Ciphertext decryption method and related device

Abstract

The invention discloses a ciphertext decryption method and a related device, and the method comprises the steps: obtaining a public key and a plaintext parameter corresponding to a ciphertext based on discrete logarithm encryption, and the public key and the plaintext parameter belong to elements in a finite field GF (p, k); then, based on the public key and LUP matrix decomposition, determining the order of the public key in GF (p, k); the ciphertext is decrypted based on the order of the public key in the GF (p, k) and plaintext parameters; and decryption of the ciphertext based on discrete logarithm encryption is realized.

Description

Technical Field

[0001] The present invention belongs to the field of quantum computing technology, and in particular to a ciphertext decryption method and related device. Background Art

[0002] Quantum computers are physical devices that follow the laws of quantum mechanics to perform high-speed mathematical and logical operations, store and process quantum information. When a device processes and calculates quantum information and runs quantum algorithms, it is a quantum computer. Quantum computers have become a key technology under research because they can process mathematical problems more efficiently than ordinary computers. For example, they can speed up the time it takes to crack a key from hundreds of years to just a few hours.

[0003] Finite field, also known as Galois Field (GF), is a very important concept in many disciplines such as abstract algebra and cryptography. Taking cryptography as an example, the discrete logarithm problem on finite fields is one of the two core difficult problems in the classical public key cryptography system. Therefore, how to decrypt ciphertext based on discrete logarithm encryption has always been a difficult problem to solve. Summary of the invention

[0004] The purpose of the present invention is to provide a ciphertext decryption method and related device to realize decryption of ciphertext based on discrete logarithm encryption.

[0005] An embodiment of the present invention provides a ciphertext decryption method, which is applied to a ciphertext encrypted based on discrete logarithm encryption, and the method comprises:

[0006] Obtaining a public key and a plaintext parameter corresponding to the ciphertext, wherein the public key and the plaintext parameter are both elements in a finite field GF(p, k);

[0007] Determining the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition;

[0008] The ciphertext is decrypted based on the order of the public key in GF(p, k) and the plaintext parameter.

[0009] Optionally, determining the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition includes:

[0010] Iteratively calculate the power of the square matrix corresponding to the public key until k-1 first square matrices are obtained, where the first square matrix is ​​2 c power, where c is an integer in [2, k];

[0011] Perform LUP decomposition on the square matrix and k-1 of the first square matrices to obtain k L-type, k U-type and k P-type matrices respectively;

[0012] Constructing an order-finding quantum circuit based on k L-type matrices, k U-type matrices and k P-type matrices;

[0013] The order of the public key in GF(p, k) is determined based on the operation result of the order-finding quantum circuit.

[0014] Optionally, determining the order of the public key in GF(p, k) based on the operation result of the order-finding quantum circuit includes:

[0015] The results of the operation of the quantum circuit for finding the order based on the continued fraction algorithm are similar to those of 2 f Expand the quotient to obtain at least one score, and the operation result is encoded with f quantum bits;

[0016] The order of the public key in GF(p, k) is determined from the denominator of at least one term of the fraction.

[0017] Optionally, constructing an order-finding quantum circuit based on k L-type matrices, k U-type matrices, and k P-type matrices includes:

[0018] Based on each of the L-type matrices and a preset modulus operator, a quantum circuit corresponding to each of the L-type matrices is constructed; based on each of the U-type matrices and a preset modulus operator, a quantum circuit corresponding to each of the U-type matrices is constructed; and based on each of the P-type matrices and a SWAP gate, a quantum circuit corresponding to each of the P-type matrices is constructed;

[0019] Cascading each of the L-type matrices with the quantum circuits corresponding to the U-type matrix and the P-type matrix corresponding to the L-type matrix in sequence to obtain k single-term modular multiplication quantum circuits;

[0020] Cascading k of the single-term modular multiplication quantum circuits in sequence to obtain a modular multiplication quantum circuit;

[0021] The quantum Fourier transform circuit, the modular multiplication quantum circuit and the inverse quantum Fourier transform circuit are sequentially cascaded to obtain an order-finding quantum circuit.

[0022] Optionally, the modulus operator includes a modulus addition operator and a modulus multiplication operator, and the step of constructing a quantum circuit corresponding to each L-type matrix based on each L-type matrix and a preset modulus operator includes:

[0023] Determine the non-zero elements of each row in each of the L-type matrices;

[0024] A quantum circuit corresponding to each L-type matrix is ​​constructed based on the non-zero elements of each row and the modular addition operator and the modular multiplication operator.

[0025] Optionally, constructing a quantum circuit corresponding to each P-type matrix based on each P-type matrix and a SWAP gate includes:

[0026] Determine the non-zero elements a in each of the P-type matrices except the diagonal mn ;

[0027] If m is less than n, the SWAP gate is applied to the mth and nth qubits;

[0028] If m is greater than n, determine the non-zero element a m′n′ , and apply the SWAP gate to the mth and n′th qubits, m′ is less than m, and n′ is greater than m;

[0029] If m is equal to n or n′, no operation is performed;

[0030] The quantum circuit corresponding to each of the P-type matrices is determined.

[0031] Optionally, decrypting the ciphertext based on the order of the public key in GF(p, k) and the plaintext parameter includes:

[0032] Determining the number of quantum bits required to construct a target quantum circuit for solving a private key corresponding to the ciphertext based on the logarithm of the order of the public key in GF(p, k);

[0033] Constructing the target quantum circuit based on the number of quantum bits required by the target quantum circuit;

[0034] Determining a private key corresponding to the ciphertext based on the operation result of the target quantum circuit;

[0035] The ciphertext is decrypted based on the private key.

