NTRU-based batch on-loop multiplication triple generation method

Abstract

The invention provides an NTRU-based batch on-loop multiplication triple generation method, which comprises the following steps of: firstly, designing a homomorphic encryption scheme based on a decision type NTRU difficulty problem, then providing a batch on-loop multiplication triple generation protocol of two parties, randomly selecting secret share vectors on integer rings by participants P0 and P1 of the protocol, and selecting lt by P0; gt; 0, lt; bgt; 0, P1 is selected as lt; gt; 1, lt; bgt; the method comprises the following steps: 1, generating an instantiated homomorphic encryption scheme by P0, generating two ciphertexts through packaging coding and encryption, sending a public parameter, a public key and the ciphertexts to another participant P1, selecting an n-dimensional random number vector r as a mask on a ring with a larger modulus by the P1, and calculating lt in an encryption state; gt; 0. Lt; bgt; 1 + 1t; gt; 1. Lt; bgt; the method comprises the steps that firstly, a ciphertext ctd of a vector a and a vector b is obtained, the ctd is sent to a participant P0, and after the participant P1 and the participant P0 execute homomorphic calculation and decryption operation through the packaging decoding and SIMD technology, the participant P0 obtains the share lt of the product of the elements of the vector a and the vector b; cgt; 0, the participant P1 obtains the other share lt of the product; cgt; 1. The scheme of the invention has higher calculation and communication efficiency, and has anti-quantum security.

Description

Technical Field

[0001] The present invention relates to the field of privacy computing technology, and in particular to a batched ring multiplication triple generation method based on NTRU. Background Art

[0002] Secure multi-party computation allows a group of mutually untrusted participants to jointly compute a function on input data without leaking input data other than the computation result. Secure multi-party computation protocols are generally divided into an offline phase and an online phase. The offline phase is independent of the input of the participants and is generally used for preprocessing and multiplication triple generation. Multiplication triples are used for multiplication operations in complex secure multi-party computation protocols and are a key component in constructing secure multi-party computation protocols. Their efficiency directly affects the efficiency of secure multi-party computation protocols.

[0003] In 2012, Ivan Damgard et al. first used homomorphic encryption based on the RLWE difficulty problem to generate multiplication triplets, and designed the secure multi-party computing protocol SPDZ in the multi-party computing environment under the malicious model; in 2016, Keller et al. used the oblivious transfer protocol to generate multiplication triplets to replace the offline multiplication triple generation in the SPDZ protocol to solve the inefficiency caused by homomorphic computing; in 2017, Keller et al. proposed a BGV-based multiplication triple protocol with more compact parameters, but these protocols can only generate triplets on finite fields and cannot generate proposed a method for generating triples of multiplication on a ring based on oblivious transfer, which is more in line with the computing model of current information systems; in 2019, Orsini et al. proposed a method for generating triples of multiplication on a ring based on homomorphic encryption, which is more efficient than the method proposed by Cramer et al.; in 2019, Deevashwer et al. further improved the scheme of Orsini et al., based on the homomorphic scheme of RLWE, and introduced packed coding, which reduced the communication overhead to 14.5% of the original scheme on a 64-bit ring, and the computational overhead to 27.8% of the original scheme.

[0004] Through the analysis of the above technical solutions, it is found that the existing solutions still have the following technical problems:

[0005] (1) The communication and computational efficiency of multiplication triples is low. Currently, the generation of multiplication triples based on homomorphic encryption requires the interaction of 6 polynomial ring elements, and the execution of multiplication and addition on a 4-order polynomial ring. The overall efficiency is low and cannot meet the needs of efficient computation of large-scale secret data. It is urgent to improve the efficiency of multiplication triples.

[0006] (2) Multiplication triplets on a ring cannot be generated efficiently in large quantities. In order to utilize the properties of the Chinese Remainder Theorem to generate multiplication triplets in large quantities, it is generally required that the modulus be a prime number or the product of a series of prime numbers. However, when the modulus is a prime number or the product of a series of prime numbers, it is impossible to generate multiplication triplets of a ring structure. Therefore, multiplication triplets on a ring are difficult to support large-scale generation. Summary of the invention

[0007] To solve the above problems, the present invention proposes a batched ring multiplication triple generation method based on NTRU, which reduces the communication overhead to 3 polynomial ring elements and the computational overhead to two multiplications on the polynomial ring and two additions on the polynomial ring, thereby greatly improving the multiplication calculation efficiency of the secure multi-party computing protocol.

