′:=0; Decode m′ and output m←Decode(m′); where the decoding algorithm is expressed as: m D ←Decode(m E The decoding algorithm uses the encoded value m E The input is the decoded value m, and the output is the decoded value m. D ; The decoding steps specifically include: With m E ∈{0,1} 2l Input is the decoded value. For m D The j-th component, j∈[l], has the following mapping relationship: Output 5. The multi-hop proxy re-encryption method for fine-grained proxy function sets according to claim 4, characterized in that, The ciphertext intended for the principal is either ciphertext generated by public key encryption or re-encrypted ciphertext generated by proxy re-encryption.

6. The multi-hop proxy re-encryption method for fine-grained proxy function sets according to claim 4, characterized in that, The fine-grained proxy key generation step further includes: inputting the principal's public and private keys, the agent's public and private keys, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent.

7. A multi-hop proxy re-encryption method for fine-grained proxy function sets, characterized in that, Includes the following steps: Key generation involves inputting security parameters into a key generation algorithm to generate a public-private key pair. Public key encryption involves inputting the public key and plaintext into an encryption algorithm to generate ciphertext corresponding to the plaintext. Fine-grained proxy key generation involves inputting the principal's public and private keys, the agent's public key, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent. The proxy re-encryption algorithm takes the ciphertext intended for the principal and the proxy key and inputs them into the re-encryption algorithm to generate re-encrypted ciphertext intended for the proxy. To decrypt the ciphertext, input the ciphertext and the corresponding private key into the decryption algorithm to obtain the plaintext corresponding to the ciphertext. Wherein, the fine-grained proxy function is a linear proxy function fM; The multi-hop proxy re-encryption method for fine-grained proxy function sets specifically includes: Choose parameter p such that q = p 2 ;Let plaintext space If the norm of the plaintext is small, then fine-grained surrogate re-encryption is performed; assuming the norm of the plaintext does not exceed Δ, a set of linear surrogate functions is defined. as follows: Plaintext space Cipher space is The key generation algorithm is expressed as: (sk,pk)←fgKeyGen(1 λ The key generation algorithm uses security parameter 1. λ As input, output public-private key pair (sk, pk); The key generation steps specifically include: The trapdoor generation algorithm TrapGen is called to generate a matrix. and the trapdoor T; wherein, the formula for the trapdoor generation algorithm TrapGen is expressed as: The trapdoor generation algorithm takes parameters n and q as input. Satisfying q≥2, Represents the set of natural numbers, where T is a small norm matrix of dimension N×N. Represents a set of integers. The set of residue classes representing the set of integers modulo q; Randomly generated The public key is obtained by concatenating the matrix: Set the private key to sk = T and output the public-private key pair (sk, pk); The encryption algorithm is expressed as follows: The encryption algorithm takes the public key pk and the plaintext m as input and outputs the ciphertext ct corresponding to the plaintext m. (pk) ; The public key encryption steps specifically include: Randomly select s←χ n , Where χ is The plaintext m is output as ct by a discrete Gaussian distribution on the surface. (pk) for: The formula for the fine-grained proxy key generation algorithm is expressed as follows: This fine-grained proxy key generation algorithm uses the principal's public and private keys (pk) (1) ,sk (1) PK with the entrusted person's public key (2) and the linear surrogate function f M As input, generate a fine-grained proxy key from principal to agent. The steps for generating the fine-grained proxy key specifically include: Random selection Call the preimage generation algorithm SamplePre to calculate R, and then f M Using the matrix as input embedding, the formula for the preimage generation algorithm SamplePre is expressed as: The dimension of the R matrix is set up Its dimensions are The formula for the re-encryption algorithm is expressed as follows: This re-encryption algorithm uses a fine-grained proxy key from the principal to the agent. And encrypted CT scans for clients (1) The input is the entrusted party's re-encrypted ciphertext ct. (2) ; The proxy re-encryption steps specifically include: calculate It also outputs a re-encrypted ciphertext ct to the client. (2) ; The decryption algorithm is expressed as: m←fgDec(sk=T,ct), which takes the private key sk and the ciphertext ct as input and outputs plaintext m, dividing the ciphertext ct into two parts: in The specific steps for decrypting the ciphertext include: The fault-tolerant learning inversion algorithm is invoked, and the LWE instance formed by the trapdoor T is used to invert (s,e). The formula of the fault-tolerant learning inversion algorithm is expressed as follows: calculate for Each component judge Is it true? If so, then set the i-th component of m. otherwise Output 8. The multi-hop proxy re-encryption method for fine-grained proxy function sets according to claim 7, characterized in that, The ciphertext intended for the principal is either ciphertext generated by public key encryption or re-encrypted ciphertext generated by proxy re-encryption.

9. The multi-hop proxy re-encryption method for fine-grained proxy function sets according to claim 7, characterized in that, The fine-grained proxy key generation step further includes: inputting the principal's public and private keys, the agent's public and private keys, and the fine-grained proxy function into the fine-grained proxy key generation algorithm to generate a fine-grained proxy key from the principal to the agent.

Images