[0036] Another embodiment of the present invention provides a ciphertext decryption device, which is applied to ciphertext based on discrete logarithm encryption, and the device includes:

[0037] An acquisition unit, used to acquire a public key and a plaintext parameter corresponding to the ciphertext, wherein the public key and the plaintext parameter are both elements in a finite field GF(p, k);

[0038] A determining unit, configured to determine the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition;

[0039] A decryption unit is used to decrypt the ciphertext based on the order of the public key in GF(p, k) and the plaintext parameter.

[0040] Yet another embodiment of the present invention provides a storage medium, wherein the storage medium stores a computer program, wherein the computer program is configured to execute any of the above methods when running.

[0041] Yet another embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute any of the above methods.

[0042] It can be seen that the present invention obtains the public key and plaintext parameters corresponding to the ciphertext based on discrete logarithm encryption, and the public key and plaintext parameters both belong to elements in the finite field GF(p, k); then determines the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition; thereby decrypting the ciphertext based on the order of the public key in GF(p, k) and the plaintext parameters; and realizes the decryption of the ciphertext based on discrete logarithm encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A network block diagram of a ciphertext decryption system provided by an embodiment of the present invention;

[0044] Figure 2 A schematic diagram of a flow chart of a ciphertext decryption method provided by an embodiment of the present invention;

[0045] Figure 3 A schematic diagram of the structure of a quantum circuit corresponding to an L-type matrix provided in an embodiment of the present invention;

[0046] Figure 4 A schematic diagram of the structure of a quantum circuit corresponding to a P-type matrix provided in an embodiment of the present invention;

[0047] Figure 5 A schematic diagram of the structure of a quantum circuit corresponding to another P-type matrix provided in an embodiment of the present invention;

[0048] Figure 6 A schematic diagram of the structure of an order-finding quantum circuit provided by an embodiment of the present invention;

[0049] Figure 7 A schematic diagram of the structure of a ciphertext decryption device provided by an embodiment of the present invention;

[0050] Figure 8 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but should not be construed as limiting the present invention.

[0052] Figure 1 1 is a network block diagram of a ciphertext decryption system provided by an embodiment of the present invention. The ciphertext decryption system may include a network 110, a server 120, a wireless device 130, a client 140, a storage 150, a classical computing unit 160, a quantum computing unit 170, and may also include additional memories, classical processors, quantum processors, and other devices not shown.

[0053] The network 110 is a medium for providing communication links between various devices and computers connected together in the ciphertext decryption system, including but not limited to the Internet, corporate intranets, local area networks, mobile communication networks and combinations thereof. The connection method may be wired, wireless communication links or optical fiber cables.

[0054] The server 120, the wireless device 130 and the client 140 are conventional data processing systems, which may contain data and applications or software tools for performing conventional computing processes. The client 140 may be a personal computer or a network computer, so the data may also be provided by the server 120. The wireless device 130 may be a smart phone, a tablet, a laptop, a smart wearable device, etc. The storage unit 150 may include a database 151, which may be configured to store data such as quantum bit parameters, quantum logic gate parameters, quantum circuits, quantum programs, etc.

[0055] The classical computing unit 160 (quantum computing unit 170) may include a classical processor 161 (quantum processor 171) for processing classical data (quantum data) and a memory 162 (memory 172) for storing classical data (quantum data). The classical data (quantum data) may be a boot file, an operating system image, and an application 163 (application 173). The application 163 (application 173) may be used to implement a quantum algorithm compiled by a ciphertext decryption method provided in an embodiment of the present invention.

[0056] Any data or information stored or generated in the classical computing unit 160 (quantum computing unit 170) can also be configured to be stored or generated in another classical (quantum) processing system in a similar manner, and any application program executed by it can also be configured to be executed in another classical (quantum) processing system in a similar manner.

[0057] It should be noted that a true quantum computer is a hybrid structure, which includes at least Figure 1 There are two major parts in it: the classical computing unit 160, which is responsible for performing classical computing and control; the quantum computing unit 170, which is responsible for running quantum programs and thus realizing quantum computing.

[0058] The classical computing unit 160 and the quantum computing unit 170 may be integrated into one device or distributed in two different devices. For example, the first device including the classical computing unit 160 runs a classical computer operating system, on which quantum application development tools and services are provided, as well as storage and network services required for quantum applications. Users develop quantum programs through the quantum application development tools and services thereon, and send quantum programs to the second device including the quantum computing unit 170 through the network services thereon. The second device runs a quantum computer operating system, and the code of the quantum program is parsed and compiled into instructions that can be recognized and executed by the quantum processor 170 through the quantum computer operating system. The quantum processor 170 implements the quantum algorithm corresponding to the quantum program according to the instructions.

[0059] The computing unit of the classic processor 161 in the classic computing unit 160 is a CMOS tube based on a silicon chip. This computing unit is not limited by time and coherence, that is, this computing unit is not limited by the length of use and can be used at any time. In addition, in the silicon chip, the number of such computing units is also sufficient. At present, the number of computing units in a classic processor 161 is tens of thousands. The number of computing units is sufficient and the computing logic that can be selected by the CMOS tube is fixed, such as: AND logic. When calculating with the help of CMOS tubes, a large number of CMOS tubes are combined with limited logic functions to achieve the calculation effect.

