Quantum secret sharing method based on lattice password and random base

Abstract

The invention belongs to the field of quantum cryptography, and relates to a quantum secret sharing method based on lattice cryptography and random base, comprising the following steps: a secret distributor generates a public key, a private key share and a verification key through a key generation algorithm; encrypting the secret by using the public key to generate a ciphertext; broadcasting the ciphertext to all participants and a secret reconstructor; each participant performs partial decryption on the ciphertext and calculates a shadow corresponding to a decryption value; embedding the shadow and the random number into information particles by adopting unitary operation; a secret restorer calculates the sum of all shadows by measuring the extracted information particles, and removes noise items to obtain a restored secret; verifying whether the recovered secret is correct or not by adopting a hash function; when the participant changes, the secret distributor executes key retransmission, generates a new private key share by re-segmenting elements in the private key vector, and re-distributes the new private key share to the participant; according to the invention, the resource consumption and communication consumption of the scheme are effectively reduced, and the overall efficiency is improved.

Description

Technical Field

[0001] The invention belongs to the field of quantum cryptography, and in particular relates to a quantum secret sharing method based on lattice cryptography and random base. Background Art

[0002] Quantum cryptography is an emerging field that combines quantum mechanics with traditional cryptography. Its security is based on the basic principles of quantum mechanics, such as the quantum superposition principle, the quantum no-cloning theorem, and the quantum uncertainty principle, and can theoretically achieve unconditional security. With the development of quantum computing technology, traditional encryption algorithms based on classical computing are facing the threat of quantum attacks. As an effective way to resist quantum attacks, quantum cryptography has become an important research direction in the field of information security.

[0003] Quantum Secret Sharing (QSS), as an important branch of quantum cryptography, aims to split a secret into multiple parts and distribute these parts to different participants. The secret can only be recovered when a certain number of participants cooperate. Traditional classical secret sharing schemes have problems such as high computational complexity and inflexible key management. Quantum secret sharing uses the characteristics of quantum mechanics to not only enhance security, but also ensure that the key is not leaked during the sharing process.

[0004] Although the existing quantum secret sharing schemes have made significant progress in security and efficiency, there are still some shortcomings. Most schemes have certain limitations in key management and cannot achieve dynamic management of keys. In addition, in most quantum secret sharing schemes using decoy particles, single-particle state schemes usually require particles to be transmitted in a ring between participants, and eavesdropper detection is required for each transmission. Therefore, participants need to prepare decoy particles. Although these decoy particle states are relatively simple, since each participant and server needs to prepare decoy particles and perform eavesdropping detection with the sender, this significantly increases the computational cost of the scheme and reduces efficiency. Some single-particle state schemes choose to have the server prepare all decoy particles, and participants only use some decoy particles to complete eavesdropper detection together with the server. Although this method reduces resource consumption, it increases the communication cost of the scheme to a certain extent. In addition, in terms of the selection of the quantum state of the decoy particles, the quantum state of the decoy particles in most schemes is usually selected from a fixed set, such as {|0>,|1>,|+>,|->}, Or unbiased In these schemes, the more decoy particles an eavesdropper measures, the greater the probability of error. Summary of the invention

[0005] In order to solve the problems existing in the above prior art, the present invention proposes a quantum secret sharing method based on lattice cryptography and random base, the method comprising: constructing a quantum secret sharing system, the system comprising a secret distributor Dealer, a secret reconstructor TP and n participants; the quantum secret sharing system includes: a key generation stage, a secret encryption and distribution stage, a quantum secret reconstruction stage and a key retransmission stage for quantum secret sharing;

[0006] The key generation phase includes: the secret distributor Dealer generates the public key TPK and the private key share tsk through the TKeyGen algorithm i And the verification key tvk i ; Dealer selects a hash function to calculate the hash value of the secret and sends the hash value to the secret reconstructor TP;

[0007] The secret encryption and distribution phase includes: Dealer encrypts the secret using the public key to generate ciphertext C; broadcasts the ciphertext to all participants and secret reconstructor TP;

[0008] The quantum secret reconstruction stage includes: each participant and the secret reconstructor TP decrypt the ciphertext; obtain the decrypted value of the decryption results of t participants, and calculate the shadow corresponding to the decrypted value; use unitary operation to embed the shadow and random number into the information particle; the secret restorer TP measures the extracted information particles, calculates the sum of all shadows, removes the noise term, and obtains the recovered secret; and uses the hash function to verify whether the recovered secret is correct;

[0009] The key resending phase includes: the system re-determines whether the participants have changed. If the participants have changed, the Dealer executes the Tsplit algorithm to generate shares for re-dividing and distributing the key; the Dealer re-divides the elements TSK in the private key vector i To generate a new private key share tsk i , and redistributed to participants.