[0008] The present invention proposes a batch ring multiplication triple generation method based on NTRU, which includes the following steps:

[0009] Step S1, designing a homomorphic encryption scheme NtruHE based on the decision-type NTRU difficulty problem, wherein the homomorphic encryption scheme supports homomorphic addition Ntru.Add, homomorphic plaintext addition NtruHE.AddPlain, and homomorphic plaintext multiplication NtruHE.MultPlain operations;

[0010] Step S2: Implement the ring multiplication triple generation protocol based on the homomorphic encryption scheme NtruHE, and set two participants, namely P 0 and P 1 , participant P 0 Generate an instantiated homomorphic encryption scheme NtruHE and randomly select two n-dimensional vectors on the ring as their own secret shares 0 ， 0 , generate two ciphertexts ct by packing encoding and encryption a,0 ,ct b，0 , and the public parameters, public key, ciphertext ct a,0 and ct b,0 Send to another participant P 1 ;Participant P 1 Randomly select two n-dimensional vectors on the ring as its own secret shares 1 ， 1 , and select an n-dimensional random number vector r on a ring with a larger modulus as a mask, and calculate it in the encrypted state 0 · 1 + 1 · 0 +r's ciphertext ct d , and ct d Sent to participant P 0 ;Participant P 1 , P 0 Using packed decoding and SIMD technology, after performing a series of homomorphic computing and decryption operations, the participant P 0 Get the share of the product of the elements at the same position in vectors a and b <c> 0 , participant P 1 Get the other share of the product <c> 1 .

[0011] Furthermore, the designed homomorphic encryption scheme NtruHE is specifically:

[0012] Establish the algorithm NtruHE.Setup(1 λ ):Input the security parameter λ, according to the decisional NTRU problem Decisional_NTRU N，q，σ , generate parameters Params = (N, q, σ, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an integral ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, t represents the plaintext modulus,

[0013] Key generation algorithm NtruHE.KeyGen(Params): Input parameter Params, from discrete Gaussian distribution Randomly select f′, calculate f=tf′+1, determine whether f is reversible, if not, reselect f′ until f is reversible, let the key sk=f, and select the key from the discrete Gaussian distribution Randomly select g and calculate h = g·f -1 mod q;

[0014] Encryption algorithm NtruHE.Enc(pk, m): Input plaintext m∈R t , from a discrete Gaussian distribution Randomly select u from the ciphertext and calculate the ciphertext ct = u·h+Δ·m mod q;

[0015] Decryption algorithm NtruHE.Dec(sk, ct): Input ciphertext ct and decryption key sk, calculate and output

[0016] Homomorphic addition NtruHE.Add(ct 0 , ct 1 ): Enter two ciphertexts ct 0 、c t 1∈R q , calculate and output ct Add =ct 0 +ct 1 mod q;

[0017] Homomorphic plaintext addition NtruHE.AddPlain(ct,pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct AddPlain = ct + Δ pt mod q;

[0018] Homomorphic plaintext multiplication NtruHE.MultPlain(ct, pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain =ct·ptmod q.

[0019] Further, in step S2, the packing code is applied to the homomorphic encryption scheme NtruHE scheme, specifically:

[0020] Packed encoding NtruHE.PackEncoding(a): Input a vector Number of plaintext slots in, is the Euler function, ord means t in the group The order in, using packing coding to calculate and output the plaintext pt∈R t ;

[0021] Pack decoding NtruHE.PackDecoding(pt): Input a plaintext pt∈R t , using packed decoding to calculate and output vector

[0022] Furthermore, step S2 is specifically as follows:

[0023] Step S21: Participant P 0 According to the security parameter λ, call the establishment algorithm NtruHE.Setup(1 λ ), generate public parameters Params;

[0024] Step S22: Participant P 0 Call the key generation algorithm NtruHE.KeyGen(Params) to generate a public-private key pair (sk, pk), and send the public parameters Params and public key pk to the participant P 1 ;

[0025] Step S23: Participant P 0 exist Randomly select two n-dimensional vectors as participants P 0 Shares held

