Theoretical security analysis method of lattice PKE / KEM scheme based on compressed public key design

Abstract

The present invention proposes a theoretical security analysis method for a lattice-based PKE / KEM scheme based on a compressed public key design, comprising the following steps: obtaining a key encapsulation scheme; utilizing the properties of a discrete Gaussian distribution to decompose e into two parts, e1 and e2, and then re-expressing the parameters as #imgabs0#; expressing #imgabs1# and #imgabs2# as #imgabs3#, wherein #imgabs4# is taken from an appropriate distribution; utilizing the properties of the discrete Gaussian distribution to decompose a secret #imgabs5# into a secret #imgabs6# and a redundant part #imgabs7# of a standard modulus LWE problem; and then rewriting the sample form as #imgabs8#; utilizing the standard modulus LWE problem corresponding to #imgabs9# to evaluate the theoretical difficulty lower bound of the corresponding problem, and then evaluating the security strength lower bound of the KEM scheme; and selecting specific parameters of the key encapsulation scheme for a required security strength λ according to the computational complexity of the standard modulus LWE problem corresponding to #imgabs10#.

Description

Technical Field

[0001] The present invention belongs to the technical field of quantum-resistant public key cryptography, and in particular relates to a theoretical security analysis method for a lattice-based PKE / KEM scheme based on compressed public key design. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In Internet of Things (IoT) applications, encrypted communication between IoT devices is necessary to ensure data privacy. Currently, the mainstream communication method utilizes public-key encapsulation to negotiate session keys, followed by block ciphers for encrypted data transmission. Due to the miniaturization of IoT devices, lightweight cryptographic algorithms are required that minimize communication bandwidth and computational requirements. With the development of quantum computing technology, existing lightweight cryptographic algorithms need to be migrated towards quantum-resistant cryptography.

[0004] A class of lightweight lattice-based cryptographic algorithms can adopt a design similar to the NIST-standardized Kyber algorithm, using a compressed public key design to save communication bandwidth, making these solutions potentially suitable for IoT applications. However, this approach cannot be used to evaluate the security of these solutions based on the standard modular LWE problem, as used for Kyber, meaning that the corresponding cryptographic system may have security risks.

[0005] According to the analysis methods in existing public literature, the security assessment of the corresponding design scheme has a significant loss. Under the premise of achieving λ-bit security strength, the existing evaluation method requires the parameters of the key encapsulation system to be selected too large, which is not conducive to the application of the algorithm in the IoT environment. Summary of the Invention

[0006] To overcome the above-mentioned deficiencies of the prior art, the present invention provides a theoretical security analysis method for the lattice-based PKE / KEM scheme based on compressed public key design, which is suitable for IoT application scenarios.

[0007] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0008] First, a theoretical security analysis method for the lattice-based PKE / KEM scheme based on compressed public key design is disclosed, including:

[0009] Obtain a key encapsulation scheme, which is a lattice-based PKE / KEM scheme based on compressed public key design;

[0010] The properties of discrete Gaussian distribution are used to decompose the error e in the key encapsulation algorithm into two parts: e1 and e2. The parameters are then re-expressed as

[0011] Will Expressed as in Taken from appropriate distribution;

[0012] Then use the properties of discrete Gaussian distribution to The secret of splitting and decomposing into the standard modulus LWE problem and redundant parts Then rewrite the sample form as

[0013] use The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated;

[0014] For the required security strength λ, according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

[0015] As a further technical solution, the key encapsulation scheme security requirements are:

[0016] The key K is computationally indistinguishable from a random uniform distribution;

[0017] Compression of ciphertext does not affect the security of the scheme;

[0018] Ciphertext The pseudo-randomness of can be ensured by the standard decision version modulo the LWE problem;

[0019] The pseudo-randomness of the ciphertext c2 requires the assumption and The calculation is indistinguishable, where u is taken from Uniform distribution on .

[0020] As a further technical solution, the steps for obtaining the key encapsulation scheme are:

[0021] Parameter generation Setup(1 λ );

[0022] Key generationKeyGen(pp);

[0023] Key encapsulation Enc(pk);

[0024] Key decapsulation Dec(ct,sk).

