Ciphertext decryption method and related apparatus

Abstract

The application discloses a ciphertext decryption method and related devices, the method obtains the public key and plaintext parameters corresponding to the ciphertext based on discrete logarithm encryption, the public key and plaintext parameters belong to the elements in the finite field GF(p, k); then the order of the public key in GF(p, k) is determined based on the public key and LUP matrix decomposition; and the ciphertext is decrypted based on the order of the public key in GF(p, k) and the plaintext parameters; the ciphertext based on discrete logarithm encryption is decrypted.

Description

Technical Field

[0001] This invention belongs to the field of quantum computing technology, specifically a method and device for decrypting encrypted text. Background Technology

[0002] A quantum computer is a physical device that performs high-speed mathematical and logical operations, stores and processes quantum information in accordance with the laws of quantum mechanics. When a device processes and calculates quantum information and runs quantum algorithms, it is a quantum computer. Because of its ability to process mathematical problems more efficiently than ordinary computers—for example, reducing the time to crack keys from hundreds of years to hours—quantum computers have become a key technology under research.

[0003] Finite fields, also known as Galois fields (GF), are a crucial concept in many disciplines, including abstract algebra and cryptography. Taking cryptography as an example, the discrete logarithm problem over finite fields is one of the two core difficult problems in classical public-key cryptography. Therefore, decrypting ciphertext encrypted using discrete logarithms has been a persistent and challenging problem. Summary of the Invention

[0004] The purpose of this invention is to provide a method and related apparatus for decrypting ciphertext, enabling the decryption of ciphertext based on discrete logarithm encryption.

[0005] One embodiment of the present invention provides a ciphertext decryption method applied to ciphertext encrypted based on discrete logarithm encryption, the method comprising:

[0006] Obtain the public key and plaintext parameters corresponding to the ciphertext, wherein both the public key and plaintext parameters are elements in the finite field GF(p,k);

[0007] The order of the public key in GF(p,k) is determined based on the public key and LUP matrix decomposition;

[0008] The ciphertext is decrypted based on the order of the public key in GF(p,k) and the plaintext parameters.

[0009] Optionally, determining the order of the public key in GF(p,k) based on the public key and LUP matrix decomposition includes:

[0010] Iteratively calculate the powers of the square matrix corresponding to the public key until k-1 first square matrices are obtained, where each first square matrix is ​​a power of 2^k of the square matrix. c The power is given by the power of c, where c is an integer in [2, k].

[0011] Perform LUP decomposition on the square matrix and k-1 of the first square matrices to obtain k L-type, k U-type and k P-type matrices respectively;

[0012] Construct a quantum circuit for order calculation based on k L-type matrices, k U-type matrices, and k P-type matrices;

[0013] The order of the public key in GF(p,k) is determined based on the operation results of the quantum circuit for order determination.

[0014] Optionally, determining the order of the public key in GF(p,k) based on the operation result of the order-finding quantum circuit includes:

[0015] The results of the operation of the quantum circuit for order calculation based on the continued fraction algorithm are compared with 2. f The quotient is expanded to obtain at least one fraction, and the result is encoded using f qubits;

[0016] The order of the public key in GF(p,k) is determined from the denominator of at least one of the fractions.

[0017] Optionally, the step of constructing an order-finding quantum circuit based on k L-type matrices, k U-type matrices, and k P-type matrices includes:

[0018] Quantum circuits corresponding to each L-type matrix are constructed based on each L-type matrix and a preset modular analog-to-digital converter; quantum circuits corresponding to each U-type matrix are constructed based on each U-type matrix and a preset modular analog-to-digital converter; and quantum circuits corresponding to each P-type matrix are constructed based on each P-type matrix and a SWAP gate.

[0019] Each L-type matrix is ​​sequentially cascaded with the quantum circuits corresponding to the U-type matrix and P-type matrix of the L-type matrix to obtain k single-term modular multiplication quantum circuits.

[0020] By cascading k of the aforementioned single-term modular multiplication quantum circuits in sequence, a modular multiplication quantum circuit is obtained;

[0021] By cascading the quantum Fourier transform circuit, the modular multiplication quantum circuit, and the inverse quantum Fourier transform circuit in sequence, an order-finding quantum circuit is obtained.

[0022] Optionally, the modular multiplication unit includes a modular addition unit and a modular multiplication unit, and the construction of the quantum circuit corresponding to each L-type matrix based on each L-type matrix and the preset modular multiplication unit includes:

[0023] Determine the non-zero elements in each row of each L-shaped matrix;

[0024] Based on the non-zero elements of each row, the modular addition and modular multiplication operators are used to construct the quantum circuit corresponding to each L-type matrix.

[0025] Optionally, constructing the quantum circuit corresponding to each P-type matrix based on each P-type matrix and the SWAP gate includes:

[0026] Determine the non-zero element a in each of the P-type matrices, excluding the diagonal elements. mn ;

[0027] If m is less than n, then the SWAP gate is applied to the m-th and n-th qubits;

[0028] If m is greater than n, then determine the non-zero element a. m′n′ And apply the SWAP gate to the m-th and n′-th qubits, where m′ is less than m and n′ is greater than m;

[0029] If m equals n or n′, then no operation is performed;

[0030] Determine the quantum circuit corresponding to each of the P-type matrices.

[0031] Optionally, the step of decrypting the ciphertext based on the order of the public key in GF(p,k) and the plaintext parameters includes:

[0032] The number of qubits required to construct the target quantum circuit for solving the private key corresponding to the ciphertext is determined based on the logarithm of the order of the public key in GF(p,k).

[0033] Construct the target quantum circuit based on the number of qubits required for the target quantum circuit;

[0034] The private key corresponding to the ciphertext is determined based on the operation result of the target quantum circuit;

[0035] The ciphertext is decrypted based on the private key.