[0026] Step S24: Participant P 0 Use package encoding to convert the shares< / c> < / c> 0 ， 0 Encoded into two plaintexts: pt a,0 =NtruHE.PackEncoding( 0 ),pt b,0 =NtruHE.PackEncoding( 0 );

[0027] Step S25: Participant P 0 Enter the public key pk to the plaintext pt a,0 ,pt b，0 Execute encryption and call the encryption algorithm to generate two homomorphic ciphertexts: ct a,0 =NtruHE.Enc(pk,pt a,0 ), ct b,0 =NtruHE.Enc(pk,pt b,0 ), and the generated ciphertext ct a，0 and ct b，0 Sent to participant P 1 ;

[0028] Step S26: Participant P 1 After receiving the public parameters Params and public key pk, Randomly select two n-dimensional vectors as participants P 1 Shares held

[0029] Step S27: Participant P 1 Use package encoding to convert the shares 1 ， 1 Encoded into two plaintexts: pt a,1 =NtruHE.PackEncoding( 1 ),pt b，1 =NtruHE.PackEncoding( 1 );

[0030] Step S28: Participant P 1 exist Randomly select an n-dimensional vector r and encode r into plaintext pt using packing encoding r =NtruHE.PackEncoding(r);

[0031] Step S29: Participant P 1 Received ciphertext ct a,0 and ct b，0 After that, perform homomorphic calculation to obtain two ciphertexts ct a0b1 =NtruHE.MultPlain(ct a,0 , pt b,1 ), ct b0a1 =NtruHE.MultPlain(ct b,0 , pt a,1 ), ct d =NtruHE.AddPlain(NtruHE.Add(ct a0b1 , ct b0a1 ), pt r ), and calculate the result ct d Sent to participant P 0 ;

[0032] Step S210: Participant P 0 Received ciphertext ct d After that, enter the private key sk and ciphertext ct d Decrypt and package and decode: pt d =NtruHE.Dec(sk,ct d ), d=NtruHE.PackDecoding(pt d )mod 2 l ;

[0033] Step S211: Participant P 0 Calculate the product share held in encrypted state: <c> 0 ＝< / c> 0 · 0 +d mod2 l ;

[0034] Step S212: At the participant P 0 Side output 0 ， 0 ， <c> 0 ;

[0035] Step S213: Execute calculation <c> 1 ＝< / c> < / c> 1 · 1 -r mod 2 l ;

[0036] Step S214: Output on the participant P1 side 1 ， 1 ， <c> 1 .

[0037] The present invention focuses on the demand for improving the efficiency of multiplication triples calculation and communication, and aims at the problems of low communication and calculation efficiency of multiplication triples and the inability to efficiently generate multiplication triples on a ring in large quantities. A batched ring multiplication triple generation method based on NTRU is proposed. The method first designs a homomorphic encryption scheme NtruHE based on the determination type NTRU difficulty problem to support operations such as homomorphic addition Ntru.Add, homomorphic plaintext addition NtruHE.AddPlain, and homomorphic plaintext multiplication NtruHE.MultPlain. Then, a two-party batched ring multiplication triple generation protocol is proposed. The parties P of the protocol are 0 Generate an instantiated homomorphic encryption scheme NtruHE and randomly select two n-dimensional vectors on the ring as their own secret shares< / c> 0 ， 0 , generate two ciphertexts ct by packing encoding and encryption a，0 ,ct b，0 , and the public parameters, public key, ciphertext ct a，0 and Ct b，0 Send to another participant P 1 ;Participant P 1 Randomly select two n-dimensional vectors on the ring as its own secret shares 1 ， 1 , and select an n-dimensional random number vector r on a ring with a larger modulus as a mask, and calculate it in the encrypted state 0 · 1 + 1 · 0 +r's ciphertext ct d , and ct d Sent to participant P 0 ;Participant P 1 , P 0 Using packed decoding and SIMD technology, after performing a series of homomorphic computing and decryption operations, the participant P 0 Get the share of the product of the elements at the same position in vectors a and b <c> 0 , participant P 1 Get the other share of the product <c> 1 ,The triple generation protocol proposed in this invention has excellent computation and communication efficiency and quantum ,security.