[0025] As a further technical solution, parameter generation Setup(1 λ ): Select a cyclotomic polynomial ring with dimension \(n\) being a power of 2 according to the security parameter \(\lambda\). Calculate the modulus \(p \lt q\), the Gaussian parameter \(\alpha\), and the rank \(k\) of the modulus, and return the parameters

[0026] As a further technical solution, key generation KeyGen(pp): Select a 128-bit long random number seed according to the security parameter \(\lambda\), and then use this random number to generate a public matrix in combination with \(F\). Sample from a discrete Gaussian distribution Calculate Return the public key \(pk=(seed, d)\) and the private key \(sk = s\).

[0027] As a further technical solution, key encapsulation Enc(pk): Recalculate the public matrix using \(seed\). Sample from a discrete Gaussian distribution and Calculate Finally, calculate the key \(K = Con(c2)\), and set the ciphertext Return \((K, ct)\).

[0028] As a further technical solution, key decapsulation Dec(ct, sk): Calculate Subsequently, use the Rec algorithm to calculate \(K = Rec(c2')\) to obtain an \(n\)-bit session key.

[0029] As a further technical solution, before the steps of obtaining the key encapsulation scheme, assume that \((Con, Rec)\) is a key agreement algorithm that satisfies correctness and security, and \(F\) is a publicly available pseudorandom function.

[0030] In the second aspect, a theoretical security analysis system for a lattice-based PKE / KEM scheme designed based on a compressed public key is disclosed, including:

[0031] A key encapsulation scheme acquisition module, configured to: obtain a key encapsulation scheme;

[0032] A first representation module, configured to: decompose \(e\) into two parts \(e1\) and \(e2\) using the properties of the discrete Gaussian distribution, and then re-represent the parameters as

[0033] A second representation module, configured to: represent as where is taken from an appropriate distribution; <00001The third representation module is configured to: reuse the properties of discrete Gaussian distribution to represent the secret The secret of splitting and decomposing into the standard modulus LWE problem and redundant parts Then rewrite the sample form as

[0035] The evaluation module is configured to: The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated;

[0036] The parameter selection module is configured to: for the required security strength λ, according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

[0037] In a second aspect, a communication device is disclosed, including: an initiator and a receiver;

[0038] The initiator uses the receiver's public key to run the key encapsulation algorithm KEM.Enc to obtain the session key K and the ciphertext ct. It then uses the key K to calculate the encrypted ciphertext ct' of the message using the block encryption algorithm, and sends the ciphertext ct and the encrypted ciphertext ct' to the receiver.

[0039] The receiver first uses KEM.Dec to decapsulate ct to obtain the key K, and then uses the block encryption algorithm to decrypt ct′ to obtain the plaintext. Within a certain period of time, the two communicating parties continue to communicate using the session key K.

[0040] The key encapsulation algorithm KEM.Enc is obtained through the theoretical security analysis method or system of the lattice PKE / KEM scheme designed based on compressed public keys.

[0041] One or more of the above technical solutions have the following beneficial effects:

[0042] The technical solution of the present invention is suitable for IoT application scenarios. It uses public key compression to save communication bandwidth and designs a lattice key encapsulation algorithm. In addition, a theoretical security assessment method is used to evaluate the design scheme faster and more accurately.

[0043] Advantages of additional aspects of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0045] Figure 1 This is a schematic diagram of the basic LP framework;

[0046] Figure 2 Design diagram for LP framework compressed public key;

[0047] Figure 3 Provides an introduction to the standard LWE problem and the semi-uniform LWE problem;

[0048] Figure 4 Schematic diagram of the theoretical security evaluation method for the LP framework plus public key compression PKE;

[0049] Figure 5 Instance conversion for semi-uniform LWE problem;

[0050] Figure 6 secret Satisfy the properties of the distribution;

[0051] Figure 7 This is the basic application mode of IoT in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0053] It should be noted that the terms used herein are for describing particular embodiments only and are not intended to limit the exemplary embodiments according to the present invention.

