Post-quantum key negotiation method and device

Abstract

The embodiment of the present invention provides a post-quantum key negotiation method and device, including: generating a first temporary session key, encapsulating the first temporary session key based on the long-term public key corresponding to the session responder, and obtaining a first encrypted ciphertext. The first encrypted ciphertext is sent to the session responder, so that the session responder uses the long-term private key to decapsulate the first encrypted ciphertext to verify the identity of the session initiator. The second encrypted ciphertext and the third encrypted ciphertext sent by the session responder are received, and the second encrypted ciphertext is decapsulated based on the long-term private key corresponding to the session initiator to obtain a second temporary session key. Based on the temporary encapsulation public key corresponding to the session initiator, the third encrypted ciphertext is decapsulated to obtain a shared key, and the temporary encapsulation public key is a post-quantum public key. Based on the first temporary session key, the second temporary session key and the shared key, a session key for session communication is determined, so that the generated session key can resist quantum attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of information security data processing, and in particular to a post-quantum key negotiation method and device. Background Art

[0002] With the rapid development of quantum computing technology, traditional public key cryptographic algorithms such as RSA and ECC are facing the threat of being cracked by quantum computers. At present, most network security protocols use public key cryptographic algorithms to achieve mutual authentication between the communicating parties and establish a shared key, and then use the shared key for symmetric encryption to ensure the confidentiality and integrity of the data. If an attacker captures packets through the network and stores the current network security protocol messages, the confidentiality of the data will be seriously threatened when a large-scale general-purpose quantum computer is developed.

[0003] Therefore, there is an urgent need for a key agreement scheme that can resist the threat of quantum computers. Summary of the invention

[0004] The embodiment of the present invention provides a post-quantum key negotiation method and device for enabling two parties to collaboratively generate a shared key for a session, so that the generated shared key has high security and can ensure the forward security of data.

[0005] In a first aspect, an embodiment of the present invention provides a post-quantum key negotiation method, which is applied to a session initiator, wherein the session initiator and a session responder jointly generate a session key, and the session initiator holds a long-term public key corresponding to the session responder. The method includes:

[0006] generating a first temporary session key;

[0007] Based on the long-term public key corresponding to the session responder, encapsulate the first temporary session key to obtain a first encrypted ciphertext, wherein the long-term public key is the SM2 public key;

[0008] Sending the first encrypted ciphertext to the session responder, so that the session responder uses the long-term private key corresponding to the session responder to decapsulate the first encrypted ciphertext to verify the identity of the session initiator, and if the verification is successful, sending the second encrypted ciphertext and the third encrypted ciphertext to the session initiator;

[0009] receiving a second encrypted ciphertext and a third encrypted ciphertext sent by the session responder, and decapsulating the second encrypted ciphertext based on the long-term private key corresponding to the session initiator to obtain a second temporary session key;

[0010] Decapsulating the third encrypted ciphertext based on a temporary encapsulation private key corresponding to the session initiator to obtain a shared key, wherein the temporary encapsulation private key is a post-quantum private key;

[0011] A session key for session communication is determined based on the first temporary session key, the second temporary session key, and the shared key.

[0012] In a second aspect, an embodiment of the present invention provides a post-quantum key negotiation device, which is applied to a session initiator, wherein the session initiator and the session responder jointly generate a session key, and the session initiator holds a long-term public key corresponding to the session responder, and the device includes:

[0013] A generating module, used for generating a first temporary session key;

[0014] An encapsulation module, configured to encapsulate the first temporary session key based on the long-term public key corresponding to the session responder to obtain a first encrypted ciphertext, wherein the long-term public key is an SM2 public key;

[0015] a sending module, configured to send the first encrypted ciphertext to the session responder, so that the session responder decapsulates the first encrypted ciphertext using the long-term private key corresponding to the session responder to verify the identity of the session initiator, and if the verification is successful, sends the second encrypted ciphertext and the third encrypted ciphertext to the session initiator;

[0016] A receiving module, configured to receive the second encrypted ciphertext and the third encrypted ciphertext sent by the session responder, and decapsulate the second encrypted ciphertext based on the long-term private key corresponding to the session initiator to obtain a second temporary session key;

[0017] A decapsulation module, configured to decapsulate the third encrypted ciphertext based on a temporary encapsulation private key corresponding to the session initiator to obtain a shared key, wherein the temporary encapsulation private key is a post-quantum private key;

[0018] The determination module is used to determine a session key used for session communication based on the first temporary session key, the second temporary session key and the shared key.

[0019] In a third aspect, an embodiment of the present invention provides an electronic device, applied to a sender, comprising: a memory, a processor, and a communication interface; wherein an executable code is stored on the memory, and when the executable code is executed by the processor, the processor can at least implement the post-quantum key negotiation method as described in the first aspect.

[0020] In a fourth aspect, an embodiment of the present invention provides a non-temporary machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of an electronic device, the processor can at least implement the post-quantum key agreement method as described in the first aspect.

[0021] In a fifth aspect, an embodiment of the present invention provides a post-quantum key negotiation method, which is applied to a session responder, wherein the session responder cooperates with a session initiator to generate a session key, and the session responder holds a long-term public key corresponding to the session initiator. The method includes:

[0022] Receiving a first encrypted ciphertext and a temporary encapsulation public key sent by the session initiator, wherein the first encrypted ciphertext is generated by encapsulating a first temporary session key based on a long-term public key corresponding to the session responder, and the temporary encapsulation public key is a post-quantum public key;

[0023] If the first encrypted ciphertext is decapsulated using the long-term private key corresponding to the session responder to obtain a first temporary session key, the identity authentication of the session initiator is passed;

[0024] If the verification is successful, the second temporary session key is encapsulated based on the long-term public key corresponding to the session initiator to obtain a second encrypted ciphertext, where the long-term public key is the SM2 public key;

[0025] Generate a random polynomial, and encapsulate the random polynomial based on the temporary encapsulation public key to obtain a third encrypted ciphertext and a shared key;

[0026] Sending the second encrypted ciphertext and the third encrypted ciphertext to the session initiator, so that the session initiator decrypts the second encrypted ciphertext and the third encrypted ciphertext respectively to obtain a second temporary session and a shared key;

[0027] A session key for session communication is generated based on the first temporary session key, the second temporary session key, and the shared key.

[0028] In a sixth aspect, an embodiment of the present invention provides a post-quantum key agreement device, which is applied to a session responder, wherein the session responder cooperates with a session initiator to generate a session key, and the session responder holds a long-term public key corresponding to the session initiator, and the device includes:

[0029] A receiving module, configured to receive a first encrypted ciphertext and a temporary encapsulation public key sent by the session initiator, wherein the first encrypted ciphertext is generated by encapsulating a first temporary session key based on a long-term public key corresponding to the session responder, and the temporary encapsulation public key is a post-quantum public key;

[0030] A decapsulation module, configured to decapsulate the first encrypted ciphertext using the long-term private key corresponding to the session responder to obtain a first temporary session key, and the identity authentication of the session initiator is passed;

[0031] A first encapsulation module is used to encapsulate the second temporary session key based on the long-term public key corresponding to the session initiator to obtain a second encrypted ciphertext if the verification is successful, wherein the long-term public key is the SM2 public key;

[0032] A second encapsulation module, used to generate a random polynomial, and encapsulate the random polynomial based on the temporary encapsulation public key to obtain a third encrypted ciphertext and a shared key;

[0033] A sending module, configured to send the second encrypted ciphertext and the third encrypted ciphertext to the session initiator, so that the session initiator decrypts the second encrypted ciphertext and the third encrypted ciphertext respectively to obtain a second temporary session and a shared key;

[0034] A generating module is used to generate a session key for session communication based on the first temporary session key, the second temporary session key and the shared key.

