Quantum computing based ciphertext decryption method and related apparatus

Abstract

The application discloses a ciphertext decryption method based on quantum calculation and related devices, and the application converts the obtained public key and plaintext parameters corresponding to the ciphertext into a square matrix, the ciphertext is a ciphertext based on discrete logarithm encryption, and the public key and the plaintext parameters both belong to elements in a finite field GF(2 t ); then, a target quantum circuit is constructed and run based on the square matrix, a private key is determined through a running result of the target quantum circuit, and the ciphertext is decrypted through the private key; even if a most efficient number field sieve method is used to decompose a binary number with 795 bits, more than 3000 years are needed in the prior art, compared with the prior art, through superposition and entanglement characteristics of quantum calculation, the ciphertext breaking speed based on discrete logarithm encryption is greatly improved.

Description

Technical Field

[0001] This invention belongs to the field of quantum computing technology, specifically a quantum computing-based method for decrypting encrypted text and related devices. Background Technology

[0002] A quantum computer is a physical device that performs high-speed mathematical and logical operations, stores and processes quantum information in accordance with the laws of quantum mechanics. When a device processes and calculates quantum information and runs quantum algorithms, it is a quantum computer. Because of its ability to process mathematical problems more efficiently than ordinary computers—for example, reducing the time to crack keys from hundreds of years to hours—quantum computers have become a key technology under research.

[0003] Discrete logarithms are considered one of the three fundamental disciplines of modern cryptography, their security relying on the computationally incomputable nature of discrete exponents over finite fields. The discrete logarithm problem is: given a prime number p and a positive integer b, know that b = a... x Find the value of (mod p) and solve for x. In discrete logarithm-based encryption methods, x is the private key, a is the public key, and b is the plaintext parameter. Given a and b, it is very difficult to solve for x. Even using the most efficient number field sieve method to factor a 795-bit binary number would take more than 3000 years. Algorithms such as ELGamal encryption, DSA digital signature scheme, ECDSA signature algorithm, SM3 signature algorithm, identity-based cryptography algorithms (IBE, IBS), and SM9 identity cryptography are all based on the assumption of the discrete logarithm difficulty problem. Therefore, how to achieve fast cracking of ciphertext encrypted using discrete logarithm encryption in traditional cryptography based on quantum computing remains a challenging problem. Summary of the Invention

[0004] The purpose of this invention is to provide a quantum computing-based ciphertext decryption method and related apparatus, which solves the problem of cracking ciphertext based on discrete logarithm encryption that has plagued traditional cryptography by using quantum computing, thereby improving the speed of ciphertext cracking.

[0005] One embodiment of the present invention provides a quantum computing-based ciphertext decryption method, applied to ciphertext encrypted using discrete logarithm encryption, the method comprising:

[0006] Obtain the public key and plaintext parameters corresponding to the ciphertext, wherein both the public key and plaintext parameters belong to the finite field GF(2). t elements in )

[0007] Determine the square matrix corresponding to the public key and plaintext parameters;

[0008] Construct the target quantum circuit based on the aforementioned array;

[0009] The private key corresponding to the ciphertext is determined based on the operation result of the target quantum circuit;

[0010] The ciphertext is decrypted based on the private key.

[0011] Optionally, constructing the target quantum circuit based on the array includes:

[0012] The square matrix corresponding to the public key is squared a predetermined number of times to obtain multiple first square matrices; and the square matrix corresponding to the plaintext parameters is squared a predetermined number of times to obtain multiple second square matrices.

[0013] Determine the square matrix corresponding to the public key and the first modular polynomial exponent operation quantum circuits corresponding to multiple first square matrices, and the square matrix corresponding to the plaintext parameters and the second modular polynomial exponent operation quantum circuits corresponding to multiple second square matrices;

[0014] The target quantum circuit is obtained by cascading the quantum Fourier transform circuit, the first modular polynomial exponentiation quantum circuit, the second modular polynomial exponentiation quantum circuit, and the quantum inverse Fourier transform circuit in sequence.

[0015] Optionally, the quantum Fourier transform circuit includes an H-gate acting on a first auxiliary bit and a second auxiliary bit, the first modular polynomial exponentiation quantum circuit is controlled by the second auxiliary bit, the second modular polynomial exponentiation quantum circuit is controlled by the first auxiliary bit, and the quantum inverse Fourier transform circuit includes quantum inverse Fourier transform modules acting on the first auxiliary bit and the second auxiliary bit.

[0016] Optionally, the private key corresponding to the ciphertext is determined based on the running result of the target quantum circuit, wherein the running result of the target quantum circuit includes good number pairs, including:

[0017] A first good number vector is determined based on one of the good number pairs, and a second good number vector is determined based on the other of the good number pairs;

[0018] Determine the inverse of each element in the second good number vector to obtain the third good number vector;

[0019] Determine the tensor product of the first good number vector and the third good number vector;

[0020] The private key corresponding to the ciphertext is determined from the tensor product.

[0021] Optionally, determining the first good number vector based on one of the good number pairs includes:

[0022] One of the pairs of good numbers is extended to both sides to obtain the first good number vector.

[0023] Optionally, determining the square matrix corresponding to the public key and the first modular polynomial exponent operation quantum circuits corresponding to the plurality of first square matrices includes:

[0024] The square matrix corresponding to the public key and each of the first square matrices are decomposed using LUP to obtain L-type, U-type, and P-type matrices.

[0025] The quantum circuits corresponding to the L-type and U-type matrices are determined based on the CNOT gate, and the quantum circuits corresponding to the P-type matrix are determined based on the SWAP gate;

[0026] Each P-type matrix and the quantum logic gates corresponding to the U-type and L-type matrices of the P-type matrix are sequentially applied to the qubits to obtain the square matrix corresponding to the public key or the quantum circuit corresponding to each of the first square matrices.