[0054] In the absence of conflict, the embodiments of the present invention and the features thereof may be combined with each other.

[0055] Practical lattice-based public key encryption / key encapsulation mechanism (PKE / KEM) schemes are typically designed using a modular lattice using an LP framework. The basic design approach involves first designing a PKE scheme that satisfies IND-CPA security based on the decision modular LWE problem. This IND-CPA-secure PKE scheme is then used as a building block to design a PKE / KEM scheme that satisfies IND-CCA2 security using a variant of the generalized FO transformation.

[0056] Since the FO paradigm is an efficient and general method for designing practical PKE / KEM schemes, a well-designed basic PKE scheme that meets IND-CPA security is the basis for designing efficient, practical, and standardized PKE / KEM schemes.

[0057] The key generation, encryption and decryption algorithms of the PKE scheme with IND-CPA security are designed based on the modular LWE problem using the LP framework as follows: Figure 1 As shown in the figure, only the cyclotomic polynomial ring used in the standardized algorithm is used as an example. During the standardization process of NIST (National Institution of Standards and Technology), a series of optimization measures were used in Kyber to balance error rate, security strength, computational efficiency and communication bandwidth. Among them, in order to save communication bandwidth, the first round of candidate algorithms submitted by Kyber to NIST adopted the following Figure 2 Here, the design of the compressed public key is omitted. The compression of A and c2 is because in the design of Kyber (and similar schemes such as Aigis and AKC-MLWE), A is generated from a random 256-bit seed. At the same time, the compression of the ciphertext does not affect the security proof. Note that when the parameter p is smaller than the parameter q, the size of the public key can be compressed. In practical applications, p is generally chosen to be a positive integer slightly smaller than q, such as a difference of 1 to 3 bits.

[0058] In the corresponding IND-CPA security proof, two versions of the modular LWE assumption are required to determine the public key and ciphertext Replace with corresponding random uniform elements. Figure 1 The standard LP design framework shown can be based on Figure 3 The reduction proof is completed by using the standard decision version modulo LWE problem shown in the figure, and then the IND-CPA security of the scheme is strictly reduced to the standard modulo LWE problem with appropriate parameters for theoretical security analysis. Figure 2 The design of the LP framework to compress the public key shown requires the use of Figure 3 The semi-uniform decision version of the modular LWE problem is shown to perform theoretical security reduction. Here, semi-uniform means generating LWE problem instances The public matrix of is not much different from A and can be calculated from A. More precisely, the public matrix A is compressed by the transformation and decompression Afterwards, the (matrix) spectral norm of the difference with the original matrix A is smaller.

[0059] Before the paper "Jia WJ, Zhang J, Xiang BW, Wang BC. Hardness of (M) LWE with semi-uniform seeds. Theoretical Computer Science, 2024, 994: 114481.", there was no theoretical reduction of the standard modulus LWE problem to the semi-uniform modulus LWE problem, so we adopted Figure 2 The theoretical IND-CPA security proof of the PKE scheme designed in the manner shown is heuristic. The security estimate of the related scheme is estimated by treating the semi-uniform LWE problem as a standard LWE problem. For this reason, starting from the second round of NIST, the Kyber design team canceled the compression of public keys to eliminate the potential security risks / concerns caused by the lack of theoretical reduction. This paper first gave the reduction of the standard LWE problem to the semi-uniform LWE problem, and then gave the use of Figure 2 The theoretical IND-CPA security evaluation method of the PKE scheme designed by the shown design method.

[0060] However, since the reduction loss from the standard LWE problem to the semi-uniform LWE problem given in the above literature is too large, if the reduction method given in the above literature is used to evaluate the Figure 2 When the theoretical IND-CPA security of the PKE scheme designed using the aforementioned design approach is compromised, the corresponding security assessment suffers significantly. In order to achieve a certain theoretical security strength (e.g., a specific λ-bit security strength), the evaluation method proposed in the aforementioned literature requires a corresponding increase in the scheme's parameters (such as the computational modulus and discrete Gaussian parameters) or the ring dimension, which in turn increases the size of the PKE scheme's public key / ciphertext and reduces its operational efficiency.