[0035] In the seventh aspect, an embodiment of the present invention provides an electronic device, applied to a sender, comprising: a memory, a processor, and a communication interface; wherein, an executable code is stored on the memory, and when the executable code is executed by the processor, the processor can at least implement the post-quantum key agreement method as described in the fifth aspect.

[0036] In an eighth aspect, an embodiment of the present invention provides a non-temporary machine-readable storage medium having executable code stored thereon. When the executable code is executed by a processor of an electronic device, the processor can at least implement the post-quantum key agreement method as described in the fifth aspect.

[0037] In the post-quantum key agreement scheme provided in the embodiment of the present invention, by combining the classical public key algorithm with the post-quantum algorithm, two interlocutors cooperate to jointly generate a session key for session communication. This not only improves the security of the session key, but also ensures the forward security of the session communication data.

[0038] Specifically, when two conversation parties collaboratively generate a session key, the session initiator first generates a first temporary session key, and encapsulates the first temporary session key based on the long-term public key corresponding to the session responder to obtain a first encrypted ciphertext. Among them, the long-term public key is the SM2 public key. Then, the first encrypted ciphertext is sent to the session responder. The session responder decapsulates the first encrypted ciphertext based on the long-term private key corresponding to the session responder to verify the identity of the session initiator. If the session responder successfully decapsulates, the identity authentication of the session initiator is passed, and the second temporary session key is encapsulated using the long-term public key corresponding to the session initiator to generate a second encrypted ciphertext, and the random polynomial is encapsulated based on the temporary encapsulation public key to generate a third encrypted ciphertext, and the second encrypted ciphertext and the third encrypted ciphertext are sent to the session initiator. The session initiator receives the second encrypted ciphertext and the third encrypted ciphertext, and decapsulates the second encrypted ciphertext based on the long-term private key corresponding to the session initiator to obtain a second temporary session key. Based on the temporary encapsulation private key corresponding to the session initiator, the third encrypted ciphertext is decapsulated to obtain a shared key, and the temporary encapsulation private key is a post-quantum private key. Finally, the session initiator determines a session key for session communication based on the first temporary session key, the second temporary session key and the shared key.

[0039] In the above scheme, the session initiator encapsulates the first temporary session key based on the SM2 long-term public key corresponding to the session responder to obtain the first encrypted ciphertext. The session responder encapsulates the second temporary session key based on the long-term public key corresponding to the session initiator to obtain the second encrypted ciphertext and encapsulates the random polynomial based on the post-quantum temporary encapsulation public key corresponding to the session initiator to obtain the third encrypted ciphertext. In this way, the session initiator decapsulates the second encrypted ciphertext based on the SM2 private key it holds to obtain the second temporary session key and decapsulates the third encrypted ciphertext based on the post-quantum temporary encapsulation private key to obtain the shared key, and determines the session key based on the first temporary session key, the second temporary session key and the shared key. That is, when the session initiator and the session responder collaboratively generate the session key, they use the hybrid classical SM2 cryptographic algorithm and the anti-quantum cryptographic algorithm to perform three decapsulation operations on the temporary session key to generate the session key, so that the generated session key has a high security, can ensure the forward security of the data, and can also be compatible with the existing public key infrastructure without the need for large-scale transformation. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0041] Figure 1 A schematic diagram of a post-quantum key agreement system provided by an embodiment of the present invention;

[0042] Figure 2 An interactive flow chart of a post-quantum key agreement method provided by an embodiment of the present invention;

[0043] Figure 3 A flowchart for determining a session key for session communication based on a first temporary session key, a second temporary session key, and a shared key is provided for an embodiment of the present invention;

[0044] Figure 4 A schematic diagram of a process flow of another post-quantum key agreement method provided by an embodiment of the present invention;

[0045] Figure 5 A schematic diagram of an application of a post-quantum key agreement method provided by an embodiment of the present invention;

[0046] Figure 6 A schematic diagram of the structure of a post-quantum key agreement device provided by an embodiment of the present invention;

[0047] Figure 7 For Figure 6 A schematic diagram of the structure of an electronic device corresponding to the post-quantum key agreement device provided in the illustrated embodiment;

[0048] Figure 8 A schematic diagram of the structure of another post-quantum key agreement device provided by an embodiment of the present invention;

[0049] Fig. 9 For Figure 8 A schematic diagram of the structure of an electronic device corresponding to the post-quantum key agreement device provided in the illustrated embodiment. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms of "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two, but does not exclude the situation of including at least one. It should be understood that the term "and / or" used in this article is only an association relationship describing the associated objects, indicating that three relationships can exist, for example, A and / or B can be represented: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are a kind of "or" relationship. Depending on the context, the words "if" and "if" used herein can be interpreted as "at the time of..." or "when...".

[0052] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such a product or system. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the product or system including the elements.

[0053] In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0054] With the rapid development of quantum computing technology, traditional public key cryptographic algorithms such as RSA and ECC are facing the threat of being cracked by quantum computers. At present, most network security protocols use public key cryptographic algorithms to achieve mutual authentication between the communicating parties and establish a shared key, and then use the shared key for symmetric encryption to ensure the confidentiality and integrity of the data. If an attacker captures packets through the network and stores the current network security protocol messages, the confidentiality of the data will be seriously threatened when a large-scale general-purpose quantum computer is developed.

[0055] In order to deal with the potential threat of quantum computers to cryptographic security in advance, the cryptography community has begun to study post-quantum cryptography (PQC). The existing quantum computing-resistant key negotiation scheme mainly replaces the existing cryptographic components with quantum computing-resistant cryptographic algorithms. However, this method requires rebuilding the current public key infrastructure, which is difficult and costly to implement, and the advancement process is uncontrollable.

[0056] In order to solve the above technical problems, while improving the security of the key, ensuring the forward security of the data, and not affecting the user experience and the cost of use, the present invention implements a new post-quantum key negotiation method, in which the session initiator and the session responder generate the session key ultimately used for session communication through interaction, thereby improving the security of the key. Moreover, when interactively generating the session key, on the basis of the classic SM2 algorithm, the post-quantum encapsulation algorithm is mixed, so that the generated session key can not only resist the attack of the post-quantum computer and ensure the forward security of the data, but also be compatible with the existing public key infrastructure without the need for large-scale transformation.

[0057] The post-quantum key agreement scheme is exemplarily described below in conjunction with the following embodiments.

[0058] Figure 1 A schematic diagram of a post-quantum key agreement system provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the system may include a session initiator and a session responder, and the session initiator and the session responder cooperate to generate a session key.

[0059] The session initiator can be any device that needs to communicate with the session responder, and the session initiator can be any computing device with certain data transmission capabilities. In specific implementation, the session initiator can be a mobile phone, a personal computer PC, a tablet computer, a setting application, a server, etc. The session responder can be any computing device with certain data transmission capabilities, for example, a mobile phone, a personal computer PC, a tablet computer, a setting application, a server, etc.

[0060] In an embodiment of the present invention, the session initiator and the session responder can generate a session key through interactive collaboration. During session communication, both ends can use the session keys generated by each end to encrypt session data to ensure the security of data transmission and the forward security of the data.

