A quantum-resistant cryptographic migration method, electronic device, and medium based on FIDO2 protocol

Abstract

The present invention discloses a quantum-resistant password migration method, electronic device, and medium based on the FIDO2 protocol, including: the interaction between the authenticator and the client implements key encapsulation based on the Kyber algorithm; the registration phase and the authentication phase are completed through the interaction of the authenticator, the client, and the server; the registration phase is the first time that the user creates an identity credential on the server, and the public key is generated and stored using the Dilithium quantum-resistant signature algorithm or the Falcon quantum-resistant signature algorithm; the authentication phase is the user logging in on the server, and using the credential created in the registration phase for identity authentication. The present invention introduces the Kyber quantum-resistant encryption algorithm and the Dilithium / Falcon quantum-resistant digital signature algorithm into the FIDO2 protocol, ensuring that the confidentiality, integrity, and reliability of authentication of communications can continue to be guaranteed in a quantum computing environment, and significantly improving the quantum-resistant security of the FIDO2 protocol.

Description

Technical Field

[0001] The present invention belongs to the technical fields of information security, cryptography and identity authentication, and in particular relates to a quantum cryptographic migration-resistant method, electronic device and medium based on the FIDO2 protocol. Background Art

[0002] With the rapid development of quantum computing technology, traditional public key cryptographic algorithms based on complex mathematical problems, such as RSA and elliptic curve cryptography (ECC), face unprecedented security threats. Quantum computers can crack these encryption algorithms in polynomial time through Shor's algorithm, thus invalidating the security protocols based on these algorithms. This problem poses a major challenge to modern Internet security and identity authentication mechanisms. The currently widely used FIDO2 protocol relies on algorithms such as ECC and RSA to ensure secure communication and identity authentication. However, under the threat of quantum computing, these algorithms will no longer be secure.

[0003] In order to cope with the security risks brought by quantum computing, quantum-resistant cryptography has quickly become a frontier field of cryptographic research. Quantum-resistant cryptographic algorithms ensure data security in future quantum computer environments by designing encryption and signature algorithms using mathematical problems that are difficult to crack by quantum computers. For example, Kyber is a lattice-based quantum-resistant encryption algorithm, and Dilithium and Falcon are lattice-based quantum-resistant digital signature schemes. However, the existing FIDO2 protocol does not yet natively support the integration of these quantum-resistant algorithms.

[0004] The current FIDO2 protocol relies on a challenge-response mechanism based on public key cryptography to ensure secure communications between users and service providers. In CTAP (Client to Authenticator Protocol) communications, traditional public key cryptography is used to transmit encryption keys and authentication data to ensure that data is not stolen or tampered with during transmission. At the same time, digital signatures are used to verify user identity and ensure data integrity. However, with the improvement of quantum computing capabilities, communications based on traditional public key cryptography will no longer be secure, and there is an urgent need to introduce quantum-resistant cryptographic algorithms.

[0005] The existing FIDO2 protocol is not secure enough in the face of quantum computing threats, and traditional public key encryption algorithms and digital signature algorithms cannot guarantee data security in a quantum computing environment. Specifically, the existing FIDO2 protocol relies on traditional public key encryption algorithms such as RSA and ECC and signature algorithms such as ECDSA and EDDSA, which will become unsafe under the attack of quantum computers.

[0006] In addition, the problems faced by existing technologies also include how to migrate from traditional cryptographic technology to quantum-resistant cryptographic technology in a smooth transition, while also considering issues such as hot migration, rollback, and flexible switching under different requirements. Upgrading algorithms without destroying existing systems while ensuring compatibility and system stability is also a difficulty of current technology. Traditional cryptographic algorithms and quantum-resistant cryptographic algorithms usually differ in performance, computational complexity, and hardware requirements, which makes direct replacement costly and complex. In particular, directly integrating quantum-resistant algorithms in the FIDO2 protocol requires solving the problem of how to achieve hybrid encryption and flexible algorithm switching without significantly modifying the existing protocol framework. Summary of the invention

[0007] In view of this, the present invention provides a quantum cryptographic migration-resistant method, electronic device, and medium based on the FIDO2 protocol.