[0061] For adoption Figure 2 The IND-CPA security evaluation of the PKE scheme with the design shown in the figure is carried out. The main problem solved by this application is: how to convert the semi-uniform modulus LWE problem with fixed parameters into the corresponding standard modulus LWE problem, reduce the reduction loss in the evaluation process so that the corresponding scheme can select smaller parameters when achieving a certain security strength, and thus enable the corresponding scheme to have more parameter selection, higher computational efficiency and smaller communication bandwidth.

[0062] The present invention draws on the reduction techniques of the Hint-LWE problem and uses techniques such as joint Gaussian distribution analysis to optimize the conversion process from an instance of a semi-uniform LWE problem to an instance of a standard LWE problem, thereby providing a more compact reduction method from a standard LWE problem to a semi-uniform LWE problem with less reduction loss. The problem conversion method provided by the present invention does not depend on algebraic structures and can be uniformly applied to corresponding problems defined on structures such as Euclidean lattices, ideal lattices, and modular lattices. At the same time, the conversion method provided by the present invention can maintain the dimension of the corresponding LWE problem, and the loss of the error Gaussian parameter is small. Furthermore, a more compact theoretical security assessment of the IND-CPA security of the LP framework PKE scheme designed using a public key compression method can be provided.

[0063] Theoretical introduction:

[0064] For a fixed set of parameters, the method for evaluating the theoretical IND-CPA security of LP-framed PKE schemes designed with public key compression is as follows: Figure 4 As shown, it can be summarized as first taking the IND-CPA of the corresponding scheme.

[0065] The security is reduced to the standard LWE problem + semi-uniform LWE problem, and then the corresponding semi-uniform LWE problem is reduced to the standard LWE problem with appropriate parameters. The solution complexity of the lower difficulty problem among the above two (different parameters) standard LWE problems is used as the theoretical computational complexity of the PKE scheme.

[0066] The technical solution of the present invention focuses on improving the reduction process of the semi-uniform LWE problem to the standard LWE problem 2. Specifically, we use the technique of joint Gaussian distribution analysis to provide a new instance conversion method related to the semi-uniform LWE problem, converting the instance of the semi-uniform LWE problem into a sample form that is easy to embed into the standard LWE problem instance, and then theoretically establish the connection between the standard LWE problem and the semi-uniform LWE problem. The specific conversion is as follows Figure 5 As shown in the figure, the basic idea is to first use the properties of discrete Gaussian distribution, and first convert the error It is divided into two parts. Used to serve as the error part of the standard LWE problem; Used in Partially fully covered information so that even if it is known There is still enough entropy. In this way, we can use the properties of the joint Gaussian distribution (specifically Figure 6 As shown), select an appropriate and efficient sampling distribution χ to resample so that The joint distribution of Finally, we use the properties of discrete Gaussian distribution to further divide the secret It is divided into two parts. Here, is the main part, which acts as the secret part of the standard LWE problem. is the reduction loss. Parts can be sampled effectively, so we can embed instances of the standard LWE problem into Figure 5 In the example at the bottom, the reduction from the standard LWE problem to the semi-uniform LWE problem is completed.

[0067] The sample conversion method in the technical solution of the present invention can reduce the standard LWE problem to a semi-uniform LWE problem while maintaining the dimension of the corresponding lattice.

[0068] The sample conversion method of the technical solution of the present invention is applicable to corresponding LWE problems defined on different structures, such as Euclidean lattices, ideal lattices, and modular lattices, and is applicable when the rank of the modular lattice is k = O(1). At the same time, the sample conversion method of the technical solution of the present invention maintains the dimensionality of the (ideal / modular) lattice and imposes no additional restrictions on the calculated modulus q.

[0069] The best results in the currently known public literature require that the calculated modulus q be a prime number with good splitting properties and that the secret distribution modulus The sample transformation method is also not applicable to the case of ring LWE and modular LWE with k = O(1). Furthermore, the theoretical reduction suffers at least O(logn+logq) loss with respect to the lattice dimension (the lattice dimension is the main factor in measuring the theoretical difficulty of related problems).