[0010] Beneficial effects of the present invention:

[0011] The present invention introduces lattice-based re-segmentable threshold public key encryption technology (RTPKE). RTPKE not only inherits the security of traditional threshold encryption, but also increases the dynamic management capability of keys, so that the new quantum secret sharing method can flexibly adjust the distribution and use of keys as needed, thereby improving the flexibility and security of the system.

[0012] The decoy particles of the present invention are not used for eavesdropper detection when transmitted between participants, but are used for eavesdropper detection by the semi-trusted third party (TP) after returning to the TP. This method effectively reduces the resource consumption and communication consumption of the scheme and improves the overall efficiency.

[0013] The decoy particles used in the present invention are not selected from fixed quantum states, but are completely random quantum states. Such random quantum states cannot obtain correct results through conventional measurements, and the probability that an eavesdropper can measure any decoy particle without being detected is almost zero. Therefore, compared with traditional quantum secret sharing schemes, the scheme proposed in this paper has significant advantages in terms of security. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a flow chart of the secret recovery phase of the present invention;

[0015] Figure 2 Schematic diagram of the process of the quantum secret recovery stage of an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] A quantum secret sharing method based on lattice cryptography and random base, the method comprising: constructing a quantum secret sharing system, the system comprising a secret distributor Dealer, a secret reconstructor TP and n participants; the quantum secret sharing system performs quantum secret sharing including: a key generation phase, a secret encryption and distribution phase, a quantum secret reconstruction phase and a key retransmission phase.

[0018] The key generation phase includes: the secret distributor Dealer generates the public key TPK and the private key share tsk through the TKeyGen algorithm i And the verification key tvk i ; Dealer selects a hash function to calculate the hash value of the secret and sends the hash value to the secret reconstructor TP;

[0019] The secret encryption and distribution phase includes: Dealer encrypts the secret using the public key to generate ciphertext C; broadcasts the ciphertext to all participants and secret reconstructor TP;

[0020] The quantum secret reconstruction stage includes: each participant and the secret reconstructor TP decrypt the ciphertext; obtain the decrypted value of the decryption results of t participants, and calculate the shadow corresponding to the decrypted value; use unitary operation to embed the shadow and random number into the information particle; the secret restorer TP measures the extracted information particles, calculates the sum of all shadows, removes the noise term, and obtains the recovered secret; and uses the hash function to verify whether the recovered secret is correct;

[0021] The key resending phase includes: the system re-determines whether the participants have changed. If the participants have changed, the Dealer executes the Tsplit algorithm to generate shares for re-dividing and distributing the key; the Dealer re-divides the elements TSK in the private key vector i To generate a new private key share tsk i , and redistributed to participants.

[0022] This embodiment provides a quantum secret sharing method based on lattice cryptography and random base, such as Figure 1 As shown, including but not limited to the following steps:

[0023] S1. Initialization and key generation phase: Dealer generates public key TPK and private key share tsk through TKeyGen algorithm i And the verification key tvk i The public key TPK is used to encrypt the secret S, and the private key share tsk i For Bob i Perform partial decryption, threshold verification key tvk i For Bob i Verify that the partial decryption result is correct. In addition, the Dealer selects a Hash function H() to calculate the secret Hash value H(S) and transmits this Hash value to TP.

[0024] Specifically, the specific implementation process of step S1 is as follows:

[0025] S11. Generate private key vector TSK: Dealer randomly generates a private key vector TSK = (TSK1, TSK2, ..., TSK n ), each TSK i is from a finite field Z q A randomly selected element from a Gaussian distribution Each element TSK of the private key vector TSK is sampled from i Will serve as the basic secret for each participant.

[0026] S12. Construct threshold polynomial f i (x): To ensure that only t or more participants can recover the private key, each private key element TSK i The segmentation is performed in the form of a threshold polynomial. For each TSK i , Dealer generates a polynomial f of degree t-1 i (x)∈Z q [x], and ensure that the value of the polynomial at 0 is TSK i :f i (x) = TSKi +a1x+a2x 2 +…+a t- 1x t-1 , where a1, a2, …, a t-1 is from a finite field Z q The coefficients are randomly selected in .

