Password-based authenticated key agreement on grids

Abstract

The application provides a password-based authentication key agreement method based on a lattice, which allows a user to use a password to agree with a server on a session key and authenticate the user identity. The method is constructed based on an ideal lattice, and its security is established on a ring-based learning problem with errors, so that the method can effectively resist quantum attacks. The user's credentials are saved in the form of password-encrypted in the server end, and only the user with the correct password can decrypt the legal credentials and establish the subsequent session key. When the session key is established, the user and the server perform an authenticated key exchange with a key hiding attribute to prevent the user's credential information from being leaked. Even if an enemy obtains the user's password-encrypted credential ciphertext and exhaustively searches the password space to decrypt the ciphertext to obtain a possible user credential set, the correct password corresponding to the credential cannot be identified from the set, so the application can resist offline dictionary attacks. In addition, two-way key confirmation can ensure the consistency of the session key and verify the user identity.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a password-based authentication key negotiation method. Background Technology

[0002] Password-based authentication key negotiation protocols aim to enable two parties sharing a password to complete authentication and negotiate a common session key over an insecure channel, using this key to encrypt subsequent communication and ensure session confidentiality. However, in client-server scenarios, directly storing user passwords on the server increases the risk of password leakage. Once the server is compromised, an adversary can easily obtain the user password. The most basic approach to address this is to store the hash value of the user password as a credential on the server for authentication and key negotiation. However, because passwords are low-entropy, an adversary can exhaustively search the password space and pre-compute a large number of password credentials. Once the server is compromised and the credentials are leaked, the adversary can immediately obtain the user password.

[0003] The OPAQUE protocol is resistant to pre-computation attacks. In OPAQUE, credentials are stored on the server in an authenticated encrypted form. Only when the user provides the correct password can the corresponding authentication encryption key be generated and the credentials decrypted to complete user authentication and session key negotiation. To prevent password information from being leaked to the server while generating the authentication encryption key, OPAQUE uses an unintentional pseudo-random function (OPRF). The user sends a blinded password hash to the server, which processes the received blinded value using a secret value. By deblinding, the user obtains the authentication encryption key generated by the server's secret value and the user's password while ensuring password confidentiality. Because the credentials contain the server's secret value, adversaries cannot arbitrarily pre-compute the password credentials to quickly obtain the user's password.

[0004] However, OPAQUE's security largely depends on the security of OPRF. Once OPRF is compromised (through cryptanalysis or quantum attacks), user passwords are vulnerable to offline dictionary attacks: an adversary, after obtaining the communication information between the user and the server, can exhaustively verify all possible passwords to reveal the user's password. To achieve security against offline dictionary attacks without relying on OPRF, the KHAPE protocol was proposed. In KHAPE, credentials containing the user's key are stored in encrypted form on the server. Only users with the correct password can decrypt the encrypted credentials to obtain the key, and use this key to perform a key-hiding AKE with the server to generate a session key. In this way, even if an adversary obtains the communication information between the user and the server and enumerates the user's password to obtain a set of possible user keys, he cannot identify the key corresponding to the correct password from the set. Therefore, KHAPE can achieve resistance to offline dictionary attacks without using OPRF. However, the KHAPE protocol is constructed based on traditionally difficult problems (such as the discrete logarithm problem) and is vulnerable to quantum attacks. This invention constructs a secure password-based authentication key negotiation protocol on an ideal lattice based on the RLWE hard problem, which can effectively resist attacks from quantum computers. Summary of the Invention

[0005] The problem to be solved by this invention is to provide a secure, quantum-resistant, password-based authentication key negotiation method.

[0006] The technical solution adopted by this invention to solve the above problems is a password-based authentication key negotiation protocol on a lattice. Its characteristics include: constructing a protocol on an ideal lattice based on the RLWE hard problem to resist quantum attacks; using password encryption credentials combined with authentication key exchange with key hiding properties to resist offline dictionary attacks; and employing two-way key confirmation to ensure the consistency of session keys. Specifically, it includes the following steps:

[0007] System initialization phase: The system is initialized based on security parameters to determine common system parameters; users and servers select appropriate numbers. and ;

[0008] Registration phase:

[0009] (1) User First send the user ID. Server Number and user password To the server ;