[0036] Another embodiment of the present invention provides a ciphertext decryption device applied to ciphertext encrypted based on discrete logarithm encryption, the device comprising:

[0037] The acquisition unit is used to acquire the public key and plaintext parameters corresponding to the ciphertext, wherein the public key and plaintext parameters are elements in the finite field GF(p,k);

[0038] A determining unit is configured to determine the order of the public key in GF(p,k) based on the public key and LUP matrix decomposition;

[0039] The decryption unit is used to decrypt the ciphertext based on the order of the public key in GF(p,k) and the plaintext parameters.

[0040] Another embodiment of the present invention provides a storage medium storing a computer program, wherein the computer program is configured to execute the method described in any of the preceding claims when running.

[0041] Another embodiment of the present invention provides an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the method described in any of the preceding claims.

[0042] As can be seen, this invention obtains the public key and plaintext parameters corresponding to the ciphertext based on discrete logarithm encryption, where both the public key and plaintext parameters are elements in the finite field GF(p,k); then, based on the public key and LUP matrix decomposition, the order of the public key in GF(p,k) is determined; thereby, the ciphertext is decrypted based on the order of the public key in GF(p,k) and the plaintext parameters; thus, the decryption of ciphertext based on discrete logarithm encryption is achieved. Attached Figure Description

[0043] Figure 1 A network block diagram of a ciphertext decryption system provided in an embodiment of the present invention;

[0044] Figure 2 A flowchart illustrating a method for decrypting ciphertext provided in an embodiment of the present invention;

[0045] Figure 3 This is a schematic diagram of the structure of a quantum circuit corresponding to an L-shaped matrix, provided in an embodiment of the present invention.

[0046] Figure 4 This is a schematic diagram of the structure of a quantum circuit corresponding to a P-type matrix provided in an embodiment of the present invention;

[0047] Figure 5 This is a schematic diagram of the structure of a quantum circuit corresponding to another P-type matrix provided in an embodiment of the present invention;

[0048] Figure 6 This is a schematic diagram of the structure of a quantum circuit for order determination provided in an embodiment of the present invention;

[0049] Figure 7 This is a schematic diagram of the structure of a ciphertext decryption device provided in an embodiment of the present invention;

[0050] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0051] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0052] Figure 1 This is a network block diagram of a ciphertext decryption system provided in an embodiment of the present invention. The ciphertext decryption system may include a network 110, a server 120, a wireless device 130, a client 140, storage 150, a classical computing unit 160, a quantum computing unit 170, and may also include additional memory, a classical processor, a quantum processor, and other devices not shown.

[0053] Network 110 is a medium used to provide communication links between various devices and computers connected together within a ciphertext decryption system, including but not limited to the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The connection method can be wired, wireless communication links, or fiber optic cables.

[0054] Server 120, wireless device 130, and client 140 are conventional data processing systems that may contain data and application programs or software tools that perform conventional computational processes. Client 140 may be a personal computer or a network computer, so the data may also be provided by server 120. Wireless device 130 may be a smartphone, tablet, laptop, smart wearable device, etc. Storage unit 150 may include database 151, which can be configured to store data such as qubit parameters, quantum logic gate parameters, quantum circuits, and quantum programs.

[0055] The classical computing unit 160 (quantum computing unit 170) may include a classical processor 161 (quantum processor 171) for processing classical data (quantum data) and a memory 162 (memory 172) for storing classical data (quantum data). The classical data (quantum data) may be a boot file, an operating system image, and an application program 163 (application program 173). The application program 163 (application program 173) may be used to implement a quantum algorithm compiled by the ciphertext decryption method provided in the embodiments of the present invention.

[0056] Any data or information stored or generated in the classical computing unit 160 (quantum computing unit 170) can also be configured to be stored or generated in another classical (quantum) processing system in a similar manner, and any application executed therein can also be configured to be executed in another classical (quantum) processing system in a similar manner.

[0057] It should be noted that a true quantum computer has a hybrid structure, which includes at least... Figure 1 The system consists of two main parts: the classical computing unit 160, which is responsible for performing classical calculations and control; and the quantum computing unit 170, which is responsible for running quantum programs to achieve quantum computing.

[0058] The aforementioned classical computing unit 160 and quantum computing unit 170 can be integrated into a single device or distributed across two different devices. For example, a first device including the classical computing unit 160 runs a classical computer operating system, providing quantum application development tools and services, as well as the storage and network services required for quantum applications. Users develop quantum programs using the quantum application development tools and services on the second device, and send these quantum programs to a second device including the quantum computing unit 170 via the network services. The second device runs a quantum computer operating system, which parses and compiles the quantum program's code into instructions that the quantum processor 170 can recognize and execute. The quantum processor 170 then implements the quantum algorithm corresponding to the quantum program based on these instructions.

[0059] The computing units of the classic processor 161 within the classic computing unit 160 are based on CMOS transistors on a silicon chip. These computing units are not limited by time or coherence; that is, they are available at any time without time constraints. Furthermore, the number of such computing units in a silicon chip is sufficient; currently, a single classic processor 161 contains tens of thousands of computing units. Given this sufficient number of computing units and the fixed selectable computing logic of the CMOS transistors (e.g., AND logic), computational performance is achieved by combining a large number of CMOS transistors with a limited set of logic functions during operation.

