Merkle tree authentication key negotiation method and device on NTRU grid

Abstract

The invention provides a Merkle tree authentication key negotiation method and device on an NTRU grid. The method comprises the following steps: respectively generating a first long-term public key and a first long-term private key pair of a first communication party and a second long-term public key and a second long-term private key pair of a second communication party; initiating an identity authentication request in response to the first communication party, randomly generating a first temporary key, generating a first ciphertext and first identity authentication information according to the first temporary key and the second long-term public key, and sending the first ciphertext and the first identity authentication information to the second communication party; the second communication party decrypts the first ciphertext through a second long-term private key and verifies the first identity authentication information, and if the identity authentication is passed, a second shared session key is generated and the second ciphertext and the second identity authentication information are sent to the first communication party; and the second communication party decrypts the second ciphertext through the first long-term private key and calculates the first shared session key, and if the identity authentication of the second identity authentication information is passed, key negotiation is completed. According to the invention, the shared session key can be negotiated only through two rounds of message interaction.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a Merkle tree authentication key negotiation method and device on an NTRU grid. Background Art

[0002] With the development of science and technology, e-commerce and e-government are becoming more and more popular. For many Internet users, in some specific applications, such as online voting and online payment, people want to sever the connection between their identity and behavior, and they also want to authenticate the identity of the communication object and ensure the integrity and confidentiality of the transmitted information. Therefore, protecting the identity privacy of the two parties in the communication when executing the authenticated key agreement protocol is proposed for this type of cryptographic task.

[0003] However, most of the existing authenticated key exchange protocols on the NTRU grid need to combine the signature algorithm to implement the authentication function, and require three rounds of interactive protocols, which results in a large amount of communication. In addition, most of the protocols do not take into account the needs of user identity privacy protection. Summary of the invention

[0004] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0005] To this end, the first objective of the present application is to propose a Merkle tree authentication key negotiation method on the NTRU lattice.

[0006] The second object of the present application is to provide a device.

[0007] The third objective of the present application is to provide an electronic device.

[0008] A fourth objective of the present application is to provide a computer-readable storage medium.

[0009] A fifth object of the present application is to provide a computer program product.

[0010] To achieve the above-mentioned purpose, the first embodiment of the present application proposes a Merkle tree authentication key negotiation method on an NTRU grid, including:

[0011] Generate a first long-term public key and a first long-term private key pair of the first communication party and a second long-term public key and a second long-term private key pair of the second communication party respectively according to a preset key generation algorithm, wherein the first long-term public key and the second long-term public key are both made public;

[0012] In response to the first communication party initiating an identity authentication request and randomly generating a first temporary key, generating a first ciphertext and first identity authentication information according to the first temporary key and the second long-term public key, and sending the first ciphertext and first identity authentication information to the second communication party;

[0013] The second communication party decrypts the first ciphertext and verifies the first identity authentication information using a second long-term private key. If the identity authentication is successful, a second shared session key is generated and the second ciphertext and the second identity authentication information are sent to the first communication party.

[0014] The second communication party decrypts the second ciphertext using the first long-term private key and calculates the first shared session key. If the identity authentication of the second identity authentication information passes, key negotiation is completed.

[0015] Optionally, before respectively generating the first long-term public key and the first long-term private key pair of the first communication party and the second long-term public key and the second long-term private key pair of the second communication party according to a preset key generation algorithm, the method further includes:

[0016] Set parameter set PARAM = {n, p, q, d}, where n is the dimension of the polynomial ring, p is the small modulus used to generate the private key polynomial, q is the large modulus used to generate the public key and limit the range of the result, and d is the function argument;

[0017] The ternary polynomial generating function L(d+1, d) is marked as L, which means that the polynomial ring has d+1 coefficients of 1, d coefficients of -1, and all other coefficients are 0. Sampler(L, seed) represents the discrete Gaussian sampling algorithm instantiated using L and seed seed.

[0018] Randomly select matrix As a shared matrix between the first communication party and the second communication party, for use by the first communication party and the second communication party in a key negotiation process;

[0019] Define the hash function h A (u 0 ,u 1 )=bin(A 0 ·u 0 +A 1 ·u 1 mod q), used to generate identity authentication information, where A = [A 0 |A 1 ],u 0 ,u 1 Represents the given two polynomials

[0020] Define a polynomial ring To ensure that in addition to h A (·) The hash function computes the special case of authentication information, while other computations remain within a fixed ring structure.