[0027] The first modular polynomial exponential operation quantum circuit is obtained by sequentially cascading the square matrix corresponding to the public key and multiple quantum circuits corresponding to the first square matrix.

[0028] Optionally, determining the quantum circuit corresponding to the P-type matrix based on the SWAP gate includes:

[0029] Determine the non-zero elements a in the P-type matrix excluding the diagonal elements. mn ;

[0030] If m is less than n, then the SWAP gate is applied to the m-th and n-th qubits;

[0031] If m is greater than n, then determine the non-zero element a. m′n′ And applying the SWAP gate to the m-th and n-th nodes. ′ On each qubit, m ′ Less than m, and n ′ Greater than m;

[0032] If m equals n or n ′ If so, no operation will be performed;

[0033] Determine the quantum circuit corresponding to the P-type matrix.

[0034] Another embodiment of the present invention provides a quantum computing-based ciphertext decryption device, applied to ciphertext encrypted using discrete logarithm encryption, the device comprising:

[0035] The acquisition unit is used to acquire the public key and plaintext parameters corresponding to the ciphertext, wherein both the public key and plaintext parameters belong to the finite field GF(2). t elements in )

[0036] A determining unit is used to determine the square matrix corresponding to the public key and the plaintext parameters;

[0037] Construction unit, used to construct target quantum circuits based on the array;

[0038] The determining unit is further configured to determine the private key corresponding to the ciphertext based on the operation result of the target quantum circuit;

[0039] A decryption unit is used to decrypt the ciphertext based on the private key.

[0040] Another embodiment of the present invention provides a storage medium storing a computer program, wherein the computer program is configured to execute the method described in any of the preceding claims when running.

[0041] Another embodiment of the present invention provides an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the method described in any of the preceding claims.

[0042] As can be seen, this invention transforms the public key and plaintext parameters corresponding to the obtained ciphertext into a square matrix. This ciphertext is based on discrete logarithm encryption, and both the public key and plaintext parameters belong to the finite field GF(2). t The elements in the array are then used to construct and run the target quantum circuit. The private key is determined by the result of the operation of the target quantum circuit, and the ciphertext is decrypted using the private key. Existing technologies, even using the most efficient number field sieve method to decompose a binary number represented by 795 bits, would take more than 3,000 years. Compared with existing technologies, this invention greatly improves the speed of cracking ciphertext based on discrete logarithm encryption by utilizing the superposition and entanglement characteristics of quantum computing. Attached Figure Description

[0043] Figure 1 A network block diagram of a quantum computing-based ciphertext decryption system provided for an embodiment of the present invention;

[0044] Figure 2 A flowchart illustrating a quantum computing-based ciphertext decryption method provided in an embodiment of the present invention;

[0045] Figure 3 This is a schematic diagram of the structure of a quantum circuit corresponding to an L-shaped matrix, provided in an embodiment of the present invention.

[0046] Figure 4 This is a schematic diagram of the structure of a quantum circuit corresponding to a P-type matrix provided in an embodiment of the present invention;

[0047] Figure 5 This is a schematic diagram of the structure of a quantum circuit corresponding to another P-type matrix provided in an embodiment of the present invention;

[0048] Figure 6This is a schematic diagram of the structure of a target quantum circuit provided in an embodiment of the present invention;

[0049] Figure 7 A schematic diagram of a quantum computing-based ciphertext decryption device provided in an embodiment of the present invention;

[0050] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0051] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0052] Figure 1 This is a network block diagram of a quantum computing-based ciphertext decryption system provided in an embodiment of the present invention. The quantum computing-based ciphertext decryption system may include a network 110, a server 120, a wireless device 130, a client 140, storage 150, a classical computing unit 160, a quantum computing unit 170, and may also include additional memory, a classical processor, a quantum processor, and other devices not shown.

[0053] Network 110 is a medium used to provide communication links between various devices and computers connected together within a quantum computing-based ciphertext decryption system, including but not limited to the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The connection method can be wired, wireless communication links, or fiber optic cables.

[0054] Server 120, wireless device 130, and client 140 are conventional data processing systems that may contain data and application programs or software tools that perform conventional computational processes. Client 140 may be a personal computer or a network computer, so the data may also be provided by server 120. Wireless device 130 may be a smartphone, tablet, laptop, smart wearable device, etc. Storage unit 150 may include database 151, which can be configured to store data such as qubit parameters, quantum logic gate parameters, quantum circuits, and quantum programs.

[0055] The classical computing unit 160 (quantum computing unit 170) may include a classical processor 161 (quantum processor 171) for processing classical data (quantum data) and a memory 162 (memory 172) for storing classical data (quantum data). The classical data (quantum data) may be a boot file, an operating system image, and an application program 163 (application program 173). The application program 163 (application program 173) may be used to implement a quantum algorithm compiled by the quantum computing-based ciphertext decryption method provided in the embodiments of the present invention.

[0056] Any data or information stored or generated in the classical computing unit 160 (quantum computing unit 170) can also be configured to be stored or generated in another classical (quantum) processing system in a similar manner, and any application executed therein can also be configured to be executed in another classical (quantum) processing system in a similar manner.

[0057] It should be noted that a true quantum computer has a hybrid structure, which includes at least... Figure 1 The system consists of two main parts: the classical computing unit 160, which is responsible for performing classical calculations and control; and the quantum computing unit 170, which is responsible for running quantum programs to achieve quantum computing.