[0027] S13. Calculate the participant’s private key share tsk i :Bob i The private key share tsk i is a polynomial f1(x),f2(x),…,f n (x) is the value at x = i. The specific calculation is as follows: tsk i =(f1(i),f2(i),…,f n (i)), which means that each participant i receives a private key share tsk i is a vector consisting of the values ​​of multiple polynomials.

[0028] S14. Distribute private key shares: Dealer distributes each participant’s private key share tsk i It is sent to the corresponding participants through a secure channel. Participants can only know their own private key shares, but cannot know the private key shares of other participants.

[0029] S15. Generate public key matrix A: Dealer generates a random matrix This matrix is ​​part of the public key and is used in the encryption process.

[0030] S16. Calculate the error vector e: Randomly generate an error vector from a Gaussian distribution The error vectors are used to protect the key and increase security.

[0031] S17. Calculate the public key vector b: Dealer calculates the public key vector b by the following formula: b=eA·TSKmode, where A·TSK is the product of the matrix A and the private key vector TSK. This vector b and the matrix A together constitute the public key TPK.

[0032] S18. Generate public key TPK: The public key consists of matrix A and vector b, that is: TPK = (A, b). The public key will be broadcast to all participants and the final secret recoverer TP for the subsequent encryption process of the secret S.

[0033] S19. Generate verification key: In order to prevent participants from cheating or submitting incorrect partial decryption results during the partial decryption process, Dealer will generate a threshold verification key tvk for each participant. i, used to verify each participant’s partial decryption result. For each participant Bob i , the threshold verification key is: The threshold verification key will be distributed to participants along with the private key share and will be made public to everyone for verifying the correctness of decryption. The dealer will eventually broadcast the public key TPK (including matrix A and vector b) to all participants and the secret restorer TP. i and threshold verification key tvk i Sent to the corresponding participants through a secure channel.

[0034] S2, secret encryption and distribution phase: Dealer uses the public key to encrypt the secret S and generate a ciphertext C. The ciphertext will be broadcast to all participants and the final secret recoverer TP so that the secret can be recovered through the collaboration of t or more participants in the subsequent decryption process.

[0035] Specifically, the detailed process of step S2 includes:

[0036] S21. Select a key pair (sk, vk): The dealer first generates a key pair (sk, vk) for the ciphertext, where sk is the signature private key and sk is the signature public key. This key pair will be used to sign the generated ciphertext in subsequent steps to ensure the integrity and authenticity of the ciphertext.

[0037] S22, Select random vectors e1, e2, e3 from Gaussian distribution: Dealer randomly selects two vectors from Gaussian distribution and a scalar e3∈Z q These random vectors and scalars will be used to ensure the randomness and security of the ciphertext.

[0038] S23. Calculate the first part c1 of the ciphertext: Calculate the first part c1 of the ciphertext using the public key matrix A and the random vectors e1 and e2: Where A is the public key matrix, e1 and e2 are random vectors generated from Gaussian distribution. This part of the ciphertext ensures randomness during transmission.

[0039] S24. Calculate the second part c2 of the ciphertext: Calculate the second part c2 of the ciphertext using the public key vector b, the random vector e1, the scalar e3 and the secret S: Where b is the public key vector and S is the secret to be encrypted (usually 0 or 1). This formula embeds the secret S into the ciphertext and adds the random vector e1 and the error term e3 to ensure the security of the encryption.

[0040] S25. Sign the ciphertext σ: Dealer uses the previously generated signature private key sk to sign the generated ciphertext c1, c2, and obtains the signature σ: σ = Sign (sk, c1, c2). This signature σ will ensure that the ciphertext has not been tampered with during transmission. The receiver can use the signature public key vk to verify the integrity of the ciphertext.

[0041] S26, Generate ciphertext C: Finally, Dealer generates ciphertext C, whose structure is: C = (c1, c2, vk, σ)

[0042] Where c1 and c2 are two parts of the ciphertext, vk is the signature public key, and σ is the signature. Dealer broadcasts the generated ciphertext C to all participants and the final secret recoverer TP.

[0043] S3, quantum secret reconstruction stage: This stage is performed by each participant Bob i Together with the secret restorer TP, t participants will partially decrypt the result μ i The partial decrypted value e in i Extract it and calculate its corresponding shadow. Each participant embeds the shadow and random number into the information particle by performing unitary operation. The secret recoverer TP measures the extracted information particles, calculates the sum of all shadows, removes the noise term, and finally recovers the secret. The hash function is used to verify whether the recovered secret is correct.