[0021] Optionally, the long-term key generation process of the key generation algorithm includes:

[0022] Input parameter set PARAM = {n, p, q, d} and a seed seed, the seed seed is used for the process of randomly sampling the generator polynomial;

[0023] A polynomial F is randomly generated according to the discrete Gaussian sampling algorithm Sampler(L, seed);

[0024] The private key f is calculated based on the polynomial F. The calculation expression is:

[0025]

[0026] Among them, it is necessary to ensure that f is in the polynomial ring If it is not reversible, regenerate the polynomial F and repeat this step until f is in the polynomial ring. After the medium is reversible, proceed to the next step;

[0027] According to the discrete Gaussian sampling algorithm Sampler(L, seed), another polynomial g is randomly generated and checked whether the polynomial g is in the polynomial ring. is irreversible. If the polynomial g is reversible, then add the polynomial g to itself g = g + g until the polynomial g is irreversible.

[0028] Calculate the long-term public key h, the calculation expression is:

[0029] h=g / f(modq)

[0030] Output the calculated long-term public key h and long-term private key pair (f, g).

[0031] Optionally, in response to the first communication party initiating an identity authentication request and randomly generating a first temporary key, generating a first ciphertext and first identity authentication information according to the first temporary key and the second long-term public key, and sending the first ciphertext and first identity authentication information to the second communication party, comprises:

[0032] The first communication party uses its own first identity information ID A and a seed to generate the filling polynomial m A-pad , used to hide identity information, the expression is:

[0033] m A-pad =Pad(ID A , seed)

[0034] Among them, the first identity information ID of the first communication party A The second identity information ID of the second communication party B They are all stored secretly locally and are not made public, and the identity information includes the current local timestamp when the protocol is executed;

[0035] According to the polynomial m A-pad With the second long-term public key h B Calculate the hash value Hash(m A-pad ||h B ), and from Sampler(L, Hash(m A-pad ||h B )) Select a random polynomial r A as the first temporary private key of the first communication party;

[0036] Using the first temporary private key r A and the second long-term public key h B Calculate R A =pt A h B , and use it as the partial value u of the first identity authentication information 000 ;

[0037] From Sampler(L,Hash(r A ))Select the mask polynomial m A-mask The polynomial coefficients of m are used to generate A-mask ;

[0038] Calculate the polynomial difference m A =m A-pad -m A-mask (modp), and use it as another part of the authentication information u of the first identity authentication information 001 ;

[0039] According to the hash function h A Calculate the first identity authentication information u 00 =h A (u 000 ,u 001 );

[0040] Calculate the first ciphertext

[0041] The message consisting of the first identity authentication information and the first ciphertext Sent to the second communication party.

[0042] Optionally, the second communication party decrypts the first ciphertext by using a second long-term private key and verifies the first identity authentication information, and if the identity authentication passes, generates a second shared session key and sends the second ciphertext and the second identity authentication information to the first communication party, including:

[0043] Through the second long-term private key f B The first ciphertext Calculated And record the result as u′ 001 =m′ A , and calculate Note R′ A u′ 000 ;

[0044] Verify the first identity authentication information u 00 , use the hash function to calculate u′ 00 =h A (u′ 000 , u′ 001 ), if u′ 00 =u 00 If the identity authentication of the first communication party is established, and the parameters of the message have not been changed during the transmission process, the message has integrity; otherwise, the message authentication fails, and the second communication party refuses to communicate;

[0045] If the identity authentication is successful, record m′ A for u 010 The second communication party uses its own second identity information ID B Generate filling polynomial m B-pad , the expression is:

[0046] m B-pad =Pad(ID B , seed)

[0047] According to the polynomial m B-pad With the first long-term public key h A Calculate the hash value Hash(m B-pad ||h A ), and from Sampler(L, Hash(m B-pad ||h A )) Select a random polynomial r B as the second temporary private key of the second communication party;

[0048] Using the first public key h of the first communication party A and the second temporary private key r B Calculate R B =pr B h A , and use it as part of the second identity authentication information u″ 001 ;

[0049] From Sampler(L,Hash(r B ))Select the mask polynomial m B-mask The polynomial coefficients of m are used to generate B-mask , and calculate the polynomial difference m B =mB-pad -m B-mask (modp), and use it as part of the second identity authentication information u 011 ;

[0050] Calculate the second ciphertext

[0051] Calculate the shared negotiation parameter R AB =r B h A R′ A ;

[0052] According to the hash function h A Calculate the identity authentication information u 0 =h A (u″ 00 ,u 01 ), where u″ 00 =h A (u′ 000 ,u″ 001 ),u 01 =h A (u 010 ,u 011 );

[0053] Calculate the second shared session key K = KDF(R AB ||m′ A ||m B ||u 0 ), where KDF(·) is a hash function used to hash a message of any length into a session key of λ bits;

[0054] Select H from Sampler(L, K) K The polynomial coefficients are denoted by H K for u 1 , calculate u = h A (u 0 ,u 1 ) as the second identity authentication information;

[0055] The message consisting of the second identity authentication information and the second ciphertext Sent to the first communication party.