[0058] The aforementioned classical computing unit 160 and quantum computing unit 170 can be integrated into a single device or distributed across two different devices. For example, a first device including the classical computing unit 160 runs a classical computer operating system, providing quantum application development tools and services, as well as the storage and network services required for quantum applications. Users develop quantum programs using the quantum application development tools and services on the second device, and send these quantum programs to a second device including the quantum computing unit 170 via the network services. The second device runs a quantum computer operating system, which parses and compiles the quantum program's code into instructions that the quantum processor 170 can recognize and execute. The quantum processor 170 then implements the quantum algorithm corresponding to the quantum program based on these instructions.

[0059] The computing units of the classic processor 161 within the classic computing unit 160 are based on CMOS transistors on a silicon chip. These computing units are not limited by time or coherence; that is, they are available at any time without time constraints. Furthermore, the number of such computing units in a silicon chip is sufficient; currently, a single classic processor 161 contains tens of thousands of computing units. Given this sufficient number of computing units and the fixed selectable computing logic of the CMOS transistors (e.g., AND logic), computational performance is achieved by combining a large number of CMOS transistors with a limited set of logic functions during operation.

[0060] In the quantum computing unit 170, the basic computing unit of the quantum processor 171 is the qubit. The input of a qubit is limited by coherence and coherence time; that is, a qubit is limited by its available usage time and is not always readily available. Making full use of qubits within their available usage time is a key challenge in quantum computing. Furthermore, the number of qubits in a quantum computer is one of the representative indicators of its performance. Each qubit performs computational functions through on-demand configured logical functions. Given the limited number of qubits and the diverse logical functions available in quantum computing, such as Hadamard gates (H gates), Pauli-X gates (X gates), Pauli-Y gates (Y gates), Pauli-Z gates (Z gates), X gates, RY gates, RZ gates, CNOT gates, CR gates, iSWAP gates, Tofoli gates, etc., quantum computing requires combining a limited number of qubits with diverse logical function combinations to achieve computational effects.

[0061] Based on these differences, the design of classical logic functions applied to CMOS transistors and the design of quantum logic functions applied to qubits are significantly and fundamentally different. The design of classical logic functions applied to CMOS transistors does not need to consider the individuality of CMOS transistors. For example, the representation of a CMOS transistor in a silicon chip is its individual identifier, location, and usable time of each CMOS transistor. Therefore, classical algorithms composed of classical logic functions only express the operational relationship of the algorithm, not the algorithm's dependence on individual CMOS transistors.

[0062] Quantum logic functions applied to qubits need to consider the individuality of each qubit, such as its position within the quantum chip, its relationship with surrounding qubits, and the duration of its usable time. Therefore, quantum algorithms composed of quantum logic functions not only express the computational relationships within the algorithm but also its dependence on the individual qubits.

[0063] For example:

[0064] Quantum Algorithm 1: H1, H2, CNOT(1,3), H3, CNOT(2,3);

[0065] Quantum Algorithm 2: H1, H2, CNOT(1,2), H3, CNOT(2,3);

[0066] Where 1 / 2 / 3 represent three sequentially connected qubits Q1, Q2, Q3 or interconnected qubits Q1, Q2, Q3, respectively;

[0067] An exemplary explanation of how quantum algorithms are affected by the coherence time of qubits is as follows:

[0068] Define the execution time of a single-qubit logic gate as t, and the execution time of two single-qubit logic gates operating on adjacent qubits as 2t; then:

[0069] When Q1, Q2, and Q3 are interconnected, the computation of Quantum Algorithm 1 requires 6t, which is divided into 4 time periods. The duration of each time period is t, 2t, t, and 2t, respectively. The operations performed in each time period are: H1, H2; CNOT(1,3); H3; CNOT(2,3);

[0070] The computation of Quantum Algorithm 1 requires 5t, which is divided into 3 time periods. The duration of each time period is t, 2t, and 2t respectively. The operations performed in each time period are: H1, H2, H3; CNOT(1,2); CNOT(2,3);

[0071] When Q1, Q2, and Q3 are connected sequentially, Quantum Algorithm 1 needs to be equivalent to: H1, H2; swap(1,2), CNOT(2,3), swap(1,2); H3; CNOT(2,3). The computation of the equivalent Quantum Algorithm 1 requires 10t, divided into 4 time periods, with each time period requiring durations of t, 6t, t, and 2t respectively. The operations performed in each time period are: H1, H2; swap(1,2), CNOT(2,3), swap(1,2); H3; CNOT(2,3).

[0072] Therefore, the application of quantum logic functions in the design of qubits (including the design of whether qubits are used and the design of the efficiency of each qubit) is key to improving the computational performance of quantum computers and requires special design. This is the unique characteristic of quantum algorithms implemented based on quantum logic functions, and is fundamentally and significantly different from classical algorithms implemented based on classical logic functions. The aforementioned design considerations for qubits are technical problems that ordinary computing devices do not need to consider or address. This invention proposes a ciphertext decryption method and related apparatus based on quantum computing, using quantum computing to solve the problem of cracking ciphertext based on discrete logarithm encryption, which has plagued traditional cryptography, thereby improving the speed of ciphertext decryption.

[0073] See Figure 2 , Figure 2 This is a flowchart illustrating a quantum computing-based ciphertext decryption method provided in an embodiment of the present invention, applied to ciphertext encrypted using discrete logarithm encryption. The method includes:

[0074] Step 201: Obtain the public key and plaintext parameters corresponding to the ciphertext, wherein both the public key and plaintext parameters belong to the finite field GF(2). t elements in )

[0075] Among them, GF(2)t The elements in the polynomial are polynomials with coefficients consisting of 0 and 1. More precisely, they are residue classes composed of polynomials. The equivalence relations within these polynomials are characterized by modularly dividing (modular division means taking the remainder of a polynomial) an irreducible polynomial of degree t. An irreducible polynomial is one that, in the current number field, has no other polynomials as factors besides 1 and the polynomial itself.