[0070] Example 1

[0071] In view of the low hardware configuration of IoT application environment devices, the cryptographic algorithm used is required to have the characteristics of relatively simple calculation and small communication bandwidth. This paper proposes a design of a lattice key encapsulation protocol suitable for IoT application environment, which adopts public key compression method, and provides a specific theoretical security evaluation method.

[0072] The security of the key encapsulation scheme requires that K is computationally indistinguishable from a random uniform distribution. Compression of the ciphertext does not affect the security of the scheme. The pseudo-randomness of can be guaranteed by the standard decision version modulo LWE problem. The pseudo-randomness of the ciphertext c2 requires the assumption and The calculation is indistinguishable, where u is taken from Uniform distribution on .

[0073] Specific parameter meaning: q is a positive integer, which is the calculation modulus; is the public matrix / vector of the modular LWE problem, uniformly selected; p is a positive integer, which is the calculation modulus after the public key is compressed, and is generally 1-3 bits smaller than the number of bits of q; T is the matrix transpose symbol; The secret vector of the modular LWE problem is selected from The appropriate parameter discrete Gaussian distribution on the LWE problem is selected from A discrete Gaussian distribution with appropriate parameters on .

[0074] This embodiment discloses a theoretical security analysis method for a lattice-based PKE / KEM scheme based on a compressed public key design, including:

[0075] Step (1): Let Using the properties of discrete Gaussian distribution, the error e is decomposed into two parts, e1 and e2, and then Expressed as This form.

[0076] In this step, The introduction is only for the convenience of representation. The theoretical role of this step is to decompose the error e so that it can be analyzed in the second step. Definition of is the public matrix / vector of the modular LWE problem, Evenly selected. The purpose is to conduct subsequent analysis. The case of p,q can be publicly calculated.

[0077] Step (2): Utilize right The information masking effect can explain the known In the case of There is still enough entropy, and the conditional distribution can be calculated. Then we can Expressed as in Taken from an appropriate distribution. The above method can be used to The samples were taken from The corresponding appropriate distribution, and then in step (3) Split.

[0078] Step (3): Use the properties of discrete Gaussian distribution to calculate the secret The secret of splitting and decomposing into the standard modulus LWE problem and redundant parts Then rewrite the sample form as So far, the corresponding standard module LWE problem can be used to evaluate the lower bound of the theoretical difficulty of the corresponding problem, and further evaluate the lower bound of the security strength of the KEM scheme.

[0079] Step (4): For the required security strength λ, according to the computational complexity of the corresponding standard module LWE problem, select the specific parameters of the scheme, specifically including the dimension n of the ring, the rank k of the modulus, the computational moduli p, q and the Gaussian error parameter α, where n and correspond one by one, and determining one of them is sufficient.

[0080] The key encapsulation method is as follows:

[0081] Design of the key encapsulation scheme KEM(Setup, KeyGen, Enc, Dec)

[0082] Suppose (Con, Rec) is a key agreement algorithm that satisfies correctness and security. F is a publicly known pseudorandom function.

[0083] Step (S1): Parameter generation Setup(1 λ ): Select a cyclotomic polynomial ring with the dimension n being a power of 2 according to the security parameter λ Calculate the moduli p < q, the Gaussian parameter α and the rank k of the modulus. Return the parameters

[0084] Step (S2): Key generation KeyGen(pp): Select a 128-bit long random number seed according to the security parameter λ, and then use this random number to generate a public matrix in combination with F Sample from the discrete Gaussian distribution Calculate Return the public key The private key <00​​​​​​​​​​​​​​​​​​​​​Step (S3): Key encapsulation Enc(pk): Recalculate the public matrix using seed Sampling discrete Gaussian distribution and calculate Finally, calculate the key K = Con(c2), and let the ciphertext Returns (K, ct).

[0087]

[0088] is the error vector (modulo the LWE problem) error vector, Elements in for The vector in (The rounding sign defaults to the polynomial ring Each coefficient in is used); for The vector in .