[0056] Optionally, the second communication party decrypts the second ciphertext by using the first long-term private key and calculates the first shared session key, and if the identity authentication of the second identity authentication information passes, completing the key negotiation includes:

[0057] Through the first long-term private key f A Decrypting the second ciphertext, we get And record the result as u′ 011 , and calculate And record R′ B u″′ 001 ;

[0058] Remember m A u′ 010 , calculate u′ 01 =h A (u′ 010 , u′ 011 ), calculate u″′ 00 =h A (u 000 ,u″′ 001 ), and calculate u′ 0 =h A (u″′ 00 , u′ 01 );

[0059] Calculate the shared negotiation parameter R′ AB =r A h B R′ B , and calculate the first shared session key K′=KDF(R′ AB ||m A ||m′ B ||u′ 0 );

[0060] Select H' from Sampler(L, K') K The polynomial coefficients are denoted by H′ K u′ 1 ;

[0061] Calculate u′=h A (u′ 0 , u′ 1 );

[0062] Verify whether u′=u. If so, the identity authentication of the second communication party is successful, and the parameters of the message are not changed during the transmission process, and the message has integrity. Otherwise, the message authentication fails, and the first communication party refuses to communicate.

[0063] If the identity authentication is successful, the session key K=K′ is shared and the key negotiation is completed.

[0064] To achieve the above-mentioned purpose, the second embodiment of the present application proposes a Merkle tree authentication key agreement device on an NTRU grid, including:

[0065] A key generation module, used to generate a first long-term public key and a first long-term private key pair of a first communication party and a second long-term public key and a second long-term private key pair of a second communication party according to a preset key generation algorithm, wherein both the first long-term public key and the second long-term public key are made public;

[0066] An identity authentication request module, configured to respond to the identity authentication request initiated by the first communication party and randomly generate a first temporary key, generate a first ciphertext and first identity authentication information according to the first temporary key and the second long-term public key, and send the first ciphertext and first identity authentication information to the second communication party;

[0067] An identity authentication module, configured to allow the second communication party to decrypt the first ciphertext and verify the first identity authentication information by using a second long-term private key, and if the identity authentication is successful, generate a second shared session key and send the second ciphertext and the second identity authentication information to the first communication party;

[0068] The key negotiation module is used for the second communication party to decrypt the second ciphertext through the first long-term private key and calculate the first shared session key. If the identity authentication of the second identity authentication information is passed, the key negotiation is completed.

[0069] To achieve the above-mentioned purpose, the third aspect of the present application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0070] The memory stores computer-executable instructions;

[0071] The processor executes the computer-executable instructions stored in the memory to implement the method as described in any one of the first aspects.

[0072] To achieve the above-mentioned purpose, the fourth aspect embodiment of the present application proposes a computer-readable storage medium, in which computer-readable storage medium is stored computer execution instructions, and when the computer execution instructions are executed by a processor, they are used to implement the method as described in any one of the first aspects.

[0073] To achieve the above-mentioned purpose, the fifth aspect of the present application proposes a computer program product, which implements any method in the first aspect when executed by a processor.

[0074] The technical solution provided by the embodiments of the present application brings at least the following beneficial effects:

[0075] The present invention does not rely on other signature schemes, but uses the Merkle tree to achieve the purpose of authentication, hiding the real identity information that the two communicating parties do not want to expose and the important parameters in the key negotiation process in the leaf nodes of the Merkle tree. In addition, an encryption algorithm based on the NTRU public key is designed. Under the premise of ensuring identity anonymity, through two rounds of message interaction, not only two-way identity authentication is completed, but also the integrity and confidentiality of the transmitted messages are guaranteed, and a shared session key is negotiated, which can resist quantum computing attacks.