[0060] In the quantum computing unit 170, the basic computing unit of the quantum processor 171 is the qubit. The input of a qubit is limited by coherence and coherence time; that is, a qubit is limited by its available usage time and is not always readily available. Making full use of qubits within their available usage time is a key challenge in quantum computing. Furthermore, the number of qubits in a quantum computer is one of the representative indicators of its performance. Each qubit performs computational functions through on-demand configured logical functions. Given the limited number of qubits and the diverse logical functions available in quantum computing, such as Hadamard gates (H gates), Pauli-X gates (X gates), Pauli-Y gates (Y gates), Pauli-Z gates (Z gates), X gates, RY gates, RZ gates, CNOT gates, CR gates, iSWAP gates, Tofoli gates, etc., quantum computing requires combining a limited number of qubits with diverse logical function combinations to achieve computational effects.

[0061] Based on these differences, the design of classical logic functions applied to CMOS transistors and the design of quantum logic functions applied to qubits are significantly and fundamentally different. The design of classical logic functions applied to CMOS transistors does not need to consider the individuality of CMOS transistors. For example, the representation of a CMOS transistor in a silicon chip is its individual identifier, location, and usable time of each CMOS transistor. Therefore, classical algorithms composed of classical logic functions only express the operational relationship of the algorithm, not the algorithm's dependence on individual CMOS transistors.

[0062] Quantum logic functions applied to qubits need to consider the individuality of each qubit, such as its position within the quantum chip, its relationship with surrounding qubits, and the duration of its usable time. Therefore, quantum algorithms composed of quantum logic functions not only express the computational relationships within the algorithm but also its dependence on the individual qubits.

[0063] For example:

[0064] Quantum Algorithm 1: H1, H2, CNOT(1,3), H3, CNOT(2,3);

[0065] Quantum Algorithm 2: H1, H2, CNOT(1,2), H3, CNOT(2,3);

[0066] Where 1 / 2 / 3 represent three sequentially connected qubits Q1, Q2, Q3 or interconnected qubits Q1, Q2, Q3, respectively;

[0067] An exemplary explanation of how quantum algorithms are affected by the coherence time of qubits is as follows:

[0068] Define the execution time of a single-qubit logic gate as t, and the execution time of two single-qubit logic gates operating on adjacent qubits as 2t; then:

[0069] When Q1, Q2, and Q3 are interconnected, the computation of Quantum Algorithm 1 requires 6t, which is divided into 4 time periods. The duration of each time period is t, 2t, t, and 2t, respectively. The operations performed in each time period are: H1, H2; CNOT(1,3); H3; CNOT(2,3);

[0070] The computation of Quantum Algorithm 1 requires 5t, which is divided into 3 time periods. The duration of each time period is t, 2t, and 2t respectively. The operations performed in each time period are: H1, H2, H3; CNOT(1,2); CNOT(2,3);

[0071] When Q1, Q2, and Q3 are connected sequentially, Quantum Algorithm 1 needs to be equivalent to: H1, H2; swap(1,2), CNOT(2,3), swap(1,2); H3; CNOT(2,3). The computation of the equivalent Quantum Algorithm 1 requires 10t, divided into 4 time periods, with each time period requiring durations of t, 6t, t, and 2t respectively. The operations performed in each time period are: H1, H2; swap(1,2), CNOT(2,3), swap(1,2); H3; CNOT(2,3).

[0072] Therefore, the application of quantum logic functions in the design of qubits (including the design of whether qubits are used and the design of the efficiency of each qubit) is key to improving the computational performance of quantum computers and requires special design. This is the unique characteristic of quantum algorithms implemented based on quantum logic functions, and is fundamentally and significantly different from classical algorithms implemented based on classical logic functions. The aforementioned design considerations for qubits are technical problems that ordinary computing devices do not need to consider or address. This invention proposes a ciphertext decryption method and related apparatus, which is beneficial for decrypting ciphertext based on discrete logarithm encryption.

[0073] See Figure 2 , Figure 2 This is a flowchart illustrating a ciphertext decryption method provided in an embodiment of the present invention, applied to ciphertext encrypted based on discrete logarithm encryption. The method includes:

[0074] Step 201: Obtain the public key and plaintext parameters corresponding to the ciphertext, wherein the public key and plaintext parameters are elements in the finite field GF(p,k);

[0075] Among them, GF(2) k The elements in the polynomial are polynomials with coefficients consisting of 0 and 1. More precisely, they are residue classes composed of polynomials. The equivalence relations within these polynomials are characterized by modularly dividing (modular division means taking the remainder of a polynomial) an irreducible polynomial of degree k. An irreducible polynomial is one that, in the current number field, has no other polynomials as factors besides 1 and the polynomial itself.

[0076] Finite field GF(p,k) and GF(2 k Similarly, GF(p, k) can also be characterized using polynomials, the difference being that the polynomial coefficients of GF(p, k) are taken from the set {0, 1, 2, ..., p-1}, where p is generally a prime number. This is similar to constructing GF(2... k Similarly, GF(p, k) also requires a given irreducible polynomial of degree k. For example, for GF(3, 2) with p = 3 and k = 2, the irreducible polynomial is assumed to be:

[0077] x2 +x+2=0

[0078] This irreducible polynomial can be equivalently written as:

[0079] x 2 =-(x+2)=2x+1

[0080] Assuming λ is a root of the polynomial above, then all elements in GF(3,2)=GF(9) can be represented as:

[0081] 0, λ, λ 2 =2λ+1,λ 3 =2λ+2,λ 4 =2,λ 5 =2λ,λ 6 =λ+2,λ 7 =λ+1,λ 8 =1

[0082] Alternatively, you could use a different symbol:

[0083] {0, 1, 2, x, x+1, x+2, 2x, 2x+1, 2x+2}

[0084] The elements described above are multiplicative closed, and all non-zero elements have inverses, forming a finite field denoted as GF(3,2), where the number of non-zero elements is p. k -1 = 3 2 -1 = 8.