[0008] In a first aspect, an embodiment of the present invention provides a quantum-resistant cryptographic migration method based on the FIDO2 protocol, which is applied to a client. The method specifically includes:

[0009] The client uses the first public key pk 1 Operate a randomly generated sequence to obtain the first shared key K 1 and ciphertext ct, and return the ciphertext ct to the authenticator; 1 and the second shared key K 2 As the shared session key K, thus completing the key encapsulation;

[0010] Among them, the first public key pk 1 The authenticator uses the Kyber algorithm to generate the first public-private key pair (pk 1 ,sk 1 ) obtained; the second shared key K 2 The authenticator uses the first private key sk 1 Obtained by decapsulating the ciphertext ct;

[0011] In response to the registration request initiated by the user, the client submits a registration request to the server; receives the first challenge and user metadata sent by the server, encrypts the first challenge and user metadata using the shared session key K, and sends them to the authenticator; receives the registration response sent by the authenticator, decrypts the registration response using the shared session key K, and uploads it to the server;

[0012] The registration response is the authenticator using the shared session key K to register the second public key pk 2 , first signature sig 1 And the second public key pk encrypted by user metadata 2The authenticator generates a pair of second public and private keys (pk 2 ,sk 2 ) obtained; the first signature sig 1 The authenticator uses the second private key sk 2 For the first challenge, the second public key pk 2 And the user metadata is signed;

[0013] In response to the authentication request initiated by the user, the client sends a login request to the server; receives the second challenge and user metadata sent by the server, encrypts the second challenge and user metadata with the shared session key K and sends them to the authenticator; receives the second signature sig returned by the authenticator and encrypted with the shared session key K 2 , user metadata and authenticator data are decrypted using the shared session key K and packaged and sent to the server;

[0014] Among them, the second signature sig 2 Utilize the second private key sk for the authenticator 2 The second challenge, user metadata and authenticator data are signed; the second private key sk 2 The authenticator generates a pair of second public and private keys (pk 2 ,sk 2 ); the second challenge is generated by the server in response to the login request sent by the client.

[0015] In a second aspect, an embodiment of the present invention provides a quantum-resistant cryptographic migration method based on the FIDO2 protocol, which is applied to a server. The method specifically includes:

[0016] In response to the registration request sent by the client, a first challenge is generated, and the first challenge and user metadata are returned to the client; a registration response sent by the client and decrypted by the shared session key K is received, and the second public key pk is used to decrypt the registration response. 2 Verify the first signature sig 1 Is it valid, the second public key pk 2 And the first signature sig 1 The second public key pk obtained by signature verification 2 Is it consistent? 、 Whether the authenticator data is valid; when the verification is passed, an authentication success signal is sent and the public key pk is stored 2 and authenticator data;

[0017] The registration response is the authenticator using the shared session key K to register the second public key pk 2 , first signature sig 1 And the second public key pk encrypted by user metadata2 The authenticator generates a pair of second public and private keys (pk 2 ,sk 2 ) obtained; the first signature sig 1 The authenticator uses the second private key sk 2 For the first challenge, the second public key pk 2 And the user metadata is signed;

[0018] The shared session key K and the first shared key K 1 , the second shared key K 2 Same; first shared key K 1 The ciphertext ct is the first public key pk sent by the client receiving the authenticator 1 And use the first public key pk 1 The second shared key K is generated by operating a randomly generated sequence; 2 The authenticator uses the first private key sk 1 Decapsulate the ciphertext ct to obtain the first public key pk 1 and the first private key sk 1 The authenticator uses the Kyber algorithm to generate the first public-private key pair (pk 1 ,sk 1 ) obtained;

[0019] In response to the login request sent by the client, a second challenge is generated, and the second challenge and the user metadata are returned to the client; the second signature sig sent by the client after being decrypted by the shared session key K is received; 2 , user metadata and authenticator data, using the second public key pk stored during the registration phase 2 For the second signature sig 2 Perform verification; when verification succeeds, send an authentication success signal;

[0020] Among them, the second signature sig 2 Utilize the second private key sk for the authenticator 2 The second challenge, user metadata and authenticator data are signed; the second private key sk 2 The authenticator generates a pair of second public and private keys (pk 2 ,sk 2 ) obtained.

