Quantum anonymity resistant two-factor authentication key negotiation method

Abstract

The invention relates to an anti-quantum anonymity two-factor authentication key negotiation method, and belongs to the technical field of information security. The negotiation process comprises the following steps: a client U sends login request information to a server S based on an intelligent card issued by the server S, wherein the login request information comprises a first ciphertext C1, a random number R and a first message check code F1; the server S verifies the received login request information, generates a session key and sends a response message to the client U, and the response message comprises a second ciphertext C2 and a second message check code F2; the client U verifies the received response message, obtains the session key, generates a third message verification code F3 and sends the third message verification code F3 to the server S; and the server S verifies whether the negotiation is successful based on the third message verification code F3. According to the method, two-way authentication and two-way confirmation are achieved through three message verification codes, on the premise that digital authentication infrastructure does not need to be transformed, client information identity is hidden, identity authentication and key negotiation of digital financial payment are achieved, and better safety and good usability are achieved.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a quantum-resistant anonymous two-factor authentication key negotiation method. Background Art

[0002] The existing digital identity authentication for financial payment is usually created and verified in the mode of username plus password at the front end, and the identity authentication between the client and the server is realized at the back end through technologies such as digital certificates. This method has real risks such as the disconnection between password authentication and certificate keys, resulting in low security, and the lack of quantum security of the authentication key negotiation protocol based on digital certificates. At the same time, it also faces the need to rely on the existing digital authentication infrastructure to carry out a lot of work on quantum-resistant cryptographic migration. At the same time, most of the current password authentication key negotiation protocols do not hide customer identity information and fail to protect the privacy of customer identities. Summary of the invention

[0003] In view of the above analysis, the present invention aims to provide a quantum-resistant anonymous two-factor authentication key negotiation method, which hides customer identity information without the need to transform the digital authentication infrastructure, and realizes identity authentication and key negotiation for digital financial payment, which specifically includes the following steps:

[0004] The client U sends a login request message to the server S, the login request message including a first ciphertext C1, a random number R and a first message verification code F1; wherein the first ciphertext C1 and the first message verification code F1 are generated based on a smart card issued by the server S;

[0005] The server S verifies the received login request information, generates a session key after the verification is passed, and sends a response message to the client U; the response message includes the second ciphertext C2 and the second message verification code F2; wherein the session key, the second ciphertext C2 and the second message verification code F2 are generated based on the first ciphertext C1, the random number R and the first message verification code F1;

[0006] Client U verifies the received response message, and if the verification is successful, obtains the session key based on the response message.

[0007] Furthermore, after obtaining the session key based on the response message, the client U also performs the following operations: generating a third message verification code F3 based on the second ciphertext C2 and the second message verification code F2 and sending the third message verification code F3 to the server S;

[0008] The server S verifies whether the negotiation is successful based on the third message verification code F3. If not, the negotiation fails and a negotiation failure message is sent to the client U.

[0009] Furthermore, the smart card carries smart card information and the client's symmetric key. Uand the second hash value V of the customer password U ;

[0010] Before the client U sends a login request to the server S, it also includes:

[0011] Enter the customer identifier ID U * , enter the customer password PW U * , based on the customer's symmetric key U Calculate V with number 2 U ', verify V U '=V U Is it true? If not, re-enter the customer identification identifier and customer password.

[0012] Furthermore, the smart card information includes: the protection code L of the first hash value of the customer password U 、Server second hash value K S,U , Server Identifier ID S and the server public key pk S ;

[0013] The client U generates the first ciphertext C1 and the first message verification code F1 based on the smart card issued by the server S, including:

[0014] Using hash function, based on customer symmetric key U , enter the customer identifier ID U * , enter the customer password PW U * Calculate the first hash value Q of the customer password with the number 1 U ;

[0015] Based on the first hash value Q of the customer password U and the protection code L of the first hash value of the customer password U Calculate the server's first hash value Y U ;

[0016] Using quantum-resistant key encapsulation algorithm based on server public key pk S Generate a first symmetric key K1 and a corresponding first ciphertext C1;

[0017] Generate the first random public key pk using the key generation algorithm t and the first random private key sk t ;

[0018] Using the first symmetric key K1 and the random number R, the authentication encryption algorithm is used to encrypt the customer identity identifier ID entered during login. U *、Server second hash value K S,U 、Server first hash value Y U , the first random public key pk t and login time T U Perform encryption protection and generate a first message verification code F1.

