Password-based authentication key negotiation method on lattice

Abstract

The invention provides an on-lattice password-based authentication key negotiation method. A user is allowed to use a password to negotiate a session key with a server and authenticate the identity of the user. And construction is carried out based on an ideal lattice, so that the security is established on a learning problem with errors on a ring, and quantum attacks can be effectively resisted. The voucher of the user is stored in a server side in a password encryption mode, and only the user with a correct password can decrypt the voucher to obtain a legal voucher and establish a subsequent session key. When a session key is established, the user and the server perform an authentication key exchange with a key hiding attribute to prevent leakage of user credential information. Even if the opponent obtains the certificate ciphertext encrypted by the user password and exhausts the password space to decrypt the ciphertext to obtain a possible user certificate set, the certificate corresponding to the correct password cannot be identified from the set, so that the method and the device can resist off-line dictionary attacks. In addition, bidirectional key confirmation can ensure consistency of session keys while verifying user identity.

Description

Technical Field

[0001] The invention belongs to information security technology, and in particular relates to a password-based authentication key negotiation method on a grid. Background Art

[0002] The password-based authentication key agreement protocol aims to enable the communicating parties who share the password to complete identity authentication and negotiate a common session key on an insecure channel, and use the session key to encrypt the subsequent communication content to ensure the confidentiality of the session. However, in the client-server scenario, the server directly saves the user password, which increases the risk of password leakage. Once the server is compromised by the adversary, the adversary can easily obtain the user password. To solve this problem, the most basic method is to use the hash value of the user password as a credential and save it on the server side for identity authentication and key negotiation. However, since the password is low entropy, the adversary can exhaust the password space and pre-calculate a large number of password credentials. Once the server is compromised and the credentials are leaked, the adversary can immediately obtain the user password.

[0003] The OPAQUE protocol is resistant to this pre-computation attack. In OPAQUE, credentials are stored on the server in an authenticated encrypted form. Only when the user provides the correct password can the corresponding authentication encryption key be generated and the credentials can be decrypted to complete user authentication and session key negotiation. In order to not leak password information to the server while generating the authentication encryption key, OPAQUE uses an oblivious pseudo-random function (OPRF). The user sends the blinded password hash value to the server, which processes the received blinded value with a secret value. By de-blinding, the user can obtain the authentication encryption key generated by the server's secret value and the user's password while ensuring the confidentiality of the password. Because the credential contains the server's secret value, the adversary cannot arbitrarily pre-compute the password credential to quickly obtain the user's password.

[0004] However, the security of OPAQUE depends largely on the security of OPRF. Once OPRF is broken (through cryptanalysis or quantum attack), the user's password will be threatened by offline dictionary attacks: after obtaining the communication information between the user and the server, the adversary can exhaustively enumerate and verify all possible passwords to reveal the user's password. In order to achieve security against offline dictionary attacks without relying on OPRF, the KHAPE protocol was proposed. In KHAPE, the credentials containing the user's key are stored in encrypted form on the server. Only the user with the correct password can decrypt the encrypted credential to obtain the key, and use the key to perform a key-hiding AKE with the server to generate a session key. In this way, even if the adversary obtains the communication information between the user and the server and enumerates the user's password to obtain a possible user key set, he cannot identify the key corresponding to the correct password from the set. Therefore, KHAPE can achieve the purpose of resisting offline dictionary attacks without using OPRF. However, the KHAPE protocol is constructed based on traditional difficult problems (such as the discrete logarithm problem) and is vulnerable to quantum attacks. The present invention constructs a secure password-based authenticated key agreement protocol on an ideal lattice based on the RLWE difficulty problem, which can effectively resist the attack of quantum computers. Summary of the invention

[0005] The problem to be solved by the present invention is to provide a password-based authentication key negotiation method that is secure and resistant to quantum attacks.

[0006] The technical solution adopted by the present invention to solve the above-mentioned problem is a password-based authenticated key agreement protocol on a lattice, which is characterized in that a protocol is constructed on an ideal lattice based on the RLWE difficulty problem to resist quantum attacks, a password is used to encrypt credentials and an authenticated key exchange with key hiding properties is combined to resist offline dictionary attacks, and a two-way key confirmation is used to ensure the consistency of the session key, which specifically includes the following steps:

[0007] System initialization phase: Initialize the system according to security parameters and determine the system's public parameters; users and servers select corresponding numbers uid and sid;

[0008] Registration stage:

[0009] (1) User First send the user number uid, server number sid and user password pwd to the server

[0010] (2) Server For users and server Select a long-term private key and disturbance Calculate the user's long-term public key and the server's long-term public key Then encrypt with the password pwd and Get the ciphertext e and finally store the key file Delete other values;