[0010] (2) Server users respectively and server Choose a long-term private key and disturbance Calculate the user's long-term public key and the server's long-term public key Then use the password encryption Obtain the ciphertext Finally, store the key file. Delete other values;

[0011] Key negotiation phase:

[0012] (1) User First send the user ID. and server number To the server ;

[0013] (2) Server according to and Retrieve the corresponding key file Then send the ciphertext For users;

[0014] (3) User uses password Decryption Obtain the user's long-term private key disturbance and server long-term public key ;

[0015] (4) The user randomly selects a temporary private key. and disturbance Calculate the user's temporary public key And the user's rejection probability parameter; calculate the user's specific probability based on the user's rejection probability parameter, and then send it with the user's specific probability. If the selected temporary public / private key is rejected, the selected temporary public / private key will be rejected and step (4) will be re-executed.

[0016] (5) The server receives Then, a temporary private key is randomly selected. and disturbance Calculate the temporary public key The server's rejection probability parameter; calculate the server's specific probability based on the server's rejection probability parameter, and then perform the next operation with the server's specific probability; otherwise, continue to repeat step (5).

[0017] (6) The server selects a random number To calculate server prekey material And then according to Calculate signal value Then send the server's temporary public key. and signal value Give the user; the server calculates the server pre-key. ;

[0018] (7) The user receives the server's temporary public key. and signal value Then, select a random number. Use the received To calculate user prekey material ;use right Error elimination is performed to obtain intermediate values. Then use Calculate the prekey ;

[0019] (8) User utilization Calculate the user key confirmation value and will Send to the server;

[0020] (9) The server receives After that, Perform verification, and utilize it after successful verification. To generate server key confirmation value and server-side session key Then send For users;

[0021] (10) When the user receives After that, Perform verification, and utilize it after successful verification. To generate client session keys The authentication key negotiation is complete.

[0022] This invention provides an authentication key negotiation scheme that allows users to negotiate session keys with a server using a password and authenticate their identity. The protocol is constructed based on an ideal lattice, making its security based on the learning problem with errors on rings (RLWE), effectively resisting quantum attacks. The protocol stores user credentials in password-encrypted form on the server, ensuring that only users providing the correct password can decrypt and obtain legitimate credentials to establish subsequent session keys. During session key establishment, the user and server perform a key-hiding AKE (Authorized Key Exchange) with key hiding properties to prevent leakage of user credential information. In this way, even if an adversary obtains the encrypted credential and exhaustively searches the password space to decrypt it and obtain a set of possible user credentials, they will not be able to identify the credential corresponding to the correct password from the set. Therefore, this protocol can resist offline dictionary attacks. Furthermore, the protocol uses two-way key confirmation to ensure session key consistency and simultaneously verify user identity.

[0023] The beneficial effects of this invention are: a lattice-based password-based authentication key negotiation protocol is designed based on the RLWE hard problem, which can effectively resist quantum attacks; the use of password encryption credentials combined with authentication key exchange with key hiding properties to negotiate session keys can resist offline dictionary attacks; and two-way key confirmation is used to ensure the consistency of session keys. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the registration phase of the password-based authentication key negotiation protocol in this invention.

[0025] Figure 2 This is a schematic diagram of the login phase of the password-based authentication key negotiation protocol in this invention. Detailed Implementation

[0026] (I) System Initialization Phase:

[0027] Determine the system common parameter set based on security parameters. ,in Powers of 2 It is an odd prime number. For model Polynomial residue class ring, It is a polynomial with random elements. , , Represents coefficients in a finite field polynomial ring on, , Indicates rounding down. This indicates rounding, where Cha represents the condition for rounding to the nearest whole number. The signal function, for The elements in To meet Error cancellation function, For set The elements in It is a symmetric encryption / decryption algorithm. yes 3D integer vector space The upper deviation is 0 and the standard deviation is The discrete Gaussian distribution, for any ,satisfy , Denotes the L2 norm; if the element Using its polynomial coefficients To be represented and exist Then we can get and ; and Here is a hash function, where It is any positive real number. The length of the session key; Represents the set of all bit strings of finite length; It is a discrete Gaussian distribution, where and It is a positive real number; It is a constant.