[0019] Furthermore, the server S verifies that the received login request information includes:

[0020] Server S is based on the server private key sk S Decrypt the first ciphertext C1 to obtain the first symmetric key K1. If the decryption is invalid, the verification fails.

[0021] Decrypt the first message verification code F1 using the random number R and the first symmetric key K1 to obtain the customer identity identifier ID entered during login U * 、Server first hash value Y U 、Server second hash value K S,U , the first random public key pk t and login time T U , if the decryption is invalid, the verification fails;

[0022] Verify the customer ID entered during login U * 、Server first hash value Y U 、Server second hash value K S,U , the first random public key pk t and login time T U Are they in the correct format and ID U * Is there a corresponding registered customer identity identifier ID? U , if not, the verification fails;

[0023] Read the current server time T S , verify whether |T S -T U |≤Δ, if not, the verification fails; Δ represents the set time interval;

[0024] Using hash function, based on server symmetric key S , Customer Identifier ID U 、ID U Corresponding customer registration time T reg And number 2 calculates K S,U ', verify K S,U '=K S,U Is it true? If not, the verification fails;

[0025] Using hash function, based on server symmetric key S , Customer Identifier ID U 、ID U Corresponding customer registration time T reg And the number 1 to get Y U ', verify Y U ' = Y U If not, the verification fails.

[0026] Further, the server S generates a session key, a second ciphertext C2 and a second message verification code F2 based on the first ciphertext C1, the random number R and the first message verification code F1, including:

[0027] Server S uses a quantum-resistant key encapsulation algorithm based on the first random public key pk t Generate a second symmetric key K2 and a corresponding second ciphertext C2;

[0028] Using a key derivation function, using the customer identity identifier ID U , Server Identifier ID S , random number R, first symmetric key K1, second symmetric key K2, server second hash value K S,U 、Server first hash value Y U and login time T U Generate three keys, including a first verification key key1, a second verification key key2 and the session key key3;

[0029] The second message verification code F2 is obtained by using a MAC algorithm based on the first verification key key1, the first ciphertext C1 and the second ciphertext C2.

[0030] Furthermore, the response message received by the client U for verification includes:

[0031] Client U uses the first random private key sk t Decrypt the second ciphertext C2 to obtain the second symmetric key K2. If the decryption is invalid, the verification fails.

[0032] Client U uses a key derivation function to obtain the client ID entered during login. U * , the server identifier ID in the smart card information S , random number R, first symmetric key K1, second symmetric key K2, server second hash value K in smart card information S,U 、Server first hash value Y U and login time T U Generate key1', key2' and key3';

[0033] Based on key1', the first ciphertext C1 and the second ciphertext C2, F2' is calculated using the MAC algorithm to verify whether F2'=F2. If not, the verification fails. If so, key1' is the first verification key key1, key2' is the second verification key key2, and key3' is the session key key3.

[0034] Further, the client U generates a third message verification code F3 based on the second ciphertext C2 and the second message verification code F2, including:

[0035] Client U calculates F3 using the MAC algorithm based on the second verification key key2, the second ciphertext C2 and the second message verification code F2.

[0036] Further, the server S verifies whether the negotiation process is successful based on the third message verification code F3, including:

[0037] Server S calculates F3' based on the second verification key key2, the second ciphertext C2 and the second message verification code F2 using the MAC algorithm, and verifies whether F3'=F3. If not, the negotiation fails and a negotiation failure message is sent to client U; if so, the negotiation succeeds.

[0038] Furthermore, before the client U sends the login request information to the server S, the client U also undergoes a registration process, which includes:

[0039] Client U sends a registration request message to server S, which includes the client ID U And the first hash value Q of the customer password U ; Client U uses a hash function based on the client's symmetric key key U , Customer Identifier ID U , Customer password PW U And the number 2 is calculated to get the second hash value V of the customer password U ;

[0040] After receiving the registration request information, the server S uses the first hash value Q of the client password to U , server symmetric key key S , Customer Identifier ID U , Customer registration time T reg The protection code L of the first hash value of the customer password is calculated by adding the number 1 U ; Based on the server symmetric key S , Customer Identifier ID U , Customer registration time T reg And number 2 calculates the server's second hash value K S,U ; The server issues the smart card carrying the smart card information to the client;

[0041] Client U enters the client symmetric key in the smart card U and the second hash value V of the customer password U .

