Image deniable encryption method based on LWE

Abstract

The invention discloses an image deniable encryption method based on LWE, and belongs to the technical field of image encryption. The method comprises the following steps: S1, a sender carries out true encryption on a true plaintext image to obtain a true ciphertext, and sends the true ciphertext to a receiver; s2, the receiver processes the received true ciphertext by using a deniable encryption technology, and embeds a pseudo plaintext image into the true ciphertext by using a pseudo encryption algorithm and a pseudo encryption key to obtain a pseudo ciphertext; s3, performing true decryption on the pseudo ciphertext by adopting a true decryption key to obtain the true plaintext image; and performing pseudo decryption by adopting the pseudo decryption key to obtain the pseudo plaintext image. According to the image deniable encryption algorithm, lossless pseudo decryption of the customized pseudo plaintext can be realized, and when the content of a pseudo result is a picture with visual semantic content, a positive decryption solution can be proved to a forcing party.

Description

Technical Field

[0001] The invention belongs to the technical field of image encryption, and in particular relates to an image deniable encryption method based on LWE. Background Art

[0002] Encryption technology is the most common means to ensure data confidentiality. Traditional encryption technology provides semantic security, so that when an adversary intercepts a ciphertext on an insecure channel, he cannot obtain any information about the corresponding plaintext message. Consider a more powerful adversary, called a coercer, who has the ability to approach the sender and / or receiver and coerce them to hand over all private information: plaintext, random values ​​used for encryption, and private keys. For general encryption schemes, once the ciphertext, plaintext, and random values ​​(or private keys) used for encryption are exposed to the coercer at the same time, the coercer can verify whether the person is lying by running the encryption algorithm (or decryption algorithm) himself. In order to ensure the confidentiality of data in the above scenario, Canetti et al. proposed a feasible solution at CRYPTO'97, called deniable encryption. Deniable encryption allows the sender and / or receiver to create "fake" (but legitimate-looking) random values ​​or private keys for some encrypted communications that have already been executed, and open the ciphertext to another plaintext message to resist coercion attacks. Therefore, deniable encryption technology is of great significance in protecting private data and sensitive information from being leaked in coercive scenarios. Specifically, deniable encryption can be used in scenarios such as electronic voting, electronic auctions, secure multi-party computing, and cloud storage services where coercers may exist. At present, many works have studied the construction methods of deniable encryption schemes, but the existing deniable encryption schemes are still insufficient in efficiency and deniability, or are difficult to implement. How to design an efficient, secure, and practical deniable encryption scheme is still a difficult problem.

[0003] Although the current deniable encryption technology has made important progress, it still has major defects in efficiency, security, functionality and application. Existing fully deniable encryption requires super-polynomial complexity or uses indistinguishable obfuscation technology. Single-bit deniable encryption has high complexity and low efficiency. Secondly, all schemes assume that users are honest and cannot prevent or retrieve users' abuse of deniability. Finally, there is currently no deniable encryption method specifically for image carriers. Summary of the invention

[0004] The present invention aims to solve the deficiencies of the prior art, and designs a deniable encryption scheme using the principle of reversible information hiding in the ciphertext domain. In the technical framework of reversible information hiding in the ciphertext domain, additional secret information can be embedded in the ciphertext after plaintext encryption, and the receiver can perform the embedding operation to obtain the secret ciphertext. At this time, the secret ciphertext can be used as a pseudo-ciphertext that supports the receiver's deniable behavior, because the secret ciphertext at this time can simultaneously support two operations: direct decryption and information extraction. Direct decryption can obtain lossless plaintext, such as the true plaintext decryption process in deniable encryption, and the extraction operation can obtain the previously embedded secret information losslessly, such as the pseudo-plaintext decryption process in deniable encryption.

[0005] To achieve the above object, the present invention provides the following solution: a method for deniable image encryption based on LWE, comprising the following steps:

[0006] S1. The sender performs true encryption on the true plaintext image to obtain true ciphertext, and sends the true ciphertext to the receiver;

[0007] S2, the receiving party processes the received true ciphertext using deniable encryption technology, and uses a pseudo encryption algorithm and a pseudo encryption key to embed a pseudo plaintext image into the true ciphertext to obtain a pseudo ciphertext;

[0008] S3. Use the real decryption key to perform real decryption on the pseudo ciphertext to obtain the real plaintext image; use the pseudo decryption key to perform pseudo decryption to obtain the pseudo plaintext image.