[0061] The session initiator holds the long-term public key corresponding to the session responder, and similarly, the session responder holds the long-term public key corresponding to the session initiator. The long-term public key may be an SM2 public key, and the long-term public key and long-term private key corresponding to the session initiator are generated by the SM2 key generation algorithm. The session initiator separately stores the long-term private key corresponding to the session initiator, sends the long-term public key corresponding to the session initiator to the session responder, or shares the long-term public key corresponding to the session initiator with the session responder, so that the session responder holds the long-term public key corresponding to the session initiator.

[0062] Similarly, for the long-term public key and long-term private key corresponding to the session responder that can be generated by the session responder through the SM2 key generation algorithm, the session responder separately saves the long-term private key corresponding to the session responder, sends the long-term public key corresponding to the session responder to the session initiator, or shares the long-term public key corresponding to the session responder with the session initiator, so that the session initiator holds the long-term public key corresponding to the session responder.

[0063] In this way, when the session initiator and the session responder perform session key negotiation, the session initiator and the session responder encapsulate the temporary session key based on the long-term public key of the other party they hold, and allow the other party to decapsulate the temporary session key based on their respective long-term private keys, so as to generate a session key through multiple decapsulation operations.

[0064] Specifically, first, the session initiator generates a first temporary session key. The first temporary session key is generated based on the long-term private key corresponding to the session initiator. In order to avoid leakage of the long-term private key corresponding to the session initiator during the transmission process, when the session initiator negotiates with the session responder to generate the session key, the long-term private key corresponding to the session initiator can be processed with a message authentication code to obtain the first temporary session key. This can not only ensure the security of the long-term private key corresponding to the session initiator, but also ensure that the long-term private key corresponding to the session initiator is not tampered with during the transmission process, so that the session responder verifies the integrity of the long-term private key corresponding to the session initiator by calculating the message authentication code of the received first temporary session key and the received message authentication code.

[0065] After generating the first temporary session key, the first temporary session key can be encapsulated based on the long-term public key corresponding to the session responder to obtain a first encrypted ciphertext, and the first encrypted ciphertext is sent to the session responder, so that the session responder uses the long-term private key corresponding to the session responder to decapsulate the first encrypted ciphertext to verify the identity of the session initiator.

[0066] By encapsulating the first temporary session key, the confidentiality, integrity and availability of the first temporary session key can be enhanced to ensure that the first temporary session key is not leaked or tampered with during transmission.

[0067] In addition, while sending the first encrypted ciphertext to the session responder, the user identifier corresponding to the session initiator and the temporary encapsulation public key can also be sent to the session responder, so that after the session responder passes the identity authentication of the session initiator, the session responder performs key encapsulation processing based on the temporary encapsulation public key corresponding to the session initiator. The temporary encapsulation public key is a post-quantum public key, and a temporary encapsulation public key and a temporary encapsulation private key can be generated by a post-quantum key generation algorithm.

[0068] Next, the session responder receives the first encrypted ciphertext and temporary encapsulation public key sent by the session initiator, and decapsulates the first encrypted ciphertext using the long-term private key corresponding to the session responder. If the decapsulation is successful and the first temporary session key is obtained, the identity information corresponding to the session initiator is verified.

[0069] If the verification is successful, the session responder generates a second temporary session key. The second temporary session key is generated based on the long-term private key corresponding to the session responder. In order to avoid leakage of the long-term private key corresponding to the session responder during the transmission process, the session responder can first perform message authentication code processing on the long-term private key corresponding to the session responder when negotiating with the session initiator to generate the session key, and obtain the second temporary session key. This can not only ensure the security of the long-term private key corresponding to the session responder, but also ensure that the long-term private key corresponding to the session responder is not tampered with during the transmission process, so that the session initiator can verify the integrity of the long-term private key corresponding to the session responder by calculating the message authentication code of the received second temporary session key and the received message authentication code.

[0070] After generating the second temporary session key, the session responder uses the long-term public key corresponding to the session initiator to encapsulate the second temporary session key to obtain a second encrypted ciphertext. By encapsulating the second temporary session key, the confidentiality, integrity and availability of the second temporary session key can be enhanced to ensure that the second temporary session key is not leaked or tampered with during transmission.

[0071] Next, a random polynomial is generated, and based on the temporary encapsulation public key corresponding to the session initiator, the random polynomial is encapsulated to obtain the third encrypted ciphertext and the derived shared key. By performing post-quantum encapsulation on the random polynomial, the confidentiality of the random polynomial can be enhanced to resist the attack of quantum computers.

[0072] Then, the session responder sends the second encrypted ciphertext and the third encrypted ciphertext to the session initiator. In addition, the session responder generates a session key for session communication based on the first temporary session key, the second temporary session key and the shared key.

[0073] Then, the session initiator receives the second encrypted ciphertext and the third encrypted ciphertext. Based on the long-term private key corresponding to the session initiator, the second encrypted ciphertext is decapsulated to obtain the second temporary session key. Based on the temporary encapsulation private key corresponding to the session initiator, the third encrypted ciphertext is decapsulated to obtain the shared key, and the temporary encapsulation private key is the post-quantum private key.

[0074] Finally, the session initiator determines the session key used for session communication based on the first temporary session key, the second temporary session key and the shared key, wherein the first temporary session key and the second temporary session key are classical public key keys, and the shared key is a post-quantum key. The session key determined in this way is more secure and can not only resist quantum computer attacks, but also be compatible with existing public key infrastructure.

[0075] In the embodiment of the present invention, the session initiator encapsulates the first temporary session key based on the SM2 long-term public key corresponding to the session responder to obtain the first encrypted ciphertext. The session responder encapsulates the second temporary session key based on the long-term public key corresponding to the session initiator to obtain the second encrypted ciphertext and encapsulates the random polynomial based on the post-quantum temporary encapsulation public key corresponding to the session initiator to obtain the third encrypted ciphertext. In this way, the session initiator decapsulates the second encrypted ciphertext based on the SM2 private key it holds to obtain the second temporary session key and decapsulates the third encrypted ciphertext based on the post-quantum temporary encapsulation private key to obtain the shared key, and determines the session key based on the first temporary session key, the second temporary session key and the shared key. That is, when the session initiator and the session responder collaboratively generate the session key, the hybrid classical SM2 cryptographic algorithm and the anti-quantum cryptographic algorithm are used to perform three decapsulation operations on the temporary session key to generate the session key, so that the generated session key has a high security, can ensure the forward security of the data, and can also be compatible with the existing public key infrastructure without the need for large-scale transformation.

[0076] The above embodiment introduces the interactive process of the session initiator and the session responder in the post-quantum key agreement system to collaboratively generate the session key, that is, an exemplary description of the session key generation process from the system perspective. The following embodiments describe in detail the process of generating the session key from the perspective of the session initiator and the perspective of the session responder, respectively.

[0077] Figure 2 An interactive flow chart of a post-quantum key agreement method provided by an embodiment of the present invention, such as Figure 2 As shown, the method is applied to the session initiator, the session initiator and the session responder jointly generate a session key, and the session initiator holds the long-term public key corresponding to the session responder. Specifically, the method may include the following steps:

[0078] 201. Generate a first temporary session key.

[0079] 202. Based on the long-term public key corresponding to the session responder, encapsulate the first temporary session key to obtain a first encrypted ciphertext, where the long-term public key is the SM2 public key.

[0080] 203. Send the first encrypted ciphertext to the session responder, so that the session responder uses the long-term private key corresponding to the session responder to decapsulate the first encrypted ciphertext to verify the identity of the session initiator. If the verification is successful, send the second encrypted ciphertext and the third encrypted ciphertext to the session initiator.