[0021] In a third aspect, an embodiment of the present invention provides a quantum-resistant cryptographic migration method based on the FIDO2 protocol, which is applied to a server. The method specifically includes:

[0022] Applied to an authenticator, the method specifically comprises:

[0023] The authenticator uses the Kyber algorithm to generate the first public-private key pair (pk 1 ,sk 1 ), and the first public key pk 1 Send to the client; use the first private key sk 1 Decapsulate the ciphertext ct and obtain the second shared key K 2 ; The first shared key K 1 and the second shared key K 2 As the shared session key K, thus completing the key encapsulation;

[0024] Among them, the first shared key K 1 and the ciphertext ct are both the first public key pk sent by the client using the authenticator 1 Obtained by operating on a randomly generated sequence;

[0025] Receive the first challenge and user metadata encrypted by the shared session key K sent by the client, and decrypt the encrypted first challenge and user metadata using the shared session key K; use the quantum-resistant signature algorithm to generate a pair of second public-private keys (pk 2 ,sk 2 );Use the second private key sk 2 For the first challenge, the second public key pk 2 , user metadata is signed to generate the first signature sig 1 ; The second public key pk 2 , first signature sig 1 and the credential data is encrypted with the shared session key K and sent to the client as a registration response;

[0026] Use the shared session key K to decrypt the encrypted second challenge and user metadata, and obtain the second private key sk generated in the registration phase according to the credential ID in the user metadata 2 ; Using the second private key sk 2 Sign the second challenge, user metadata, and authenticator data to generate the second signature sig 2 ; The second signature sig 2 , user metadata, and authenticator data are encrypted with the shared session key K and sent to the client.

[0027] In a fourth aspect, an embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-mentioned anti-quantum cryptographic migration method based on the FIDO2 protocol.

[0028] In a fifth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned quantum-resistant cryptographic migration method based on the FIDO2 protocol.

[0029] In a sixth aspect, an embodiment of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-mentioned FIDO2 protocol-based anti-quantum cryptographic migration method.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] (1) This invention introduces the Kyber quantum-resistant encryption algorithm and the Dilithium / Falcon quantum-resistant digital signature algorithm into the FIDO2 protocol, effectively solving the problem that traditional public key encryption based on the RSA / ECC algorithm and digital signature based on ECDSA / EDDSA are insecure under quantum computing attacks. The new solution can continue to ensure the confidentiality, integrity and reliability of communication and authentication in a quantum computing environment, significantly improving the quantum-resistant security of the protocol.

[0032] (2) The present invention implements interface encapsulation of the Dilithium anti-quantum signature algorithm or the Falcon anti-quantum signature algorithm to achieve pluggability and modularity, ensuring that the existing system can achieve a smooth transition without large-scale transformation. Hybrid encryption allows the traditional algorithms in the system to be gradually replaced, ensuring that the system can still maintain efficient operation before the advent of the quantum computing era. At the same time, it simplifies the algorithm migration process, avoids the compatibility and stability issues that may be caused by sudden transition, and provides a practical, economical and easy-to-implement anti-quantum solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0034] Figure 1 A schematic diagram of a quantum-resistant cryptographic migration method based on the FIDO2 protocol provided in an embodiment of the present invention;

[0035] Figure 2 A schematic diagram of a key encapsulation stage of a quantum-resistant cryptographic migration method based on the FIDO2 protocol provided in an embodiment of the present invention;

[0036] Figure 3A schematic diagram of the registration phase of the quantum-resistant cryptographic migration method based on the FIDO2 protocol provided by an embodiment of the present invention;

[0037] Figure 4 A schematic diagram of the anti-quantum cryptographic migration method based on the FIDO2 protocol in the authentication stage provided by an embodiment of the present invention;

[0038] Figure 5 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] It should be noted that, in the absence of conflict, the features in the following embodiments and implementations may be combined with each other.

[0041] The present invention provides a quantum-resistant cryptographic migration method based on the FIDO2 protocol. The present invention aims to enhance the current FIDO2 (Fast Identity Online) protocol and improve its security in the quantum computing era by introducing quantum-resistant cryptographic algorithms. The technical solution of the invention is mainly used in the fields of identity authentication, key management, data encryption and digital signature, and is particularly suitable for scenarios with extremely high security requirements, such as network identity authentication, online transactions, IoT device authentication, digital asset protection, etc.

[0042] Specifically, Figure 1 As shown, the specific steps of a quantum cryptographic migration method based on the FIDO2 protocol provided by the present invention include:

[0043] Step S1, when the authenticator establishes a secure connection with the client, it is based on the key encapsulation phase based on the Kyber algorithm.