[0076] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0078] Figure 1 A flowchart of a Merkle tree authentication key agreement method on an NTRU grid provided in an embodiment of the present application;

[0079] Figure 2 A schematic diagram of a Merkle tree constructed by a first communication party provided in an embodiment of the present application;

[0080] Figure 3 A schematic diagram of a Merkle tree constructed by a second communication party provided in an embodiment of the present application;

[0081] Figure 4 A schematic diagram of the structure of a Merkle tree authentication key agreement device on an NTRU grid provided in an embodiment of the present application. DETAILED DESCRIPTION

[0082] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0083] With the development of science and technology, e-commerce and e-government are becoming more and more popular. For many Internet users, in some specific applications, such as online voting and online payment, people want to sever the connection between their identity and behavior, and they also want to authenticate the identity of the communication object and ensure the integrity and confidentiality of the transmitted information. Therefore, protecting the identity privacy of the two parties in the communication when executing the authenticated key agreement protocol is proposed for this type of cryptographic task.

[0084] However, most of the existing authenticated key exchange protocols on the NTRU grid need to combine the signature algorithm to implement the authentication function, and require three rounds of interactive protocols, which results in a large amount of communication. In addition, most of the protocols do not take into account the needs of user identity privacy protection.

[0085] To address this problem, an embodiment of the present application provides a Merkle tree authentication key negotiation method on an NTRU lattice, and designs a two-round key negotiation protocol on an NTRU lattice that uses a Merkle tree to implement identity privacy protection and two-way authentication. The real identity information that the communicating parties do not want to expose and the important parameters in the key negotiation process are hidden in the leaf nodes of the Merkle tree, so the hash value corresponding to the root node has integrity and cannot be tampered with. In addition, the protocol designed in this application is based on the NTRU public key encryption algorithm. Under the premise of ensuring identity anonymity, it not only completes two-way identity authentication through two rounds of message interaction, but also ensures the integrity and confidentiality of the transmitted messages, and negotiates a shared session key, which can resist quantum computing attacks.

[0086] Figure 1 A schematic diagram of a flow chart of a Merkle tree authentication key negotiation method on an NTRU grid provided in an embodiment of the present application. Figure 1 As shown, the method comprises the following steps:

[0087] Step 101, according to a preset key generation algorithm, generate a first long-term public key, a first long-term private key pair of a first communication party and a second long-term public key, a second long-term private key pair of a second communication party, and both the first long-term public key and the second long-term public key are made public.

[0088] It should be noted that before generating a long-term key pair, various parameters need to be initialized.

[0089] In an embodiment of the present application, the parameter set PARAM={n,p,q,d} is set, where n is the dimension of the polynomial ring, p is a small modulus used to generate a private key polynomial, q is a large modulus used to generate a public key and limit the range of the result, and d is a function independent variable.

[0090] In addition, the ternary polynomial generating function L(d+1, d) is marked as L, which means that the polynomial ring has all integer coefficient polynomials with d+1 coefficients of 1, d coefficients of -1, and the rest of the coefficients are 0, and Sampler(L, seed) represents the discrete Gaussian sampling algorithm instantiated using L and seed seed.

[0091] In addition, the definition is from the domain {0, 1}n k ×{0,1}n k Mapped to the range {0, 1}n k The function is in, for Define the hash function h A Used to generate identity authentication information:

[0092] h A (u 0 ,u 1 )=bin(A 0 ·u 0 +A 1 ·u 1 modq)∈{0,1} nk

[0093] Among them, u 0 ,u 1 Represents the given two polynomials.

[0094] The specific implementation of the present invention follows the following steps:

[0095] Randomly select matrix As a shared matrix between the first communication party and the second communication party, it is used by the first communication party and the second communication party in the key negotiation process. Other parameters can adopt the recommended parameters given in Table 1.

[0096] Table 1 Parameter selection corresponding to different security levels

[0097]

[0098] In addition, we define the polynomial ring To ensure that in addition to h A (·) The hash function computes the special case of authentication information, while other computations remain within a fixed ring structure.

[0099] In the embodiment of the present application, after initializing various parameters, the first long-term public key h of the first communication party is generated according to the key generation algorithm. A 、The first long-term private key pair (f A , g A ) and the second long-term public key h of the second communication party B , the second long-term private key pair (f B , g B ).

[0100] Among them, the long-term public key information h of the first communication party and the second communication party A With h B are all public, and all users in the network are allowed to hold them. The public and legal key negotiation participants are the first communication party and the second communication party. A , g A ) and the second long-term private key pair (f B, g B ) is kept secret locally and not made public.

[0101] As a possible implementation, the long-term key generation process of the key generation algorithm includes the following steps:

[0102] Step 1: Input parameter set PARAM={n, p, q, d} and a seed seed, where the seed seed is used for random sampling to generate the polynomial.

[0103] Step 2: Generate a polynomial F randomly according to the discrete Gaussian sampling algorithm Sampler(L, seed).