[0081] 204. Receive the second encrypted ciphertext and the third encrypted ciphertext sent by the session responder, and decapsulate the second encrypted ciphertext based on the long-term private key corresponding to the session initiator to obtain a second temporary session key.

[0082] 205. Based on the temporary encapsulation private key corresponding to the session initiator, the third encrypted ciphertext is decapsulated to obtain a shared key, where the temporary encapsulation private key is a post-quantum private key.

[0083] 206. Determine a session key for session communication based on the first temporary session key, the second temporary session key, and the shared key.

[0084] When the session initiator generates the session key, first, it generates a first temporary session key. Specifically, in an optional embodiment, the specific generation process of the first temporary session key may be: obtaining the long-term private key corresponding to the session initiator, the long-term private key being the SM2 private key. Generate a random number, perform a hash operation on the random number and the long-term private key corresponding to the session initiator, obtain a first hash operation result, and determine the first hash operation result as the first temporary session key. The hash operation may be a message authentication code operation based on a hash function.

[0085] For example, suppose the long-term private key corresponding to the session initiator is . Generate a random number , perform a hash operation on the random number and the long-term private key corresponding to the session initiator to obtain the first hash operation result and determine the first hash operation result as the first temporary session key .Right now .

[0086] Next, based on the long-term public key corresponding to the session response end, the first temporary session key is encapsulated to obtain a first encrypted ciphertext. Specifically, based on the long-term public key corresponding to the session response end, the first temporary session key is encapsulated to obtain a first encrypted ciphertext. The implementation process may include: based on the long-term public key corresponding to the session response end, asymmetrically encrypting the first temporary session key to obtain the first encrypted ciphertext, so as to encapsulate the first temporary session key in the first encrypted ciphertext.

[0087] Among them, when encapsulating the first temporary session key, the SM2 encryption algorithm can be used to encapsulate the first temporary session key. This not only retains the security and regulatory constraints of the traditional algorithm, but also can better be compatible with the post-quantum algorithm, and directly perform post-quantum upgrades based on the traditional algorithm.

[0088] For example, in the specific implementation, assume that the long-term public key corresponding to the session responder is , the first temporary session key is The first temporary session key is encrypted based on the SM2 algorithm. Encapsulate and obtain the first encrypted ciphertext ,Right now .

[0089] Next, a temporary encapsulation key pair is generated using a post-quantum key generation algorithm for encapsulating a temporary session key. Specifically, a random polynomial is generated, and the random polynomial is post-quantum encapsulated to generate a temporary encapsulation public key and a temporary encapsulation private key corresponding to the session initiator.

[0090] Specifically, in an optional embodiment, a security parameter is obtained and a random polynomial is generated. Then, the key generation algorithm of Kyber is called to generate a public key and a private key based on the security parameter and the random polynomial. A hash operation is performed on the public key based on a hash function to obtain a hash operation result, and a temporary encapsulated private key is generated based on the hash operation result and the private key, and its public key is determined as a temporary encapsulated public key.

[0091] For example, suppose the obtained security parameters are , generate a random polynomial . Call Kyber's key generation algorithm K-PKE.KeyGen , based on safety parameters and random polynomials , generate a public key and private key dk . Determine its public key as a temporary encapsulated public key ,Right now Next, the temporary encapsulated public key is hashed based on the hash function H=SHA3-256 to obtain the hash result. . Then generate a random number , concatenate the random number, hash result and private key to obtain a temporary encapsulated private key = .

[0092] Then, the first encrypted ciphertext and the temporary encapsulation public key are sent to the session responder, so that the session responder uses the long-term private key corresponding to the session responder to decapsulate the first encrypted ciphertext to verify the identity of the session initiator. If the verification is successful, the second encrypted ciphertext and the third encrypted ciphertext are sent to the session initiator.

[0093] Next, the second encrypted ciphertext and the third encrypted ciphertext sent by the session responder are received. Based on the long-term private key corresponding to the session initiator, the second encrypted ciphertext is decapsulated to obtain the second temporary session key. The second encrypted ciphertext is obtained by the session responder encapsulating the second temporary session key based on the long-term public key corresponding to the session initiator.

[0094] In an optional embodiment, the specific implementation process of decapsulating the second encrypted ciphertext may be: based on the long-term private key corresponding to the session initiator, the second encrypted ciphertext is asymmetrically decrypted to obtain a second temporary session key.

[0095] In specific implementation, the SM2 decryption algorithm can be used to perform asymmetric decryption processing on the second encrypted ciphertext to obtain the second temporary session key. For example, assuming that the long-term private key corresponding to the session initiator is , the second encrypted ciphertext is . Use the SM2 decryption algorithm to asymmetric decrypt the second encrypted ciphertext to obtain the second temporary session key .Right now .

[0096] Then, based on the temporary encapsulation private key corresponding to the session initiator, the third encrypted ciphertext is decapsulated to obtain a shared key, and the temporary encapsulation private key is a post-quantum private key. Among them, the third encrypted ciphertext is the third encrypted ciphertext obtained by the session responder performing post-quantum encapsulation on the second random number based on the temporary encapsulation public key. Then the post-quantum decapsulation algorithm can be used to decapsulate the third encrypted ciphertext. Specifically, based on the temporary encapsulation private key corresponding to the session initiator, the third encrypted ciphertext is post-quantum decapsulated to obtain a shared key.

[0097] For example, suppose the temporary wrapped private key is , the third encrypted ciphertext is . Perform post-quantum decapsulation on the third encrypted ciphertext to obtain the shared key .Right now .

[0098] In order to improve the security of the shared key, the embodiment of the present invention provides a new post-quantum decapsulation process. Specifically, in an optional embodiment, the third encrypted ciphertext is subjected to post-quantum decapsulation processing, and the specific implementation process of obtaining the shared key can be: calling the Kyber key generation algorithm, based on the temporary encapsulation private key, to obtain the splicing result of the private key and the public key. That is ( Next, the Kyber decryption algorithm is called to decrypt the third encrypted ciphertext Decapsulate and get the decryption result .Right now K-PKE.Decrypt . Call the hash function G to perform a hash operation on the decryption result to derive the shared key and random numbers .Right now G Next, call the hash function Recalculate the hash result corresponding to the third encrypted ciphertext .Right now . And call the Kyber encryption algorithm to re-encrypt to verify the consistency and get the new encrypted ciphertext ,Right now K-PKE.Encrypt .like If the shared key is not found, recalculate it, otherwise output the shared key .

[0099] Finally, a session key for session communication is determined based on the first temporary session key, the second temporary session key and the shared key.

[0100] Since the session key is randomly generated and used only for one session, it greatly reduces the risk of the key being cracked. Even if an attacker is able to intercept the key of a session, the key cannot be used to decrypt data of other sessions, ensuring the forward security of the data. In addition, the use of session keys can also prevent the potential risk of leakage caused by long-term use of keys. By using session keys, the security of communication data can be achieved without frequently changing long-term keys.

[0101] In summary, in the embodiment of the present invention, when the session initiator and the session responder collaboratively generate a session key, they use a hybrid classical SM2 cryptographic algorithm and a quantum-resistant cryptographic algorithm to perform three decapsulation operations on the temporary session key to generate a session key, so that the generated session key has a high security and can ensure the forward security of the data. At the same time, it can also be compatible with the existing public key infrastructure without the need for large-scale transformation.