[0042] The present invention can achieve at least one of the following beneficial effects:

[0043] By using different ciphertexts and check codes for each communication session during the negotiation process, the adversary cannot distinguish whether any two different sessions correspond to the same customer, hiding the customer's identity information, and achieving secure identity authentication and key negotiation for digital financial payments, with better security and good usability.

[0044] By using the quantum computing-safe asymmetric key encapsulation algorithm ∑1 and four symmetric cryptographic primitives ∑2, MAC, H, and KDF, we have achieved a quantum-resistant anonymous two-factor authentication key negotiation process without the need to transform the digital authentication infrastructure. This ensures that even if any one of the two factors is leaked, the two-factor authentication key negotiation protocol is still secure relative to the other factor, thereby improving the protocol's resistance to quantum computing attacks and imperceptible online dictionary attacks.

[0045] By randomly generating symmetric keys and randomly generating asymmetric key pairs during the negotiation process, and using different keys in each communication session, perfect forward secrecy, known key security, unknown key sharing, and key control are achieved, which can prevent key leakage and counterfeiting. It has more security attributes than the two-factor authentication key negotiation scheme in the prior art.

[0046] In the scheme of the present invention, the anonymity proof of the scheme only requires Σ1 to be a key encapsulation algorithm that is secure with IND-CCA, and does not require Σ1 and other cryptographic primitives to satisfy anonymity. It is easy to implement and has high computational efficiency. In the scheme of the present invention, the user generates registration request information based on the customer password, enters the customer password when logging in, and the server does not store the customer password, that is, the password is changed locally by the customer, and the server does not store the customer password and the long key associated with the password. Therefore, the scheme of the present invention has the practical function of detecting wrong passwords and can resist denial of service attacks.

[0047] The scheme of the present invention adopts modular design, and any number of the five cryptographic algorithms (including Σ1, Σ2, MAC, H, and KDF) can be replaced as long as they meet the required security and availability requirements, thus having high practicality.

[0048] The solution of the present invention does not consider the key confirmation of the client by the server. The client and the server only need to exchange the first message verification code and the second message verification code. Key negotiation can be achieved without exchanging the third message verification code, which has a good compromise between security and efficiency.

[0049] Other features and advantages of the present invention will be described in the following description, and some advantages may become apparent from the description, or may be understood by practicing the present invention. The purpose and other advantages of the present invention may be realized and obtained through the contents particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0051] Figure 1 This is the quantum-resistant anonymous two-factor authentication key negotiation process between the client U and the server S of the present invention;

[0052] Figure 2 This is the registration process of the client U to the server S of the present invention. DETAILED DESCRIPTION

[0053] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, related terms and abbreviations, wherein the accompanying drawings, related terms and abbreviations constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0054] Related terms and abbreviations

[0055] Key agreement protocol for two-factor authentication: Authentication is performed through two factors, one factor is a "high entropy" key (also called a long key), including a randomly generated symmetric key, a randomly generated private key and a corresponding public key; the other factor is a "low entropy" password (also called a short key). Usually, the high entropy key is stored in a smart card; the password is not stored but memorized by the client. The security that the key agreement protocol for two-factor authentication expects to achieve is that when any of the two factors is leaked, the protocol is secure relative to the other factor.

[0056] Σ1=(∑1.KeyGen,∑1.Encaps,Σ1.Decaps): key encapsulation algorithm Σ1=(Σ1.KeyGen,∑1.Encaps,∑1.Decaps), where the encapsulation takes the public key pk as input and (K,c) as output, denoted as (K,c)=∑1.Encaps(pk); the ciphertext c is decrypted with the private key sk to obtain K, denoted as K=∑1.Decaps(sk,c), ∑1.Decaps may return invalid, otherwise it returns the correct K.

[0057] ∑2=(∑2.AEnc,Σ2.ADec): Authenticated encryption algorithm Σ2=(∑2.AEnc,Σ2.ADec), where the encryption of plaintext p with key key (length λ bits) and one-time number nonce (length λ bits) for confidentiality and integrity protection is denoted as (nonce,c)=∑2.AEnc(key,nonce,p); decryption is denoted as (nonce,p)=∑2.ADec(key,nonce,c), ∑2.ADec may return invalid, otherwise it returns the correct nonce and p.