[0028] (ii) Registration stage, such as Figure 1 As shown:

[0029] (1) User First send the user ID. Server Number and user password To the server ;

[0030] (2) Server users respectively and server Using Discrete Gaussian Distribution Select user's long-term private key Server long-term private key disturbance and disturbance Using random elements Calculate the user's long-term public key and the server's long-term public key Then use the password. encryption Obtain the ciphertext , Finally, store the key file. Delete other values.

[0031] (iii) Key negotiation phase, such as Figure 2 As shown:

[0032] (1) User First send the user ID. and server number To the server ;

[0033] (2) Server according to and Retrieve the corresponding key file Then send the ciphertext For users;

[0034] (3) User uses password Decryption Obtain the user's long-term private key ;

[0035] (4) Users utilize discrete Gaussian distribution Randomly select a temporary private key and disturbance Calculate the user's temporary public key and median value And calculate the user rejection probability parameter. ,in For coefficient vector concatenation operation Reuse and The resulting discrete Gaussian distribution calculates the specific probability of the user. , exist Take the minimum value between 1 and 2. express 3D integer vector space The mean is 0 and the standard deviation is 0. The discrete Gaussian distribution, express 3D integer vector space The upper mean is Standard deviation is The discrete Gaussian distribution; users with probability send If the selected temporary public / private key is rejected, the selected temporary public / private key will be rejected and step (4) will be re-executed.

[0036] (5) The server utilizes a discrete Gaussian distribution. Randomly select a temporary private key and disturbance Calculate the server's temporary public key and median value uid And calculate the server rejection probability parameter. ,in This is a coefficient vector concatenation operation; then using... and The discrete Gaussian distribution formed is used to calculate the specific probability of the server. , express 3D integer vector space The upper mean is Standard deviation is The discrete Gaussian distribution; the server uses probability Proceed to the next step; otherwise, repeat step (5).

[0037] (6) The server utilizes a discrete Gaussian distribution.

[0038] Select random number ,use Computational prekey material The middle number reuse Calculate signal value Then send the server's temporary public key. and signal value Give the user; the server calculates the server pre-key. uid, sid intermediate quantity .

[0039] (7) The user receives the server's temporary public key. and signal value Then, using the discrete Gaussian distribution Select random number ,use Computational prekey material The middle number Users utilize right Error elimination is performed to obtain intermediate values. Then use the pre-key calculation ;

[0040] (8) The user calculates the user key confirmation value. , It is a pseudo-random function; and Send to the server;

[0041] (9) The server receives Next, first determine Is it equal to If they are not equal, the verification fails, and the server key confirmation value is set. Server session key Otherwise, if verification passes, proceed with the settings. , , This is a failure symbol;

[0042] (10) When the user receives Next, first determine Is it equal to If they are not equal, the verification fails, and the settings are changed. Otherwise, if verification passes, set the client session key. .

[0043] Password-based authentication key negotiation protocols are typically constructed based on traditionally difficult problems and are vulnerable to attacks by quantum computers. To resist quantum attacks, this invention provides a lattice-based password-based authentication key negotiation protocol and provides a detailed description of the protocol. Specific examples are used to illustrate the principles and implementation methods of this invention; the descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. It should be noted that those skilled in the art can make various improvements and modifications to this invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this invention.

Claims

1. A password-based authentication key negotiation method, characterized in that, Includes the following steps: System initialization phase: The system is initialized based on security parameters to determine common system parameters; users and servers select appropriate numbers. and ; Registration phase: (1) User First send the user ID. Server Number and user password To the server ; (2) Server users respectively and server Choose a long-term private key and disturbance Calculate the user's long-term public key and the server's long-term public key Then use the password encryption Obtain the ciphertext Finally, store the key file. Delete other values; Key negotiation phase: (1) User First send the user ID. and server number To the server ; (2) Server according to and Retrieve the corresponding key file Then send the ciphertext For users; (3) User uses password Decryption Obtain the user's long-term private key ; (4) The user randomly selects a temporary private key. and disturbance Calculate the user's temporary public key And the user's rejection probability parameter; calculate the user's specific probability based on the user's rejection probability parameter, and then send it with the user's specific probability. If the selected temporary public / private key is rejected, the selected temporary public / private key will be rejected and step (4) will be re-executed. (5) The server receives Then, a temporary private key is randomly selected. and disturbance Calculate the temporary public key The server's rejection probability parameter; calculate the server's specific probability based on the server's rejection probability parameter, and then perform the next operation with the server's specific probability; otherwise, continue to repeat step (5). (6) The server selects a random number To calculate server prekey material And then according to Calculate signal value Then send the server's temporary public key. and signal value For users; The server calculates the server prekey. ; (7) The user receives the server's temporary public key. and signal value Then, select a random number. Use the received To calculate user prekey material ; use right Error elimination is performed to obtain intermediate values. Then use Calculate user prekey ; (8) User utilization Calculate the user key confirmation value and will Send to the server; (9) The server receives After that, Perform verification, and utilize it after successful verification. To generate server key confirmation value and server-side session key Then send For users; (10) When the user receives After that, Perform verification, and utilize it after successful verification. To generate client session keys The authentication key negotiation is complete.