[0009] Further preferably, the true plaintext bits encrypted by the sender are: t ∈{0,1} l , the real encryption key is: (P, A, r t );

[0010] The true encryption process includes:

[0011] The true plaintext bit p t and key r t Perform XOR operation to obtain the sequence to be encrypted, m = (m1, m2, ... m l ), m l ∈{0,1};

[0012] Based on the random sequence a∈{0,1} d , get the true ciphertext: u=Aa, Where d represents the dimension of the vector in the public key space; l represents the number of bits of an encrypted image pixel at a time; q is a prime number, q∈(n 2 ,2n 2 )≥2; n represents the security parameter; P and A represent the public key; rt represents the secret key;

[0013] in, P=A T S+E, S is a random matrix, E is the noise matrix, r t ∈{0,1} l .

[0014] Further preferably, the pseudo plaintext bits of the receiver are: f ∈{0,1} l , the pseudo encryption key is: (S,r f );

[0015] The pseudo-encryption process includes:

[0016] The pseudo-plaintext bit p f With key r f Perform XOR operation to obtain the pseudo-encryption sequence w, w = (w1, w2, ... w i ), w i ∈{0,1};

[0017] Calculate the quantized vector v, v = cS T u=E T a+m[q / 2],v=(v1,v2,...,v l ) T ; In the re-quantized ciphertext domain space, when v j ∈[0,q / 2], based on w i Determine whether the position of the quantized vector undergoes a symmetric transformation; i =1, a symmetrical change occurs, and the value of the quantized variable is: j '=q-ν j ; When v j ∈[q / 2,q), based on w i Determine whether the position of the quantized vector undergoes a symmetric transformation; i =0, a symmetrical change occurs, and the value of the quantized variable is: j '=q-ν j ; The increment of the quantized vector is: Δv j =v j '-v j ; Based on the increment, the ciphertext sequence c=(c1,c2,...,c l ) T ;

[0018] in,

[0019]

[0020] c j '=c j-Δv j modq, (j=1,2,…,l);

[0021] In the formula, w j represents the jth pseudo-plaintext bit to be encrypted; c j ' means according to c j and the pseudo-plaintext bit w j Generated pseudo-ciphertext.

[0022] Further preferably, in the case of true decryption, the true decryption key (S, r t ) decrypts the pseudo ciphertext (u,c');

[0023] The real decryption methods include:

[0024] Calculate the quantized vector: v'=c'-S T u, according to the true decryption mapping rule, the decryption result m' is obtained, m'=(m1',m2',...,m l ') T ;in,

[0025]

[0026] Where, ν j ' represents the quantized vector;

[0027] True plaintext bit p t ':

[0028]

[0029] Further preferably, in the case of compulsion, using the embedded key (S, r f ) decrypts the pseudo ciphertext (u,c');

[0030] Pseudo-decryption methods include:

[0031] Calculate the quantized vector: v'=c'-S T u, according to the pseudo-decryption mapping rule, the decryption result w' is obtained, w'=(w1',w2',...,w l ');in:

[0032]

[0033] Where, ν j ' represents the quantized vector;

[0034] Pseudo-plaintext bit p f :

[0035]

[0036] Further preferably, the true decryption mapping rule includes: in the ciphertext domain space, a circle is used to represent a set of points on a finite field, and the finite field is evenly divided into four regions, namely: I[0,q / 4], II[q / 4,q / 2], III[q / 2,3q / 4] and IV[3q / 4,q]; the point corresponding to the numerical value of the quantization vector is located in region I or region IV, and is decrypted to 0; otherwise, it is decrypted to 1.