[0076] For current binary system computers, GF(2) t This is particularly important because many encryption standard algorithms use bytes as the unit of processing; for example, each byte can be considered as GF(2). 8 An element in (k=8) corresponds to a polynomial of degree no more than 7, a7a6a5a4a3a2a1a0=a7x 7 +a6x 6 +a5x 5 +a4x 4 +a3x 3 +a2x 2 +a1x 1 +a0.

[0077] Step 202: Determine the square matrix corresponding to the public key and plaintext parameters;

[0078] Specifically, determining the square matrix corresponding to the public key includes:

[0079] Determine the degree corresponding to the highest term in a preset irreducible polynomial, wherein the preset irreducible polynomial is a modulus;

[0080] Determine the result of a first modular multiplication operation between the public key and each term with a lower degree than the term corresponding to the highest term;

[0081] The square matrix corresponding to the public key is determined based on the result of the first modular multiplication operation.

[0082] For example, the presupposed irreducible polynomial is f = 1 + x + x 4 The public key is a polynomial 1+x, and the results of the first modular multiplication of the public key with each term of a lower degree than the highest term are as follows:

[0083] (1+x)×1 mod f = 1+x

[0084] (1+x)×xmodf=x+x 2

[0085] (1+x)×x 2 modf = x 2 +x 3

[0086] (1+x)×x 3modf = x 3 +x 4 mod f = 1 + x + x 3

[0087] Translate the above expression into the language of linear algebra:

[0088] (1, 1, 0, 0) × (1, 0, 0, 0) = (1, 1, 0, 0)

[0089] (1, 1, 0, 0) × (0, 1, 0, 0) = (0, 1, 1, 0)

[0090] (1, 1, 0, 0) × (0, 0, 1, 0) = (0, 0, 1, 1)

[0091] (1, 1, 0, 0) × (0, 0, 0, 1) = (1, 1, 0, 1)

[0092] Writing the four equations together gives us:

[0093]

[0094] Therefore, the square matrix corresponding to the public key to be determined can be obtained as follows:

[0095]

[0096] The vector in the left multiplication field of the square matrix corresponding to the public key is equivalent to (1+x) multiplied by its elements, which is obvious because polynomial operations follow the distributive law of multiplication over addition.

[0097] Similarly, determining the square matrix corresponding to the plaintext parameters includes:

[0098] Determine the degree corresponding to the highest term in a preset irreducible polynomial, wherein the preset irreducible polynomial is the obtained modulus;

[0099] Determine the result of the second modular multiplication operation between the plaintext parameter and each term with a lower exponent than the highest term;

[0100] The square matrix corresponding to the plaintext parameters is determined based on the result of the second modular multiplication operation.

[0101] Here, we only need to replace the public key with the plaintext parameter to determine the square matrix corresponding to the plaintext parameter. For the specific implementation process, please refer to the above implementation process of the square matrix corresponding to the public key.

[0102] Step 203: Construct the target quantum circuit based on the array;

[0103] The mathematical representation of a quantum logic gate is a matrix. Therefore, the matrix can be processed, such as by decomposition, to obtain the quantum logic gate. Then, the quantum logic gate can be applied to the corresponding qubit to obtain the target quantum circuit.

[0104] Step 204: Determine the private key corresponding to the ciphertext based on the operation result of the target quantum circuit;

[0105] The target quantum circuit runs on a quantum computing unit, which can be a quantum computer or a quantum virtual machine. The classical computing unit sends the target quantum circuit to the quantum computing unit, which excites the qubits in the target quantum circuit to their initial states. Then, based on the quantum logic gates in the target quantum circuit, it applies corresponding analog signals to the qubits to cause the initial states of the qubits to evolve. Finally, it applies analog signals to measure the qubits, determines the result of the target quantum circuit's operation, and feeds the result back to the classical computing unit.

[0106] The quantum computing unit executes the target quantum circuit a specified number of times. The measured execution results can be in the form of an array. For example, for two qubits and 1024 executions, the measurement results could be "00":251, "01":213, "10":260, "11":300, where "00", "01", "10", and "11" are the measured quantum states, and "251", "213", "260", and "300" are the number of times the measured quantum states were executed.

[0107] Step 205: Decrypt the ciphertext based on the private key.

[0108] To determine the private key corresponding to the ciphertext based on the running results, and to decrypt the ciphertext based on the private key, please refer to the patent document with application number "202111365914.4" entitled "Ciphertext Decryption Method and Related Device"; or refer to the patent document with application number "202111365902.1" entitled "Ciphertext Decryption Method and Related Device".

[0109] As can be seen, this invention transforms the public key and plaintext parameters corresponding to the obtained ciphertext into a square matrix. This ciphertext is based on discrete logarithm encryption, and both the public key and plaintext parameters belong to the finite field GF(2). tThe elements in the array are then used to construct and run the target quantum circuit. The private key is determined by the result of the operation of the target quantum circuit, and the ciphertext is decrypted using the private key. Existing technologies, even using the most efficient number field sieve method to decompose a binary number represented by 795 bits, would take more than 3,000 years. Compared with existing technologies, this invention greatly improves the speed of cracking ciphertext based on discrete logarithm encryption by utilizing the superposition and entanglement characteristics of quantum computing.

[0110] Optionally, constructing the target quantum circuit based on the array includes:

[0111] The square matrix corresponding to the public key is squared a predetermined number of times to obtain multiple first square matrices; and the square matrix corresponding to the plaintext parameters is squared a predetermined number of times to obtain multiple second square matrices.