[0085] Discrete logarithms are considered one of the three fundamental disciplines of modern cryptography, their security relying on the computationally incomputable nature of discrete exponents over finite fields. The discrete logarithm problem is: given a prime number p and a positive integer b, know that b = a... x Find the value of (mod p) and solve for x. In discrete logarithm-based encryption methods, x is the private key, a is the public key, and b is the plaintext parameter. Given a and b, it is very difficult to solve for x. Even using the most efficient number field sieve method to factor a 795-bit binary number would take over 3000 years. Algorithms such as ELGamal encryption, DSA digital signature scheme, ECDSA signature algorithm, SM3 signature algorithm, identity-based cryptography (IBE, IBS), and SM9 identity cryptography are all based on the assumption of the discrete logarithm difficulty problem. Therefore, how to achieve fast cracking of ciphertext encrypted using discrete logarithm encryption in traditional cryptography using quantum circuits remains a challenging problem.

[0086] Step 202: Determine the order of the public key in GF(p,k) based on the public key and LUP matrix decomposition;

[0087] For a group, the concept of the order of its elements is similar to the concept of period, that is, the smallest positive integer that makes the power of the element equal to the identity element.

[0088] Let x be the irreducible polynomial. 2 Taking the finite field GF(3,2) as an example, if x + 2 = 0, then the order of element x is Ord(x) = 8, and the order of element 2x + 1 is Ord(2x + 1) = Ord(x + 2). 2 =4.

[0089] Decomposing a square matrix A into the product of a lower triangular matrix L and an upper triangular matrix U is called LU decomposition. LUP decomposition is based on LU decomposition by adding a permutation matrix P. The square matrix A is first subjected to the permutation matrix to obtain AP, and then the new matrix is ​​decomposed into LU, i.e., AP = LU.

[0090] Step 203: Decrypt the ciphertext based on the order of the public key in GF(p,k) and the plaintext parameters.

[0091] The problem of factoring large numbers can be transformed into a periodic problem of a function modulo the composite number to be factored. The discrete logarithm problem is a type of factoring problem of large numbers. Therefore, the ciphertext can be decrypted by first finding the order (i.e., period) of the public key in GF(p,k) and then using the order of the public key in GF(p,k) and the plaintext parameters.

[0092] As can be seen, this invention obtains the public key and plaintext parameters corresponding to the ciphertext based on discrete logarithm encryption, where both the public key and plaintext parameters are elements in the finite field GF(p,k); then, based on the public key and LUP matrix decomposition, the order of the public key in GF(p,k) is determined; thereby, the ciphertext is decrypted based on the order of the public key in GF(p,k) and the plaintext parameters; thus, the decryption of ciphertext based on discrete logarithm encryption is achieved.

[0093] Optionally, determining the order of the public key in GF(p,k) based on the public key and LUP matrix decomposition includes:

[0094] Iteratively calculate the powers of the square matrix corresponding to the public key until k-1 first square matrices are obtained, where each first square matrix is ​​a power of 2^k of the square matrix. c The power is given by the power of c, where c is an integer in [2, k].

[0095] Perform LUP decomposition on the square matrix and k-1 of the first square matrices to obtain k L-type, k U-type and k P-type matrices respectively;

[0096] Construct a quantum circuit for order calculation based on k L-type matrices, k U-type matrices, and k P-type matrices;

[0097] The order of the public key in GF(p,k) is determined based on the operation results of the quantum circuit for order determination.

[0098] Further, before iteratively calculating the power factorization of the matrix corresponding to the public key, the method includes:

[0099] Determine the degree corresponding to the highest term in a preset irreducible polynomial, wherein the preset irreducible polynomial has a modulus p;

[0100] Determine the result of a modular multiplication operation between the public key and each term with a lower degree than the term corresponding to the highest term;

[0101] The matrix corresponding to the public key is determined based on the modular multiplication result.

[0102] For example, the presupposed irreducible polynomial is:

[0103] f(x) = x 3 +3x 2 +x+2

[0104] Right now

[0105] x 3 =-(3x 2 (x + 2) = 2x 2 +4x+3

[0106] The result of a modular multiplication of the public key 2x+3 with each term having a lower degree than the highest term is:

[0107] (2x+3)×1 mod f(x) = 2x+3

[0108] (2x+3)×x mod f(x)=2x 2 +3x

[0109] (2x+3)×x 2 mod f(x)=(2x 3 +3x 2 )mod(2x 2 (+4x+3)=2x 2 +3x

[0110] Translate the above expression into the language of linear algebra:

[0111] (3, 2, 0) × (1, 0, 0) = (3, 2, 0)

[0112] (3, 2, 0) × (0, 1, 0) = (0, 3, 2)

[0113] (3, 2, 0) × (0, 0, 1) = (1, 3, 2)

[0114] Writing the four equations together gives us:

[0115]

[0116] Therefore, the matrix corresponding to the public key can be determined as follows:

[0117]

[0118] Here, we can verify:

[0119] (2x 2 +x+4)×(2x+3)=x 2 +2x+4mod5

[0120] It can also be obtained using matrix calculations:

[0121]

[0122] After obtaining the matrix corresponding to the public key, its exponentiation is calculated iteratively, for example:

[0123]

[0124]

[0125] ...

[0126] Ultimately, we obtain the matrix corresponding to the public key, the square of that matrix, the cube of that matrix, and so on, the 2' of that matrix. k The power is k, and there are a total of k first square matrices.

[0127] Furthermore, the construction of the order-finding quantum circuit based on k L-type matrices, k U-type matrices, and k P-type matrices includes:

[0128] Quantum circuits corresponding to each L-type matrix are constructed based on each L-type matrix and a preset modular analog-to-digital converter; quantum circuits corresponding to each U-type matrix are constructed based on each U-type matrix and a preset modular analog-to-digital converter; and quantum circuits corresponding to each P-type matrix are constructed based on each P-type matrix and a SWAP gate.