[0058] MAC: Message Authentication Code, uses the key key (length is λ bits) to authenticate the message m, the tag is tag, and is denoted as tag=MAC(key,m); when the key key is used to verify the received message-tag pair (m′,tag′), tag″=MAC(key,m′) is calculated. If tag″=tag′, the authentication succeeds, otherwise the authentication fails.

[0059] H: Hash function, with a hash value of fixed length (2λ bits).

[0060] KDF: Key derivation function, supports arbitrary output length.

[0061] λ: safety index.

[0062] η: positive integer.

[0063] Related explanation: The public key cryptographic algorithm ∑1 is required to be resistant to quantum computing attacks; ∑2, MAC, H, and KDF based on symmetric cryptographic mechanisms are also required to be resistant to quantum computing attacks; the security of the above cryptographic algorithms all meet the following requirements: the classical security is at least λ bits, and the quantum security is at least λ / 2 bits.

[0064] A specific embodiment of the present invention discloses a quantum-resistant anonymous two-factor authentication key negotiation method, including a registration process of a client U to a server S and a quantum-resistant anonymous two-factor authentication key negotiation process between the client U and the server S.

[0065] Specifically, before the registration process of the client U to the server S, the key generation process of the server S is also included, and the server S runs in a secure environment:

[0066] ⑴Use the key generation algorithm of ∑1.KeyGen to randomly generate the public and private key pair of server S, (pk S ,sk S )←∑1.KeyGen(1 λ );

[0067] ⑵Randomly generate a symmetric key S ←{0,1} 256 .

[0068] Specifically, the registration process of client U to server S is run in a secure environment, including:

[0069] 1. Customer U executes:

[0070] ⑴Enter the customer password PW U ;

[0071] ⑵Randomly generate customer symmetric key U ←{0,1} 256 ;

[0072] ⑶Use hash function based on customer symmetric key U , Customer Identifier ID U , Customer password PW U And the number 1 is calculated to get the first hash value Q of the customer password U , Q U =H(key U ||ID U ||PW U ||1); Customer Identifier ID U It is an identifier pre-specified by the customer that uniquely represents the identity of the customer U;

[0073] ⑷Send registration request information {ID U ,Q U};

[0074] ⑸Use hash function based on customer symmetric key U , Customer Identifier ID U , Customer password PW U And the number 2 is calculated to get the second hash value V of the customer password U , V U =H(H(key U ||ID U ||PW U ||2)modη).

[0075] 2. After receiving the registration request, server S executes:

[0076] ⑴ Check whether client U is a registered client. If U is registering for the first time, server S generates and stores an entry corresponding to client U in the account database (ID U ,T reg ), where T reg = T, otherwise, server S updates T with T in the existing entry corresponding to client U. reg The value of; where T is the current time;

[0077] (2) Based on the first hash value Q of the customer password U , server symmetric key key S , Customer Identifier ID U , Customer registration time T reg The protection code L of the first hash value of the customer password is calculated by adding the number 1 U ,

[0078] ⑶ Based on server symmetric key S , Customer Identifier ID U , Customer registration time T reg And number 2 calculates the server's second hash value K S,U , K S,U =

[0079] H(key S ||ID U ||T reg ||2);

[0080] ⑷The server will carry the smart card information {K S,U ,L U ,ID S ,pk S} smart card is issued to the customer.

[0081] 3. After receiving the smart card, customer U enters the customer symmetric key in the smart card U and the second hash value V of the customer password U ; Complete the registration.

[0082] After completing the registration, the client U and the server S can start the quantum-resistant anonymous two-factor authentication key negotiation process. Specifically, the negotiation can be performed before each transaction, or at a preset time interval, which is determined based on the transaction frequency and the amount of data protection.