[0044] Specifically, Figure 2 As shown, the detailed process of step S3 includes:

[0045] S31. Randomly select t participants: TP randomly selects t participants from n participants as participants in quantum secret reconstruction.

[0046] S32, TP prepares information particles and decoy particles: TP first prepares a d-dimensional single particle As information particles, Then construct a privacy coefficient matrix:

[0047]

[0048] In this matrix, the elements of each row satisfy Using the elements in the coefficient matrix as parameters, TP prepares a set of decoy particles It is named as decoy particle sequence V. TP will A new sequence V′ is obtained by random insertion into V, TP records the insertion position and sends V′ to participant Bob1 through an ideal quantum channel.

[0049] S33, each participant calculates the shadow corresponding to the partial decryption result: After all participants have received the particle, each participant Bob i (i=1,2,…,t) Take out your own private key share, perform partial decryption and verification, and generate partial decryption result μ i , and then calculate the shadow S corresponding to the decrypted value i The specific steps are as follows:

[0050] (1) Verify the ciphertext signature:

[0051] During the decryption process, the integrity of the ciphertext must first be verified to ensure that the ciphertext has not been tampered with during transmission.

[0052] Bob i Use the signature public key vk contained in the ciphertext to verify the signature σ of the ciphertext (c1, c2):

[0053] Verify(vk,c1,c2,σ)

[0054] If the signature verification fails, the ciphertext is considered invalid and the participant outputs μ i =(i,⊥), indicating partial decryption failure, stop the subsequent decryption operation. If the signature verification passes, continue with the partial decryption step.

[0055] (2) Partial decryption calculation:

[0056] Each participant uses the public key TPK and his own private key share tsk i =(s i,1 ,s i,2 ,…,s i,n )Through TShareDecryption(TPK,tsk i ,C) algorithm partially decrypts the ciphertext C and generates a partial decryption result μ i The specific steps are as follows:

[0057] First, participant Bob i Calculate the partial decryption value sd i :

[0058] sd i =c2+c1·tsk i modq

[0059] Among them, c1 is the first part of the ciphertext, c2 is the second part of the ciphertext, and tsk i It is participant Bob i The participant's private key share is combined with the ciphertext to generate a partial decryption value.

[0060] Then, calculate the pseudo-random correction term xi :

[0061] Participant Bob i Generate a pseudo-random correction term x i , which is used to ensure that some decryption results are random and prevent attackers from inferring the private key content through multiple decryption results.

[0062] Correction term x i By the following pseudo-random function φ KA (c1,c2) ​​generates:

[0063] x i =φ KA (c1,c2)

[0064] Among them, the pseudo-random function φ KA Use the random seed KA held by the participant and the ciphertext c1 and c2 as input to generate a pseudo-random value.

[0065] Finally, calculate the partial decryption result μ i :

[0066] Participant Bob i Combined with the partially decrypted value sd i and the pseudo-random correction term x i , calculate the final partial decryption result:

[0067] e i =sd i +x i modq

[0068] The generated partial decryption result μ i for:

[0069]

[0070] Among them, e i Bob is a participant i The partial decrypted value of is the correction term x i The correction term makes the decryption result unpredictable, thus ensuring security.

[0071] (3) Verify partial decryption results:

[0072] After obtaining partial decryption results, each participant Bob i You need to verify your partial decryption results through the TShareVerify algorithm Is it correct? Make sure there are no calculation errors in these decryption results.

[0073] The verification process is based on the following equation:

[0074]

[0075] in, is the partially decrypted value e i The exponential form of is the pseudo-random correction term x i exponential form, c2 is the second part of the ciphertext, r1, r2, …, r n is the value in the ciphertext c1, It is participant Bob i The individual elements of the verification key.

[0076] If the verification is successful, it means that the participant's partial decryption result is correct, and the decryption result is used for subsequent secret recovery. Otherwise, it directly returns ⊥, indicating that the decryption failed.