[0037] Further preferably, the pseudo-decryption mapping rule includes: in the ciphertext domain space, a circle is used to represent a set of points on a finite field, and the finite field is evenly divided into four regions, namely: I[0,q / 4], II[q / 4,q / 2], III[q / 2,3q / 4] and IV[3q / 4,q]; the point corresponding to the numerical value of the quantization vector is located in region I or region II, and is decrypted to 0; otherwise, it is decrypted to 1.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] The deniable encryption algorithm for images of the present invention can realize lossless pseudo-decryption of customized pseudo-plaintext. When the content of the pseudo-result is a picture with intuitive semantic content, the correct decryption answer can be proved to the forcing party. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solution of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0041] Figure 1 This is a flowchart of an image deniable encryption method based on LWE according to an embodiment of the present invention;

[0042] Figure 2 This is a schematic diagram of finite domain partitioning according to an embodiment of the present invention;

[0043] Figure 3 This is a schematic diagram of the requantization partition of a finite field according to an embodiment of the present invention;

[0044] Figure 4 This is a diagram showing an example of a deniable encryption process according to an embodiment of the present invention;

[0045] Figure 5 A data histogram of the ciphertext according to an embodiment of the present invention;

[0046] Figure 6 The data histogram of the quantized vector according to the embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0049] Embodiment 1:

[0050] like Figure 1 As shown, this embodiment provides an image deniable encryption method based on LWE, comprising the following steps:

[0051] S1. The sender performs true encryption on the true plaintext image to obtain true ciphertext, and sends the true ciphertext to the receiver.

[0052] Among them, the true plaintext bits encrypted by the sender are: p t ∈{0,1} l , the real encryption key is: (P, A, r t ); the real encryption process includes:

[0053] First, use the stream encryption method to encrypt the real plaintext information: t and r t Perform XOR operation to obtain the sequence to be encrypted, m = (m1, m2, ... m l ), m l ∈{0,1}, used for LWE encryption; m is as follows:

[0054]

[0055] After that, select a random sequence a∈{0,1} d , get the true ciphertext: u=Aa, The true ciphertext is sent to the receiver through an open channel and stored confidentially by the receiver. Where d represents the dimension of the vector in the public key space, d≥(1+ε)(1+n)log2q, ε>0; l represents the number of bits of the encrypted image pixel at a time; q is a prime number, q∈(n 2 ,2n 2 )≥2; n represents the security parameter, which is used to determine other parameters; P and A represent the public key; r t Represents a key.

[0056] Introducing LWE encrypted noise distribution This is a discrete Gaussian distribution:

[0057]

[0058] Where [qx] means qx is rounded to the nearest integer; is the standard deviation of the chosen Gaussian noise distribution, and its value will affect the security with standard deviation.

[0059] Among them, A and S are independent and identically distributed uniformly distributed random matrices, S is a random matrix, E is the noise matrix that follows the distribution χ in formula (2), Get the public key of LWE and r t and r f are two pseudo-random matrices, used to encrypt the true plaintext image and the pseudo-plaintext image respectively, r t ∈{0,1} l , r f ∈{0,1} l When encrypting, the image is first divided into blocks, and the data blocks with a length of l bits are encrypted separately, and finally the ciphertext image is obtained.

[0060] S2. The receiver processes the received true ciphertext using deniable encryption technology, and uses a pseudo encryption algorithm and a pseudo encryption key to embed a pseudo plaintext image into the true ciphertext to obtain a pseudo ciphertext.

[0061] Among them, the true ciphertext is (u, c) and the pseudo plaintext bits of the receiver are: p f ∈{0,1} l , the pseudo encryption key is: (S,r f ); the pseudo-encryption process includes:

[0062] The pseudo-plaintext bit p f With key r f Perform XOR operation to obtain the pseudo-encryption sequence w, w = (w1, w2, ... w i ), w i ∈{0,1}, used for subsequent embedding. w is as follows:

[0063]

[0064] Calculate the quantized vector v, v = cS T u=E T a+m[q / 2],v=(v1,v2,...,v l ) T ; In the re-quantized ciphertext domain space, when v j ∈[0,q / 2], based on w iDetermine whether the position of the quantized vector undergoes a symmetric transformation; i =1, a symmetrical change occurs, and the value of the quantized variable is: j '=q-ν j ; When v j ∈[q / 2,q), based on w i Determine whether the position of the quantized vector undergoes a symmetric transformation; i =0, a symmetrical change occurs, and the value of the quantized variable is: j '=q-ν j ; The increment of the quantized vector is: Δv j =v j '-v j ; Based on the corresponding changes in the incremental ciphertext, the ciphertext sequence c=(c1,c2,...,c l ) T :