[0112] Determine the square matrix corresponding to the public key and the first modular polynomial exponent operation quantum circuits corresponding to multiple first square matrices, and the square matrix corresponding to the plaintext parameters and the second modular polynomial exponent operation quantum circuits corresponding to multiple second square matrices;

[0113] The target quantum circuit is obtained by cascading the quantum Fourier transform circuit, the first modular polynomial exponentiation quantum circuit, the second modular polynomial exponentiation quantum circuit, and the quantum inverse Fourier transform circuit in sequence.

[0114] The preset number of iterations is t-1. Specifically, the square of the matrix corresponding to the public key is iteratively calculated until t-1 first matrices are obtained, where each first matrix is ​​a 2x2 of the matrix corresponding to the public key. q Powers. For example, when q = 1, then (1 + x) 2 The corresponding first square matrix is ​​the square of the square matrix corresponding to the public key:

[0115]

[0116] Following the above method, iterative calculations can also yield... The corresponding first matrix.

[0117] The method for determining the second square matrix is ​​the same as that for determining the first square matrix, except that the square parameter is different, which will not be elaborated here.

[0118] Specifically, determining the square matrix corresponding to the public key and the quantum circuits for first modular polynomial exponent operations corresponding to the plurality of first square matrices includes:

[0119] Perform LUP decomposition on the square matrix corresponding to the public key and each of the first square matrices to obtain L-type, U-type and P-type matrices;

[0120] The quantum circuits corresponding to the L-type and U-type matrices are determined based on the CNOT gate, and the quantum circuits corresponding to the P-type matrix are determined based on the SWAP gate;

[0121] Each P-type matrix and the quantum logic gates corresponding to the U-type and L-type matrices of the P-type matrix are sequentially applied to the qubits to obtain the square matrix corresponding to the public key or the quantum circuit corresponding to each of the first square matrices.

[0122] The first modular polynomial exponential operation quantum circuit is obtained by sequentially cascading the square matrix corresponding to the public key and multiple quantum circuits corresponding to the first square matrix.

[0123] Decomposing a square matrix A into the product of a lower triangular matrix L and an upper triangular matrix U is called LU decomposition. LUP decomposition is based on LU decomposition by adding a permutation matrix P. The square matrix A is first subjected to the permutation matrix to obtain AP, and then the new matrix is ​​decomposed into LU, i.e., AP = LU.

[0124] The elements of the P-type, U-type, and L-type matrices are all taken from {0,1}. Therefore, the quantum circuits corresponding to the P-type matrix can be implemented by SWAP gates, while the quantum circuits corresponding to the U-type and L-type matrices can be implemented by CNOT gates.

[0125] Specifically, the construction of the quantum circuit corresponding to the L-type matrix based on the CNOT gate includes:

[0126] Determine the non-zero elements a in the L-shaped matrix excluding the diagonal elements. ij By applying CNOT gates to the i-th and j-th qubits, a quantum circuit corresponding to the L-type matrix is ​​obtained. The i-th qubit is the controlled qubit, and the j-th qubit is the control qubit. The i and j are the row and column numbers of the L-type matrix, respectively.

[0127] like Figure 3 As shown, Figure 3 This is a schematic diagram of a quantum circuit corresponding to an L-shaped matrix, provided as an embodiment of the present invention. For example, the L-shaped matrix is ​​as follows:

[0128]

[0129] The non-zero elements (excluding the diagonal) in the L-shaped matrix are a 20 a 21 a 30Then, following the order of the non-zero element from smallest to largest and then from smallest to largest, the CNOT gate is applied to the 2nd and 0th qubits (q2 and q0), where the 2nd qubit q2 is the controlled bit and the 0th qubit q0 is the control bit; the CNOT gate is applied to the 2nd and 1st qubits (q2 and q1), where the 2nd qubit q2 is the controlled bit and the 1st qubit q1 is the control bit; the CNOT gate is applied to the 3rd and 0th qubits (q3 and q0), where the 3rd qubit q3 is the controlled bit and the 0th qubit q0 is the control bit.

[0130] Specifically, the construction of the quantum circuit corresponding to the U-shaped matrix based on the CNOT gate includes:

[0131] Determine the non-zero elements a in the U-shaped matrix excluding the diagonal elements. ij By applying CNOT gates to the i-th and j-th qubits, a quantum circuit corresponding to the U-shaped matrix is ​​obtained. The j-th qubit is the controlled qubit, and the i-th qubit is the control qubit. The i and j are the row and column numbers of the U-shaped matrix, respectively.

[0132] The specific implementation process of the quantum circuit corresponding to the U-shaped matrix is ​​similar to that of the quantum circuit corresponding to the L-shaped matrix. Please refer to the above-mentioned implementation process of the quantum circuit corresponding to the L-shaped matrix, which will not be repeated here.

[0133] In one embodiment of the present invention, the construction of the quantum circuit corresponding to the P-type matrix based on the SWAP gate, wherein the dimension of the P-type matrix is ​​t×t, includes:

[0134] The quantum states of the t qubits corresponding to the row number are transferred to the quantum states of the t qubits corresponding to the column number, and the non-zero elements a in the P-type matrix other than the diagonal are determined. mn The m and n are the number of rows and columns of the P-type matrix, respectively.

[0135] By applying the SWAP gate to the m-th qubit of the t-th qubits corresponding to the row number and the n-th qubit of the t-th qubits corresponding to the column number, the quantum circuit corresponding to the P-type matrix is ​​obtained.

[0136] Further, the transfer of the quantum state of the t qubits corresponding to the row number to the quantum state of the t qubits corresponding to the column number includes:

[0137] The SWAP gate is applied to the qubits with the same row number and column number, where both the row number and column number correspond to t qubits.