[0060] The basic computing unit of the quantum processor 171 in the quantum computing unit 170 is a quantum bit, and the input of the quantum bit is limited by coherence and coherence time, that is, the quantum bit is limited by the use time and is not available at any time. Making full use of the quantum bit within the available use time of the quantum bit is a key problem in quantum computing. In addition, the number of quantum bits in a quantum computer is one of the representative indicators of the performance of a quantum computer. Each quantum bit realizes the computing function through the logical function configured on demand. In view of the limited number of quantum bits, the logical functions in the field of quantum computing are diverse, such as: Hadamard gate (Hadamard gate, H gate), Pauli-X gate (X gate), Pauli-Y gate (Y gate) Pauli-Z gate (Z gate), X gate, RY gate, RZ gate, CNOT gate, CR gate, iSWAP gate, Toffoli gate, etc. During quantum computing, it is necessary to use limited quantum bits combined with a variety of logical functions to achieve the computing effect.

[0061] Based on these differences, the design of CMOS tubes by classical logic functions and the design of quantum bits by quantum logic functions are significantly and essentially different. The design of CMOS tubes by classical logic functions does not need to consider the individuality of CMOS tubes. For example, the representation of CMOS tubes in silicon chips is the individual identification, position, and usable life of each CMOS tube. Therefore, the classical algorithm composed of classical logic functions only expresses the operational relationship of the algorithm, but does not express the algorithm's dependence on individual CMOS tubes.

[0062] When quantum logic functions act on qubits, the individuality of qubits needs to be considered, such as the individual identification of the qubit in the quantum chip, its position, its relationship with surrounding qubits, and the usable time of each qubit. Therefore, the quantum algorithm composed of quantum logic functions not only expresses the computational relationship of the algorithm, but also expresses the algorithm's dependence on individual qubits.

[0063] Exemplary:

[0064] Quantum algorithm 1: H1, H2, CNOT(1,3), H3, CNOT(2,3);

[0065] Quantum Algorithm 2: H1, H2, CNOT(1,2), H3, CNOT(2,3);

[0066] Among them, 1 / 2 / 3 represent three sequentially connected quantum bits Q1, Q2, Q3 or mutually connected quantum bits Q1, Q2, Q3;

[0067] An exemplary explanation of how quantum algorithms are affected by the coherence time of qubits is as follows:

[0068] Define the execution time of a single-qubit logic gate as t, and the execution time of a two-qubit logic gate acting on adjacent bits as 2t; then:

[0069] When Q1, Q2, and Q3 are interconnected, the calculation of quantum algorithm 1 takes 6t, which is divided into 4 time periods. The duration of each time period is t, 2t, t, and 2t respectively. The operations performed in each time period are: H1, H2; CNOT(1, 3); H3; CNOT(2, 3);

[0070] The calculation of quantum algorithm 1 takes 5t, which is divided into 3 time periods. The duration of each time period is t, 2t, and 2t respectively. The operations performed in each time period are: H1, H2, H3; CNOT(1, 2); CNOT(2, 3);

[0071] When Q1, Q2, and Q3 are connected in sequence, the quantum algorithm 1 needs to be equivalent to: H1, H2; swap(1, 2), CNOT(2, 3), swap(1, 2); H3; CNOT(2, 3); the calculation of the equivalent quantum algorithm 1 requires 10t, which is divided into 4 time periods, and the duration of each time period is t, 6t, t, and 2t respectively. The operations performed in each time period are: H1, H2; swap(1, 2), CNOT(2, 3), swap(1, 2); H3; CNOT(2, 3).

[0072] Therefore, the design of the quantum logic function acting on the quantum bit (including the design of whether the quantum bit is used or not and the design of the efficiency of each quantum bit) is the key to improving the computing performance of the quantum computer, and requires special design. This is also the uniqueness of the quantum algorithm based on the quantum logic function, which is essentially and significantly different from the classical algorithm based on the classical logic function. The above-mentioned design for quantum bits is a technical problem that ordinary computing devices do not need to consider or face. The present invention proposes a ciphertext decryption method and related devices, which are conducive to decrypting ciphertext based on discrete logarithm encryption.

[0073] See also Figure 2 , Figure 2 A flowchart of a ciphertext decryption method provided in an embodiment of the present invention is applied to ciphertext based on discrete logarithm encryption, and the method includes:

[0074] Step 201: Obtain a public key and a plaintext parameter corresponding to the ciphertext, wherein the public key and the plaintext parameter are both elements in a finite field GF(p, k);

[0075] Among them, GF(2 k ) are polynomials with coefficients of 0 and 1, or more precisely, the remainder class of polynomials, where the equivalence relation is characterized by modulo division (modulo division means dividing a polynomial and taking the remainder) an irreducible polynomial of degree k. An irreducible polynomial is one that has no other polynomials as factors except 1 and the polynomial itself in the current number field.

[0076] Finite field GF(p, k) and GF(2 k ), GF(p, k) can also be described by polynomials. The difference is that the polynomial coefficients of GF(p, k) are taken from the set {0, 1, 2, ..., p-1}, where p is generally a prime number. k ), GF(p, k) also requires a k-order irreducible polynomial to be given first. For example, for GF(3, 2) with p=3, k=2, assume that the irreducible polynomial is:

[0077] x2 +x+2=0

[0078] This irreducible polynomial can be equivalently written as:

[0079] x 2 =-(x+2)=2x+1

[0080] Assuming that λ is the root of the above polynomial, all elements in GF(3,2)=GF(9) can be expressed as:

[0081] 0, λ, λ 2 =2λ+1,λ 3 =2λ+2,λ 4 =2,λ 5 =2λ,λ 6 =λ+2,λ 7 =λ+1,λ 8 =1

[0082] Or you can change the symbol:

[0083] {0, 1, 2, x, x+1, x+2, 2x, 2x+1, 2x+2}

[0084] The above elements are closed by multiplication, and all non-zero elements have inverses, forming a finite field, denoted as GF(3,2), where the number of non-zero elements is p k -1=3 2 -1=8.