[0089] Step (S4): Key decapsulation Dec(ct,sk): Calculation Then, the Rec algorithm is used to calculate K=Rec(c2′) to obtain an n-bit session key.

[0090] Example 2

[0091] The purpose of this embodiment is to provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the program.

[0092] Example 3

[0093] The purpose of this embodiment is to provide a computer-readable storage medium.

[0094] A computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps of the above method.

[0095] Example 4

[0096] The purpose of this embodiment is to provide a theoretical security analysis system for the lattice-based PKE / KEM scheme based on compressed public key design, including:

[0097] The key encapsulation scheme acquisition module is configured to: obtain a key encapsulation scheme;

[0098] The first representation module is configured to use the properties of discrete Gaussian distribution to decompose e into two parts, e1 and e2, and then re-express the parameters as

[0099] The second representation module is configured to: Expressed as in Taken from appropriate distribution;

[0100] The third representation module is configured to: reuse the properties of discrete Gaussian distribution to represent the secret The secret of splitting and decomposing into the standard modulus LWE problem and redundant parts Then rewrite the sample form as

[0101] The evaluation module is configured to: The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated; the parameter selection module is configured as follows: for the required security strength λ, according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

[0102] Example 5

[0103] The purpose of this embodiment is to provide a computer program product containing instructions, which, when running on a computer, enables the computer to execute the methods and functions involved in any of the above embodiments.

[0104] Example 6

[0105] The purpose of this embodiment is to provide a basic application model of IoT. Figure 7 As shown, the server initializes the KEM parameter pp, and then uses the KeyGen algorithm with the IoT device to generate their own public and private key pairs.

[0106] When communication is required between a server and a device or between devices, a communication apparatus includes: an initiator and a receiver;

[0107] (1) The initiator uses the receiver's public key to run the key encapsulation algorithm KEM.Enc to obtain the session key K and the ciphertext ct. It then uses the key K to calculate the encrypted ciphertext ct' of the message using a block encryption algorithm (such as AES) and sends the ciphertext ct and the encrypted ciphertext ct' to the receiver.

[0108] (2) The receiver first uses KEM.Dec to decapsulate ct to obtain the key K, and then uses the block encryption algorithm to decrypt ct' to obtain the plaintext. Within a certain period of time (key life cycle), the communicating parties can continue to communicate using this session key K.

[0109] The key encapsulation algorithm KEM.Enc is obtained through the theoretical security analysis method or system of the lattice PKE / KEM scheme designed based on compressed public keys.

[0110] The steps involved in the apparatus of the above embodiment correspond to those of the method embodiment 1. For detailed implementation, please refer to the relevant description of embodiment 1. The term "computer-readable storage medium" should be understood to mean a single medium or multiple media containing one or more instruction sets; it should also be understood to include any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and causing the processor to perform any method of the present invention.

[0111] Those skilled in the art will appreciate that the modules or steps of the present invention described above can be implemented using a general-purpose computer device. Alternatively, they can be implemented using program code executable by a computing device, which can then be stored in a storage device and executed by the computing device. Alternatively, they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0112] Although the above describes the specific embodiments of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without any creative work are still within the scope of protection of the present invention.

Claims

1. The theoretical security analysis method of the lattice PKE / KEM scheme based on compressed public key design is characterized by: include: Obtain a key encapsulation scheme, which is a lattice-based PKE / KEM scheme based on compressed public key design; Using the properties of discrete Gaussian distribution to encapsulate the error in the key encapsulation algorithm Disassembled into and Two parts, and then re-express the parameters as ; The secret vector of the LWE problem is selected from Parameterized discrete Gaussian distribution on ; is the error of the LWE problem, selected from discrete Gaussian distribution with parameters on , Based on security strength Select the dimension The ring of cyclotomic polynomials that is a power of 2; is the public matrix / vector of the modular LWE problem, Medium uniform selection; , ; Will Expressed as ,in Taken from appropriate distribution; Then use the properties of discrete Gaussian distribution to The secret of splitting and decomposing into the standard modulus LWE problem and redundant parts Then rewrite the sample form as ; use The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated; For the required security strength ,according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

2. The theoretical security analysis method of the lattice-based PKE / KEM scheme based on compressed public key design as claimed in claim 1 is characterized in that: The steps to obtain the key encapsulation scheme are: Parameter Generation Setup ; Key GenerationKeyGen ; Key encapsulation Enc(pk); Key decapsulation Dec(ct,sk).