[0044] Specifically, Figure 2 As shown, the key encapsulation phase specifically includes the following steps:

[0045] Step S101: The authenticator generates a first public-private key pair (pk 1 ,sk 1 ), and the first public key pk 1 Sent to the client.

[0046] Step S102: The client receives the first public key pk sent by the authenticator. 1, and use the first public key pk 1 Using the first public key pk 1 Operate a randomly generated sequence to obtain the first shared key K 1 and ciphertext ct, return the ciphertext ct to the authenticator, and the first shared key K 1 Saved on the client.

[0047] Step S103, the authenticator uses the first private key sk 1 Decapsulate the ciphertext ct to obtain the second shared key K 2 ; The client confirms the first shared key K 1 Shared key K with the second 2 The same, the first shared key K 1 Shared key K with the second 2 As the shared session key K between the client and the authenticator, K = K 1 = K 2 .

[0048] It should be noted that in this example, the shared session key K generated by Kyber is used to encrypt sensitive data transmitted between the client and the authenticator, such as authentication requests, signature results, etc. In theory, the first shared key K 1 Shared key K with the second 2 Similarly, this can prevent the shared session key K from being intercepted when it is directly transmitted.

[0049] Step S2: creating identity credentials for the first time on the server according to the registration request sent by the user.

[0050] Specifically, Figure 3 As shown, the registration phase specifically includes the following steps:

[0051] Step S201: In response to a registration request from a user, the client sends a registration request to a server.

[0052] Step S202: The server generates a first challenge in response to the registration request sent by the client, and returns the first challenge and user metadata to the client.

[0053] The first challenge is a random number or encrypted data, and the challenge is a one-time data used to ensure the uniqueness of the request and prevent replay attacks. The user metadata includes the user ID and the domain name of the server (RelyingParty ID, RP ID), as shown in Table 1 below:

[0054] Table 1: User metadata table

[0055]

[0056] Step S203: the client receives the first challenge and user metadata sent by the server, encrypts the first challenge and user metadata using the shared session key K, and forwards the first challenge and user metadata encrypted by the shared session key K to the authenticator.

[0057] Step S204: The authenticator receives the first challenge and user metadata encrypted by the shared session key K sent by the client, and decrypts the encrypted first challenge and user metadata using the shared session key K; generates a pair of second public-private keys (pk 2 ,sk 2 );Use the second private key sk 2 For the first challenge, the second public key pk 2 , user metadata is signed to generate the first signature sig 1 ; The second public key pk 2 , first signature sig 1 The credential data is encrypted with the shared session key K and sent to the client as a registration response.

[0058] Among them, the second private key sk 2 will be securely stored in the authenticator, and the second public key pk 2 Will be used for authentication on the server side. The signature sig is used to prove that the authenticator has passed the challenge and generated a valid public key.

[0059] Furthermore, the credential data includes a credential ID and authenticator data.

[0060] It should be noted that the Authenticator Data is an important data structure generated by the authenticator in the FIDO2 protocol and returned to the client or server. It contains key security information related to the authentication operation, ensuring the legitimacy of the authentication request and the security and integrity of the entire identity authentication process.

[0061] The authenticator data includes at least one or more of: RP ID Hash, Flags, Signature Counter, and extended data (such as geographic location or device status); RP ID Hash is the SHA-256 hash value of the RP ID, which is used to verify that the authentication operation is bound to a specific service; Flags is used to describe the user interaction status (such as touching the authenticator or verifying through a PIN); Signature Counter is a counter to prevent replay attacks.

[0062] Step S205: The client receives the registration response sent by the authenticator, decrypts the registration response using the shared session key K, and sends it to the server.

[0063] Step S206: After receiving the registration response, the server will use the second public key pk 2 Verify the first signature sig returned by the authenticator 1 Is it valid? Verify the second public key pk 2 And the first signature sig 1 The second public key pk obtained by signature verification 2 Whether it is consistent, whether the authenticator data (such as the device binding key AAGUID, etc.) is valid, after verification, the server will send the public key pk 2 and authenticator data for future authentication attempts.

[0064] Furthermore, it also includes: verifying whether the credential ID and the server domain name RP ID in the user metadata are consistent.

[0065] Step S3, based on the authentication request sent by the user, log in to the server and use the identity credentials created during the registration phase to perform identity authentication.