[0085] Discrete logarithms are regarded as one of the three foundations of contemporary cryptography. They rely on the difficulty of calculating discrete exponents over finite fields to ensure their security. The discrete logarithm problem is: given a prime number p and a positive integer b, knowing that b = a x (mod p) to solve for x. In the encryption method based on discrete logarithms, x is the private key, a is the public key, and the plaintext parameter is b. Given a and b, it is difficult to solve for x. Even if the most efficient number field sieve method is used to decompose the binary number represented by 795 bits, it will take more than 3,000 years. The ELGamal encryption algorithm, DSA digital signature scheme, ECDSA signature algorithm, SM3 signature algorithm, identity-based cryptographic algorithm (IBE, IBS), SM9 identification cryptographic algorithm, etc. are all based on the assumption of the difficulty of discrete logarithm problems. Therefore, how to quickly crack the ciphertext based on discrete logarithm encryption in the field of traditional cryptography based on quantum circuits is a difficult problem.

[0086] Step 202: Determine the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition;

[0087] For a group, the concept of the order of an element is similar to the concept of period, that is, the smallest positive integer that can make the power of the element equal to the identity element.

[0088] Or take the irreducible polynomial as x 2 +x+2=0, taking the finite field GF(3,2) as an example, the order of element x is Ord(x)=8, and the order of element 2x+1 is Ord(2x+1)=Ord(x 2 )=4.

[0089] Among them, decomposing a square matrix A into the product of the lower triangular matrix L and the upper triangular matrix U is called LU decomposition. LUP decomposition is to add a permutation matrix P on the basis of LU decomposition. The square matrix A is first subjected to the permutation matrix to obtain AP, and then the new matrix is ​​decomposed by LU, that is, AP = LU.

[0090] Step 203: Decrypt the ciphertext based on the order of the public key in GF(p, k) and the plaintext parameters.

[0091] The problem of factoring large numbers can be transformed into the problem of finding the period of a function modulo the composite number to be factored. The discrete logarithm problem is a type of problem of factoring large numbers. Therefore, the ciphertext can be decrypted by first finding the order (i.e., period) of the public key in GF(p, k) and then using the order of the public key in GF(p, k) and the plaintext parameters.

[0092] It can be seen that the present invention obtains the public key and plaintext parameters corresponding to the ciphertext based on discrete logarithm encryption, and the public key and plaintext parameters both belong to elements in the finite field GF(p, k); then determines the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition; thereby decrypting the ciphertext based on the order of the public key in GF(p, k) and the plaintext parameters; and realizes the decryption of the ciphertext based on discrete logarithm encryption.

[0093] Optionally, determining the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition includes:

[0094] Iteratively calculate the power of the square matrix corresponding to the public key until k-1 first square matrices are obtained, where the first square matrix is ​​2 c power, where c is an integer in [2, k];

[0095] Perform LUP decomposition on the square matrix and k-1 of the first square matrices to obtain k L-type, k U-type and k P-type matrices respectively;

[0096] Constructing an order-finding quantum circuit based on k L-type matrices, k U-type matrices and k P-type matrices;

[0097] The order of the public key in GF(p, k) is determined based on the operation result of the order-finding quantum circuit.

[0098] Furthermore, before iteratively calculating the power decomposition of the square matrix corresponding to the public key, the method includes:

[0099] Determining the degree corresponding to the highest term in a preset irreducible polynomial, wherein the preset irreducible polynomial is the modulus p;

[0100] Determine a result of a modular multiplication of the public key with each term of a lower degree than that corresponding to the highest term;

[0101] A matrix corresponding to the public key is determined based on the modular multiplication result.

[0102] For example, the preset irreducible polynomial is:

[0103] f(x)=x 3 +3x 2 +x+2

[0104] Right now

[0105] x 3 =-(3x 2 +x+2)=2x 2 +4x+3

[0106] The result of modular multiplication of the public key 2x+3 with each term with a lower number than the highest term is:

[0107] (2x+3)×1mod f(x)=2x+3

[0108] (2x+3)×x mod f(x)=2x 2 +3x

[0109] (2x+3)×x 2 mod f(x) = (2x 3 +3x 2 )mod(2x 2 +4x+3)=2x 2 +3x

[0110] Translating the above expression into the language of linear algebra:

[0111] (3, 2, 0) × (1, 0, 0) = (3, 2, 0)

[0112] (3, 2, 0) × (0, 1, 0) = (0, 3, 2)

[0113] (3, 2, 0) × (0, 0, 1) = (1, 3, 2)

[0114] Putting the above four equations together we get:

[0115]

[0116] Therefore, the matrix corresponding to the public key can be determined as:

[0117]

[0118] Here, you can verify:

[0119] (2x 2 +x+4)×(2x+3)=x 2 +2x+4mod5

[0120] It can also be calculated using matrices:

[0121]

[0122] After obtaining the matrix corresponding to the public key, iteratively calculate its power, for example:

[0123]

[0124]

[0125] …

[0126] Finally, we get the matrix corresponding to the public key, the square of the matrix, the cube of the matrix... the 2 k power, a total of k first square matrices.