[0102] The above embodiment describes that the session initiator interacts with the session responder to decapsulate the second encrypted ciphertext encapsulated with the second temporary session key and the third encrypted ciphertext encapsulated with the shared key, obtain the second temporary session key and the shared key, and generate the session key based on the first temporary session key, the second temporary session key and the shared key. In order to facilitate understanding of the specific implementation process of generating the session key based on the first temporary session key, the second temporary session key and the shared key, this process is described in detail in conjunction with the following embodiment.

[0103] Figure 3 The present invention provides a flowchart for determining a session key for session communication based on a first temporary session key, a second temporary session key and a shared key. Figure 3 As shown, the method may specifically include the following steps:

[0104] 301. Determine a session identifier based on a user identifier corresponding to a session initiator, a user identifier corresponding to a session responder, a first encrypted ciphertext, a second encrypted ciphertext, a third encrypted ciphertext, and a temporary encapsulated public key.

[0105] 302. Perform a hash operation on the session identifier, the first temporary session key, the second temporary session key, and the shared key to obtain a second hash operation result.

[0106] 303. Determine the second hash operation result as a session key used for performing session communication with the session responder.

[0107] First, determine the session identifier corresponding to this session. Among them, you can first obtain the user identifier corresponding to the session initiator and the user identifier corresponding to the session responder. Determine the session identifier based on the user identifier corresponding to the session initiator, the user identifier corresponding to the session responder, the first encrypted ciphertext, the second encrypted ciphertext, the third encrypted ciphertext, the first temporary session key, and the temporary encapsulation public key.

[0108] In the specific implementation, it is assumed that the user ID corresponding to the session initiator is , the user ID corresponding to the session responder is The first encrypted ciphertext is , the second encrypted ciphertext is , the third encrypted ciphertext is , the long-term public key corresponding to the session initiator is , the long-term public key corresponding to the session responder is , the temporary encapsulated public key is The session key obtained is .

[0109] Then, the session identifier, the first temporary session key, the second temporary session key and the shared key are hashed to obtain a third hash operation result. The third hash operation result is determined as the session key for session communication with the session responder. For example, the determined session key is .

[0110] The session key determined in the above way can not only resist the attack of quantum computers, but also be compatible with the existing public key infrastructure.

[0111] The above embodiment introduces a detailed description of the session key generation process from the perspective of the session initiator. The following describes the session key generation process in detail from the perspective of the session responder.

[0112] Figure 4 A flowchart of another post-quantum key agreement method provided by an embodiment of the present invention; see Attachment Figure 4 As shown, the execution subject of the method may be a key negotiation device, which is located at the session responder. The session responder cooperates with the session initiator to generate a session key. The session responder holds a long-term public key corresponding to the session initiator. Specifically, the key negotiation method may include the following steps:

[0113] 401. Receive a first encrypted ciphertext and a temporary encapsulation public key sent by a session initiator, where the first encrypted ciphertext is generated by encapsulating a first temporary session key based on a long-term public key corresponding to a session responder, and the temporary encapsulation public key is a post-quantum public key.

[0114] 402. If the first encrypted ciphertext is decapsulated using the long-term private key corresponding to the session responder to obtain the first temporary session key, the identity authentication of the session initiator is successful.

[0115] 403. If the verification is successful, the second temporary session key is encapsulated based on the long-term public key corresponding to the session initiator to obtain a second encrypted ciphertext, and the long-term public key is the SM2 public key.

[0116] 404. Generate a random polynomial, and encapsulate the random polynomial based on the temporary encapsulation public key to obtain a third encrypted ciphertext and a shared key.

[0117] 405. Send the second encrypted ciphertext and the third encrypted ciphertext to the session initiator, so that the session initiator decrypts the second encrypted ciphertext and the third encrypted ciphertext respectively to obtain a second temporary session key and a shared key.

[0118] 406. Generate a session key for session communication based on the first temporary session key, the second temporary session key, and the shared key.

[0119] First, a first encrypted ciphertext and a temporary encapsulation public key sent by a session initiator are received. The first encrypted ciphertext is generated by encapsulating a first temporary session key based on a long-term public key corresponding to a session responder. The temporary encapsulation public key is a post-quantum public key.

[0120] Then, the first encrypted ciphertext is decapsulated using the long-term private key corresponding to the session responder. If the decapsulation is successful to obtain the first temporary session key, the identity authentication of the session initiator is passed. The first encrypted ciphertext can be decapsulated using the SM2 decryption algorithm. Specifically, if the first encrypted ciphertext is asymmetrically decrypted using the long-term private key corresponding to the session responder to obtain the first temporary session key, the identity authentication of the session initiator is passed.

[0121] In specific implementation, it is assumed that the long-term private key corresponding to the session responder is , the first encrypted ciphertext is , perform asymmetric decryption on the first encrypted ciphertext to obtain a first temporary session key If the first temporary session key is successfully obtained, the identity authentication of the session initiator is passed.

[0122] After the identity authentication is passed, a second temporary session key is generated. The long-term private key corresponding to the session responder can be obtained first, and the long-term private key is the SM2 private key. Then, a random number is generated, and a hash operation is performed on the random number and the long-term private key corresponding to the session responder to obtain a hash operation result. The hash operation result is determined as the second temporary session key.

[0123] For example, suppose the long-term private key corresponding to the session responder is . Generate a random number , perform a hash operation on the random number and the long-term private key corresponding to the session initiator to obtain the first hash operation result and determine the first hash operation result as the first temporary session key .Right now .

[0124] Then, based on the long-term public key corresponding to the session initiator, the second temporary session key is encapsulated to obtain a second encrypted ciphertext. The second temporary session key can be encapsulated using the SM2 encryption algorithm. Specifically, based on the long-term public key corresponding to the session initiator, the second temporary session key is asymmetrically encrypted to obtain a second encrypted ciphertext, so that the second temporary session key is encapsulated in the second encrypted ciphertext.

[0125] For example, in the specific implementation, assume that the long-term public key corresponding to the session initiator is , the second temporary session key is The second temporary session key is encrypted based on the SM2 algorithm. Encapsulate and obtain the second encrypted ciphertext ,Right now .

[0126] Next, a random polynomial is generated, and based on the temporary encapsulation public key, the random polynomial is encapsulated to obtain a third encrypted ciphertext and a shared key. The random polynomial can be encapsulated by a post-quantum encapsulation algorithm. Specifically, a first secret value is generated; a hash operation is performed on the temporary encapsulation public key and the first secret value using a preset hash function to obtain a shared key and a second secret value; the shared key, the first secret value, and the second secret value are subjected to post-quantum encryption to obtain a third encrypted ciphertext.

[0127] For example, the temporary wrapped public key is , generate the first secret value random number Temporary Encapsulation Public Key Perform hash operation to obtain the shared key and the second secret value ,Right now G H( )), where G is a hash function. Call the post-quantum encryption algorithm to perform key encapsulation on the shared key, the first secret value and the second secret value to obtain the third encrypted ciphertext .Right now -PKE.Encrypt( .

[0128] The second encrypted ciphertext and the third encrypted ciphertext are sent to the session initiator, so that the session initiator decrypts the second encrypted ciphertext and the third encrypted ciphertext respectively to obtain the second temporary session key and the shared key.

[0129] Next, a session key for session communication is generated based on the first temporary session key, the second temporary session key and the shared key. The specific implementation process of generating the session key for session communication based on the first temporary session key, the second temporary session key and the shared key may include: determining a session identifier according to a user identifier corresponding to the session initiator and a user identifier corresponding to the session responder; and determining a session key for session communication with the session responder according to the session identifier, the first temporary session key, the second temporary session key and the shared key.