[0038] In summary, the beneficial technical effects of the present invention are:

[0039] (1) The generation of multiplication triples is more efficient. The batch multiplication triple generation method based on NTRU proposed in the present invention reduces the communication overhead to 3 polynomial ring elements and the computational overhead to multiplication on the polynomial ring and addition on the polynomial ring twice, which greatly improves the efficiency.

[0040] (2) The adaptability of the generation of triples by multiplication on the ring is stronger. The present invention designs a homomorphic encryption scheme based on the NTRU mathematical difficulty problem and realizes the ring The secure multi-party computing on the network is more in line with the computing model of modern computing systems and has stronger adaptability;

[0041] (3) Multiplication triplets can be generated in large quantities. The present invention takes into account secure multi-party computation on the ring and applies the Chinese remainder theorem to the protocol by utilizing the relationship between parameters. It implements a single instruction multiple output stream to support a single protocol execution and can generate even thousands of multiplication triplets. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] < / c> < / c> Figure 1 It is a flowchart of a method for generating batched ring multiplication triples based on NTRU provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] Multiplication triples are key components of a secure multi-party computing protocol based on secret sharing, and are used to assist multiple participants in performing multiplication calculations. This paper focuses on the need to improve the efficiency of multiplication triple calculation and communication, and aims to address the problems of low efficiency of multiplication triple communication and calculation, and the inability to efficiently generate multiplication triples on a ring in large quantities. A batch multiplication triple generation method on a ring based on NTRU is proposed. This method has two participants P 0 , P 1 , firstly, the participant P 0 Instantiate the NTRU cryptographic scheme and send the public parameters and public key to another party P 1 , both parties randomly select a share vector on the integer ring, P 0 Select 0 ， 0 , P 1 Select 1 ， 1 , and then generate multiplication triplets in batches through a series of ciphertext calculations and plaintext calculations.

[0046] First, the relevant symbols of the present invention are described as follows:

[0047] For positive integers make represents the remainder class of integers modulo q, symbol Indicates approximate rounding. If the decimal part of a is 0.5, then Take the integer part, the positive integer N is a power of 2, that is, there is an integer Let N = 2 k , then x N +1 is a 2N-order cyclotomic polynomial, then the ring is a cyclotomic polynomial ring. Any element a on R can be regarded as a unique polynomial with a degree less than N and x N +1. For convenience, we can use the polynomial Represents the elements on R, and its coefficient vector is (a 0 , a 1 , ..., a N-1 ), for any integer There is a business ring

[0048] When A is a set, x←A means randomly selecting an element x from the set A. When χ is a probability distribution, x←χ means randomly sampling an element x from the probability distribution χ. When f is a function, x←f means the output of function f.

[0049] The m parties in the protocol use P 0 , P 1 ,…,P m-1 To indicate that for an element symbol represents the secret share a of all participants for a 0 、a 1 , …, a m-1 , participant P i Holds secret share a i , expressed as i , i = 0, 1, ..., m-1, which satisfies a 0 +a 1 +…+a m-1 =a mod 2 l .

[0050] The present invention proposes a batch ring multiplication triple generation method based on NTRU, which includes the following steps:

[0051] Step S1, designing a homomorphic encryption scheme NtruHE based on the decision-type NTRU difficulty problem, wherein the homomorphic encryption scheme supports homomorphic addition Ntru.Add, homomorphic plaintext addition NtruHE.AddPlain, and homomorphic plaintext multiplication NtruHE.MultPlain operations;

[0052] Step S2: Implement the ring multiplication triple generation protocol based on the homomorphic encryption scheme NtruHE, and set two participants, namely P 0 and P 1 , participant P 0 Generate an instantiated homomorphic encryption scheme NtruHE and randomly select two n-dimensional vectors on the ring as their own secret shares 0 ， 0 , generate two ciphertexts ct by packing encoding and encryption a,0 ,ct b，0 , and the public parameters, public key, ciphertext ct a,0 and ct b,0 Send to another participant P 1 ;Participant P 1 Randomly select two n-dimensional vectors on the ring as its own secret shares 1 ， 1 , and select an n-dimensional random number vector r on a ring with a larger modulus as a mask, and calculate it in the encrypted state 0 · 1 + 1 · 0 +r's ciphertext ct d , and ct d Sent to participant P 0 ;Participant P 1 , P 0 Using packed decoding and SIMD (single instruction multiple data) technology, after performing a series of homomorphic computing and decryption operations, the participant P 0 Get the share of the product of the elements at the same position in vectors a and b <c> 0 , participant P 1 Get the other share of the product <c> 1 .