[0129] Each L-type matrix is ​​sequentially cascaded with the quantum circuits corresponding to the U-type matrix and P-type matrix of the L-type matrix to obtain k single-term modular multiplication quantum circuits.

[0130] By cascading k of the aforementioned single-term modular multiplication quantum circuits in sequence, a modular multiplication quantum circuit is obtained;

[0131] By cascading the quantum Fourier transform circuit, the modular multiplication quantum circuit, and the inverse quantum Fourier transform circuit in sequence, an order-finding quantum circuit is obtained.

[0132] Specifically, the modular multiplication unit includes a modular addition unit and a modular multiplication unit. The step of constructing the quantum circuit corresponding to each L-type matrix based on each L-type matrix and the preset modular multiplication unit includes:

[0133] Determine the non-zero elements in each row of each L-shaped matrix;

[0134] Based on the non-zero elements of each row, the modular addition and modular multiplication operators are used to construct the quantum circuit corresponding to each L-type matrix.

[0135] Specifically, the step of constructing the quantum circuit corresponding to each L-type matrix based on the non-zero elements of each row and the modular addition and modular multiplication operators includes:

[0136] Determine the non-zero elements on the diagonal and non-zero elements on both sides of the diagonal in each row.

[0137] Based on the non-zero elements on the diagonal and the non-zero elements on the non-diagonal, as well as the modular addition and modular multiplication operators, a modular addition and modular multiplication operation circuit is determined. The multiplier of the modular addition and modular multiplication operation circuit is the non-zero element on the diagonal, and the addend of the modular addition and modular multiplication operation circuit is the product of the coefficients of the non-zero elements on the non-diagonal and the corresponding terms of the non-zero elements on the non-diagonal in any polynomial. The modulus of the modular addition and modular multiplication operation circuit is p.

[0138] The quantum circuit corresponding to each L-type matrix is ​​constructed based on the modular addition and modular multiplication operation circuits corresponding to each row.

[0139] More specifically, for each non-zero element in a row, if the non-zero element is a diagonal element, it is multiplied by the element; if the non-zero element is not a diagonal element, it is added to the product of the element and the coefficient of the corresponding term in an arbitrary polynomial. After performing addition and multiplication operations on all non-zero elements in the row, the result is modulo p.

[0140] The number of data bits required is The required number of auxiliary bits depends on the modular adder and modular multiplier used. In one specific embodiment, the auxiliary bits...

[0141] For example, the L-type matrix over GF(5,3) is:

[0142]

[0143] p = 5, and the non-zero element in the 0th row is a. 00 =3, a 02=1, then the modular addition and modular multiplication operation is determined to be (×3+C)mod 5. The logic gate corresponding to this modular addition and modular multiplication operation operates on the data bit and auxiliary bit corresponding to the first term of an arbitrary polynomial; the non-zero element in the first row is a. 11 =3, a 12 =41, then the modular addition and modular multiplication operation is determined to be (×3+4C)mod 5. The logic gate corresponding to this modular addition and modular multiplication operation operates on the second term of an arbitrary polynomial. Data bits and Auxiliary bits; where an arbitrary polynomial is Cx 2 +Bx+A.

[0144] like Figure 3 As shown, Figure 3 This is a schematic diagram of a quantum circuit corresponding to an L-shaped matrix, provided in an embodiment of the present invention. The quantum circuit includes 12 qubits, of which 9 are data bits used to encode an arbitrary polynomial Cx. 2 The quantum states corresponding to +Bx+A are as follows: for example, the quantum state corresponding to A is |a2>|a1>|a0>, the quantum state corresponding to B is |b2>|b1>|b0>, and the quantum state corresponding to C is |c2>|c1>|c0>. The other four are auxiliary bits, with corresponding quantum states |aux3>|aux2>|aux1>|aux0>, used to assist in modular addition and multiplication operations. The initial quantum states of these four qubits are |0>|0>|0>|0), and they are reset to 0 after each operation for the next operation.

[0145] The quantum logic gate corresponding to (×3+C) mod 5 operates on the qubits corresponding to |a2)|a1>|a0> and |aux3>|aux2>|aux1>|aux0>, and the quantum logic gate corresponding to (×3+4C) mod 5 operates on the qubits corresponding to |b2>|b1>|b0> and |aux3>|aux2>|aux1>|aux0>.

[0146] The specific implementation process of the quantum circuit corresponding to the U-shaped matrix is ​​similar to that of the quantum circuit corresponding to the L-shaped matrix, except that one is an upper triangular matrix and the other is a lower triangular matrix. For details, please refer to the specific implementation process of the quantum circuit corresponding to the L-shaped matrix mentioned above, which will not be repeated here.

[0147] In one embodiment of the present invention, the construction of the quantum circuit corresponding to each P-type matrix based on each P-type matrix and a SWAP gate, wherein the dimension of the P-type matrix is ​​k×k, includes:

[0148] The quantum states of k qubits corresponding to the row number are transferred to the quantum states of k qubits corresponding to the column number, and the non-zero elements a in each P-type matrix except for the diagonal are determined. mn The m and n are the number of rows and columns of the P-type matrix, respectively.

[0149] By applying the SWAP gate to the m-th qubit of the k qubits corresponding to the row number and the n-th qubit of the k qubits corresponding to the column number, the quantum circuit corresponding to each of the P-type matrices is obtained.

[0150] Further, the transfer of the quantum state of k qubits corresponding to the row number to the quantum state of k qubits corresponding to the column number includes:

[0151] The SWAP gate is applied to the qubits with the same row number and column number, where both the row number and column number correspond to k qubits.