[0066] Specifically, Figure 4 As shown, the authentication phase includes the following steps:

[0067] Step S301: In response to the user's authentication request, the client sends a login request to the server.

[0068] Step S302: The server receives the login request sent by the client, generates a second challenge, and returns the second challenge and user metadata to the client.

[0069] The second challenge is a random number or an encrypted challenge, which is used to ensure the uniqueness of the request and prevent replay attacks. The user metadata includes a credential ID.

[0070] Step S303: The client receives the second challenge sent by the server, and encrypts the second challenge and user metadata with the shared session key K and sends them to the authenticator.

[0071] Step S204: The authenticator uses the shared session key K to decrypt the encrypted second challenge and user metadata, and obtains the second private key sk generated during the registration phase according to the credential ID in the user metadata. 2 ; Using the second private key sk 2 Sign the second challenge, user metadata, and authenticator data to generate the second signature sig 2 , the second signature sig 2It is the authenticator's proof of the user's identity, ensuring that the user is the legal owner of the credential. 2 , user metadata, and authenticator data are encrypted with the shared session key K and sent to the client.

[0072] Step S205: The client sends the second signature sig returned by the authenticator. 2 , user metadata and authenticator data are decrypted using the shared session key K and packaged and sent to the server.

[0073] Step S206: The server receives the decrypted second signature sig transmitted by the client. 2 , user metadata and authenticator data, using the second public key pk stored during the registration phase 2 The second signature sig returned by the authenticator 2 Verify. The server verifies the second signature sig 2 The server verifies the validity of the credential and checks the matching of the credential ID in the user metadata to ensure the authenticity of the user's identity. If the signature verification passes, the server confirms that the user is the legal owner of the credential and sends an authentication success signal to the user, who can then log in. If the signature verification fails, the authentication fails.

[0074] It should be noted that in the anti-quantum migration process provided in this example, only the data transmission between the authenticator and the client is encrypted, and the data transmission between the client and the server is not encrypted. This is mainly because the communication between the authenticator and the client may be carried out through an insecure connection, such as Bluetooth, USB, NFC and other interfaces, especially when the authenticator is an external device. This physical connection is vulnerable to threats such as man-in-the-middle attacks. Therefore, it is very important to protect the communication security of this path. The data transmission between the client and the server is carried out through HTTPS (based on the TLS protocol). TLS already provides end-to-end encryption for this path, ensuring the confidentiality, integrity and authentication of the data. Because TLS has effectively protected this communication path, the FIDO2 protocol itself does not need to add an additional encryption layer on top of it. And with the advancement of the standardization process of anti-quantum algorithms, the industry already has many mature TLS protocol implementation methods that support anti-quantum, which will not be repeated in this example.

[0075] Furthermore, the present invention chooses to use Kyber to replace public key encryption algorithms such as RSA / ECC in the FIDO2 protocol, and Dilithium / Falcon to replace traditional digital signature algorithms such as ECDSA / EDDSA in the FIDO2 protocol. Since NIST started the process of standardizing quantum-resistant cryptographic algorithms in 2016, it has standardized four algorithms: Kyber, Dilithium, Falcon, and SPHINCS+. These four algorithms are widely recognized and regarded as reliable choices for secure communications and authentication.

[0076] The Kyber algorithm is an encryption algorithm based on lattice cryptography with high efficiency and security. It provides a fast key generation and encryption process, providing higher performance for authentication while ensuring security. The Dilithium and Falcon algorithms are lattice-based digital signature algorithms with the characteristics of resistance to quantum computing attacks. They provide strong signature verification capabilities and have advantages in resisting the various risks faced by traditional digital signature algorithms. The selection of these three algorithms is based on considerations of security, efficiency, and future security. They have been rigorously evaluated and reviewed during the standardization process of NIST and are considered to be algorithms that can meet current and future cryptographic challenges.

[0077] In contrast, the reason why the SPHINCS+ algorithm was not selected is that the SPHINCS+ algorithm has poor performance in the key generation and signing process, especially in resource-constrained environments. In addition, the SPHINCS+ algorithm may have some shortcomings in some aspects, such as speed and efficiency, compared to the Kyber, Dilithium and Falcon algorithms. Therefore, in order to achieve better performance and security in the FIDO2 protocol, the Kyber, Dilithium and Falcon algorithms were selected to implement quantum-resistant cryptographic algorithm migration.