[0053] Among them, the NTRU difficulty problem is assumed to be:

[0054] NTRU sampling: In the distribution χ σ f and g are randomly selected on R q It is reversible, taking f as the secret information, and calculating h = g·f -1 , we get NTRU N，q，σ (f) sampling h;

[0055] Decisional_NTRU N，q，σ :Let integer N>0,q>0, real number σ>0, in discrete Gaussian distribution Select f as an element on R, and f is in R q It is reversible, taking f as the secret information, and selecting from the discrete Gaussian distribution As an element on R, h = g·f -1 mod q forms a probability distribution NTRU N，q，σ (f) Differentiate between NTRU N，q，σ (f) and random uniform distribution u←R q .

[0056] Decisional_NTRU N，q，σ It is a mathematically difficult problem that can be used to construct public key encryption, key agreement, homomorphic encryption and other schemes.

[0057] The homomorphic encryption scheme NtruHE designed in step S1 is specifically:

[0058] Establish the algorithm NtruHE.Setup(1 λ ):Input the security parameter λ, according to the decisional NTRU problem Decisional_NTRU N，q，σ , generate parameters Params = (N, q, σ, B, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an integral ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, t represents the plaintext modulus,

[0059] Key generation algorithm NtruHE.KeyGen(Params): Input parameter Params, randomly selected For discrete Gaussian distribution, calculate f = tf′ + 1, determine whether f is reversible, if not, reselect f′ until f is reversible, set the key sk = f, and randomly select Calculate h = g·f -1 mod q;

[0060] Encryption algorithm NtruHE.Enc(pk, m): Input plaintext m∈R t , randomly selected Calculate the ciphertext ct = u·h+Δ·m mod q;

[0061] Decryption algorithm NtruHE.Dec(sk, ct): Input ciphertext ct and decryption key sk, calculate and output

[0062] Homomorphic addition NtruHE.Add(ct 0 , ct 1 ): Enter two ciphertexts ct 0 ,ct 1 ∈R q , calculate and output ct Add =ct 0 +ct 1 mod q;

[0063] Homomorphic plaintext addition NtruHE.AddPlain(ct,pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct AddPlain = ct + Δ·pt mod q;

[0064] Homomorphic plaintext multiplication NtruHE.MultPlain(ct, pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain =ct·pt mod q.

[0065] In step S2, the packing code is applied to the homomorphic encryption scheme NtruHE scheme, specifically:

[0066] Packed encoding NtruHE.PackEncoding(a): Input a vector is an n-dimensional vector, each element in the vector is within the range modulo t, the number of plaintext slots in, is the Euler function, ord means t in the group The order in, using packing coding to calculate and output the plaintext pt∈R t ;

[0067] Pack decoding NtruHE.PackDecoding(pt): Input a plaintext pt∈R t , using packed decoding to calculate and output vector

[0068] In step S2, the ring multiplication triple generation protocol is implemented based on the homomorphic encryption scheme NtruHE, specifically:

[0069] Step S21: Participant P 0 According to the security parameter λ, call the establishment algorithm NtruHE.Setup(1 λ ), generate public parameters Params;

[0070] Step S22: Participant P 0 Call the key generation algorithm NtruHE.KeyGen(Params) to generate a public-private key pair (sk, pk), and send the public parameters Params and public key pk to the participant P 1 ;

[0071] Step S23: Participant P 0 exist Randomly select two n-dimensional vectors as participants P 0 Shares held< / c> < / c> 0 ， 0 ∈

[0072] Step S24: Participant P 0 Use package encoding to convert the shares 0 ， 0 Encoded into two plaintexts: pt a,0 =NtruHE.PackEncoding( 0 ),pt b,0 =NtruHE.PackEncoding( 0 );