[0127] Furthermore, constructing an order-finding quantum circuit based on k L-type matrices, k U-type matrices and k P-type matrices comprises:

[0128] Based on each of the L-type matrices and a preset modulus operator, a quantum circuit corresponding to each of the L-type matrices is constructed; based on each of the U-type matrices and a preset modulus operator, a quantum circuit corresponding to each of the U-type matrices is constructed; and based on each of the P-type matrices and a SWAP gate, a quantum circuit corresponding to each of the P-type matrices is constructed;

[0129] Cascading each of the L-type matrices with the quantum circuits corresponding to the U-type matrix and the P-type matrix corresponding to the L-type matrix in sequence to obtain k single-term modular multiplication quantum circuits;

[0130] Cascading k of the single-term modular multiplication quantum circuits in sequence to obtain a modular multiplication quantum circuit;

[0131] The quantum Fourier transform circuit, the modular multiplication quantum circuit and the inverse quantum Fourier transform circuit are sequentially cascaded to obtain an order-finding quantum circuit.

[0132] Specifically, the modulus operator includes a modulus addition operator and a modulus multiplication operator, and the quantum circuit corresponding to each L-type matrix is ​​constructed based on each L-type matrix and a preset modulus operator, including:

[0133] Determine the non-zero elements of each row in each of the L-type matrices;

[0134] A quantum circuit corresponding to each L-type matrix is ​​constructed based on the non-zero elements of each row and the modular addition operator and the modular multiplication operator.

[0135] Specifically, the quantum circuit corresponding to each L-type matrix is ​​constructed based on the non-zero elements of each row and the modular addition operator and the modular multiplication operator, including:

[0136] Determine the diagonal non-zero elements and off-diagonal non-zero elements in each row of non-zero elements;

[0137] Determining a modular addition and modular multiplication operation circuit based on the diagonal non-zero elements and the off-diagonal non-zero elements and the modular addition operator and the modular multiplication operator, the multiplier of the modular addition and modular multiplication operation circuit is the diagonal non-zero element, the addend of the modular addition and modular multiplication operation circuit is the product of the coefficients of the off-diagonal non-zero elements and the corresponding terms of the off-diagonal non-zero elements in an arbitrary polynomial, and the modulus of the modular addition and modular multiplication operation circuit is the p;

[0138] A quantum circuit corresponding to each of the L-type matrices is constructed based on the modular addition and modular multiplication operation circuits corresponding to each row.

[0139] More specifically, for each non-zero element in a row, if the non-zero element is an element on the diagonal, multiply the element; if the non-zero element is an element off the diagonal, add the product of the element and the coefficient of the corresponding term in an arbitrary polynomial. After completing the addition and multiplication operations on all non-zero elements in the row, take the modulus of the result, and the modulus is p.

[0140] The number of data bits required is The number of auxiliary bits required depends on the modular addition operator and modular multiplication operator used. In a specific embodiment, the auxiliary bits are

[0141] For example, the L-type matrix on GF(5,3) is:

[0142]

[0143] p=5, the non-zero element in row 0 is a 00 =3, a 02=1, then the modular addition and modular multiplication operation is determined to be (×3+C) mod 5, and the logic gate corresponding to the modular addition and modular multiplication operation acts on the data bit and auxiliary bit corresponding to the first term of an arbitrary polynomial; the non-zero element in the first row is a 11 =3, a 12 =41, then the modular addition and modular multiplication operation is determined to be (×3+4C) mod 5, and the logic gate corresponding to the modular addition and modular multiplication operation acts on the second term of an arbitrary polynomial corresponding to data bits and Auxiliary bits; where an arbitrary polynomial is Cx 2 +Bx+A.

[0144] like Figure 3 As shown, Figure 3 A schematic diagram of a quantum circuit corresponding to an L-type matrix provided in an embodiment of the present invention. The quantum circuit includes 12 quantum bits, 9 of which are data bits used to encode an arbitrary polynomial Cx 2 +Bx+A corresponds to the quantum state, for example, the quantum state corresponding to A is |a2>|a1>|a0>, the quantum state corresponding to B is |b2>|b1>|b0>, and the quantum state corresponding to C is |c2>|c1>|c0>. The other 4 are auxiliary bits, and the corresponding quantum states are |aux3>|aux2>|aux1>|aux0>, which are used to assist modular addition and modular multiplication operations. The initial quantum states of the 4 quantum bits are |0>|0>|0>|0), and they will be reset to 0 after completing one operation for the next operation.

[0145] The quantum logic gate corresponding to (×3+C)mod 5 acts on the quantum bits corresponding to |a2>|a1>|a0> and |aux3>|aux2>|aux1>|aux0>, and the quantum logic gate corresponding to (×3+4C)mod 5 acts on the quantum bits corresponding to |b2>|b1>|b0> and |aux3>|aux2>|aux1>|aux0>.

[0146] The specific implementation process of the quantum circuit corresponding to the U-type matrix is ​​similar to the specific implementation process of the quantum circuit corresponding to the L-type matrix, except that one is an upper triangular matrix and the other is a lower triangular matrix. Please refer to the specific implementation process of the quantum circuit corresponding to the above L-type matrix, which will not be repeated here.

[0147] In one of the embodiments provided by the present invention, the quantum circuit corresponding to each P-type matrix is ​​constructed based on each P-type matrix and the SWAP gate, and the dimension of the P-type matrix is ​​k×k, including:

[0148] The quantum state of the k qubits corresponding to the number of rows is transferred to the quantum state of the k qubits corresponding to the number of columns, and the non-zero elements a except the diagonal in each of the P-type matrices are determined. mn , m and n are the number of rows and columns of the P-type matrix respectively;

[0149] The SWAP gate is applied to the mth quantum bit among the k quantum bits corresponding to the number of rows and the nth quantum bit among the k quantum bits corresponding to the number of columns to obtain a quantum circuit corresponding to each of the P-type matrices.