[0152] For example, such as Figure 4 As shown, Figure 4 This is a schematic diagram of a quantum circuit corresponding to a P-type matrix provided in an embodiment of the present invention. If t = 4, then the quantum circuit includes four qubits corresponding to the row number: q Line0 q Line1 q Line2 q Line3 The four qubits corresponding to the column number: q Row0 q Row1 q Row2 q Row3 You can first use SWAP(q) Line0 q Row0 ), SWAP(q) Line1 q Row1 ), SWAP(q) Line2 q Row2 ), SWAP(q) Line3 q Row3 The quantum state of the qubit corresponding to the row number is transferred to the quantum state of the qubit corresponding to the column number. Here, the four SWAP gates operate on different qubits, so their timing is not affected. Figure 4 This is just one example.

[0153] If the P-type matrix is:

[0154]

[0155] Then the non-zero element is a 01 a 12 a 23 a 30 Therefore, SWAP(q) exists.Line0 q Row1 ), SWAP(q) Line1 q Row2 ), SWAP(q) Line2 q Row3 ), SWAP(q) Line3 q Row0 Similarly, the four SWAP gates here operate on different qubits, therefore their timing is not affected. Figure 4 This is just one example.

[0156] In another embodiment of the present invention, the step of constructing the quantum circuit corresponding to each P-type matrix based on each P-type matrix and the SWAP gate includes:

[0157] Determine the non-zero element a in each of the P-type matrices, excluding the diagonal elements. mn ;

[0158] If m is less than n, then the SWAP gate is applied to the m-th and n-th qubits;

[0159] If m is greater than n, then determine the non-zero element a. m′n′ And apply the SWAP gate to the m-th and n′-th qubits, where m′ is less than m and n′ is greater than m;

[0160] If m equals n or n′, then no operation is performed;

[0161] Determine the quantum circuit corresponding to each of the P-type matrices.

[0162] For example, such as Figure 5 As shown, Figure 5 This is a schematic diagram of another quantum circuit corresponding to a P-type matrix provided in an embodiment of the present invention.

[0163] If the P-type matrix is:

[0164]

[0165] Non-zero elements include a 03 a 10 a 21 a 32 For non-zero element a 03 If 0 < 3, then the SWAP gate is applied to the 0th and 3rd qubits (q0 and q3); for non-zero elements a 10 If 1 > 0, then the search upwards will return a. 03 If m = 1 > m′ = 0 and n′ = 3 > m = 1, apply the SWAP gate to the 1st and 3rd qubits (q1 and q3); similarly, for non-zero element a... 21Apply the SWAP gate to the 2nd and 3rd qubits (q2 and q3); for non-zero element a 32 If no operation is performed, then no operation is performed; after all non-zero elements have been traversed, the quantum circuit corresponding to the P-type matrix is ​​determined.

[0166] As can be seen, in this embodiment of the invention, the required number of qubits is k, which is less than the 2k qubits required in the previous embodiment. The classical computation involved in the previous embodiment involves less computation and is more logically direct, but it calls up a larger number of qubits. The advantages and disadvantages of this embodiment are the opposite of those of the previous embodiment.

[0167] It should be noted that the maximum value of an element in an L-shaped or U-shaped matrix is ​​p-1, therefore each element needs to... Each data bit represents the number of quantum circuits required for k×k L-type and U-type matrices. One data bit; since all elements in a P-type matrix are 1, each element requires one data bit to represent. For a k×k P-type matrix, the corresponding quantum circuit requires k or 2k data bits. When cascading, the P-type matrix can be expanded to... A quantum circuit with 10 data bits, i.e. Each data bit represents an element.

[0168] The above embodiments can be used to construct quantum circuits corresponding to each L-type, U-type, and P-type matrix. Then, each L-type matrix is ​​sequentially cascaded with the quantum circuits corresponding to its corresponding U-type and P-type matrices to obtain k single-term modular multiplication quantum circuits. The k single-term modular multiplication quantum circuits are sequentially cascaded to obtain a modular multiplication quantum circuit. The quantum Fourier transform circuit, the modular multiplication quantum circuit, and the inverse quantum Fourier transform circuit are sequentially cascaded to obtain an order-finding quantum circuit.

[0169] like Figure 6 As shown, Figure 6 This invention provides a schematic diagram of the structure of a quantum circuit for determining order. The quantum circuit includes three registers, the first register including... Each data bit is used to store an element in GF(p,k). Since the elements in the finite field GF(p,k) come from {0, 1, ..., p-1}, each element in GF(p,k) requires... Each data bit is used for storage.

[0170] The second register is used as control bits to control whether to perform the quantum operation corresponding to the matrix. Since there are k matrix operations, the data bits corresponding to each matrix operation are... One, therefore, is needed The first auxiliary bit.

[0171] In this embodiment, the third register includes A second auxiliary bit is used to assist in modulo-digital operations. The number of second auxiliary bits used varies in different embodiments and is determined based on the modulo-digital operations.

[0172] Of the data bits, except for the least significant bit which has an initial quantum state of |1>, the others... The initial quantum state of each qubit is |0>. The first auxiliary bit and The initial quantum state of each of the second auxiliary bits is |0>.

[0173] In this matrix, the public key 'a' corresponds to a square matrix A1, and the first square matrix consists of A2, A3, ..., A1. k-1 A k The quantum circuit corresponding to square array A is Mat A, and the quantum circuits corresponding to the first square array are Mat A2, Mat A3, ..., Mat A. k-1 Mat A k Each quantum circuit corresponding to a square array or the first square array is controlled by the corresponding first auxiliary bit.

[0174] This quantum circuit for determining order also includes quantum Fourier transform and quantum inverse Fourier transform operations. The quantum Fourier transform operation includes an H-gate acting on each first auxiliary bit, and the quantum inverse Fourier transform operation acts on... The first auxiliary bit.