[0104] Step 3: Calculate the private key f based on the polynomial F. The calculation expression is:

[0105]

[0106] Among them, it is necessary to ensure that f is in the polynomial ring If it is not reversible, return to step 2 to regenerate polynomial F and repeat this step until f is in the polynomial ring. After the reaction is reversible, proceed to the next step.

[0107] Step 4: Generate another polynomial g randomly according to the discrete Gaussian sampling algorithm Sampler(L,seed), and check whether the polynomial g is in the polynomial ring. It is irreversible.

[0108] If the polynomial g is reversible, then add the polynomial g to itself g=g+g until the polynomial g becomes irreversible.

[0109] Step 5: Calculate the long-term public key h. The calculation expression is:

[0110] h=g / f(modq)

[0111] Step 6: Output the calculated long-term public key h and long-term private key pair (f, g).

[0112] Step 102, in response to the first communication party initiating an identity authentication request and randomly generating a first temporary key, generate a first ciphertext and first identity authentication information according to the first temporary key and the second long-term public key, and send them to the second communication party.

[0113] In this step, the first communication party initiates an identity authentication request and first hides its own identity information ID A , and then use your first temporary private key r A and the second long-term public key h of the second communication party B Generate the first ciphertext and the first identity authentication information u00 and sends it to the second communication party.

[0114] In the embodiment of the present application, the first communication party performs the following operations, and after the following operations, the following Figure 2 Schematic diagram of the Merkle tree structure shown.

[0115] Specifically, the implementation process of step 102 includes the following steps:

[0116] Step 1: The first communication party initiates an identity authentication request. The first communication party uses its own first identity information ID A and a seed to generate the filling polynomial m A-pad , used to hide identity information, the expression is:

[0117] m A-pad =Pad(ID A , seed)

[0118] Among them, the first identity information ID of the first communication party A The second identity information ID of the second communication party B They are all stored secretly locally and are not made public, and the identity information contains the local current timestamp when the protocol is executed, which means that the user's ID information is different each time the protocol is executed.

[0119] Step 2: According to the polynomial m A-pad With the second long-term public key h B Calculate the hash value Hash(m A-pad ||h B ), and from Sampler(L, Hash(m A-pad ||h B )) Select a random polynomial r A As your first temporary private key.

[0120] Step 3: Use the first temporary private key r A and the second long-term public key h B Calculate R A =pr A h B , and use it as the partial value u of the first identity authentication information 000 .

[0121] Step 4: From Sampler(L, Hash(r A ))Select the mask polynomial m A-mask The polynomial coefficients of m are used to generate A-mask .

[0122] Step 5: Calculate the polynomial difference m A =mA-pad -m A-mask (modp), and use it as another part of the first identity authentication information u 001 .

[0123] Step 6: According to the hash function h A Calculate the first identity authentication information u 00 =h A (u 000 ,u 001 ).

[0124] Step 7: Calculate the first ciphertext

[0125] Step 8: Send the message consisting of the first identity authentication information and the first ciphertext Sent to the second communication party.

[0126] Step 103, the second communication party decrypts the first ciphertext and verifies the first identity authentication information using the second long-term private key. If the identity authentication is successful, a second shared session key is generated and the second ciphertext and the second identity authentication information are sent to the first communication party.

[0127] In this step, the second communication party receives the information X and first decrypts the first ciphertext Verify the first identity authentication information u again 00 If the identity authentication of the first communication party is successful, the second communication party will generate a shared second shared session key through a series of operations and construct the following Figure 3 The Merkle tree structure diagram is shown in Figure 1. Then, the second communication party takes the second ciphertext And the second identity authentication information u is sent to the first communication party.

[0128] Specifically, step 103 further includes the following steps:

[0129] Step 1: Use the second long-term private key f B First ciphertext Calculated And record the result as u′ 001 =m′ A , and calculate Note R′ A u′ 000 .

[0130] Step 2: Verify the first identity authentication information u 00 , use the hash function to calculate u′ 00 =h A (u′ 000 , u′ 001 ), if u′ 00 =u 00If the authentication is established, the identity authentication of the first communication party is passed, and the parameters of the message are not changed during the transmission process, and the message has integrity; otherwise, the message authentication fails and the second communication party refuses to communicate.

[0131] Step 3: If the identity authentication is successful, record m′ A for u 010 The second communication party uses its own second identity information ID B Generate filling polynomial m B-pad , the expression is:

[0132] m B-pad =Pad(ID B , seed)

[0133] Step 4: According to the polynomial m B-pad With the first long-term public key h A Calculate the hash value Hash(m B-pad ||h A ), and from Sampler(L, Hash(m B-pad ||h A )) Select a random polynomial r B Serves as a second temporary private key for the second communicating party.