[0077] (4) Calculate the shadow S corresponding to the decrypted value i :

[0078] After performing some decryption and verification steps, each participant Bob i Take out your own partial decryption results respectively The partial decrypted value e in i , and calculate the shadow S of the decrypted value i :

[0079] S i =e i ·λ i modq

[0080] Where i = 1, 2, ..., t, λ i is the Lagrange interpolation coefficient, defined as:

[0081]

[0082] S34, Bob1 performs unitary operation to embed shadow and random number: After receiving the sequence V', Bob1 first calculates B1 = r1 + S1, where r1 is a randomly selected integer from the set {0, 1, 2, ..., d-1}, and S1 is the shadow corresponding to the partial decrypted value e1 of Bob1. Next, Bob1 performs unitary operation on all particles in V' Subsequently, Bob1 reorders the particles in the sequence to obtain a new sequence V′1, and Bob1 records the ordering information v1. Finally, Bob1 sends the sequence V′1 to Bob2.

[0083] Furthermore, the specific form of the unitary operation performed by each participant is:

[0084]

[0085] Among them, U α,β For any single-particle state {|t>|t∈(0,1,2,...,d-1)}, the results are as follows:

[0086]

[0087] Furthermore, the properties of the d-dimensional Pauli operator are described as follows:

[0088] For any two Pauli operators U a,b and U p,q (a,b,p,q∈{0,1,2,...,d-1}), if they are applied to the particle|σ> in sequence, the transformation process of the particle is:

[0089] U a,b U p,q |σ>=ω b·p U a+p,b+q ∣σ>

[0090] S35. Other participants perform similar operations as Bob1: Each of the remaining participants Bob k (k=2,3,4,...,t) all perform similar operations as Bob1 until Bob t We obtain a new sequence V′ t And send it to TP.

[0091] S36, TP obtains sorting information from all participants: confirms sequence V′ t And after sending it back to TP, each participant Bob k (k=3,4,...,t) will all have the sorting information {v k |k=1,2,…,t} is sent to TP through the classical channel. TP then converts the sequence V′ into t The particles in are restored to their original positions, thus obtaining a new sequence VV″. At this time, the order of particles in V″ should be the same as the order of particles in sequence V′.

[0092] S37, TP performs eavesdropping detection: TP extracts the particle V″ according to the recorded initial position of the secret particle TP is then measured using the computational basis {|0>,|1>,...,|d-1>} Get measurement results TP calculation At this time, except for the secret particle, assume that the remaining particles of sequence V″ are {|ψ1>′,|ψ2>′,...,|ψ m >′}. TP performs the Qudit quantum gate on these remaining particles:

[0093] G d (α i(0-sum′) ,α i(1-sum′) ,…,α i(d-1-sum′) )∣ψ i >′,i=1,2,…,m

[0094] Furthermore, the Qudit quantum gate executed by TP is specifically explained as:

[0095] G d is a d-dimensional transformation that can map any qudit state to |d-1>:

[0096]

[0097] where {α j |j=0,1,...,d-1} satisfies G d can be broken down into:

[0098]

[0099] And X j (a j ,b j ) is in the form of:

[0100]

[0101] Where I represents the identity matrix, a j * ,b j * Indicates a j ,b j The conjugate number of .

[0102] Now, TP measures all remaining particles using the computational basis {|0>,|1>,...,|d-1>}. If the measurement results of all remaining particles are d-1, TP continues the protocol. Otherwise, TP considers the communication unsafe, cancels the communication and restarts the protocol.

[0103] S38, TP calculates the sum of all shadows: All participants randomly select a participant as a representative to collect random numbers from each participant and calculate the sum of the random numbers:

[0104]

[0105] The representative then sends R to TP. After receiving R, TP calculates the sum of all shadows:

[0106] sum = (sum′-R) mod d

[0107] At this time, the sum of the shadows corresponding to the t participants obtained by TP is

[0108] S39, remove noise, recover the final secret and verify: TP determines and removes noise based on the value range of the sum of the shadows, and finally recovers the secret S. If sum is close to 0, the recovered secret is S′=0. The recovered secret is S′=1. TP uses the hash function H() to calculate the hash value H(S′), and then verifies whether the equation H(S′)=H(S) holds. If the equation holds, the secret recovery process is correct; otherwise, he believes that there is at least one dishonest participant in the reconstruction process and ends the execution process.

[0109] S4. Participant change and key redistribution mechanism: In the quantum secret sharing scheme based on lattice cryptography and random base, participant change and key redistribution are a dynamic adjustment mechanism of the system. When the participant set changes (such as new participants joining or existing participants leaving), the Dealer executes the Tsplit algorithm to redistribute and redistribute the key shares. The Dealer redistributes the elements TSK in the private key vector. i To generate a new private key share tsk i , and redistribute it to participants to flexibly adapt to changes in participants.