[0073] Step S25: Participant P 0 Enter the public key pk to the plaintext pt a,0 ,pt b，0 Execute encryption and call the encryption algorithm to generate two homomorphic ciphertexts: ct a,0 =NtruHE.Enc(pk,pt a,0 ), ct b,0 =NtruHE.Enc(pk,pt b,0 ), and the generated ciphertext ct a,0 and ct b，0 Sent to participant P 1 ;

[0074] Step S26: Participants P 1After receiving the public parameters Params and public key pk, Randomly select two n-dimensional vectors as participants P 1 Shares held

[0075] Step S27: Participant P 1 Use package encoding to convert the shares 1 ， 1 Encoded into two plaintexts: pt a,1 =NtruHE.PackEncoding( 1 ),pt b，1 =NtruHE.PackEncoding( 1 );

[0076] Step S28: Participant P 1 exist Randomly select an n-dimensional vector r and encode r into plaintext pt using packing encoding r =NtruHE.PackEncoding(r);

[0077] Step S29: Participant P 1 Received ciphertext ct a,0 and ct b，0 After that, perform homomorphic calculation to obtain two ciphertexts ct aob1 =NtruHE.MultPlain(ct a,0 , pt b,1 ), ct b0a1 =NtruHE.MultPlain(ct b,0 , pt a,1 ), ct d =NtruHE.AddPlain(NtruHE.Add(ct a0b1 , ct b0a1 ), pt r ), and calculate the result ct d Sent to participant P 0 ;

[0078] Step S210: Participant P 0 Received ciphertext ct d After that, enter the private key sk and ciphertext ct d Decryption and packaging decoding: Pt d =NtruHE.Dec(sk,ct d ), d=NtruHE.PackDecoding(pt d )mod 2 l ;

[0079] Step S211: Participant P 0 Calculate the product share held in encrypted state: <c> 0 ＝< / c> 0 · 0 +d mod2 l ;

[0080] Step S212: At the participant P 0 Side output 0 ， 0 ， <c> 0 ;

[0081] Step S213: Execute calculation <c> 1 ＝< / c> < / c> 1 · 1 -r mod 2 l ;

[0082] Step S214: Output on the participant P1 side 1 ， 1 ， <c> 1 .

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.< / c>

Claims

1. A batch ring multiplication triple generation method based on NTRU, characterized in that: The method comprises: Step S1, designing a homomorphic encryption scheme NtruHE based on the decision-type NTRU difficulty problem, wherein the homomorphic encryption scheme supports homomorphic addition Ntru.Add, homomorphic plaintext addition NtruHE.AddPlain, and homomorphic plaintext multiplication NtruHE.MultPlain operations; Step S2, based on the homomorphic encryption scheme NtruHE, implement the ring multiplication triple generation protocol. Set two participants, P0 and P1. Participant P0 generates an instantiated homomorphic encryption scheme NtruHE and randomly selects two n-dimensional vectors on the ring as its own secret shares. 0, 0, generate two ciphertexts ct by packing encoding and encryption a，0 ,ct b，0 , and the public parameters, public key, ciphertext ct a，0 and ct b，0 Sent to another participant P1; participant P1 randomly selects two n-dimensional vectors on the ring as its own secret share 1, 1, and select an n-dimensional random number vector r on a ring with a larger modulus as a mask, and calculate in the encrypted state 0· 1+ 1· 0+r ciphertext ct d , and ct d Sent to participant P0; after participants P1 and P0 use packed decoding and single instruction multiple data (SIMD) technology to perform a series of homomorphic calculations and decryption operations, participant P0 obtains a share of the product of the elements at the same position of vectors a and b <c>0, party P1 gets the other share of the product <c> 1。< / c> < / c> 2. The method according to claim 1, characterized in that The designed homomorphic encryption scheme NtruHE is: Establish the algorithm NtruHE.Setup(1 λ ):Input the security parameter λ, according to the decisional NTRU problem Decisional_NTRU N，q，σ , generate parameters Params = (N, q, σ, l, t, Δ), so that the complexity of solving the difficult problem is not less than 2 λ , where N represents an integral ring The degree of the generating polynomial, q represents the ciphertext modulus, σ represents the standard deviation of the discrete Gaussian distribution, t represents the plaintext modulus, Key generation algorithm NtruHE.KeyGen(Params): Input parameter Params, from discrete Gaussian distribution Randomly select f′, calculate f=tf′+1, determine whether f is reversible, if not, reselect f′ until f is reversible, let the key sk=f, and select the key from the discrete Gaussian distribution Randomly select g and calculate h = g·f -1 mod q; Encryption algorithm NtruHE.Enc(pk, m): Input plaintext m∈R t , from a discrete Gaussian distribution Randomly select u from the ciphertext and calculate the ciphertext ct = u·h+Δ·m mod q; Decryption algorithm NtruHE.Dec(sk, ct): Input ciphertext ct and decryption key sk, calculate and output Homomorphic addition NtruHE.Add(ct0, ct1): Input two ciphertexts ct0, ct1∈R q , calculate and output ct Add = ct0 + ct1 mod q; Homomorphic plaintext addition NtruHE.AddPlain(ct, pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct AddPlain = ct + Δ·pt mod q; Homomorphic plaintext multiplication NtruHE.MultPlain(ct, pt): Input ciphertext ct∈R q and a plaintext pt∈R t , calculate and output ct MultPlain =ct·pt mod q.