[0138] For example, such as Figure 4 As shown, Figure 4 This is a schematic diagram of a quantum circuit corresponding to a P-type matrix provided in an embodiment of the present invention. If t = 4, then the quantum circuit includes four qubits corresponding to the row number: q Line0 q Line1 q Line2 q Line3 The four qubits corresponding to the column number: q Row0 q Row1 q Row2 q Row3 You can first use SWAP(q) Line0 q Row0 ), SWAP(q) Line1 q Row1 ), SWAP(q) Line2 q Row2 ), SWAP(q) Line3 q Row3 The quantum state of the qubit corresponding to the row number is transferred to the quantum state of the qubit corresponding to the column number. Here, the four SWAP gates operate on different qubits, so their timing is not affected. Figure 4 This is just one example.

[0139] If the P-type matrix is:

[0140]

[0141] Then the non-zero element is a 01 a 12 a 23 a 30 Therefore, SWAP(q) exists. Line0 q Row1 ), SWAP(q) Line1 q Row2 ), SWAP(q) Line2 q Row3 ), SWAP(q) Line3 q Row0 Similarly, the four SWAP gates here operate on different qubits, therefore their timing is not affected. Figure 4 This is just one example.

[0142] In another embodiment of the present invention, determining the quantum circuit corresponding to the P-type matrix based on the SWAP gate includes:

[0143] Determine the non-zero elements a in the P-type matrix excluding the diagonal elements. mn ;

[0144] If m is less than n, then the SWAP gate is applied to the m-th and n-th qubits;

[0145] If m is greater than n, then determine the non-zero element a. m′n′ And apply the SWAP gate to the m-th and n′-th qubits, where m′ is less than m and n′ is greater than m;

[0146] If m equals n or n′, then no operation is performed;

[0147] Determine the quantum circuit corresponding to the P-type matrix.

[0148] For example, such as Figure 5 As shown, Figure 5 This is a schematic diagram of another quantum circuit corresponding to a P-type matrix provided in an embodiment of the present invention.

[0149] If the P-type matrix is:

[0150]

[0151] Non-zero elements include a 03 a 10 a 21 a 32 For non-zero element a o3 If 0 < 3, then the SWAP gate is applied to the 0th and 3rd qubits (q0 and q3); for non-zero elements a 10 If 1 > 0, then the search upwards will return a. 03 Given that m = 1 > m′ = 0 and n′ = 3 > m = 1, apply the SWAP gate to the 1st and 3rd qubits (q1 and q3); similarly, for non-zero elements a... 21 Apply the SWAP gate to the 2nd and 3rd qubits (q2 and q3); for non-zero element a 32 If no operation is performed, then no operation is performed; after all non-zero elements have been traversed, the quantum circuit corresponding to the P-type matrix is ​​determined.

[0152] As can be seen, in this embodiment of the invention, the required number of qubits is 2t, which is less than the number of qubits t required in the previous embodiments. The classical computation involved in the previous embodiments involves less computation and is more logically direct, but it calls up a larger number of qubits. The advantages and disadvantages of this embodiment of the invention are the opposite of those of the previous embodiments.

[0153] Optionally, the quantum Fourier transform circuit includes an H-gate acting on a first auxiliary bit and a second auxiliary bit, the first modular polynomial exponentiation quantum circuit is controlled by the second auxiliary bit, the second modular polynomial exponentiation quantum circuit is controlled by the first auxiliary bit, and the quantum inverse Fourier transform circuit includes quantum inverse Fourier transform modules acting on the first auxiliary bit and the second auxiliary bit.

[0154] Among them, the quantum circuits corresponding to L-type, U-type, and P-type matrices require at least t qubits. Therefore, the quantum circuits for the first-modulus polynomial exponent operation and the second-modulus polynomial exponent operation also require at least t qubits.

[0155] In this circuit, the first modular polynomial exponentiation quantum circuit is controlled by a second auxiliary bit. The first modular polynomial exponentiation quantum circuit includes t terms, each controlled by one second auxiliary bit, thus requiring t second auxiliary bits for control. Similarly, it requires t first auxiliary bits for control.

[0156] Among them, the H gate is a single gate, and the H gate acts on the first auxiliary bit and the second auxiliary bit, so 2t H gates are needed.

[0157] Specifically, the quantum inverse Fourier transform circuit includes quantum inverse Fourier transform modules acting on the first auxiliary bit and the second auxiliary bit, including: the quantum inverse Fourier transform circuit includes two quantum inverse Fourier transform modules, one of which acts on t first auxiliary bits and the other acts on t second auxiliary bits.

[0158] like Figure 6 As shown, Figure 6 This is a schematic diagram of a target quantum circuit provided in an embodiment of the present invention. The target quantum circuit includes t first auxiliary bits, t second auxiliary bits, and t qubits. The initial quantum state of the t first auxiliary bits and the t second auxiliary bits is |0>. Among the t qubits, except for the least significant qubit which has an initial quantum state of |1>, the initial quantum state of the other t-1 qubits is |0>.

[0159] In this matrix, the public key 'a' corresponds to a square matrix A, and the first square matrix consists of A2, A3, ..., A2. t-1 A t The quantum circuit corresponding to square array A is Mat A, and the quantum circuits corresponding to the first square array are Mat A2, Mat A3, ..., Mat A t-1 Mat A t Each square array or the quantum circuit corresponding to the first square array is controlled by the corresponding second auxiliary bit, together forming the first modular polynomial exponential operation quantum circuit.