[0110] Specifically, the detailed process of step S4 includes:

[0111] To ensure that the entry of new participants or the exit of existing participants does not affect the security of the system, the Dealer needs to regenerate the private key share based on TSK through the Tsplit algorithm.

[0112] S41, generate a new threshold polynomial f′ i (x): Dealer creates a TSK for each private key vector element i Regenerate a new threshold polynomial f′ of degree t-1 i (x), and ensure that the value of the polynomial at 0 is equal to the private key vector element TSK i , that is, f′ i (0) = TSK i This ensures that the newly allocated private key share is consistent with the original private key vector:

[0113] f′ i (x) = TSK i +a′1x+a′2x 2 +…+a′ t-1 x t-1

[0114] Among them, a′1,a′2,…,a′ t-1 is from a finite field Z q The coefficients are randomly selected in .

[0115] S42. Recalculate the private key share tsk′ for existing participants i : For each existing participant Bob i , Dealer calculates the new private key share tsk′ i , which is based on the new threshold polynomial f′ i (x) to split:

[0116] tsk′ i =(f′1(i),f′2(i),…,f′ n (i))

[0117] These new private key shares tsk′ i It will be distributed to all current participants, replacing the original private key shares.

[0118] S43. Calculate the private key share tsk′ for the new participant i :When a new participant joins, Dealer uses the regenerated polynomial f′ i (x) Calculate for each new participant Bob j The private key share tsk′ j :

[0119] tsk′ j =(f′1(j),f′2(j),…,f′ n (j))

[0120] These newly calculated private key shares are distributed to newly joined participants.

[0121] S44, generate a new threshold verification key tvk′ i : Since the private key vector element TSK i The verification keys of all participants need to be regenerated. Dealer generates a new threshold verification key tvk′ for each participant. i , used to verify the partial decryption results of participants in future decryption:

[0122]

[0123] These new verification keys are used during the decryption process to verify the correctness of each participant's partial decryption results.

[0124] S45. Output new private key share and threshold verification key: Dealer outputs new private key share tsk′ iand threshold verification key tvk′ i Distributed to existing and new participants. These private key shares must be transmitted over a secure channel to prevent interception or tampering. Threshold verification key tvk′ i They can be distributed over public channels as they do not affect the security of the private key shares.

[0125] The above embodiments further illustrate the purpose, technical solutions and advantages of the present invention in detail. It should be understood that the above embodiments are only preferred implementation modes of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made to the present invention within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A quantum secret sharing method based on lattice cryptography and random base, characterized in that: include: Construct a quantum secret sharing system, which includes a secret distributor Dealer, a secret reconstructor TP, and n participants; The quantum secret sharing system includes: key generation phase, secret encryption and distribution phase, quantum secret reconstruction phase and key retransmission phase; The key generation phase includes: the secret distributor Dealer generates the public key TPK and the private key share tsk through the TKeyGen algorithm i And the verification key tvk i ; Dealer selects a hash function to calculate the hash value of the secret and sends the hash value to the secret reconstructor TP; The secret encryption and distribution phase includes: Dealer encrypts the secret using the public key to generate ciphertext C; broadcasts the ciphertext to all participants and secret reconstructor TP; The quantum secret reconstruction stage includes: each participant and the secret reconstructor TP decrypt the ciphertext; obtain the decrypted value of the decryption results of t participants, and calculate the shadow corresponding to the decrypted value; use unitary operation to embed the shadow and random number into the information particle; the secret restorer TP measures the extracted information particles, calculates the sum of all shadows, removes the noise term, and obtains the recovered secret; and uses the hash function to verify whether the recovered secret is correct; The key resending phase includes: the system re-determines whether the participants have changed. If the participants have changed, the Dealer executes the Tsplit algorithm to generate shares for re-dividing and distributing the key; the Dealer re-divides the elements TSK in the private key vector i To generate a new private key share tsk i , and redistributed to participants.