[0150] Furthermore, the step of transferring the quantum state of the k qubits corresponding to the number of rows to the quantum state of the k qubits corresponding to the number of columns includes:

[0151] The SWAP gate is applied to the qubits corresponding to the row number and the qubits corresponding to the column number with the same serial number, that is, k qubits corresponding to both the row number and the column number.

[0152] For example, Figure 4 As shown, Figure 4 A schematic diagram of a quantum circuit structure corresponding to a P-type matrix provided in an embodiment of the present invention. If t=4, the quantum circuit includes four quantum bits corresponding to the number of rows: q Line0 ,q Line1 ,q Line2 ,q Line3 , the number of columns corresponds to the four quantum bits: q Row0 ,q Row1 ,q Row2 ,q Row3 . You can first use SWAP(q Line0 ,q Row0 )、SWAP(q Line1 ,q Row1 )、SWAP(q Line2 ,q Row2 )、SWAP(q Line3 ,q Row3 ) transfers the quantum state of the qubit corresponding to the row number to the quantum state of the qubit corresponding to the column number. Here, the four SWAP gates act on different qubits, so their action sequence is not affected. Figure 4 Just one example.

[0153] If the P-type matrix is:

[0154]

[0155] Then the non-zero elements have a 01 、a 12 、a 23 、a 30 , so there exists SWAP(qLine0 ,q Row1 )、SWAP(q Line1 ,q Row2 )、SWAP(q Line2 ,q Row3 )、SWAP(q Line3 ,q Row0 ). Similarly, the four SWAP gates act on different quantum bits, so it does not affect their timing. Figure 4 Just one example.

[0156] In another embodiment provided by the present invention, the step of constructing a quantum circuit corresponding to each P-type matrix based on each P-type matrix and a SWAP gate includes:

[0157] Determine the non-zero elements a in each of the P-type matrices except the diagonal mn ;

[0158] If m is less than n, the SWAP gate is applied to the mth and nth qubits;

[0159] If m is greater than n, determine the non-zero element a m′n′ , and apply the SWAP gate to the mth and n′th qubits, m′ is less than m, and n′ is greater than m;

[0160] If m is equal to n or n′, no operation is performed;

[0161] The quantum circuit corresponding to each of the P-type matrices is determined.

[0162] For example, Figure 5 As shown, Figure 5 A schematic diagram of the structure of a quantum circuit corresponding to another P-type matrix provided in an embodiment of the present invention.

[0163] If the P-type matrix is:

[0164]

[0165] The non-zero elements are a 03 、a 10 、a 21 、a 32 , for non-zero elements a 03 , 0<3, then the SWAP gate acts on the 0th and 3rd quantum bits (q0 and q3); for non-zero elements a 10 , 1>0, then search upward to get a 03 , m=1>m′=0 and n′=3>m=1, apply the SWAP gate to the first and third qubits (q1 and q3); similarly, for the non-zero element a 21, apply the SWAP gate to the second and third qubits (q2 and q3); for non-zero elements a 32 , no operation is performed; after all non-zero elements are traversed, the quantum circuit corresponding to the P-type matrix is ​​determined.

[0166] It can be seen that in the embodiment of the present invention, the number of qubits required is k, which is less than the number of qubits required in the previous embodiment, 2k. The previous embodiment involves less computational complexity in classical calculations, and the logic is more direct, but the number of qubits called is larger. The advantages and disadvantages of the embodiment of the present invention are opposite to those of the previous embodiment.

[0167] It should be noted that the maximum value of the elements in the L-type and U-type matrices is p-1, so each element needs data bits represent that for k×k L-type and U-type matrices, the corresponding quantum circuits need data bits; since all elements in the P-type matrix are 1, each element requires 1 data bit to represent. For a k×k P-type matrix, its corresponding quantum circuit requires k or 2k data bits; when cascading, the P-type matrix can be expanded to A quantum circuit with 100 data bits, that is, data bits represent one element.

[0168] Through the above embodiments, a quantum circuit corresponding to each L-type, U-type and P-type matrix can be constructed, and then each L-type matrix and the quantum circuits corresponding to its corresponding U-type matrix and P-type matrix are cascaded in sequence to obtain k single-item modular multiplication quantum circuits; the k single-item modular multiplication quantum circuits are cascaded in sequence to obtain a modular multiplication quantum circuit; the quantum Fourier transform circuit, the modular multiplication quantum circuit and the inverse quantum Fourier transform circuit are cascaded in sequence to obtain an order-finding quantum circuit.

[0169] like Figure 6 As shown, Figure 6 A schematic diagram of a quantum circuit for finding an order provided by an embodiment of the present invention. The quantum circuit for finding an order includes three registers, the first register includes data bits are used to store the elements in GF(p, k). Since the elements in the finite field GF(p, k) come from {0, 1, ..., p-1}, each element in GF(p, k) needs data bits to store.

[0170] The second register is used as a control bit to control whether to execute the quantum operation corresponding to the matrix. Since there are k matrix operations, the data bit corresponding to each matrix operation is Therefore, it is necessary The first auxiliary bit.

[0171] In this embodiment, the third register includes The second auxiliary bits are used to assist in the modulus operation. Different embodiments use different numbers of second auxiliary bits, which are determined based on the modulus operation.

[0172] Except for the lowest bit of data whose initial quantum state is |1>, the other bits The initial quantum state of the quantum bit is |0>, The first auxiliary bit and The initial quantum states of the second auxiliary bits are all |0>.

[0173] Among them, the square matrix corresponding to the public key a is A1, and the first square matrix is ​​A2, A3...A k-1 , A k , the quantum circuit corresponding to matrix A is Mat A, and the quantum circuits corresponding to the first matrix are MatA2, MatA3,...Mat A k-1 Mat A k , each square matrix or the quantum circuit corresponding to the first square matrix is ​​controlled by the corresponding first auxiliary bit.