[0130] Among them, the process of determining the session identifier and the specific implementation process of determining the session key used for session communication with the session responder based on the session identifier, the first temporary session key, the second temporary session key and the shared key are roughly the same as the generation process of the session initiator in the above embodiment, and can refer to the above embodiment, which will not be repeated here.

[0131] In the embodiment of the present invention, when the session initiator and the session responder collaboratively generate a session key, they use a hybrid classical SM2 cryptographic algorithm and a quantum-resistant cryptographic algorithm to perform three decapsulation operations on the temporary session key to generate a session key, so that the generated session key has a high security and can ensure the forward security of the data. At the same time, it can also be compatible with the existing public key infrastructure without the need for large-scale transformation.

[0132] Among them, the specific implementation process involved in the embodiments of the present invention can refer to the contents in the above embodiments, and will not be repeated here.

[0133] In order to facilitate understanding of the implementation process of the above two ends jointly generating session keys, the following is explained in combination with specific application scenarios. Figure 5 As shown, it is assumed that user A as the session initiator and user B as the session responder need to jointly generate a session key. The specific implementation process may include the following steps:

[0134] Initialization phase:

[0135] Step 1: Use the SM2 key generation method to generate long-term public keys and long-term private keys corresponding to the two conversation parties, and generate user identifiers corresponding to the two conversation parties.

[0136] Step 2: Share the long-term public keys of the two participants.

[0137] In this way, the session initiator holds , where the user identity corresponding to the session initiator is , the long-term private key corresponding to the session initiator is , the long-term public key corresponding to the session initiator is , the long-term public key corresponding to the session responder is The session responder holds Among them, the user identity corresponding to the session responder is , the long-term private key corresponding to the session responder is .

[0138] At the same time, the user IDs of the two participants can also be shared. In addition, the user IDs of the two participants can also be shared during the key negotiation process, and there is no limitation on this. Key negotiation phase:

[0139] Step 1: The session initiator uses the post-quantum key generation method to generate a temporary wrapped public key and a temporary wrapped private key.

[0140] Specifically, based on security parameters, call Kyber's key generation algorithm ,dk K-PKE.KeyGen , generate a temporary private key dk and the temporary public key , determine the temporary public key as a temporary encapsulated public key .Right now H is the hash function SHA3-256, using the public and private key pair to construct a secret private key , determine the secret private key as a temporary encapsulated private key. Among them, z is a random number. Finally, return Among them, the temporary encapsulation public key is , the temporary encapsulated private key is .

[0141] Step 2: The session initiator generates a first temporary session key using a hash operation function.

[0142] Specifically, generate random numbers , and calculate the first temporary session key .

[0143] Step 3: The session initiator uses the SM2 encryption algorithm to encrypt the first temporary session key based on the long-term public key corresponding to the session responder, and generates a first encrypted ciphertext encapsulating the first temporary session key.

[0144] Specifically, calculate the first encrypted ciphertext .

[0145] Step 4: The session initiator sends the user identification, the first encrypted ciphertext, and the temporary encapsulated public key to the session responder.

[0146] Step 5: The session responder receives the user identification, the first encrypted ciphertext, and the temporary encapsulated public key sent by the session initiator.

[0147] Step 6: The session responder uses its corresponding long-term private key to decrypt the first encrypted ciphertext to verify the identity of the session responder.

[0148] Specifically, based on the long-term private key corresponding to the session responder , for the first encrypted ciphertext Decrypt and get the first temporary session key .

[0149] Step 7: The session responder generates a second temporary session key based on the long-term private key corresponding to the session responder using a hash operation function.

[0150] Specifically, generate random numbers , and calculate . Determine it as the second temporary session key .

[0151] Step 8: The session responder uses the SM2 encryption algorithm to encrypt the second temporary session key based on the long-term public key corresponding to the session initiator, and generates a second encrypted ciphertext encapsulating the second temporary session key.

[0152] Specifically, calculate . Get the second encrypted ciphertext .

[0153] Step 9: The session responder uses the post-quantum key encapsulation algorithm to perform a post-quantum encryption operation on the temporary encapsulation public key corresponding to the session initiator to generate a third encrypted ciphertext and a derived shared key.

[0154] Specifically, you can generate a random number first , and then use the temporary encapsulated public key Key wrapping of random numbers . Get the third encrypted ciphertext and a shared key .

[0155] Among them, the post-quantum key encapsulation method used can be: using the hash function G to temporarily encapsulate the public key and Perform hash operation and get the result as G H( )).in, is a polynomial, and G is the hash function SHA3-512. Call the Kyber encryption algorithm to encapsulate the temporary encapsulated public key, random number and polynomial to obtain the third encrypted ciphertext ,Right now -PKE.Encrypt( . Returns the shared key And the third encrypted ciphertext .

[0156] Step 10: The session responder sends the user identifier, the second encrypted ciphertext, and the third encrypted ciphertext to the session initiator.

[0157] Step 11: The session responder determines a target session key based on the first temporary session key, the second temporary session key, and the shared key.

[0158] Specifically, calculate the target session key .

[0159] Step 12: The session initiator receives the user identifier, the second encrypted ciphertext, and the third encrypted ciphertext sent by the session responder, and decrypts the second encrypted ciphertext based on the long-term private key corresponding to the session initiator to obtain the second temporary session key, and decrypts the third encrypted ciphertext based on the first temporary private key to obtain the shared key.

[0160] Specifically, based on the long-term private key corresponding to the session initiator, the second encrypted ciphertext is decrypted by calling the SM2 decryption algorithm to calculate the second temporary session key ,Right now Based on the first temporary private key, the third encrypted ciphertext is decrypted by calling the post-quantum decapsulation method to calculate the shared key .

[0161] Among them, the specific implementation process of the post-quantum decapsulation method to decrypt the third encrypted ciphertext is: calling the Kyber key generation algorithm, based on the temporary encapsulation private key, to obtain the splicing result of the private key and the public key. That is ( Next, the Kyber decryption algorithm is called to decrypt the third encrypted ciphertext Decapsulate and get the decryption result .Right now K-PKE.Decrypt . Call the hash function G to perform a hash operation on the decryption result to derive the shared key and random numbers .Right now G Next, call the hash function , recalculate the hash result corresponding to the third encrypted ciphertext .Right now . And call the Kyber encryption algorithm to re-encrypt to verify the consistency and get the new encrypted ciphertext ,Right now K-PKE.Encrypt .like If the shared key is not found, recalculate it, otherwise output the shared key .

[0162] Step 13: The session initiator generates a target session key based on the first temporary session key, the second temporary session key and the shared key.

[0163] Specifically, calculate the target session key .

[0164] From the above description, it can be seen that the key negotiation method in the embodiment of the present invention can retain the security and regulatory constraints of the traditional algorithm, and has the potential for post-quantum security and forward security. It does not require large-scale transformation of the existing public key infrastructure, and the application system deployment and transformation are very convenient. In addition, the classical algorithm SM2 is used to generate session keys, which has good compatibility with the existing system for post-quantum upgrades, and the post-quantum key encapsulation algorithm uses the Kyber algorithm, which has high computing performance and small communication bandwidth. In addition, the application of this method in the key negotiation of the TLS handshake has fewer interactions than the draft submitted by the IETF, and the newly designed hybrid post-quantum key negotiation mechanism can be proven to be secure under the CK+ model;

[0165] The key agreement device of one or more embodiments of the present invention will be described in detail below. Those skilled in the art will appreciate that these devices can be configured using commercially available hardware components through the steps taught in this solution.