[0160] In this matrix, the plaintext parameter b corresponds to matrix B, and the second matrix is ​​B2, B3, ..., B. t-1 B t The quantum circuit corresponding to the first square array B is Mat B, and the quantum circuits corresponding to the second square array are MatB2, MatB3, ..., Mat B. t-1 Mat B tEach quantum circuit corresponding to a square matrix or a second square matrix is ​​controlled by the corresponding second auxiliary bit, together forming the second modular polynomial exponential operation quantum circuit.

[0161] The quantum Fourier transform operation is performed through an H-gate acting on each first auxiliary bit and each second auxiliary bit, which is a quantum inverse Fourier transform operation. Another quantum inverse Fourier transform operation is performed on t first auxiliary bits. It applies to t second auxiliary bits.

[0162] Optionally, the private key corresponding to the ciphertext is determined based on the running result of the target quantum circuit, wherein the running result of the target quantum circuit includes good number pairs, including:

[0163] A first good number vector is determined based on one of the good number pairs, and a second good number vector is determined based on the other of the good number pairs;

[0164] Determine the inverse of each element in the second good number vector to obtain the third good number vector;

[0165] Determine the tensor product of the first good number vector and the third good number vector;

[0166] The private key corresponding to the ciphertext is determined from the tensor product.

[0167] Among them, the good number is the classical data obtained after decoding the good state of quantum data, the good state is the quantum state obtained by measuring the first auxiliary bit or the second auxiliary bit, and the good number pair includes two good numbers, which are the two good numbers corresponding to the two good states obtained by measuring the first auxiliary bit and the second auxiliary bit, respectively.

[0168] run Figure 6 The quantum circuit shown can be used to measure t first auxiliary bits and t second auxiliary bits to obtain good pairs l and k of binary strings, which can then be converted to decimal. The discrete logarithm problem can then be transformed into solving congruence equations:

[0169] k×x=lmod2 t

[0170] The solution to the above equation is not necessarily unique, and considering measurement errors (there are errors in l and k), it is necessary to expand the calculation range of the polynomial size.

[0171] Neglecting errors, and assuming that the measured k is not even, then 2 t Since k and k are coprime, there exist integer k. -1 ,satisfy:

[0172] k×k -1=1 mod2 t

[0173] Therefore:

[0174] x=k×x×k -1 =l×k -1 mod2 t

[0175] The computational simulation can be performed using the Extended Euclidean Algorithm, with a time complexity of log2. t =t, even if we calculate the modular inverse of the polynomial, the above complexity can still guarantee that the total time complexity is at the polynomial level. Compared with traditional algorithms, its time complexity is greatly reduced.

[0176] Considering measurement errors (errors exist in l and k), it is necessary to expand the calculation range of the polynomial size. Specifically, determining the first good number vector based on one of the good number pairs includes: extending one of the good number pairs to both sides to obtain the first good number vector. For example, it can be that l and k are extended to both sides to obtain good number vectors. For example, the first good number vectors long l and long k are as follows:

[0177] longl=[l-tl-t+1…l-1 ll+1…l+t-1 l+t]

[0178] longk=[k-tk-t+1…k-1 kk+1…k+t-1 k+t]

[0179] Specifically, the inverse of each element in the second good number vector long k is determined to obtain the third good number vector long k. -1 :

[0180] longk -1 =[(kt) -1 …k -1 …(k+t) -1 ]

[0181] longl and longk -1 The tensor product is:

[0182]

[0183] Finally, from the tensor product above, 4t 2 Select the appropriate element from the given elements as the private key x corresponding to the ciphertext.

[0184] See Figure 7 , Figure 7This is a schematic diagram of a quantum computing-based ciphertext decryption device provided in an embodiment of the present invention. The device is applied to ciphertext encrypted using discrete logarithm encryption and includes:

[0185] Acquisition unit 701 is used to acquire the public key and plaintext parameters corresponding to the ciphertext, wherein both the public key and plaintext parameters belong to the finite field GF(2). t elements in )

[0186] Determining unit 702 is used to determine the square matrix corresponding to the public key and plaintext parameters;

[0187] Construction unit 703 is used to construct the target quantum circuit based on the array;

[0188] The determining unit 702 is further configured to determine the private key corresponding to the ciphertext based on the operation result of the target quantum circuit;

[0189] The decryption unit 704 is used to decrypt the ciphertext based on the private key.

[0190] The specific functions and effects of the quantum computing-based ciphertext decryption device can be explained by referring to other embodiments in this specification, and will not be repeated here. Each module in the quantum computing-based ciphertext decryption device can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in a computer device in hardware form, or it can be stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0191] Please see Figure 8 This specification also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, characterized in that the processor, when executing the computer program, implements the quantum computing-based ciphertext decryption method described in any of the above embodiments. Please refer to... Figure 8 The computer device can be a classical computer or a quantum computer.

[0192] This specification also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a computer, causes the computer to perform the quantum computing-based ciphertext decryption method in any of the above embodiments.

[0193] This specification also provides a computer program product containing instructions that, when executed by a computer, cause the computer to perform the quantum computing-based ciphertext decryption method in any of the above embodiments.

[0194] It is understood that the specific examples in this specification are only intended to help those skilled in the art better understand the implementation methods described herein, and are not intended to limit the scope of the invention.

[0195] It is understood that in the various embodiments of this specification, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not limit the implementation process of the embodiments of this specification in any way.

[0196] It is understood that the various implementation methods described in this specification can be implemented individually or in combination, and the implementation methods in this specification are not limited in this respect.

[0197] Unless otherwise stated, all technical and scientific terms used in the embodiments of this specification have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of this specification. The term "and / or" as used in this specification includes any and all combinations of one or more of the associated listed items. The singular forms "a," "the," and "the" as used in the embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0198] It is understood that the processor in the embodiments of this specification can be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method embodiments can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this specification. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this specification can be directly implemented by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above methods.