[0174] The order-finding quantum circuit also includes a quantum Fourier transform operation and a quantum inverse Fourier transform operation. The quantum Fourier transform operation includes an H gate acting on each first auxiliary bit, and the quantum inverse Fourier transform operation acts on The first auxiliary bit.

[0175] Optionally, determining the order of the public key in GF(p, k) based on the operation result of the order-finding quantum circuit includes:

[0176] The results of the operation of the quantum circuit for finding the order based on the continued fraction algorithm are similar to those of 2 f Expand the quotient to obtain at least one score, and the operation result is encoded with f quantum bits;

[0177] The order of the public key in GF(p, k) is determined from the denominator of at least one term of the fraction.

[0178] For example, Figure 6 The f qubits in the first register of the Fourier transform are measured to obtain a bit string of length f, which is converted into a decimal number λ. Here, It should be noted that, during the conversion process, the side that controls the higher-order operator is regarded as the digital high bit, and the other side is regarded as the digital low bit.

[0179] Compute using the continued fraction algorithm:

[0180]

[0181] The calculation process can be stopped at a preset number of iterations or at a preset accuracy, and then at least one score can be obtained:

[0182]

[0183] The order of the public key in GF(p, k) is determined from the denominator of at least one of the fractions, that is, the denominator a1, a2, etc. of the at least one fraction is used to verify whether it is the order of the element. According to mathematical theorems, it can be guaranteed that when the number of control bits f>2·[log2N+1], there is a probability of O(1) that the correct period can be read in any measurement, where [] indicates rounding, and N indicates the order of GF(p, k), that is, the number of elements in the group.

[0184] Optionally, decrypting the ciphertext based on the order of the public key in GF(p, k) and the plaintext parameter includes:

[0185] Determining the number of quantum bits required to construct a target quantum circuit for solving a private key corresponding to the ciphertext based on the logarithm of the order of the public key in GF(p, k);

[0186] Constructing the target quantum circuit based on the number of quantum bits required by the target quantum circuit;

[0187] Determining a private key corresponding to the ciphertext based on the operation result of the target quantum circuit;

[0188] The ciphertext is decrypted based on the private key.

[0189] In general, if the order of the public key in GF(p, k) is r, then the number of control bits and data bits required in the target quantum circuit is equal to If the target quantum circuit is constructed directly without using the method in the embodiment of the present invention, the number of control bits and data bits required is The order r of the public key must be smaller than the order p of GF(p, k), thereby reducing the number of quantum bits and effectively saving hardware resources.

[0190] The order-finding quantum circuit in the above embodiment and the target quantum circuit in this embodiment can be run on a quantum computing unit, which can be on a quantum computer or a quantum virtual machine. The classical computing unit sends the quantum circuit to the quantum computing unit, which excites the quantum bits in the quantum circuit to an initial state, and then applies corresponding analog signals to the quantum bits based on the quantum logic gates in the quantum circuit to make the initial state of the quantum bits evolve, and finally applies analog signals to measure the quantum bits to determine the operation results of the quantum circuit, and feeds the results back to the classical computing unit.

[0191] The quantum computing unit executes the quantum circuit for a specified number of times. The measured operation result can be in the form of an array or a binary bit string. For example, in the form of an array, for two quantum bits and 1024 execution times, the measurement results can be "00": 251, "01": 213, "10": 260, "11": 300, where "00", "01", "10", "11" are the measured quantum states, and "251, 213, 260, 300" are the times corresponding to the measured quantum states. For example, in the form of a binary bit string, for 2 quantum bits and 1 execution time, "11" is the measured quantum state.

[0192] To determine the private key corresponding to the ciphertext based on the running result, and to decrypt the ciphertext based on the private key, you can refer to the patent document with application number "202111365914.4" and invention name "Ciphertext decryption method and related equipment"; or refer to the patent document with application number "202111365902.1" and invention name "Ciphertext decryption method and related equipment".

[0193] The present invention proposes a ciphertext decryption device, which is applied to ciphertext based on discrete logarithm encryption, see Figure 7 , Figure 7 A schematic diagram of the structure of a ciphertext decryption device provided in an embodiment of the present invention, the device comprising:

[0194] An acquisition unit 701 is used to acquire a public key and a plaintext parameter corresponding to the ciphertext, wherein the public key and the plaintext parameter are both elements in a finite field GF(p, k);

[0195] A determining unit 702 is used to determine the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition;

[0196] The decryption unit 703 is used to decrypt the ciphertext based on the order of the public key in GF(p, k) and the plaintext parameter.

[0197] The specific functions and effects achieved by the ciphertext decryption device can be explained in reference to other embodiments of this specification, and will not be repeated here. Each module in the ciphertext decryption device can be implemented in whole or in part by software, hardware, and a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0198] See also Figure 8 The present specification also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the ciphertext decryption method in any of the above embodiments when executing the computer program. Figure 8 , the computer device may be a classical computer. The computer device may also be a quantum computer.

[0199] The embodiments of the present specification also provide a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a computer, the computer executes the ciphertext decryption method in any of the above embodiments.

[0200] The embodiments of this specification also provide a computer program product including instructions, which, when executed by a computer, enables the computer to execute the ciphertext decryption method in any of the above embodiments.

[0201] It should be understood that the specific examples in this specification are only intended to help those skilled in the art to better understand the implementation methods of this specification, rather than to limit the scope of the present invention.