2. A quantum secret sharing method based on lattice cryptography and random base according to claim 1, characterized in that: The specific steps of the key generation phase include: Step 1: Dealer randomly generates a private key vector TSK = (TSK1, TSK2, ..., TSK n ); Step 2: For each private key element TSK i , Dealer generates a polynomial f of degree t-1 i (x); Step 3: According to the polynomial f i (x) Calculate the participant’s private key share tsk i ; Step 4. Dealer sends each participant’s private key share tsk i Send to corresponding participants through a secure channel; Step 5: Dealer generates a random matrix A; Step 6: Randomly generate an error vector e from Gaussian distribution; Step 7: Calculate the public key vector b according to the error vector; Step 8: Generate a public key TPK based on the random matrix A and the public key vector b; Step 9: For each participant, generate a threshold verification key tvk i ; Dealer broadcasts the public key TPK to all participants and secret recoverer TP; private key share tsk i and threshold verification key tvk i Sent to the corresponding participants through a secure channel.

3. A quantum secret sharing method based on lattice cryptography and random base according to claim 2, characterized in that: Polynomial f i The expression of (x) is: f i (x)=TSK i +a1x+a2x 2 +…+a t-1 x t-1 Among them, a1, a2, …, a t-1 From the finite field Z q The coefficients are randomly selected in .

4. A quantum secret sharing method based on lattice cryptography and random base according to claim 2, characterized in that: Private key share tsk i The polynomial f n The value of (x) at x=i.

5. The quantum secret sharing method based on lattice cryptography and random base according to claim 1, characterized in that: The secret encryption and distribution phase includes: Step 1: Dealer generates a key pair (sk, vk) for the ciphertext, where sk is the signature private key and vk is the signature public key; Step 2: Dealer randomly selects two vectors e1, e2 and a scalar e3 from Gaussian distribution; Step 3: Calculate the first part c1 of the ciphertext using the public key matrix A and the random vectors e1 and e2; Step 4: Calculate the second part c2 of the ciphertext using the public key vector b, the random vector e1, the scalar e3 and the secret S; Step 5: Dealer uses the previously generated signature private key sk to sign the generated ciphertext c1, c2 to obtain the signature σ; Step 6: Dealer generates a ciphertext C, whose structure is: C = (c1, c2, vk, σ); Dealer broadcasts the generated ciphertext C to all participants and the final secret reconstructor TP.

6. A quantum secret sharing method based on lattice cryptography and random base according to claim 5, characterized in that: The first part of the ciphertext c1 is: The second part of the ciphertext c2 is: Where A is the public key matrix, e1 and e2 are random vectors generated from Gaussian distribution, b is the public key vector, S is the secret to be encrypted, e3 is a scalar, q is a large prime number, and mod is the modulus operation. To round down.

7. The quantum secret sharing method based on lattice cryptography and random base according to claim 1, characterized in that: Decrypting ciphertext includes: Step 1: TP randomly selects t participants from n participants as participants in quantum secret reconstruction; Step 2: TP converts a d-dimensional single particle as information particles; construct a privacy coefficient matrix; construct a decoy particle sequence V with the elements in the privacy coefficient matrix; insert the information particles into the decoy particle sequence to obtain a new sequence V′; TP records the insertion position and sends V′ to the participants through an ideal quantum channel; Step 3: After all participants receive the particles, they verify the ciphertext signature; each participant Bob i (i=1,2,…,t) Take out your own private key share, perform partial decryption and verification, and generate partial decryption result μ i .

8. The quantum secret sharing method based on lattice cryptography and random base according to claim 1, characterized in that: The unitary operation is used to embed shadows and random numbers into information particles: after participant Bob1 receives the sequence V′, he calculates B1=r1+S1; participant Bob1 performs unitary operation on all particles in V′ Bob1 reorders the particles in the sequence to obtain a new sequence V′1. Bob1 records the ordering information v1. Bob1 sends the sequence V′1 to Bob2. Other participants perform the same operation as Bob1 until Bob t We obtain a new sequence V′ t And send it to TP.

9. The quantum secret sharing method based on lattice cryptography and random base according to claim 1, characterized in that: The key resending phase includes: Dealer generates a TSK for each private key vector element i Regenerate a new threshold polynomial f of degree t-1 i ′(x), and ensure that the value of the polynomial at 0 is equal to the private key vector element TSK i ; For each existing participant Bob i , Dealer calculates the new private key share tsk′ i ; When a new participant joins, Dealer uses the regenerated polynomial f i ′(x) calculates each new participant Bob j The private key share tsk′ j ; Dealer generates a new threshold verification key tvk′ for each participant i , which is used to verify the partial decryption results of the participants in the future; Dealer will use the new private key share tsk′ i and threshold verification key tvk′ i Distribute to existing and new participants.

Images