2. The method as described in claim 1, characterized in that, The specific steps in the system initialization phase are as follows: Determine the system common parameter set based on security parameters. ,in Powers of 2 It is an odd prime number. For model Polynomial residue class ring, It is a polynomial with random elements. finite field , Represents coefficients in a finite field polynomial ring on, , Indicates rounding down. This indicates rounding, where Cha represents the condition for rounding to the nearest whole number. The signal function, for The elements in To meet Error cancellation function, For set The elements in It is a symmetric encryption / decryption algorithm. yes 3D integer vector space The upper deviation is 0 and the standard deviation is The discrete Gaussian distribution for any variable ,satisfy , Represents the L2 norm; elements Using its polynomial coefficients Representation and existence of vectors Then we get and ; and Here is a hash function, where It is any positive real number. The length of the session key; Represents the set of all bit strings of finite length; It is a discrete Gaussian distribution, where and It is a positive real number; It is a constant.

3. The method as described in claim 2, characterized in that, The calculation of the user's long-term public key and the server's long-term public key in step (2) of the registration phase is as follows: server users respectively and server Using Discrete Gaussian Distribution Select user's long-term private key Server long-term private key disturbance and disturbance Using random elements Calculate the user's long-term public key and the server's long-term public key .

4. The method as described in claim 3, characterized in that, The specific calculation of the user-specific probability in step (4) of the login phase is as follows: Users utilize discrete Gaussian distribution Randomly select a temporary private key and disturbance Calculate the user's temporary public key and median value And calculate the user rejection probability parameter. ,in This is a coefficient vector concatenation operation; then using... and The resulting discrete Gaussian distribution calculates the specific probability of the user. , Indicates in Take the minimum value between 1 and 2. express 3D integer vector space The mean is 0 and the standard deviation is 0. The discrete Gaussian distribution, express 3D integer vector space The upper mean is Standard deviation is The discrete Gaussian distribution.

5. The method as described in claim 4, characterized in that, The specific calculation of the server-specific probability in step (5) of the login phase is as follows: The server utilizes a discrete Gaussian distribution. and median value uid And calculate the server rejection probability parameter. ,in This is a coefficient vector concatenation operation; then using... and The discrete Gaussian distribution formed is used to calculate the specific probability of the server. , express 3D integer vector space The upper mean is Standard deviation is The discrete Gaussian distribution.

6. The method as described in claim 5, characterized in that, Step (6) of the login phase is as follows: The server utilizes a discrete Gaussian distribution. (uid, sid, reuse Calculate signal value Then send the server's temporary public key. and signal value For users; The server calculates the server prekey. uid, sid intermediate quantity .

7. The method as described in claim 6, characterized in that, Step (7) of the login phase is as follows: The user received a temporary public key from the server. and signal value Then, using the discrete Gaussian distribution Select random number ,use Computational prekey material The middle number Users utilize right ; 8. The method as described in claim 7, characterized in that, In step (8) of the login phase, the user utilizes Calculate the user key confirmation value Specifically: , It is a pseudo-random function.

9. The method as described in claim 8, characterized in that, In step (9) of the login phase, Perform verification, and utilize it after successful verification. Come and server-side session key The specific method is as follows: the server determines If they are not equal, the verification fails, and the server key confirmation value is set. Server session key Otherwise, if verification passes, proceed with the settings. , , This is a failure symbol.

10. The method as described in claim 9, characterized in that, In step (10) of the login phase, Perform verification, and utilize it after successful verification. Come End session key The specific method is: user judgment Is it equal to If they are not equal, the verification fails, and the settings are changed. Otherwise, if verification passes, set the client session key. .

Images