[0166] Figure 6 A schematic diagram of the structure of a post-quantum key agreement device provided by an embodiment of the present invention is located at the session initiator, such as Figure 6 As shown, the device includes: a generating module 11, an encapsulating module 12, a sending module 13, a receiving module 14, a decapsulating module 15, and a determining module 16.

[0167] The generating module 11 is configured to generate a first temporary session key.

[0168] The encapsulation module 12 is used to encapsulate the first temporary session key based on the long-term public key corresponding to the session responder to obtain a first encrypted ciphertext, and the long-term public key is the SM2 public key.

[0169] The sending module 13 is used to send the first encrypted ciphertext to the session responder, so that the session responder uses the long-term private key corresponding to the session responder to decapsulate the first encrypted ciphertext to verify the identity of the session initiator. If the verification is successful, the second encrypted ciphertext and the third encrypted ciphertext are sent to the session initiator.

[0170] The receiving module 14 is used to receive the second encrypted ciphertext and the third encrypted ciphertext sent by the session responder, and decapsulate the second encrypted ciphertext based on the long-term private key corresponding to the session initiator to obtain a second temporary session key.

[0171] The decapsulation module 15 is used to decapsulate the third encrypted ciphertext based on the temporary encapsulation private key corresponding to the session initiator to obtain a shared key, wherein the temporary encapsulation private key is a post-quantum private key.

[0172] The determination module 16 is configured to determine a session key for session communication based on the first temporary session key, the second temporary session key and the shared key.

[0173] Optionally, the generation module 11 is specifically used to: obtain a long-term private key corresponding to the session initiator, where the long-term private key is an SM2 private key; generate a random number; perform a hash operation on the random number and the long-term private key corresponding to the session initiator to obtain a first hash operation result; and determine the first hash operation result as a first temporary session key.

[0174] Optionally, the encapsulation module 12 is specifically used to: based on the long-term public key corresponding to the session responder, asymmetrically encrypt the first temporary session key to obtain a first encrypted ciphertext, so as to encapsulate the first temporary session key in the first encrypted ciphertext.

[0175] Optionally, the receiving module 14 is specifically used to: perform asymmetric decryption on the second encrypted ciphertext based on the long-term private key corresponding to the session initiator to obtain a second temporary session key.

[0176] Optionally, the decapsulation module 15 is specifically used to: generate a random polynomial; perform post-quantum encapsulation on the random polynomial to generate a temporary encapsulation public key and a temporary encapsulation private key corresponding to the session initiator; send the temporary encapsulation public key corresponding to the session initiator to the session responder, so that the session responder performs post-quantum encapsulation on the second random number based on the temporary encapsulation public key to obtain a third encrypted ciphertext and a shared key; perform post-quantum decapsulation on the third encrypted ciphertext based on the temporary encapsulation private key corresponding to the session initiator to obtain a shared key.

[0177] Optionally, the determination module 16 is specifically used to: determine the session identifier based on the user identifier corresponding to the session initiator, the user identifier corresponding to the session responder, the first encrypted ciphertext, the second encrypted ciphertext, the third encrypted ciphertext, and the temporary encapsulated public key; perform a hash operation on the session identifier, the first temporary session key, the second temporary session key, and the shared key to obtain a second hash operation result; and determine the second hash operation result as a session key for session communication with the session responder.

[0178] Figure 6 The device shown can execute the steps introduced in the aforementioned embodiments. For detailed execution process and technical effects, please refer to the description in the aforementioned embodiments, which will not be repeated here.

[0179] In one possible design, the above Figure 6 The structure of the post-quantum key agreement device shown can be implemented as an electronic device, such as Figure 7As shown, the electronic device may include: a memory 21, a processor 22, and a communication interface 23. The memory 21 stores executable code, and when the executable code is executed by the processor 22, the processor 22 can at least implement the post-quantum key negotiation method provided in the above-mentioned embodiment.

[0180] Figure 8 A schematic diagram of the structure of another post-quantum key agreement device provided by an embodiment of the present invention is located at the session response end, such as Figure 8 As shown, the device includes: a receiving module 31, a decapsulation module 32, a first encapsulation module 33, a second encapsulation module 34, a sending module 35, and a generating module 36.

[0181] The receiving module 31 is used to receive the first encrypted ciphertext and the temporary encapsulation public key sent by the session initiator, wherein the first encrypted ciphertext is generated by encapsulating the first temporary session key based on the long-term public key corresponding to the session responder, and the temporary encapsulation public key is a post-quantum public key.

[0182] The decapsulation module 32 is configured to decapsulate the first encrypted ciphertext using the long-term private key corresponding to the session responder to obtain a first temporary session key, and the identity authentication of the session initiator is passed.

[0183] The first encapsulation module 33 is used to encapsulate the second temporary session key based on the long-term public key corresponding to the session initiator to obtain a second encrypted ciphertext if the verification is successful, and the long-term public key is the SM2 public key.

[0184] The second encapsulation module 34 is used to generate a random polynomial, and encapsulate the random polynomial based on the temporary encapsulation public key to obtain a third encrypted ciphertext and a shared key.

[0185] The sending module 35 is used to send the second encrypted ciphertext and the third encrypted ciphertext to the session initiator, so that the session initiator decrypts the second encrypted ciphertext and the third encrypted ciphertext respectively to obtain a second temporary session and a shared key.

[0186] The generating module 36 is used to generate a session key for session communication based on the first temporary session key, the second temporary session key and the shared key.

[0187] Optionally, the decapsulation module 32 is specifically used for: if the long-term private key corresponding to the session responder is used to asymmetrically decrypt the first encrypted ciphertext to obtain a first temporary session key, the identity authentication of the session initiator is passed.

[0188] Optionally, based on the long-term public key corresponding to the session initiator, the second temporary session key is encapsulated to obtain the second encrypted ciphertext, and the first encapsulation module 33 is specifically used to: obtain the long-term private key corresponding to the session responder, where the long-term private key is the SM2 private key; generate a random number; perform a hash operation on the random number and the long-term private key corresponding to the session responder to obtain a hash operation result; and determine the hash operation result as the second temporary session key.

[0189] Optionally, the first encapsulation module 33 is used to: asymmetrically encrypt the second temporary session key based on the long-term public key corresponding to the session initiator to obtain a second encrypted ciphertext, so as to encapsulate the second temporary session key in the second encrypted ciphertext.

[0190] Optionally, the second encapsulation module 34 is used to: generate a first secret value; use a preset hash function to perform a hash operation on the temporary encapsulation public key and the first secret value to obtain a shared key and a second secret value; perform post-quantum encryption on the shared key, the first secret value, and the second secret value to obtain a third encrypted ciphertext.

[0191] Optionally, the generating module 36 is specifically used to: determine a session identifier according to a user identifier corresponding to the session initiator and a user identifier corresponding to the session responder; and determine a session key for session communication with the session responder according to the session identifier, the first temporary session key, the second temporary session key and the shared key.

[0192] Figure 8 The device shown can execute the steps introduced in the aforementioned embodiments. For detailed execution process and technical effects, please refer to the description in the aforementioned embodiments, which will not be repeated here.