[0011] Key negotiation phase:

[0012] (1) User First send the user number uid and server number sid to the server

[0013] (2) The server retrieves the corresponding key file based on uid and sid Then send the ciphertext e to the user;

[0014] (3) The user uses the password pwd to decrypt e to obtain the user's long-term private key Perturbation and the server's long-term public key

[0015] (4) The user randomly selects a temporary private key and disturbance Calculate the user's temporary public key and the user's rejection probability parameter;

[0016] Calculate the user's specific probability based on the user's rejection probability parameter, and then send x with the user's specific probability u to the server, otherwise reject the currently selected temporary public and private keys and re-execute step (4);

[0017] (5) The server receives x u After that, a temporary private key is randomly selected and disturbance Calculate temporary public key and the server's rejection probability parameter; calculate the server's specific probability based on the server's rejection probability parameter, and then perform the next step with the server's specific probability, otherwise continue to re-execute step (5);

[0018] (6) The server selects a random number g s To calculate the server pre-key material According to Calculate signal value Then send the server temporary public key y S and signal value to the user; the server calculates the server pre-key

[0019] (7) The user receives the server's temporary public key y S and signal value Then, select a random number Use the received y S To calculate the user pre-key material use K u Perform error elimination to obtain the intermediate value σ u , and then use σ u Calculate the pre-key sk u ;

[0020] (8) User uses sk u Calculate the user key confirmation value τ and send τ to the server;

[0021] (9) After receiving τ, the server verifies τ and uses To generate the server key confirmation value γ

[0022] and the server-side session key Then send γ to the user;

[0023] (10) After receiving γ, the user verifies γ and uses sk u To generate the client session key

[0024] Authentication key negotiation is complete.

[0025] The authenticated key negotiation scheme of the present invention allows the user to negotiate the session key with the server using a password and authenticate the user identity. The protocol is constructed based on an ideal lattice, so that its security is established on the ring error learning problem (RLWE), which can effectively resist quantum attacks. The protocol stores the user credentials in the form of password encryption on the server side, so that only the user who provides the correct password can decrypt the legitimate credentials and establish the subsequent session key. When establishing the session key, the user and the server perform an authenticated key exchange (Key-hiding AKE) with a key hiding property to prevent the leakage of user credential information. In this way, even if the adversary obtains the credential ciphertext encrypted by the user password and exhaustively decrypts the ciphertext to obtain a possible user credential set by exhaustively enumerating the password space, he cannot identify the credential corresponding to the correct password from the set, so the protocol can resist offline dictionary attacks. In addition, the protocol uses two-way key confirmation to ensure the consistency of the session key and verify the user identity at the same time.

[0026] The beneficial effects of the present invention are as follows: a password-based authenticated key negotiation protocol on a lattice is designed based on the RLWE difficulty problem, which can effectively resist quantum attacks; a password-encrypted credential is used in combination with an authenticated key exchange with a key hiding property to negotiate a session key, which can resist offline dictionary attacks; and a two-way key confirmation is used to ensure the consistency of the session key. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic diagram of the registration phase of the password-based authentication key agreement protocol in the present invention;

[0028] Figure 2 It is a schematic diagram of the login phase of the password-based authentication key negotiation protocol in the present invention. DETAILED DESCRIPTION

[0029] (I) System initialization phase:

[0030] Determine the system common parameter set based on security parameters Where n is a power of 2, q is an odd prime number, is a polynomial residue class ring modulo q, (x n +1) is a polynomial, with random elements a∈R q , Represents coefficients in a finite field The polynomial ring on , Indicates rounding down. Indicates rounding, Cha means satisfying The signal function of The elements in Mod2 satisfy The error elimination function is , b is an element in the set {0,1}, Enc / Dec is a symmetric encryption / decryption algorithm, is an n-dimensional integer vector space For any discrete Gaussian distribution with variance 0 and standard deviation σ, satisfy ||·|| represents the L2 norm; if the element v∈R q Use its polynomial coefficients (v0,v1,…,v n-1 ) and there exists b=(b0,b1,…,b n-1 )∈{0,1} n Then we can get Cha(v)=(Cha(v0),…,Cha(v n-1 )) and Mod2(v,b)=(Mod2(v0,b0),…,Mod2(v n-1 ,b n-1 )); and H2:{0,1} *→{0,1} κ is a hash function, where γ is any positive real number, κ is the length of the session key; {0,1} * Represents the set of all bit strings of finite length; and is a discrete Gaussian distribution, where α and β are positive real numbers and M is a constant.