[0134] Step 5: Use the first public key h of the first communication party A and the second temporary private key r B Calculate R B =pr B h A , and use it as part of the second identity authentication information u″ 001 .

[0135] Step 6. From Sampler(L, Hash(r B ))Select the mask polynomial m B-mask The polynomial coefficients of m are used to generate B-mask , and calculate the polynomial difference m B =m B-pad -m B-mask (modp), and use it as part of the second identity authentication information u 011 .

[0136] Step 7: Calculate the second ciphertext

[0137] Step 8: Calculate the shared negotiation parameter R AB =r B h A R′ A ;

[0138] Step 9: According to the hash function hA Calculate the identity authentication information u 0 =h A (u″ 00 ,u 01 ), where u″ 00 =h A (u′ 000 ,u″ 001 ),u 01 =h A (u 010 ,u 011 ).

[0139] Step 10: Calculate the second shared session key K = KDF(R AB ||m′ A ||m B ||u 0 ), where KDF(·) is a hash function used to hash a message of any length into a session key of λ bits in length.

[0140] Step 11. Select H from Sampler (L, K) K The polynomial coefficients are denoted by H K for u 1 , calculate u = h A (u 0 ,u 1 ) as the second identity authentication information.

[0141] Step 12: Send the message consisting of the second identity authentication information and the second ciphertext Sent to the first communication party.

[0142] Step 104: The second communication party decrypts the second ciphertext using the first long-term private key and calculates the first shared session key. If the identity authentication of the second identity authentication information passes, key negotiation is completed.

[0143] In this step, the first communication party verifies the identity of the second communication party after receiving Y. If the last step is successfully executed, the first communication party and the second communication party can obtain a shared session key.

[0144] Specifically, step 104 includes the following steps:

[0145] Step 1: Use the first long-term private key f A Decrypt the second ciphertext and calculate And record the result as u′ 011 , and calculate And record R′ B u″′ 001 .

[0146] Step 2: Remember mA u′ 010 , calculate u′ 01 =h A (u′ 010 , u′ 011 ), calculate u″′ 00 =h A (u 000 ,u″′ 001 ), and calculate u′ 0 =h A (u″′ 00 , u′ 01 ).

[0147] Step 3: Calculate the shared negotiation parameter R′ AB =r A h B R′ B , and calculate the first shared session key K′=KDF(R′ AB ||m A ||m′ B ||u′ 0 ).

[0148] Step 4: Select H' from Sampler(L, K') K The polynomial coefficients are denoted by H′ K u′ 1 .

[0149] Step 5: Calculate the verification value u′=h A (u′ 0 , u′ 1 ).

[0150] Step 6: Verify whether u′=u. If so, the identity authentication of the second communication party is successful, and the message parameters are not changed during the transmission process, and the message has integrity. Otherwise, the message verification fails and the first communication party refuses to communicate.

[0151] Step 7: If the identity authentication is successful, the session key K=K′ is shared and key negotiation is completed.

[0152] Therefore, through the above steps, the first communication party and the second communication party complete secure identity authentication and session key negotiation, ensuring the identity privacy and communication security of both parties.

[0153] In order to implement the above embodiment, the present application also proposes a Merkle tree authentication key negotiation device on the NTRU grid. Figure 4 This is a schematic diagram of the structure of a Merkle tree authentication key agreement device on a NTRU grid provided in an embodiment of the present application. Figure 4 As shown, the device comprises:

[0154] A key generation module, used to generate a first long-term public key and a first long-term private key pair of a first communication party and a second long-term public key and a second long-term private key pair of a second communication party according to a preset key generation algorithm, wherein both the first long-term public key and the second long-term public key are made public;

[0155] An identity authentication request module, configured to respond to an identity authentication request initiated by a first communication party and randomly generate a first temporary key, generate a first ciphertext and first identity authentication information according to the first temporary key and a second long-term public key, and send the first ciphertext and first identity authentication information to a second communication party;

[0156] An identity authentication module, configured to allow the second communication party to decrypt the first ciphertext and verify the first identity authentication information by using a second long-term private key, and if the identity authentication is successful, generate a second shared session key and send the second ciphertext and the second identity authentication information to the first communication party;

[0157] The key negotiation module is used for the second communication party to decrypt the second ciphertext using the first long-term private key and calculate the first shared session key. If the identity authentication of the second identity authentication information is passed, the key negotiation is completed.

[0158] In order to implement the above embodiments, the present application also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided by the above embodiments.

[0159] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0160] In order to implement the above embodiments, the present application also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.