[0199] It is understood that the memory in the embodiments of this specification may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM). It should be noted that the memory in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0200] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this specification.

[0201] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the aforementioned method implementations, and will not be repeated here.

[0202] In the several embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0203] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0204] In addition, the functional units in the various embodiments of this specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0205] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this specification, in essence, or the parts that contribute to the prior art, or parts of the technical solutions, can be embodied in the form of software products. These computer software products are stored in a storage medium and include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0206] The above description is merely a specific embodiment of this specification, but the scope of protection of this invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this specification should be included within the scope of protection of this specification. Therefore, the scope of protection of this invention should be determined by the scope of the claims.

Claims

1. A ciphertext decryption method based on quantum computing, characterized in that, The method, applied to ciphertext based on discrete logarithm encryption, includes: Obtain the public key and plaintext parameters corresponding to the ciphertext, where both the public key and plaintext parameters belong to a finite field. Middle element; Determine the square matrix corresponding to the public key and plaintext parameters; The square matrix corresponding to the public key is squared a predetermined number of times to obtain multiple first square matrices; and the square matrix corresponding to the plaintext parameters is squared a predetermined number of times to obtain multiple second square matrices. Determine the square matrix corresponding to the public key and the first modular polynomial exponent operation quantum circuits corresponding to multiple first square matrices, and the square matrix corresponding to the plaintext parameters and the second modular polynomial exponent operation quantum circuits corresponding to multiple second square matrices; The quantum Fourier transform circuit, the first modular polynomial exponentiation quantum circuit, the second modular polynomial exponentiation quantum circuit, and the quantum inverse Fourier transform circuit are cascaded sequentially to obtain the target quantum circuit. The private key corresponding to the ciphertext is determined based on the operation result of the target quantum circuit; The ciphertext is decrypted based on the private key.

2. The method as described in claim 1, characterized in that, The quantum Fourier transform circuit includes an H-gate acting on a first auxiliary bit and a second auxiliary bit. The first modular polynomial exponentiation quantum circuit is controlled by the second auxiliary bit, and the second modular polynomial exponentiation quantum circuit is controlled by the first auxiliary bit. The quantum inverse Fourier transform circuit includes quantum inverse Fourier transform modules acting on the first auxiliary bit and the second auxiliary bit.

3. The method as described in claim 1, characterized in that, The private key corresponding to the ciphertext is determined based on the operation result of the target quantum circuit. The operation result of the target quantum circuit includes good number pairs, including: A first good number vector is determined based on one of the good number pairs, and a second good number vector is determined based on the other of the good number pairs; Determine the inverse of each element in the second good number vector to obtain the third good number vector; Determine the tensor product of the first good number vector and the third good number vector; The private key corresponding to the ciphertext is determined from the tensor product.

4. The method as described in claim 3, characterized in that, Determining the first good number vector based on one of the good number pairs includes: One of the pairs of good numbers is extended to both sides to obtain the first good number vector.

5. The method as described in claim 1, characterized in that, The step of determining the square matrix corresponding to the public key and the quantum circuits for first modular polynomial exponent operations corresponding to multiple first matrices includes: Perform LUP decomposition on the square matrix corresponding to the public key and each of the first square matrices to obtain L-type, U-type and P-type matrices; The quantum circuits corresponding to the L-type and U-type matrices are determined based on the CNOT gate, and the quantum circuits corresponding to the P-type matrix are determined based on the SWAP gate; Each P-type matrix and the quantum logic gates corresponding to the U-type and L-type matrices of the P-type matrix are sequentially applied to the qubits to obtain the square matrix corresponding to the public key or the quantum circuit corresponding to each of the first square matrices. The first modular polynomial exponential operation quantum circuit is obtained by sequentially cascading the square matrix corresponding to the public key and multiple quantum circuits corresponding to the first square matrix.

6. The method as described in claim 5, characterized in that, The determination of the quantum circuit corresponding to the P-type matrix based on the SWAP gate includes: Determine the non-zero elements in the P-type matrix excluding the diagonal. ; If m is less than n, then the SWAP gate is applied to the m-th and n-th qubits; If m is greater than n, then determine the non-zero elements. And applying the SWAP gate to the m-th and m-th... On each quantum bit, Less than m, and Greater than m; If m equals n or If so, no operation will be performed; Determine the quantum circuit corresponding to the P-type matrix.

7. A quantum computing-based ciphertext decryption device, characterized in that, For use with ciphertext encrypted based on discrete logarithm encryption, the apparatus includes: The acquisition unit is used to acquire the public key and plaintext parameters corresponding to the ciphertext, wherein both the public key and plaintext parameters belong to a finite field. Middle element; A determining unit is used to determine the square matrix corresponding to the public key and the plaintext parameters; A construction unit is configured to perform a preset number of squaring operations on the square matrix corresponding to the public key to obtain multiple first square matrices; and to perform a preset number of squaring operations on the square matrix corresponding to the plaintext parameters to obtain multiple second square matrices; determine the first modular polynomial exponentiation quantum circuit corresponding to the square matrix corresponding to the public key and the multiple first square matrices, and the second modular polynomial exponentiation quantum circuit corresponding to the square matrix corresponding to the plaintext parameters and the multiple second square matrices; and cascade the quantum Fourier transform circuit, the first modular polynomial exponentiation quantum circuit, the second modular polynomial exponentiation quantum circuit, and the quantum inverse Fourier transform circuit sequentially to obtain the target quantum circuit; The determining unit is further configured to determine the private key corresponding to the ciphertext based on the operation result of the target quantum circuit; A decryption unit is used to decrypt the ciphertext based on the private key.

8. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 6 when it is run.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 1 to 6.

Images