[0031] (ii) Registration stage, such as Figure 1 As shown:

[0032] (1) User First send the user number uid, server number sid and user password pwd to the server

[0033] (2) Server For users and server Using discrete Gaussian distribution Select the user's long-term private key Server long-term private key Perturbation and disturbance Calculate the user's long-term public key using the random element a and the server's long-term public key Then encrypt with the password pwd and Get the ciphertext Finally store the key file Delete the other values.

[0034] (III) Key negotiation phase, such as Figure 2 As shown:

[0035] (1) User First send the user number uid and server number sid to the server

[0036] (2) The server retrieves the corresponding key file based on uid and sid Then send the ciphertext e to the user;

[0037] (3) The user uses the password pwd to decrypt e to obtain the user's long-term private key Perturbation and the server's long-term public key

[0038] (4) Users use discrete Gaussian distribution Randomly select a temporary private key and disturbance Calculate the user's temporary public key and the median And calculate the user rejection probability parameter Where | is the coefficient vector concatenation operation; then use and The discrete Gaussian distribution formed calculates the user's specific probability min(X,1) means taking the minimum value between X and 1. Represents a 2n-dimensional integer vector space A discrete Gaussian distribution with an upper mean of 0 and a standard deviation of β. Represents a 2n-dimensional integer vector space The upper mean is Discrete Gaussian distribution with standard deviation β; users use probability Send x u to the server, otherwise reject the currently selected temporary public and private keys and re-execute step (4);

[0039] (5) The server uses discrete Gaussian distribution Randomly select a temporary private key and disturbance Calculate the server's temporary public key and the median And calculate the server rejection probability parameter Where | is the coefficient vector concatenation operation; then use and The discrete Gaussian distribution formed calculates the server-specific probability Represents a 2n-dimensional integer vector space The upper mean is Discrete Gaussian distribution with standard deviation β; the server is based on probability Execute the next step, otherwise continue to execute step (5);

[0040] (6) The server uses discrete Gaussian distribution Select a random number g s , using g s Compute pre-key material Middle number Reuse Calculate signal value Then send the server temporary public key y S and signal value to the user; the server calculates the server pre-key Intermediate

[0041] (7) The user receives the server's temporary public key y S and signal value Then, using discrete Gaussian distribution Pick a random number use Compute pre-key material Middle number User Utilization K u Perform error elimination to obtain the intermediate value Then use the calculated pre-key

[0042]

[0043] (8) The user calculates the user key confirmation value PRF is a pseudo-random function; and τ is sent to the server;

[0044] (9) After receiving τ, the server first determines whether τ is equal to If they are not equal, the verification fails, and the server key confirmation value γ is set to ⊥, and the server session key Otherwise, verification is successful, set

[0045] ⊥ is the failure symbol;

[0046] (10) After receiving γ, the user first determines whether γ is equal to If they are not equal, the validation fails and the Otherwise, the verification is successful and the user-side session key is set

[0047] Password-based authenticated key agreement protocols are usually constructed based on traditional difficult problems and are vulnerable to attacks by quantum computers. In order to resist quantum attacks, the present invention provides a password-based authenticated key agreement protocol on a lattice and introduces the protocol in detail. This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A password-based authentication key negotiation method on a grid, characterized in that: The following steps are involved: System initialization phase: Initialize the system according to security parameters and determine the system's public parameters; users and servers select corresponding numbers uid and sid; Registration stage: (1) User First send the user number uid, server number sid and user password pwd to the server (2) Server For users and server Select a long-term private key and disturbance Calculate the user's long-term public key and the server's long-term public key Then encrypt with the password pwd and Get the ciphertext e and finally store the key file Delete other values; Key negotiation phase: (1) User First send the user number uid and server number sid to the server (2) The server retrieves the corresponding key file based on uid and sid Then send the ciphertext e to the user; (3) The user uses the password pwd to decrypt e to obtain the user's long-term private key Perturbation and the server's long-term public key (4) The user randomly selects a temporary private key and disturbance Calculate the user's temporary public key and the user's rejection probability parameter; calculate the user's specific probability based on the user's rejection probability parameter, and then send x with the user's specific probability u to the server, otherwise reject the currently selected temporary public and private keys and re-execute step (4); (5) The server receives x u After that, a temporary private key is randomly selected and disturbance Calculate the temporary public key and the server's rejection probability parameter; calculate the server's specific probability based on the server's rejection probability parameter, and then perform the next step with the server's specific probability, otherwise continue to re-execute step (5); (6) The server selects a random number g s To calculate the server pre-key material According to Calculate signal value Then send the server temporary public key y S and signal value To users; Server computes server prekey (7) The user receives the server's temporary public key y S and signal value Then, select a random number Use the received y S To calculate the user pre-key material use K u Perform error elimination to obtain the intermediate value σ u , and then use σ u Calculate the user pre-key sk u ; (8) User uses sk u Calculate the user key confirmation value τ and send τ to the server; (9) After receiving τ, the server verifies τ and uses To generate the server key confirmation value γ and the server-side session key Then send γ to the user; (10) After receiving γ, the user verifies γ and uses sk u To generate the client session key Authentication key negotiation completes.