[0078] The quantum-resistant cryptographic algorithm in the present invention adopts a pluggable design. All required quantum-resistant algorithms are implemented in CTAP in advance, allowing the selection of appropriate post-quantum cryptographic algorithms according to different application scenarios. Users or developers can dynamically select algorithm modules through configuration parameters to support flexible replacement and expansion of quantum-resistant cryptographic algorithms. For example, users can choose to use Kyber for key encapsulation or Dilithium for signing by modifying the configuration file. In a hybrid encryption environment, the system can support both traditional cryptographic algorithms and quantum-resistant cryptographic algorithms, facilitating the post-quantum migration of the system.

[0079] In summary, the anti-quantum cryptographic migration method based on the FIDO2 protocol provided by the present invention can solve the potential threat of quantum computing to traditional encryption and signature algorithms (such as RSA, ECC), by adopting the Kyber algorithm in the post-quantum cryptographic algorithm to replace the key encapsulation in CTAP communication, and using the Dilithium or Falcon algorithm to replace the digital signature part, thereby achieving comprehensive anti-quantum protection for the identity authentication process. In addition, the present invention supports hybrid encryption, so that traditional cryptographic algorithms and post-quantum cryptographic algorithms can work together seamlessly, ensuring security in the era of quantum computing and smoothness of the transition process. The present invention has modular and pluggable characteristics, which facilitates flexible algorithm upgrades and system adaptation. The present invention can not only effectively prevent quantum computer attacks, but also ensure smoothness and compatibility during the quantum migration transition period through pluggable characteristics, avoiding the high cost and complexity brought about by comprehensive system replacement.

[0080] The present specification also provides a computer-readable storage medium, which stores a computer program, and the computer program can be used to execute the above-mentioned data synchronization method.

[0081] This manual also provides Figure 5 The schematic structure diagram of the electronic device shown in FIG. Figure 5 As mentioned above, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory and a non-volatile memory, and may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the above data synchronization method.

[0082] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0083] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0084] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0085] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0086] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0087] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0088] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0089] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0090] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0091] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0092] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0093] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0094] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0095] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0096] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0097] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0098] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

[0099] Those skilled in the art will readily appreciate other embodiments of the present application after considering the description and practicing the contents disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application. The description and examples are intended to be exemplary only.

[0100] It will be appreciated that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A quantum-resistant cryptographic migration method based on the FIDO2 protocol, characterized in that: Applied to the client, the method specifically includes: During the registration phase, the client's execution process includes: In response to the registration request initiated by the user, the client submits a registration request to the server; receives the first challenge and user metadata sent by the server, encrypts the first challenge and user metadata using the shared session key K, and sends them to the authenticator; receives the registration response sent by the authenticator, decrypts the registration response using the shared session key K, and uploads it to the server; The registration response is obtained by the authenticator using the shared session key K to encrypt the second public key pk2, the first signature sig1 and the user metadata; the second public key pk2 is obtained by the authenticator generating a pair of second public and private keys (pk2, sk2) through the quantum-resistant signature algorithm; the first signature sig1 is obtained by the authenticator using the second private key sk2 to sign the first challenge, the second public key pk2 and the user metadata; The process of encapsulating the shared session key K includes: The client uses the first public key pk1 to operate on a randomly generated sequence to obtain the first shared key K1 and the ciphertext ct, and returns the ciphertext ct to the authenticator; the first shared key K1 and the second shared key K2 are used as the shared session key K, thereby completing the key encapsulation; Among them, the first public key pk1 is obtained by the authenticator using the Kyber algorithm to generate the first public-private key pair (pk1, sk1); the second shared key K2 is obtained by the authenticator using the first private key sk1 to decapsulate the ciphertext ct; In response to the authentication request initiated by the user, the client sends a login request to the server; receives the second challenge and user metadata sent by the server, encrypts the second challenge and user metadata using the shared session key K, and sends them to the authenticator; receives the second signature sig2, user metadata, and authenticator data returned by the authenticator and encrypted using the shared session key K, decrypts them using the shared session key K, and packages them and sends them to the server; Among them, the second signature sig2 is obtained by the authenticator using the second private key sk2 to sign the second challenge, user metadata and authenticator data; the second private key sk2 is obtained by the authenticator generating a pair of second public and private keys (pk2, sk2) through the quantum-resistant signature algorithm during the registration phase, and the quantum-resistant signature algorithm uses the Dilithium quantum-resistant signature algorithm or the Falcon quantum-resistant signature algorithm; the second challenge is generated by the server in response to the login request sent by the client.