[0083] Specifically, the quantum-resistant anonymous two-factor authentication key negotiation process between client U and server S includes:

[0084] 1. Client U sends a login request message to server S, where the login request message includes a first ciphertext C1, a random number R, and a first message verification code F1. Specifically, client U executes:

[0085] ⑴Insert the smart card into the card reader and read the customer's symmetric key U , the second hash value V of the customer password U , Smart card information {K S,U ,L U ,ID S ,pk S};

[0086] ⑵Enter the customer ID U * , enter the customer password PW U * ;

[0087] ⑶ Based on the customer's symmetric key U 、ID U * , PW U * Calculate V U ',V U '

[0088] =H(H(key U ||ID U * ||PW U * ||2)modη);

[0089] ⑷Verify V U '=V U Is it true? If not, return to (2);

[0090] ⑸Use hash function based on customer symmetric key U , enter the customer identifier ID U * , enter the customer password PW U * Calculate the first hash value Q of the customer password with the number 1 U , Q U =H(key U ||ID U * ||PW U * ||1);

[0091] (6) First hash value Q based on the customer password U and the protection code L of the first hash value of the customer passwordU Calculate the server's first hash value Y U ,

[0092] ⑺Use quantum-resistant key encapsulation algorithm based on server public key pk S Randomly generate a first symmetric key K1 and a corresponding first ciphertext C1, (K 1, C1)←∑1.Encaps(pk S );

[0093] ⑻Randomly generate R←{0,1} λ ;

[0094] ⑼Use the key generation algorithm to generate the first random public key pk t and the first random private key sk t , (pk t ,sk t )←Σ1.KeyGen(1 λ );

[0095] ⑽Read the current time T U ;

[0096] ⑾Use the first symmetric key K1 and the random number R, adopt the authentication encryption algorithm, and encrypt the customer identity identifier ID entered during login. U * 、Server second hash value K S,U 、Server first hash value Y U , the first random public key pk t and login time T U Encryption protection is performed to generate the first message verification code F1, (R, F1)←Σ2.AEnc(K1, R, ID U * ||K S,U ||Y U ||pk t ||T U );

[0097] ⑿Send login request information {C1, R, F1} to server S.

[0098] 2. After receiving the login request information, the server S verifies the received login request information, generates a session key after the verification is passed, and sends a response message to the client U; the response message includes the second ciphertext C2 and the second message verification code F2.

[0099] Specifically, server S executes:

[0100] ⑴ Verify whether C1, R, and F1 are in the correct format. If not, the verification fails and the negotiation is terminated.

[0101] (2) Verify whether R is the same as a certain R' stored in the server S. If so, the verification fails and the negotiation is terminated;

[0102] ⑶ Server S based on server private key sk S Decrypt the first ciphertext C1 to obtain the first symmetric key K1, K1←Σ1.Decaps(sk S ,C1), if the decryption is invalid, the verification fails and the negotiation is terminated;

[0103] (4) Decrypt the first message verification code F1 using the random number R and the first symmetric key K1 to obtain the customer identity identifier ID entered during login U * 、Server first hash value Y U 、Server second hash value K S,U , the first random public key pk t and login time T U ,(R,ID U * ||K S,U ||Y U ||pk t ||T U )←∑2.ADec(K1,R,F1), if the decryption is invalid, the verification fails and the negotiation is terminated;

[0104] ⑸Verify the customer identity identifier ID entered during login U * 、Server first hash value Y U 、Server second hash value K S,U , the first random public key pk t and login time T U Are they in the correct format and ID U * Is there a corresponding registered customer identity identifier ID? U , if not, the verification fails and the negotiation is terminated;

[0105] ⑹Read the current server time T S , verify whether |T S -T U |≤Δ, if not, the verification fails and the negotiation is terminated; Δ represents the set time interval;

[0106] ⑺Use hash function based on server symmetric key S , Customer Identifier ID U 、ID U Corresponding customer registration time T reg And number 2 calculates K S,U ', verify KS,U '=K S,U Is it established? If not, the verification fails and the negotiation is terminated;

[0107] ⑻Use hash function based on server symmetric key S , Customer Identifier ID U ,

[0108] ID U Corresponding customer registration time T reg And the number 1 to get Y U ', verify Y U '

[0109] =Y U If not, it means the verification has failed, then the negotiation is terminated after executing the following steps:

[0110] If not defined Then define And let In the customer identifier ID U Record Y in the entry U ;in Indicates the number of times the client has attempted to log in;

[0111] If there is a corresponding And Y U ' and previously in the customer identification ID U The Y stored in the entry U ' are different, then let Add the current Y in this entry U ';