2. The method according to claim 1, characterized in that: The specific steps of the system initialization phase are: Determine the system common parameter set based on the security parameters Where n is a power of 2, q is an odd prime number, is a polynomial residue class ring modulo q, (x n +1) is a polynomial, with random elements a∈R q , finite field Represents coefficients in a finite field The polynomial ring on , Indicates rounding down. Indicates rounding, Cha means satisfying The signal function of The elements in Mod2 satisfy The error elimination function is , b is an element in the set {0,1}, Enc / Dec is a symmetric encryption / decryption algorithm, is an n-dimensional integer vector space For any variable, a discrete Gaussian distribution with variance 0 and standard deviation σ is satisfy ||·|| represents the L2 norm; element v∈R q Use its polynomial coefficients (v0,v1,…,v n-1 ) and there exists a vector b=(b0,b1,…,b n-1 )∈{0,1} n , then we get Cha(v)=(Cha(v0),…,Cha(v n-1 )) and Mod2(v,b)=(Mod2(v0,b0),…,Mod2(v n-1 ,b n-1 )); and H2:{0,1} * →{0,1} κ is a hash function, where γ is any positive real number and k is the length of the session key; {0,1} * Represents the set of all bit strings of finite length; and is a discrete Gaussian distribution, where α and β are positive real numbers and M is a constant.

3. The method according to claim 2, characterized in that: The calculation of the user's long-term public key and the server's long-term public key in step (2) of the registration phase is as follows: server For users and server Using discrete Gaussian distribution Select the user's long-term private key Server long-term private key Perturbation and disturbance Calculate the user's long-term public key using the random element a and the server's long-term public key 4. The method according to claim 3, characterized in that: The specific calculation of the user-specific probability in step (4) of the login phase is as follows: Discrete Gaussian distribution Randomly select a temporary private key and disturbance Calculate the user's temporary public key and the median And calculate the user rejection probability parameter Where | is the coefficient vector concatenation operation; then use and The discrete Gaussian distribution formed calculates the user's specific probability min(X,1) means taking the minimum value between X and 1. Represents a 2n-dimensional integer vector space A discrete Gaussian distribution with an upper mean of 0 and a standard deviation of β. Represents a 2n-dimensional integer vector space The upper mean is Discrete Gaussian distribution with standard deviation β.

5. The method according to claim 4, characterized in that: The specific calculation of the server-specific probability in step (5) of the login phase is as follows: The server uses discrete Gaussian distribution Randomly select a temporary private key and disturbance Compute server temporary public key and the median And calculate the server rejection probability parameter Where | is the coefficient vector concatenation operation; then use and The discrete Gaussian distribution formed calculates the server-specific probability Represents a 2n-dimensional integer vector space The upper mean is Discrete Gaussian distribution with standard deviation β.

6. The method according to claim 5, characterized in that Step (6) of the login phase is as follows: The server uses discrete Gaussian distribution Select a random number g s , using g s Compute pre-key material Middle number Reuse Calculate signal value Then send the server temporary public key y S and signal value To users; Server computes server prekey Intermediate 7. The method according to claim 6, characterized in that Step (7) of the login phase is as follows: The user receives the server's temporary public key y S and signal value Then, using discrete Gaussian distribution Pick a random number use Compute pre-key material Middle number User Utilization K u Perform error elimination to obtain the intermediate value Then use σ u Calculate the pre-key 8. The method according to claim 7, characterized in that: In the login phase, step (8), the user uses sk u The calculation of the user key confirmation value τ is specifically: PRF is a pseudo-random function.

9. The method according to claim 8, characterized in that In the login phase, step (9) verifies τ, and after verification, uses To generate the server key confirmation value γ and the server-side session key The specific method is: the server determines whether τ is equal to If they are not equal, the verification fails, and the server key confirmation value γ is set to ⊥, and the server session key Otherwise, verification is successful, set ⊥ is the failure symbol.

10. The method according to claim 9, characterized in that In the step (10) of the login phase, γ is verified and after verification, sk is used u To generate the client session key The specific method is: the user determines whether γ is equal to If they are not equal, the validation fails and the Otherwise, the verification is successful and the user-side session key is set

Images