3. The method according to claim 1, characterized in that In step S2, the packing code is applied to the homomorphic encryption scheme NtruHE, specifically: Packed encoding NtruHE.PackEncoding(a): Input a vector Number of plaintext slots in, is the Euler function, ord means t in the group The order in is calculated and the plaintext pt∈R is output using packing coding t ; Pack decoding NtruHE.PackDecoding(pt): Input a plaintext pt∈R t , using packed decoding to calculate and output vector 4. The method according to claim 3, characterized in that In step S2, the ring multiplication triple generation protocol is implemented based on the homomorphic encryption scheme NtruHE, which specifically includes: Step S21: The participant P0 calls the establishment algorithm NtruHE.Setup(1 λ ), generate public parameters Params; Step S22: Participant P0 calls the key generation algorithm NtruHE.KeyGen(Params) to generate a public-private key pair (sk, pk), and sends the public parameters Params and the public key pk to participant P1; Step S23: Participant P0 Randomly select two n-dimensional vectors as the shares held by participant P0 Step S24: Participant P0 uses packaging coding to 0, 0 is encoded as two plaintexts: pt a，0 =NtruHE.PackEncoding( 0),pt b，0 =NtruHE.PackEncoding( 0)； Step S25: Participant P0 inputs the public key pk to the plaintext pt a，0 ,pt b，0 Execute encryption and call the encryption algorithm to generate two homomorphic ciphertexts: ct a，0 =NtruHE.Enc(pk,pt a，0 ), ct b，0 =NtruHE.Enc(pk,pt b，0 ), and the generated ciphertext ct a，0 and ct b，0 Sent to participant P1; Step S26: After receiving the public parameters Params and public key pk, the participant P1 Randomly select two n-dimensional vectors as the shares held by participant P1 Step S27: Participant P1 uses packaging coding to 1, 1 is encoded into two plaintexts: pt a，1 =NtruHE.PackEncoding( 1),pt b，1 =NtruHE.PackEncoding( 1)； Step S28: Participant P1 Randomly select an n-dimensional vector r and encode r into plaintext pt using packing encoding r =NtruHE.PackEncoding(r); Step S29: Participant P1 receives the ciphertext ct a，0 and ct b，0 After that, perform homomorphic calculation to obtain two ciphertexts ct a0b1 =NtruHE.MultPlain(ct a，0 , pt b，1 ), ct b0a1 =NtruHE.MultPlain(ct b，0 , pt a，1 ), ct d =NtruHE.AddPlain(NtruHE.Add(ct a0b1 , ct b0a1 ), pt r ), and calculate the result ct d Sent to participant P0; Step S210: Participant P0 receives the ciphertext ct d After that, enter the private key sk and encrypt the ciphertext ct d Decrypt and package and decode: pt d =NtruHE.Dec(sk,ct d ), d=NtruHE.PackDecoding(pt d )mod2 l ; Step S211: Participant P0 calculates the product share it holds in an encrypted state: <c> 0＝< / c> 0· 0+d mod 2 l ; Step S212: Output at participant P0 0, 0, <c> 0；< / c> Step S213: Execute calculation <c> 1＝< / c> 1· 1-r mod 2 l ; Step S214: Output on the participant P1 side 1, 1, <c> 1。< / c>

Images