[0161] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0162] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0163] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0164] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0165] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0166] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0167] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0168] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0169] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0170] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0171] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

[0172] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0173] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A Merkle tree authenticated key agreement method on an NTRU lattice, characterized in that: The following steps are involved: Generate a first long-term public key and a first long-term private key pair of the first communication party and a second long-term public key and a second long-term private key pair of the second communication party respectively according to a preset key generation algorithm, wherein the first long-term public key and the second long-term public key are both made public; In response to the first communication party initiating an identity authentication request and randomly generating a first temporary key, generating a first ciphertext and first identity authentication information according to the first temporary key and the second long-term public key, and sending the first ciphertext and first identity authentication information to the second communication party; The second communication party decrypts the first ciphertext and verifies the first identity authentication information using a second long-term private key. If the identity authentication is successful, a second shared session key is generated and the second ciphertext and the second identity authentication information are sent to the first communication party. The second communication party decrypts the second ciphertext using the first long-term private key and calculates the first shared session key. If the identity authentication of the second identity authentication information passes, key negotiation is completed.

2. The method according to claim 1, characterized in that Before respectively generating a first long-term public key and a first long-term private key pair of the first communication party and a second long-term public key and a second long-term private key pair of the second communication party according to a preset key generation algorithm, the method further includes: Set the parameter set PARAM = {n, p, q, d}, where n is the dimension of the polynomial ring, p is the small modulus used to generate the private key polynomial, q is the large modulus used to generate the public key and limit the range of the result, and d is the function argument; The ternary polynomial generating function L(d+1,d) is marked as L, which means that the polynomial ring has d+1 coefficients of 1, d coefficients of -1, and all other coefficients are 0. Sampler(L,seed) represents the discrete Gaussian sampling algorithm instantiated with L and seed seed. Randomly select matrix As a shared matrix between the first communication party and the second communication party, for use by the first communication party and the second communication party in a key negotiation process; Define the hash function h A (u0,u1)=bin(A0·u0+A1·u1mod q), used to generate identity authentication information, where A=[A0|A1], u0,u1 represent two given polynomials Define a polynomial ring To ensure that in addition to h A (·) The hash function computes the special case of authentication information, while other computations remain within a fixed ring structure.

3. The method according to claim 2, characterized in that The long-term key generation process of the key generation algorithm includes: Input parameter set PARAM = {n, p, q, d} and a seed seed, the seed seed is used for random sampling and generating polynomials; A polynomial F is randomly generated according to the discrete Gaussian sampling algorithm Sampler(L,seed); Calculate the private key f according to the polynomial F, and the calculation expression is: Among them, it is necessary to ensure that f is in the polynomial ring If it is not reversible, regenerate the polynomial F and repeat this step until f is in the polynomial ring. After the medium is reversible, proceed to the next step; According to the discrete Gaussian sampling algorithm Sampler(L,seed), another polynomial g is randomly generated and checked whether the polynomial g is in the polynomial ring. is irreversible. If the polynomial g is reversible, then add the polynomial g to itself g = g + g until the polynomial g is irreversible. Calculate the long-term public key f, the calculation expression is: h=g / f(modq) Output the calculated long-term public key h and long-term private key pair (f, g).

4. The method according to claim 3, characterized in that The method of randomly generating a first temporary key in response to the first communication party initiating an identity authentication request, generating a first ciphertext and first identity authentication information according to the first temporary key and the second long-term public key, and sending the first ciphertext and first identity authentication information to the second communication party includes: The first communication party uses its own first identity information ID A and a seed to generate the filling polynomial m A-pad , used to hide identity information, the expression is: m A-pad =Pad(ID A ,seed) Among them, the first identity information ID of the first communication party A The second identity information ID of the second communication party B They are all stored secretly locally and are not made public, and the identity information includes the current local timestamp when the protocol is executed; According to the polynomial m A-pad With the second long-term public key h B Calculate the hash value Hash(m A-pad ||h B ), and from Sampler(L, Hash(m A-pad ||h B )) Select a random polynomial r A as the first temporary private key of the first communication party; Using the first temporary private key r A and the second long-term public key h B Calculate R A =pr A h B , and use it as the partial value u of the first identity authentication information 000 ; From Sampler(L, Hash(r A ))Select the mask polynomial m A-mask The polynomial coefficients of m are used to generate A-mask ; Calculate the polynomial difference m A =m A-pad -m A-mask (modp), and use it as another part of the authentication information u of the first identity authentication information 001 ; According to the hash function h A Calculate the first identity authentication information u 00 =h A (u 000 ,u 001 ); Calculate the first ciphertext The message consisting of the first identity authentication information and the first ciphertext Sent to the second communication party.