2. A quantum-resistant cryptographic migration method based on the FIDO2 protocol, characterized in that: Applied to a server, the method specifically includes: The server's execution process during the registration phase includes: In response to the registration request sent by the client, generate a first challenge, and return the first challenge and user metadata to the client; receive the registration response sent by the client after decryption by the shared session key K, use the second public key pk2 to verify whether the first signature sig1 is valid, verify whether the second public key pk2 and the second public key pk2 obtained by verifying the first signature sig1 are consistent, and whether the authenticator data is valid; when the verification is successful, send an authentication success signal, and store the public key pk2 and authenticator data; The registration response is obtained by the authenticator using the shared session key K to encrypt the second public key pk2, the first signature sig1 and the user metadata; the second public key pk2 is obtained by the authenticator generating a pair of second public and private keys (pk2, sk2) through a quantum-resistant signature algorithm, and the quantum-resistant signature algorithm uses the Dilithium quantum-resistant signature algorithm or the Falcon quantum-resistant signature algorithm; the first signature sig1 is obtained by the authenticator using the second private key sk2 to sign the first challenge, the second public key pk2 and the user metadata; Among them, the shared session key K is the same as the first shared key K1 and the second shared key K2; the first shared key K1 and the ciphertext ct are both obtained by the client receiving the first public key pk1 sent by the authenticator and using the first public key pk1 to operate on a randomly generated sequence; the second shared key K2 is obtained by the authenticator using the first private key sk1 to decapsulate the ciphertext ct; the first public key pk1 and the first private key sk1 are obtained by the authenticator using the Kyber algorithm to generate the first public-private key pair (pk1, sk1); In response to the login request sent by the client, generate a second challenge, and return the second challenge and the user metadata to the client; receive the second signature sig2, user metadata and authenticator data decrypted by the shared session key K sent by the client, and verify the second signature sig2 using the second public key pk2 stored in the registration phase; when the verification is successful, send an authentication success signal; Among them, the second signature sig2 is obtained by the authenticator using the second private key sk2 to sign the second challenge, user metadata and authenticator data; the second private key sk2 is obtained by the authenticator generating a pair of second public and private keys (pk2, sk2) through the quantum-resistant signature algorithm during the registration phase.

3. A quantum-resistant cryptographic migration method based on the FIDO2 protocol, characterized in that: Applied to an authenticator, the method specifically comprises: The authenticator generates a first public-private key pair (pk1, sk1) using the Kyber algorithm, and sends the first public key pk1 to the client; decapsulates the ciphertext ct using the first private key sk1 to obtain the second shared key K2; uses the first shared key K1 and the second shared key K2 as the shared session key K, thereby completing key encapsulation; The first shared key K1 is obtained by the client using the first public key pk1 sent by the authenticator to calculate a randomly generated sequence; Receive the first challenge and user metadata encrypted by the shared session key K sent by the client, and decrypt the encrypted first challenge and user metadata by using the shared session key K; generate a pair of second public and private keys (pk2, sk2) by using the quantum-resistant signature algorithm, wherein the quantum-resistant signature algorithm uses the Dilithium quantum-resistant signature algorithm or the Falcon quantum-resistant signature algorithm; use the second private key sk2 to sign the first challenge, the second public key pk2, and the user metadata to generate a first signature sig1; encrypt the second public key pk2, the first signature sig1, and the credential data by using the shared session key K and send them to the client as a registration response; The encrypted second challenge and user metadata are decrypted using the shared session key K, and the second private key sk2 generated during the registration phase is obtained according to the credential ID in the user metadata; the second challenge, user metadata and authenticator data are signed using the second private key sk2 to generate a second signature sig2; the second signature sig2, user metadata and authenticator data are encrypted with the shared session key K and sent to the client.

4. An electronic device comprising a memory and a processor, characterized in that: The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the FIDO2 protocol-based quantum cryptographic migration method described in any one of claims 1-3.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the anti-quantum cryptographic migration method based on the FIDO2 protocol as described in any one of claims 1 to 3 is implemented.

6. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the anti-quantum cryptographic migration method based on the FIDO2 protocol described in any one of claims 1 to 3 is implemented.

Images