[0065] in,

[0066]

[0067] c j '=c j -Δv j modq, (j=1,2,…,l); (5)

[0068] In the formula, w j represents the jth pseudo-plaintext bit to be encrypted; c j ' means according to c j and the pseudo-plaintext bit w j Generated pseudo-ciphertext.

[0069] S3. Use the real decryption key to perform real decryption on the pseudo ciphertext to obtain the real plaintext image; use the pseudo decryption key to perform pseudo decryption to obtain the pseudo plaintext image.

[0070] In the case of true decryption, the true decryption key (S, r t ) decrypts the pseudo ciphertext (u,c'); the real decryption methods include:

[0071] Calculate the quantized vector: v'=c'-S T u, according to the true decryption mapping rule, the decryption result m' is obtained, m'=(m1',m2',...,m l ') T ;in,

[0072]

[0073] Where, ν j ' represents a quantized vector.

[0074] True plaintext bit p t ':

[0075]

[0076] In the case of forced, using the embedded key (S,r f ) decrypts the pseudo ciphertext (u,c'); the pseudo decryption method includes:

[0077] Calculate the quantized vector: v'=c'-S T u, according to the pseudo-decryption mapping rule, the decryption result w' is obtained, w'=(w1',w2',...,w l ');in:

[0078]

[0079] Pseudo-plaintext bit p f :

[0080]

[0081] In the above method, the true decryption mapping rule includes: the decryption process of the LWE algorithm is a probabilistic decryption, and the quantization vector for plaintext mapping can be obtained by using the private key, v = cS T u=E T a+m[q / 2], the value of the variable in this vector fluctuates around 0 or [q / 2] in the ciphertext space, and the fluctuation value is E T a, obeys discrete Gaussian distribution. Its decryption rules are as follows Figure 2 As shown, the circle represents a finite field The set of points on the finite field is divided into 4 regions: I[0,q / 4], II[q / 4,q / 2], III[q / 2,3q / 4] and IV[3q / 4,q]; if the point corresponding to the value of the quantized vector is in region I or region IV, it is decrypted to 0; otherwise, it is decrypted to 1.

[0082] On the basis of the above true decryption mapping rules, a pseudo-encryption and pseudo-decryption process is constructed. The key point is to define the quantization area for the pseudo-plaintext bit 0 or 1. The entire ciphertext domain space is re-quantized. Specifically, the pseudo-decryption mapping rules include: in the ciphertext domain space, a circle is used to represent the set of points on the finite field, and the finite field is evenly divided into 4 regions, namely: I[0,q / 4], II[q / 4,q / 2], III[q / 2,3q / 4] and IV[3q / 4,q]; the point corresponding to the value of the quantization vector is located in area I or area II, and the decryption is 0; otherwise, the decryption is 1.

[0083] According to the above quantization rules, the pseudo-encryption process actually achieves the modification of the quantization vector by modifying the true ciphertext data, so that the quantization vector is located in a specific area, so that it can carry both true plaintext bits and pseudo-plaintext bits. In the decryption process, the true plaintext bits can be obtained by using the true key and the original decryption quantization rules, and the pseudo-plaintext bits can be obtained by using the pseudo key and the pseudo-decryption quantization rules. During the pseudo-encryption process, it is necessary to modify the values ​​of the corresponding variables in the quantization vector so that it is located in the information load area of ​​the sub-area. Since there is a linear correlation between the ciphertext and the quantization vector in LWE encryption, the quantization vector can be modified by directly modifying the ciphertext. The modification process is as follows: Figure 3 As shown in the figure, when the true plaintext m=0 is encrypted, the quantization vector of the obtained ciphertext is actually located at point A. At this time, the pseudo-plaintext is w=0, and the information carried by the pseudo-interval indicated at point A is w=0. At this time, the true ciphertext does not need to be modified, and the pseudo-ciphertext containing the pseudo-plaintext information is the original ciphertext.