[0202] It can be understood that in the various implementations of this specification, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the implementation methods of this specification.

[0203] It can be understood that the various embodiments described in this specification can be implemented individually or in combination, and the embodiments of this specification are not limited to this.

[0204] Unless otherwise specified, all technical and scientific terms used in the embodiments of this specification have the same meaning as those generally understood by those skilled in the art of the technical field of this specification. The terms used in this specification are only for the purpose of describing specific embodiments and are not intended to limit the scope of this specification. The term "and / or" used in this specification includes any and all combinations of one or more related listed items. The singular forms of "a", "above", and "the" used in the embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0205] It can be understood that the processor of the embodiment of this specification can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method implementation can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiment of this specification can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of this specification can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0206] It is understood that the memory in the embodiments of this specification may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (programmable ROM, PROM), an erasable programmable read-only memory (erasablePROM, EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory may be a random access memory (RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0207] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this specification.

[0208] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method implementation methods and will not be repeated here.

[0209] In the several embodiments provided in this specification, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0210] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0211] In addition, each functional unit in each embodiment of the present specification may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0212] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this specification, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of this specification. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0213] The above is only a specific implementation of this specification, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in this specification, which should be included in the protection scope of this specification. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A ciphertext decryption method, characterized in that: Applied to ciphertext based on discrete logarithm encryption, the method comprises: Obtain a public key and a plaintext parameter corresponding to the ciphertext, wherein the public key and the plaintext parameter both belong to an element in a finite field GF(p, k); Determine the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition; The ciphertext is decrypted based on the order of the public key in GF(p, k) and the plaintext parameter.

2. The method according to claim 1, characterized in that The step of determining the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition comprises: Iteratively calculate the power of the square matrix corresponding to the public key until k-1 first square matrices are obtained, where the first square matrix is ​​2 c power, where c is an integer in [2, k]; Perform LUP decomposition on the square matrix and k-1 of the first square matrices to obtain k L-type, k U-type and k P-type matrices respectively; Constructing an order-finding quantum circuit based on k L-type matrices, k U-type matrices and k P-type matrices; The order of the public key in GF(p, k) is determined based on the operation result of the order-finding quantum circuit.

3. The method according to claim 2, characterized in that The step of determining the order of the public key in GF(p, k) based on the operation result of the order-finding quantum circuit comprises: The results of the operation of the quantum circuit for finding the order based on the continued fraction algorithm are similar to those of 2 f Expand the quotient to obtain at least one score, and the operation result is encoded with f quantum bits; The order of the public key in GF(p, k) is determined from the denominator of at least one of the fractions.

4. The method according to claim 2 or 3, characterized in that The step of constructing an order-finding quantum circuit based on k L-type matrices, k U-type matrices and k P-type matrices comprises: Based on each of the L-type matrices and a preset modulus operator, a quantum circuit corresponding to each of the L-type matrices is constructed; based on each of the U-type matrices and a preset modulus operator, a quantum circuit corresponding to each of the U-type matrices is constructed; and based on each of the P-type matrices and a SWAP gate, a quantum circuit corresponding to each of the P-type matrices is constructed; Cascading each of the L-type matrices with the quantum circuits corresponding to the U-type matrix and the P-type matrix corresponding to the L-type matrix in sequence to obtain k single-term modular multiplication quantum circuits; Cascading k of the single-term modular multiplication quantum circuits in sequence to obtain a modular multiplication quantum circuit; The quantum Fourier transform circuit, the modular multiplication quantum circuit and the inverse quantum Fourier transform circuit are sequentially cascaded to obtain an order-finding quantum circuit.

5. The method according to claim 4, characterized in that The modulus operator includes a modulus addition operator and a modulus multiplication operator, and the quantum circuit corresponding to each L-type matrix is ​​constructed based on each L-type matrix and a preset modulus operator, including: Determine the non-zero elements of each row in each of the L-type matrices; A quantum circuit corresponding to each L-type matrix is ​​constructed based on the non-zero elements of each row and the modular addition operator and the modular multiplication operator.

6. The method according to claim 5, characterized in that The step of constructing a quantum circuit corresponding to each of the P-type matrices based on each of the P-type matrices and the SWAP gates includes: Determine the non-zero elements a in each of the P-type matrices except the diagonal mn ; If m is less than n, the SWAP gate is applied to the mth and nth qubits; If m is greater than n, determine the non-zero element a m′n′ , and apply the SWAP gate to the mth and n′th qubits, m′ is less than m, and n′ is greater than m; If m is equal to n or n′, no operation is performed; The quantum circuit corresponding to each of the P-type matrices is determined.

7. The method according to claim 1, characterized in that The decrypting the ciphertext based on the order of the public key in GF(p, k) and the plaintext parameter comprises: Determining the number of quantum bits required to construct a target quantum circuit for solving a private key corresponding to the ciphertext based on the logarithm of the order of the public key in GF(p, k); Constructing the target quantum circuit based on the number of quantum bits required by the target quantum circuit; Determining a private key corresponding to the ciphertext based on the operation result of the target quantum circuit; The ciphertext is decrypted based on the private key.

8. A ciphertext decryption device, characterized in that: Applied to ciphertext based on discrete logarithm encryption, the device comprises: An acquisition unit, used to acquire a public key and a plaintext parameter corresponding to the ciphertext, wherein the public key and the plaintext parameter are both elements in a finite field GF(p, k); A determining unit, configured to determine the order of the public key in GF(p, k) based on the public key and LUP matrix decomposition; A decryption unit is used to decrypt the ciphertext based on the order of the public key in GF(p, k) and the plaintext parameter.

9. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 7 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.

Images