[0112] If there is a corresponding and Then delete the customer identifier ID U All contents of the entry, including the customer registration time T reg and all storage units Y U '; 6 represents the maximum number of times the system allows a customer to attempt to log in;

[0113] ⑼ Delete all random numbers that exceed the time interval Δ, and store the random number R received this time;

[0114] ⑽Use quantum-resistant key encapsulation algorithm based on the first random public key pk t Randomly generate a second symmetric key K2 and a corresponding second ciphertext C2, (K 2, C2)←∑1.Encaps(pk t );

[0115] ⑾Use the key derivation function and use the customer identity identifier IDU , Server Identifier ID S , random number R, first symmetric key K1, second symmetric key K2, server second hash value K S,U 、Server first hash value Y U and login time T U Generate three keys, including the first verification key key1, the second verification key key2 and the session key key3,

[0116] key1||key2||key3=KDF(ID U ||ID S ||R||K1||K2||K S,U ||Y U ||T U ); It should be noted that the key derivation function KDF generates an output result of a required length according to actual needs. In this embodiment, three keys are generated. Exemplarily, the length of each key can be 32 bytes;

[0117] ⑿ Based on the first verification key key1, the first ciphertext C1 and the second ciphertext C2, a MAC algorithm is used to obtain a second message verification code F2, F2 = MAC (key1, C1 || C2);

[0118] ⒀Send a response message {C2, F2} to client U.

[0119] 3. After receiving the response message, client U verifies the received response message. If the verification is successful, the session key is obtained based on the response message. Specifically, client U executes:

[0120] ⑴ Verify that C2 is in the correct format. If not, the verification fails and the negotiation is terminated.

[0121] (2) Based on the first random private key sk t Decrypt the second ciphertext C2 to obtain the second symmetric key K2, K2←∑1.Decaps(sk t ,C2), if the decryption is invalid, the verification fails and the negotiation is terminated;

[0122] ⑶ Use the key derivation function to use the customer identity identifier ID entered during login U * , the server identifier ID in the smart card information S , random number R, first symmetric key K1, second symmetric key K2, server second hash value K in smart card information S,U 、Server first hash value Y U and login time T UGenerate key1', key2' and key3', key1||key2||key3=KDF(ID U ||ID S ||R||K1||K2||K S,U ||Y U ||T U );

[0123] (4) Based on key1', the first ciphertext C1 and the second ciphertext C2, the MAC algorithm is used to calculate F2', F2' = MAC (key1', C1||C2), and verify whether F2' = F2 is established. If not, the verification fails and the negotiation is terminated;

[0124] If yes, then key1' is the first verification key key1, key2' is the second verification key key2, and key3' is the session key key3;

[0125] (5) Based on the second verification key key2, the second ciphertext C2 and the second message check code F2, the MAC algorithm is used to calculate F3, F3 = MAC (key2, C2 || F2);

[0126] (6) Send the third message verification code {F3} to the server S;

[0127] ⑺Delete ID from memory U * , PW U * 、key1、key2、K1、K2、Y U ,sk t , pk t And other sensitive data.

[0128] 4. After receiving the third message verification code, server S executes:

[0129] (1) Based on the second verification key key2, the second ciphertext C2 and the second message check code F2, the MAC algorithm is used to calculate F3', and verify whether F3'=F3 is established. If not, the negotiation fails, and a negotiation failure message is sent to the client U to terminate the negotiation; if so, the negotiation is successful;

[0130] ⑵Delete key1, key2, K1, K2, Y in memory U , pk t etc., ending the negotiation process.

[0131] This embodiment discloses a quantum-resistant anonymous two-factor authentication key negotiation method. By using different ciphertexts and check codes for each communication session during the negotiation process, an adversary cannot distinguish whether any two different sessions correspond to the same customer, thereby hiding customer identity information, achieving secure identity authentication and key negotiation for digital financial payments, and having better security and good usability.

[0132] By using the quantum computing-safe asymmetric key encapsulation algorithm ∑1 and four symmetric cryptographic primitives ∑2, MAC, H, and KDF, we have achieved a quantum-resistant anonymous two-factor authentication key negotiation process without the need to transform the digital authentication infrastructure. This ensures that even if any one of the two factors is leaked, the two-factor authentication key negotiation protocol is still secure relative to the other factor, thereby improving the protocol's resistance to quantum computing attacks and imperceptible online dictionary attacks.