[0084] However, if the pseudo plaintext is w = 1, the position of A does not meet the requirement. We add one operation in the encryption process and modify the ciphertext so that the quantized vector is located at the symmetric position of A about the vertical symmetry axis of Zq, that is, Figure 3 In the decryption process, the true plaintext bit indicated by A' is 0, and the pseudo-plaintext bit is 1, which satisfies the deniable encryption process.

[0085] Embodiment 2:

[0086] This embodiment verifies the correctness and security of the method proposed by the present invention through theoretical analysis and experiments. In this embodiment, the true plaintext and pseudo plaintext images are set to be 256×256 binary images (i.e., a certain bit layer from a grayscale image with an 8-bit color depth): n=157, q=24659, l=256, ε=0.2, d=2766.

[0087] (1) Correctness verification:

[0088] After separating the bit planes of an aerial image, the most significant bit layer is taken as the true plaintext. Figure 4 (a), after encryption, the true ciphertext is Figure 4 (b), the receiver selects an everyday natural image as the pseudo plaintext Figure 4 (c) Input the true ciphertext and pseudo plaintext into the pseudo encryption algorithm to obtain the pseudo ciphertext as Figure 4 (d) Using the true decryption algorithm from the pseudo-ciphertext, we get the following result: Figure 4 (e), this result is consistent with Figure 4 (a) Completely consistent; using the pseudo-decryption algorithm from the pseudo-ciphertext to obtain the result is as follows Figure 4 (f), this result is consistent with Figure 4(c) is completely consistent, indicating that the accuracy of the true decryption and the false decryption is 100%. Subsequently, multiple groups of images were tested, and the true plaintext and false plaintext selected are shown in Table 1. The decryption accuracy is 100%.

[0089] Table 1

[0090]

[0091]

[0092] (2) Security verification:

[0093] In this embodiment, security mainly includes two meanings: first, true decryption or pseudo decryption cannot be performed without a key. In the present invention, both the true decryption key and the pseudo decryption key include the private key S in the LWE cryptographic system. According to the security of the LWE cryptography, it can be known that without S, any enemy cannot obtain the quantized vector v=cS by any method. T u. Therefore, the confidentiality of the plaintext content depends on the confidentiality of S. Second, the true ciphertext and the pseudo-ciphertext are indistinguishable in data distribution. The following analyzes the characteristics from two perspectives: the ciphertext data histogram and the quantization vector distribution histogram.

[0094] pass Figure 5 It can be seen from the histogram that there is no clear difference in the data histogram of the ciphertext under different experimental groups. Figure 5 (a) and (b) are the histogram comparisons of the true and false ciphertext data of experimental group 1; Figure 5 (c) and (d) are the histogram comparisons of the true and false ciphertext data of experimental group 2; Figure 5 (e) and (f) are the histogram comparisons of the true and false ciphertext data of experimental group 3.

[0095] pass Figure 6 From the histogram, we can see that there is no clear difference in the histogram of the quantized vector under different experimental groups, that is, the decryptor cannot determine whether the data has been processed during the decryption process. Figure 6 (a) and (b) are the comparison of quantization vector histograms of true and false ciphertext data in experimental group 1; Figure 6 (c) and (d) are the comparison of quantization vector histograms of true and false ciphertext data in experimental group 2; Figure 6 (e) and (f) are the comparison of quantization vector histograms of true and false ciphertext data in experimental group 3.

[0096] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A method for deniable image encryption based on LWE, characterized in that: The following steps are involved: S1. The sender performs true encryption on the true plaintext image to obtain true ciphertext, and sends the true ciphertext to the receiver; S2, the receiving party processes the received true ciphertext using deniable encryption technology, and uses a pseudo encryption algorithm and a pseudo encryption key to embed a pseudo plaintext image into the true ciphertext to obtain a pseudo ciphertext; S3, using the true decryption key to truly decrypt the pseudo ciphertext to obtain the true plaintext image; The pseudo decryption key is used to perform pseudo decryption to obtain the pseudo plaintext image.