[0193] In one possible design, the above Figure 8 The structure of the post-quantum key agreement device shown can be implemented as an electronic device, such as Fig. 9 As shown, the electronic device may include: a memory 41, a processor 42, and a communication interface 43. The memory 41 stores executable code, and when the executable code is executed by the processor 42, the processor 42 can at least implement the post-quantum key negotiation method provided in the above-mentioned embodiment.

[0194] In addition, an embodiment of the present invention provides a non-temporary machine-readable storage medium, on which executable code is stored. When the executable code is executed by a processor of an electronic device, the processor can at least implement the post-quantum key negotiation method provided in the aforementioned embodiment.

[0195] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. Those of ordinary skill in the art may understand and implement the present invention without creative effort.

[0196] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by adding a necessary general hardware platform, and of course can also be implemented by combining hardware and software. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a computer product, and the present invention can be implemented in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0197] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A post-quantum key agreement method, characterized in that: Applied to a session initiator, the session initiator and the session responder jointly generate a session key, the session initiator holds a long-term public key corresponding to the session responder, and the method includes: generating a first temporary session key; Based on the long-term public key corresponding to the session responder, encapsulate the first temporary session key to obtain a first encrypted ciphertext, wherein the long-term public key is the SM2 public key; Sending the first encrypted ciphertext to the session responder, so that the session responder uses the long-term private key corresponding to the session responder to decapsulate the first encrypted ciphertext to verify the identity of the session initiator, and if the verification is successful, sending the second encrypted ciphertext and the third encrypted ciphertext to the session initiator; receiving a second encrypted ciphertext and a third encrypted ciphertext sent by the session responder, and decapsulating the second encrypted ciphertext based on the long-term private key corresponding to the session initiator to obtain a second temporary session key; Decapsulating the third encrypted ciphertext based on a temporary encapsulation private key corresponding to the session initiator to obtain a shared key, wherein the temporary encapsulation private key is a post-quantum private key; A session key for session communication is determined based on the first temporary session key, the second temporary session key, and the shared key.

2. The method according to claim 1, characterized in that The generating of the first temporary session key comprises: Obtain the long-term private key corresponding to the session initiator, where the long-term private key is the SM2 private key; Generate a random number; Performing a hash operation on the random number and a long-term private key corresponding to the session initiator to obtain a first hash operation result; The first hash operation result is determined as a first temporary session key.

3. The method according to claim 1, characterized in that The encapsulating the first temporary session key based on the long-term public key corresponding to the session responder to obtain a first encrypted ciphertext includes: Based on the long-term public key corresponding to the session responder, the first temporary session key is asymmetrically encrypted to obtain a first encrypted ciphertext, so as to encapsulate the first temporary session key in the first encrypted ciphertext.

4. The method according to claim 1, characterized in that: The decapsulating the second encrypted ciphertext based on the long-term private key corresponding to the session initiator to obtain a second temporary session key includes: Based on the long-term private key corresponding to the session initiator, the second encrypted ciphertext is asymmetrically decrypted to obtain a second temporary session key.

5. The method according to claim 1, characterized in that The decapsulating the third encrypted ciphertext based on the temporary encapsulation private key corresponding to the session initiator to obtain a shared key includes: Generate random polynomials; Performing post-quantum encapsulation on the random polynomial to generate a temporary encapsulation public key and a temporary encapsulation private key corresponding to the session initiator; Sending the temporary encapsulation public key corresponding to the session initiator to the session responder, so that the session responder performs post-quantum encapsulation on the second random number based on the temporary encapsulation public key to obtain a third encrypted ciphertext and a shared key; Based on the temporary encapsulation private key corresponding to the session initiator, the third encrypted ciphertext is post-quantum decapsulated to obtain a shared key.

6. The method according to claim 1, characterized in that The determining, based on the first temporary session key, the second temporary session key, and the shared key, a session key for session communication comprises: Determine a session identifier based on a user identifier corresponding to the session initiator, a user identifier corresponding to the session responder, the first encrypted ciphertext, the second encrypted ciphertext, the third encrypted ciphertext, and a temporary encapsulation public key; Performing a hash operation on the session identifier, the first temporary session key, the second temporary session key, and the shared key to obtain a second hash operation result; The second hash operation result is determined as a session key used for performing session communication with the session responder.

7. A post-quantum key agreement method, characterized in that: Applied to a session responder, the session responder cooperates with a session initiator to generate a session key, the session responder holds a long-term public key corresponding to the session initiator, and the method includes: Receiving a first encrypted ciphertext and a temporary encapsulation public key sent by the session initiator, wherein the first encrypted ciphertext is generated by encapsulating a first temporary session key based on a long-term public key corresponding to the session responder, and the temporary encapsulation public key is a post-quantum public key; If the first encrypted ciphertext is decapsulated using the long-term private key corresponding to the session responder to obtain a first temporary session key, the identity authentication of the session initiator is passed; If the verification is successful, the second temporary session key is encapsulated based on the long-term public key corresponding to the session initiator to obtain a second encrypted ciphertext, where the long-term public key is the SM2 public key; Generate a random polynomial, and encapsulate the random polynomial based on the temporary encapsulation public key to obtain a third encrypted ciphertext and a shared key; Sending the second encrypted ciphertext and the third encrypted ciphertext to the session initiator, so that the session initiator decrypts the second encrypted ciphertext and the third encrypted ciphertext respectively to obtain a second temporary session and a shared key; A session key for session communication is generated based on the first temporary session key, the second temporary session key, and the shared key.

8. The method according to claim 7, characterized in that If the first encrypted ciphertext is decapsulated using the long-term private key corresponding to the session responder to obtain a first temporary session key, the identity authentication of the session initiator is passed, including: If the first encrypted ciphertext is asymmetrically decrypted using the long-term private key corresponding to the session responder to obtain a first temporary session key, the identity authentication of the session initiator is passed.

9. The method according to claim 7, characterized in that: Before encapsulating the second temporary session key based on the long-term public key corresponding to the session initiator to obtain the second encrypted ciphertext, the method further includes: Obtaining a long-term private key corresponding to the session responder, where the long-term private key is an SM2 private key; Generate a random number; Performing a hash operation on the random number and a long-term private key corresponding to the session responder to obtain a hash operation result; The hash operation result is determined as the second temporary session key.

10. The method according to claim 7, characterized in that The encapsulating the second temporary session key based on the long-term public key corresponding to the session initiator to obtain the second encrypted ciphertext includes: Based on the long-term public key corresponding to the session initiator, the second temporary session key is asymmetrically encrypted to obtain a second encrypted ciphertext, so as to encapsulate the second temporary session key in the second encrypted ciphertext.

11. The method according to claim 7, characterized in that The step of encapsulating the random polynomial based on the temporary encapsulation public key to obtain a third encrypted ciphertext and a shared key includes: generating a first secret value; Using a preset hash function, performing a hash operation on the temporary encapsulated public key and the first secret value to obtain a shared key and a second secret value; Post-quantum encryption is performed on the shared key, the first secret value, and the second secret value to obtain a third encrypted ciphertext.

12. The method according to claim 7, characterized in that The step of generating a session key for session communication based on the first temporary session key, the second temporary session key and the shared key comprises: Determine a session identifier according to a user identifier corresponding to the session initiating end and a user identifier corresponding to the session responding end; A session key used for session communication with the session responder is determined according to the session identifier, the first temporary session key, the second temporary session key, and the shared key.

13. An electronic device, characterized in that: include: A memory, a processor, and a communication interface; wherein the memory stores executable code, and when the executable code is executed by the processor, the processor executes the post-quantum key negotiation method as described in any one of claims 1 to 6 or 7 to 12.

Images