[0133] This embodiment achieves perfect forward secrecy, known key security, unknown key sharing, and key control by randomly generating symmetric keys and randomly generating asymmetric key pairs during the negotiation process, and using different keys in each communication session. It can prevent key leakage and counterfeiting and has more security attributes than the two-factor authentication key negotiation scheme in the prior art.

[0134] In this embodiment, the anonymity proof of the scheme only requires that ∑1 is an IND-CCA secure key encapsulation algorithm, and does not require that ∑1 and other cryptographic primitives themselves satisfy anonymity. It is easy to implement and has high computational efficiency.

[0135] In this embodiment, the user generates registration request information based on the client password and enters the client password when logging in, but the server does not store the client password, that is, the password is changed locally by the client, and the server does not store the client password and the long key related to the password. Therefore, the solution of the present invention has the practical function of detecting incorrect passwords and can resist denial of service attacks.

[0136] This embodiment adopts modular design, and any number of the five cryptographic algorithms (including Σ1, Σ2, MAC, H, and KDF) can be replaced as long as they meet the required security and availability requirements, which has high practicality.

[0137] In this embodiment, if the server's key confirmation of the client is not considered, the client and the server only need to exchange the first message verification code and the second message verification code, and key negotiation can be achieved without exchanging the third message verification code, which has a good compromise between security and efficiency.

[0138] Other features and advantages of the present invention will be described in the following description, and some advantages may become apparent from the description, or may be understood by practicing the present invention. The purpose and other advantages of the present invention may be realized and obtained through the contents particularly pointed out in the description, claims and drawings.

[0139] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A quantum-resistant anonymous two-factor authentication key negotiation method, characterized in that: include: The client U sends a login request message to the server S, the login request message including a first ciphertext C1, a random number R and a first message verification code F1; wherein the first ciphertext C1 and the first message verification code F1 are generated based on a smart card issued by the server S; The server S verifies the received login request information, generates a session key after the verification is passed, and sends a response message to the client U; the response message includes the second ciphertext C2 and the second message verification code F2; wherein the session key, the second ciphertext C2 and the second message verification code F2 are generated based on the first ciphertext C1, the random number R and the first message verification code F1; Client U verifies the received response message, and if the verification is successful, obtains the session key based on the response message.

2. The key negotiation method according to claim 1, characterized in that: After obtaining the session key based on the response message, the client U further performs the following operations: generating a third message verification code F3 based on the second ciphertext C2 and the second message verification code F2 and sending it to the server S; The server S verifies whether the negotiation is successful based on the third message verification code F3. If not, the negotiation fails and a negotiation failure message is sent to the client U.

3. The key negotiation method according to claim 2, characterized in that: The smart card carries smart card information and the client's symmetric key. U and the second hash value V of the customer password U ; Before the client U sends a login request to the server S, it also includes: Enter the customer identifier ID U * , enter the customer password PW U * , based on the customer's symmetric key U Calculate V with number 2 U ', verify V U '=V U Is it true? If not, re-enter the customer identification identifier and customer password.

4. The key negotiation method according to claim 3, characterized in that: The smart card information includes: the protection code L of the first hash value of the customer password U 、Server second hash value K S,U , Server Identifier ID S and the server public key pk S ; The client U generates the first ciphertext C1 and the first message verification code F1 based on the smart card issued by the server S, including: Using hash function, based on customer symmetric key U , enter the customer identifier ID U * , enter the customer password PW U * Calculate the first hash value Q of the customer password with the number 1 U ; Based on the first hash value Q of the customer password U and the protection code L of the first hash value of the customer password U Calculate the server's first hash value Y U ; Using quantum-resistant key encapsulation algorithm based on server public key pk S Generate a first symmetric key K1 and a corresponding first ciphertext C1; Generate the first random public key pk using the key generation algorithm t and the first random private key sk t ; Using the first symmetric key K1 and the random number R, the authentication encryption algorithm is used to encrypt the customer identity identifier ID entered during login. U * 、Server second hash value K S,U 、Server first hash value Y U , the first random public key pk t and login time T U Perform encryption protection and generate a first message verification code F1.