2. According to the LWE-based image deniable encryption method of claim 1, it is characterized in that: The true plaintext bits encrypted by the sender are: p t ∈{0,1} l , the real encryption key is: (P, A, r t ); The true encryption process includes: The true plaintext bit p t and key r t Perform XOR operation to obtain the sequence to be encrypted, m = (m1, m2, ... m l ), m l ∈{0,1}; Based on the random sequence a∈{0,1} d , get the true ciphertext: Where d represents the dimension of the vector in the public key space; l represents the number of bits of an encrypted image pixel at a time; q is a prime number, q∈(n 2 ,2n 2 )≥2; n represents the security parameter; P and A represent the public key; rt represents the secret key; in, P=A T S+E, S is a random matrix, E is the noise matrix, r t ∈{0,1} l .

3. According to the LWE-based image deniable encryption method of claim 1, it is characterized in that: The pseudo-plaintext bits of the receiver are: p f ∈{0,1} l , the pseudo encryption key is: (S,r f ); The pseudo-encryption process includes: The pseudo-plaintext bit p f With key r f Perform XOR operation to obtain the pseudo-encryption sequence w, w = (w1, w2, ... w i ), w i ∈{0,1}; Calculate the quantized vector v, v = cS T u=E T a+m[q / 2],v=(v1,v2,...,v l ) T ; In the re-quantized ciphertext domain space, when v j ∈[0,q / 2], based on w i Determine whether the position of the quantized vector undergoes a symmetric transformation; i =1, a symmetrical change occurs, and the value of the quantized variable is: j '=q-ν j ; When v j ∈[q / 2,q), based on w i Determine whether the position of the quantized vector undergoes a symmetric transformation; i =0, a symmetrical change occurs, and the value of the quantized variable is: j '=q-ν j ; The increment of the quantized vector is: Δv j =v j '-v j ; Based on the increment, the ciphertext sequence c=(c1,c2,...,c l ) T ; in, c j 'c j -Δv j modq,(j,1,2,…,l); In the formula, w j represents the jth pseudo plaintext bit to be encrypted; cj' represents the j and the pseudo-plaintext bit w j Generated pseudo-ciphertext.

4. According to the LWE-based image deniability encryption method of claim 1, it is characterized in that: In the case of true decryption, the true decryption key (S, r t ) decrypts the pseudo ciphertext (u,c'); True decryption methods include: Calculate the quantized vector: v'=c'-S T u, according to the true decryption mapping rule, the decryption result m' is obtained, m'=(m1',m2',...,m l ') T ;in, Where, ν j ' represents the quantized vector; True plaintext bit p t ':

5. According to the LWE-based image deniable encryption method of claim 1, it is characterized in that: In the case of forced, using the embedded key (S,r f ) decrypts the pseudo ciphertext (u,c'); Pseudo-decryption methods include: Calculate the quantized vector: v'=c'-S T u, according to the pseudo-decryption mapping rule, the decryption result w' is obtained, w'=(w1',w2',...,w l ');in: Where, ν j ' represents the quantized vector; Pseudo-plaintext bit p f :

6. According to claim 4, the method for deniable image encryption based on LWE is characterized in that: The true decryption mapping rule includes: in the ciphertext domain space, a circle is used to represent a set of points on a finite field, and the finite field is evenly divided into four regions, namely: I[0,q / 4], II[q / 4,q / 2], III[q / 2,3q / 4] and IV[3q / 4,q]; if the point corresponding to the value of the quantized vector is located in region I or region IV, it is decrypted to 0; otherwise, it is decrypted to 1.

7. According to claim 5, the method for deniable image encryption based on LWE is characterized in that: The pseudo-decryption mapping rule includes: in the ciphertext domain space, a circle is used to represent a set of points on a finite field, and the finite field is evenly divided into four regions, namely: I[0,q / 4], II[q / 4,q / 2], III[q / 2,3q / 4] and IV[3q / 4,q]; if the point corresponding to the value of the quantized vector is located in region I or region II, it is decrypted to 0; otherwise, it is decrypted to 1.

Images