3. The theoretical security analysis method of the lattice-based PKE / KEM scheme based on compressed public key design as claimed in claim 2 is characterized in that: Parameter Generation Setup :Based on security strength Select the dimension The ring of cyclotomic polynomials that is a power of 2 , calculate the modulus , Gaussian parameters and the rank of the module , return parameter pp=( ).

4. The theoretical security analysis method of the lattice-based PKE / KEM scheme based on compressed public key design as claimed in claim 3 is characterized in that: Key GenerationKeyGen :Based on security strength Select a 128-bit random number seed, and then use this random number combined with F to generate the public matrix , sampling discrete Gaussian distribution ,calculate , private key sk = .

5. The theoretical security analysis method of the lattice-based PKE / KEM scheme based on compressed public key design as claimed in claim 3 is characterized in that: Key encapsulation Enc(pk): Recalculate the public matrix using seed , sampling discrete Gaussian distribution and ,calculate , , , and finally calculate the key , and let the ciphertext ct = ,return(K,ct); Key decapsulation Dec(ct,sk): calculation , , then use the Rec algorithm to calculate K=Rec( )get bit session key; Before obtaining the key encapsulation scheme, it is assumed that (Con, Rec) is a key consensus algorithm that meets the correctness and security requirements, and F is a public pseudo-random function.

6. A theoretical security analysis system for lattice-based PKE / KEM schemes based on compressed public key design, characterized by: include: The key encapsulation scheme acquisition module is configured to: obtain a key encapsulation scheme, where the key encapsulation scheme is a lattice PKE / KEM scheme designed based on a compressed public key; The first representation module is configured to: utilize the properties of discrete Gaussian distribution to encapsulate the error in the key encapsulation algorithm Disassembled into and Two parts, and then re-express the parameters as ; The secret vector of the LWE problem is selected from Parameterized discrete Gaussian distribution on ; is the error of the LWE problem, selected from discrete Gaussian distribution with parameters on , Based on security strength Select the dimension The ring of cyclotomic polynomials that is a power of 2; is the public matrix / vector of the modular LWE problem, Medium uniform selection; , ; Will Expressed as ,in Taken from appropriate distribution; The second representation module is configured to: Expressed as ,in Taken from appropriate distribution; The third representation module is configured to: reuse the properties of discrete Gaussian distribution to represent the secret The secret of splitting and decomposing into the standard modulus LWE problem and redundant parts Then rewrite the sample form as ; The evaluation module is configured to: The corresponding standard modulus LWE problem is used to evaluate the theoretical difficulty lower bound of the corresponding problem, and then the security strength lower bound of the KEM solution is evaluated; The parameter selection module is configured to: ,according to The specific parameters of the key encapsulation scheme are selected based on the computational complexity of the corresponding standard modulus LWE problem.

7. A communication device, characterized in that it comprises: Initiator and receiver; The initiator uses the receiver's public key to run the key encapsulation algorithm KEM.Enc to obtain the session key K and ciphertext ct. Then it uses the key K to calculate the encrypted ciphertext of the message using the block encryption algorithm. , and the ciphertext ct and the encrypted ciphertext Send to the recipient; The receiver first uses KEM.Dec to decapsulate ct to obtain the key K, and then uses the block encryption algorithm to decrypt After obtaining the plaintext, the two communicating parties continue to communicate using the session key K within a certain period of time. The key encapsulation algorithm KEM.Enc is obtained through the theoretical security analysis method of the lattice PKE / KEM scheme based on compressed public key design described in any one of claims 1 to 5 or the system described in claim 6.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method described in any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are performed.

Images