5. The key negotiation method according to claim 4, characterized in that: The login request information received by the server S for verification includes: Server S is based on the server private key sk S Decrypt the first ciphertext C1 to obtain the first symmetric key K1. If the decryption is invalid, the verification fails. Decrypt the first message verification code F1 using the random number R and the first symmetric key K1 to obtain the customer identity identifier ID entered during login U * 、Server first hash value Y U 、Server second hash value K S,U , the first random public key pk t and login time T U , if the decryption is invalid, the verification fails; Verify the customer ID entered during login U * 、Server first hash value Y U 、Server second hash value K S,U , the first random public key pk t and login time T U Are they in the correct format and ID U * Is there a corresponding registered customer identity identifier ID? U , if not, the verification fails; Read the current server time T S , verify whether |T S -T U |≤Δ, if not, the verification fails; Δ represents the set time interval; Using hash function, based on server symmetric key S , Customer Identifier ID U 、ID U Corresponding customer registration time T reg And number 2 calculates K S,U ', verify K S,U '=K S,U Is it true? If not, the verification fails; Using hash function, based on server symmetric key S , Customer Identifier ID U 、ID U Corresponding customer registration time T reg And the number 1 to get Y U ', verify Y U ' = Y U If not, the verification fails.

6. The key negotiation method according to claim 5, characterized in that: The server S generates a session key, a second ciphertext C2 and a second message verification code F2 based on the first ciphertext C1, the random number R and the first message verification code F1, including: Server S uses a quantum-resistant key encapsulation algorithm based on the first random public key pk t Generate a second symmetric key K2 and a corresponding second ciphertext C2; Using a key derivation function, using the customer identity identifier ID U , Server Identifier ID S , random number R, first symmetric key K1, second symmetric key K2, server second hash value K S,U 、Server first hash value Y U and login time T U Generate three keys, including a first verification key key1, a second verification key key2 and the session key key3; The second message verification code F2 is obtained by using a MAC algorithm based on the first verification key key1, the first ciphertext C1 and the second ciphertext C2.

7. The key negotiation method according to claim 6, characterized in that: The response message received by the client U for verification includes: Client U uses the first random private key sk t Decrypt the second ciphertext C2 to obtain the second symmetric key K2. If the decryption is invalid, the verification fails. Client U uses a key derivation function to obtain the client ID entered during login. U * , the server identifier ID in the smart card information S , random number R, first symmetric key K1, second symmetric key K2, server second hash value K in smart card information S,U 、Server first hash value Y U and login time T U Generate key1', key2' and key3'; Based on key1', the first ciphertext C1 and the second ciphertext C2, F2' is calculated using the MAC algorithm to verify whether F2'=F2. If not, the verification fails. If so, key1' is the first verification key key1, key2' is the second verification key key2, and key3' is the session key key3.

8. The key negotiation method according to claim 7, characterized in that: The client U generates the third message verification code F3 based on the second ciphertext C2 and the second message verification code F2, including: Client U calculates F3 using the MAC algorithm based on the second verification key key2, the second ciphertext C2 and the second message verification code F2.

9. The key negotiation method according to claim 8, characterized in that: The server S verifies whether the negotiation process is successful based on the third message verification code F3, including: Server S calculates F3' based on the second verification key key2, the second ciphertext C2 and the second message verification code F2 using the MAC algorithm, and verifies whether F3'=F3. If not, the negotiation fails and a negotiation failure message is sent to client U; if so, the negotiation succeeds.

10. The key negotiation method according to any one of claims 3 to 9, characterized in that: Before the client U sends a login request to the server S, the client U undergoes a registration process, which includes: Client U sends a registration request message to server S, which includes the client ID U And the first hash value Q of the customer password U ; Client U uses a hash function based on the client's symmetric key key U , Customer Identifier ID U , Customer password PW U And the number 2 is calculated to get the second hash value V of the customer password U ; After receiving the registration request information, the server S uses the first hash value Q of the client password to U , server symmetric key key S , Customer Identifier ID U , Customer registration time T reg The protection code L of the first hash value of the customer password is calculated by adding the number 1 U ; Based on the server symmetric key S , Customer Identifier ID U , Customer registration time T reg And number 2 calculates the server's second hash value K S,U ; The server issues the smart card carrying the smart card information to the client; Client U enters the client symmetric key in the smart card U and the second hash value V of the customer password U .

Images