[0175] Optionally, determining the order of the public key in GF(p,k) based on the operation result of the order-finding quantum circuit includes:

[0176] The results of the operation of the quantum circuit for order calculation based on the continued fraction algorithm are compared with 2. f The quotient is expanded to obtain at least one fraction, and the result is encoded using f qubits;

[0177] The order of the public key in GF(p,k) is determined from the denominator of at least one of the fractions.

[0178] For example, for Figure 6 The first register in the array, after Fourier transform of the f qubits, is measured to obtain a bit string of length f, which is then converted into a decimal number λ. Here, It should be noted that during the conversion process, the side controlling the higher-order arithmetic unit is considered the high-order bit of the number, and the other side is considered the low-order bit of the number.

[0179] Calculated using the continued fraction algorithm:

[0180]

[0181] The calculation process can stop at a preset number of iterations or at a preset precision, thus yielding at least one score:

[0182]

[0183] The order of the public key in GF(p,k) is determined from the denominator of at least one of the aforementioned fractions, i.e., the denominators a1, a2, ..., of the aforementioned at least one fraction are used to verify whether they represent the order of an element. According to mathematical theorems, it can be guaranteed that when the number of control bits f > 2 * [log₂N + 1], any measurement has an O(1) probability of reading the correct period, where [] represents rounding, and N represents the order of GF(p,k), i.e., the number of elements in the group.

[0184] Optionally, the step of decrypting the ciphertext based on the order of the public key in GF(p,k) and the plaintext parameters includes:

[0185] The number of qubits required to construct the target quantum circuit for solving the private key corresponding to the ciphertext is determined based on the logarithm of the order of the public key in GF(p,k).

[0186] Construct the target quantum circuit based on the number of qubits required for the target quantum circuit;

[0187] The private key corresponding to the ciphertext is determined based on the operation result of the target quantum circuit;

[0188] The ciphertext is decrypted based on the private key.

[0189] Generally speaking, if the order of the public key in GF(p,k) is r, then the number of control bits and data bits required in the target quantum circuit are both equal to the order of the public key in GF(p,k). Proportional. If the target quantum circuit is constructed directly without using the method described in this embodiment of the invention, the required number of control bits and data bits is... The order r of the public key must be less than the order p of GF(p,k), thus reducing the number of qubits and effectively saving hardware resources.

[0190] The quantum circuits for order determination in the above embodiments, and the target quantum circuit in this embodiment, can run on a quantum computing unit, which can be a quantum computer or a quantum virtual machine. The classical computing unit sends the quantum circuit to the quantum computing unit, which excites the qubits in the quantum circuit to their initial states. Then, based on the quantum logic gates in the quantum circuit, it applies corresponding analog signals to the qubits to cause the initial states of the qubits to evolve. Finally, it applies analog signals to measure the qubits, determines the result of the quantum circuit's operation, and feeds the result back to the classical computing unit.

[0191] A quantum computing unit executes a quantum circuit a specified number of times. The measured result can be in the form of an array or a binary bit string. For example, in the array form, for two qubits and 1024 executions, the measurement result could be "00":251, "01":213, "10":260, "11":300, where "00", "01", "10", and "11" are the measured quantum states, and "251", "213", "260", and "300" are the execution counts corresponding to those quantum states. In the binary bit string form, for two qubits and one execution, "11" represents the measured quantum state.

[0192] To determine the private key corresponding to the ciphertext based on the running results, and to decrypt the ciphertext based on the private key, please refer to the patent document with application number "202111365914.4" entitled "Ciphertext Decryption Method and Related Device"; or refer to the patent document with application number "202111365902.1" entitled "Ciphertext Decryption Method and Related Device".

[0193] This invention proposes a ciphertext decryption device for use with ciphertext encrypted based on discrete logarithm encryption. See [link to relevant documentation]. Figure 7 , Figure 7 This is a schematic diagram of a ciphertext decryption device provided in an embodiment of the present invention. The device includes:

[0194] The acquisition unit 701 is used to acquire the public key and plaintext parameters corresponding to the ciphertext, wherein the public key and plaintext parameters are both elements in the finite field GF(p,k);

[0195] The determining unit 702 is used to determine the order of the public key in GF(p,k) based on the public key and LUP matrix decomposition;

[0196] The decryption unit 703 is used to decrypt the ciphertext based on the order of the public key in GF(p,k) and the plaintext parameters.

[0197] The specific functions and effects of the ciphertext decryption device can be explained by referring to other embodiments in this specification, and will not be repeated here. Each module in the ciphertext decryption device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0198] Please see Figure 8 This specification also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the encrypted decryption method of any of the above embodiments. Please refer to... Figure 8 The computer device can be a classical computer or a quantum computer.

[0199] This specification also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a computer, causes the computer to perform the ciphertext decryption method in any of the above embodiments.

[0200] This specification also provides a computer program product containing instructions that, when executed by a computer, cause the computer to perform the ciphertext decryption method in any of the above embodiments.

[0201] It is understood that the specific examples in this specification are only intended to help those skilled in the art better understand the implementation methods described herein, and are not intended to limit the scope of the invention.

[0202] It is understood that in the various embodiments of this specification, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not limit the implementation process of the embodiments of this specification in any way.

[0203] It is understood that the various implementation methods described in this specification can be implemented individually or in combination, and the implementation methods in this specification are not limited in this respect.

[0204] Unless otherwise stated, all technical and scientific terms used in the embodiments of this specification have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of this specification. The term "and / or" as used in this specification includes any and all combinations of one or more of the associated listed items. The singular forms "a," "the," and "the" as used in the embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0205] It is understood that the processor in the embodiments of this specification can be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method embodiments can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this specification. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this specification can be directly implemented by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above methods.

[0206] It is understood that the memory in the embodiments of this specification may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM). It should be noted that the memory in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0207] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this specification.