5. The method according to claim 4, characterized in that The second communication party decrypts the first ciphertext by using a second long-term private key and verifies the first identity authentication information, and if the identity authentication is successful, generates a second shared session key and sends the second ciphertext and the second identity authentication information to the first communication party, including: Through the second long-term private key f B The first ciphertext Calculated And record the result as u′ 001 =m′ A , and calculate Note R′ A u′ 000 ; Verify the first identity authentication information u 00 , use the hash function to calculate u′ 00 =h A (u′ 000 , u′ 001 ), if u′ 00 =u 00 If the identity authentication of the first communication party is established, and the parameters of the message have not been changed during the transmission process, the message has integrity; otherwise, the message authentication fails, and the second communication party refuses to communicate; If the identity authentication is successful, record m′ A for u 010 The second communication party uses its own second identity information ID B Generate filling polynomial m B-pad , the expression is: m B-pad =Pad(ID B ,seed) According to the polynomial m B-pad With the first long-term public key h A Calculate the hash value Hash(m B-pad ||h A ), and from Sampler(L, Hash(m B-pad ||h A )) Select a random polynomial r B as the second temporary private key of the second communication party; Using the first public key h of the first communication party A and the second temporary private key r B Calculate R B =pr B h A , and use it as part of the second identity authentication information u″ 001 ; From Sampler(L, Hash(r B ))Select the mask polynomial m B-mask The polynomial coefficients of m are used to generate B-mask , and calculate the polynomial difference m B =m B-pad -m B-mask (modp), and use it as part of the second identity authentication information u 011 ; Calculate the second ciphertext Calculate the shared negotiation parameter R AB =r B h A R′ A ; According to the hash function h A Calculate the identity authentication information u0 = h A (u″ 00 ,u 01 ), where u″ 00 =h A (u′ 000 ,u″ 001 ),u 01 =h A (u 010 ,u 011 ); Calculate the second shared session key K = KDF(R AB ||m′ A ||m B ||u0), where KDF(·) is a hash function used to hash a message of any length into a session key of λ bits; Select H from Sampler(L, K) K The polynomial coefficients are denoted by H K For u1, calculate u=h A (u0, u1) as the second identity authentication information; The message consisting of the second identity authentication information and the second ciphertext Sent to the first communication party.

6. The method according to claim 5, characterized in that The second communication party decrypts the second ciphertext by using the first long-term private key and calculates the first shared session key, and if the identity authentication of the second identity authentication information passes, completing the key negotiation includes: Through the first long-term private key f A Decrypt the second ciphertext and calculate And record the result as u′ 011 , and calculate And record R′ B u″′ 001 ; Remember m A u′ 010 , calculate u′ 01 =h A (u′ 010 , u′ 011 ), calculate u″′ 00 =h A (u 000 ,u″′ 001 ), and calculate u′0=h A (u″′ 00 , u′ 01 ); Calculate the shared negotiation parameter R′ AB =r A h B R′ B , and calculate the first shared session key K′=KDF(R′ AB ||m A ||m′ B ||u′0); Select H' from Sampler(L, K') K The polynomial coefficients are denoted by H′ K is u′1; Calculation u′=h A (u′0, u′1); Verify whether u′=u. If so, the identity authentication of the second communication party is successful, and the parameters of the message are not changed during the transmission process, and the message has integrity. Otherwise, the message authentication fails, and the first communication party refuses to communicate. If the identity authentication is successful, the session key K=K′ is shared and the key negotiation is completed.

7. A Merkle tree authenticated key agreement device on an NTRU grid, characterized in that: include: A key generation module, used to generate a first long-term public key and a first long-term private key pair of a first communication party and a second long-term public key and a second long-term private key pair of a second communication party according to a preset key generation algorithm, wherein both the first long-term public key and the second long-term public key are made public; An identity authentication request module, configured to respond to the identity authentication request initiated by the first communication party and randomly generate a first temporary key, generate a first ciphertext and first identity authentication information according to the first temporary key and the second long-term public key, and send the first ciphertext and first identity authentication information to the second communication party; An identity authentication module, configured to allow the second communication party to decrypt the first ciphertext and verify the first identity authentication information by using a second long-term private key, and if the identity authentication is successful, generate a second shared session key and send the second ciphertext and the second identity authentication information to the first communication party; The key negotiation module is used for the second communication party to decrypt the second ciphertext through the first long-term private key and calculate the first shared session key. If the identity authentication of the second identity authentication information is passed, the key negotiation is completed.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images