[0208] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the aforementioned method implementations, and will not be repeated here.

[0209] In the several embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0210] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0211] In addition, the functional units in the various embodiments of this specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0212] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this specification, in essence, or the parts that contribute to the prior art, or parts of the technical solutions, can be embodied in the form of software products. These computer software products are stored in a storage medium and include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0213] The above description is merely a specific embodiment of this specification, but the scope of protection of this invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this specification should be included within the scope of protection of this specification. Therefore, the scope of protection of this invention should be determined by the scope of the claims.

Claims

1. A method for decrypting encrypted text, characterized in that, The method, applied to ciphertext based on discrete logarithm encryption, includes: Obtain the public key and plaintext parameters corresponding to the ciphertext, where both the public key and plaintext parameters belong to a finite field. Middle element; Iteratively calculate the powers of the square matrix corresponding to the public key until k-1 first square matrices are obtained, where each first square matrix is ​​a power of the square matrix. The power is given by the power of c, where c is an integer in [2, k]. Perform LUP decomposition on the square matrix and k-1 of the first square matrices to obtain k L-type, k U-type and k P-type matrices respectively; Constructing order-finding quantum circuits based on k L-type matrices, k U-type matrices, and k P-type matrices includes: constructing a quantum circuit corresponding to each L-type matrix based on each L-type matrix and a preset modular multiplication operator; constructing a quantum circuit corresponding to each U-type matrix based on each U-type matrix and a preset modular multiplication operator; and constructing a quantum circuit corresponding to each P-type matrix based on each P-type matrix and a SWAP gate; cascading each L-type matrix with the corresponding U-type and P-type quantum circuits to obtain k single-term modular multiplication quantum circuits; cascading the k single-term modular multiplication quantum circuits to obtain a modular multiplication quantum circuit; and cascading the quantum Fourier transform circuit, the modular multiplication quantum circuit, and the inverse quantum Fourier transform circuit to obtain an order-finding quantum circuit. Based on the operation results of the quantum circuit for order calculation, the public key is determined in... The order in the middle; Based on the public key The ciphertext is decrypted using the order and the plaintext parameters.

2. The method as described in claim 1, characterized in that, The public key is determined based on the operation result of the quantum circuit. The order in the middle includes: The results of the operation of the quantum circuit for order calculation based on the continued fraction algorithm are as follows: The quotient is expanded to obtain at least one fraction, and the result is encoded using f qubits; Determine the public key from the denominator of at least one of the fractions. The order of the middle.

3. The method as described in claim 1 or 2, characterized in that, The modular multiplication unit includes a modular addition unit and a modular multiplication unit. The construction of the quantum circuit corresponding to each L-type matrix based on each L-type matrix and the preset modular multiplication unit includes: Determine the non-zero elements in each row of each L-shaped matrix; Based on the non-zero elements of each row, the modular addition and modular multiplication operators are used to construct the quantum circuit corresponding to each L-type matrix.

4. The method as described in claim 3, characterized in that, The construction of the quantum circuit corresponding to each P-type matrix based on each P-type matrix and the SWAP gate includes: Determine the non-zero elements (excluding the diagonal) in each of the aforementioned P-type matrices. ; If m is less than n, then the SWAP gate is applied to the m-th and n-th qubits; If m is greater than n, then determine the non-zero elements. And applying the SWAP gate to the m-th and m-th... On each quantum bit, Less than m, and Greater than m; If m equals n or If so, no operation will be performed; Determine the quantum circuit corresponding to each of the P-type matrices.

5. The method as described in claim 1, characterized in that, The basis of the public key The order in the code and the plaintext parameters are used to decrypt the ciphertext, including: Based on the public key The logarithm of the order in the ciphertext determines the number of qubits required to construct the target quantum circuit for solving the private key corresponding to the ciphertext; Construct the target quantum circuit based on the number of qubits required for the target quantum circuit; The private key corresponding to the ciphertext is determined based on the operation result of the target quantum circuit; The ciphertext is decrypted based on the private key.

6. A ciphertext decryption device, characterized in that, For use with ciphertext encrypted based on discrete logarithm encryption, the apparatus includes: The acquisition unit is used to acquire the public key and plaintext parameters corresponding to the ciphertext, wherein both the public key and plaintext parameters belong to a finite field. Middle element; The determining unit is used to iteratively calculate the power of the square matrix corresponding to the public key until k-1 first square matrices are obtained, where the first square matrix is ​​the power of the square matrix. The power is given by the power of c, where c is an integer in [2, k]. Perform LUP decomposition on the square matrix and k-1 of the first square matrices to obtain k L-type, k U-type and k P-type matrices respectively; Constructing order-finding quantum circuits based on k L-type matrices, k U-type matrices, and k P-type matrices includes: constructing a quantum circuit corresponding to each L-type matrix based on each L-type matrix and a preset modular multiplication operator; constructing a quantum circuit corresponding to each U-type matrix based on each U-type matrix and a preset modular multiplication operator; and constructing a quantum circuit corresponding to each P-type matrix based on each P-type matrix and a SWAP gate; cascading each L-type matrix with the corresponding U-type and P-type quantum circuits to obtain k single-term modular multiplication quantum circuits; cascading the k single-term modular multiplication quantum circuits to obtain a modular multiplication quantum circuit; and cascading the quantum Fourier transform circuit, the modular multiplication quantum circuit, and the inverse quantum Fourier transform circuit to obtain an order-finding quantum circuit. Based on the operation results of the quantum circuit for order calculation, the public key is determined in... The order in the middle; Decryption unit, used for decryption based on the public key The ciphertext is decrypted using the order and the plaintext parameters.

7. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 5 when it is run.

8. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method as described in any one of claims 1 to 5.

Images