Grid-based decryption method and device, equipment, medium and chip
By splitting the private key s into s1 and s2, and obtaining the decryption parameters w1 and w2 based on the ciphertext (u, v), the decryption process of the grid-based cipher algorithm is simplified, and the problems of high decryption complexity and low efficiency in the prior art are solved, and efficient ciphertext decryption and side channel attack resistance are achieved.
Patent Information
- Application Number
- CN202411684071.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-22
- Publication Date
- 2025-03-07
AI Technical Summary
The grid-based cryptographic algorithm is highly complex in the decryption process, requiring multiple analog conversions and addition and subtraction operations, resulting in low decryption efficiency and high cost.
By splitting the private key s into the first sub-private key s1 and the second sub-private key s2, and obtaining the decryption parameters w1 and w2 based on the ciphertext (u, v), the decryption process is simplified and multiple analog conversions and addition and subtraction operations are avoided.
Improves the decryption efficiency of grid-based ciphertexts, reduces decryption costs, and resists first-order side channel attacks.
Smart Images
Figure CN119583134A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of decryption technology, and in particular to a lattice-based decryption method, device, equipment, medium and chip. Background Art
[0002] In recent years, lattice-based cryptographic algorithms have achieved a better balance in security, public and private key sizes, and computing speed, and are considered to be one of the most promising post-quantum cryptographic algorithms. However, similar to traditional public key cryptographic algorithms, lattice-based cryptographic algorithms are also vulnerable to side channel attacks. Among them, for lattice-based cryptographic algorithms, the main method of side channel protection is mask protection, where the main protection area is the calculation process involving the private key in the decryption process. In the related art, the arithmetic mask can be converted into a Boolean mask, and the XOR operation can be further performed based on the ciphertext to restore the plaintext. However, the applicant found that the above-mentioned decryption process is relatively complicated, and multiple modular conversions and multiple addition and subtraction operations are required in the above-mentioned decryption process, which reduces the decryption efficiency and increases the decryption cost. Summary of the invention
[0003] In order to solve the problems in the related art, the embodiments of the present disclosure provide a lattice-based decryption method, apparatus, device, medium and chip.
[0004] In a first aspect, an embodiment of the present disclosure provides a lattice-based decryption method, comprising:
[0005] Get the private key s, and split the private key s into the first sub-private key s1 and the second sub-private key s2, where s2 = s-s1modq, q is a preset parameter;
[0006] Get the ciphertext (u,v), and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2;
[0007] based on Get the third decryption parameter m1, and based on Obtain a fourth decryption parameter m2, where d is an integer greater than or equal to 3;
[0008] based on Get the plaintext m.
[0009] In one embodiment of the present disclosure, the private key s is taken from Z q A vector that satisfies a discrete Gaussian distribution, where Z q is the remainder class ring of modq.
[0010] In one embodiment of the present disclosure, the first sub-private key s1 is taken from Z qA vector that satisfies uniform random selection.
[0011] In one embodiment of the present disclosure, if the ciphertext is encrypted by a lattice encryption algorithm based on the error learning LWE problem, the private key s and the first sub-private key s1 are both n-dimensional vectors, where n is an integer greater than or equal to 2;
[0012] If the ciphertext is encrypted using a lattice encryption algorithm based on the R-LWE problem of ring error learning, then the private key s and the first child private key s1 are both polynomials of degree n-1;
[0013] If the ciphertext is encrypted by a lattice encryption algorithm based on the modular error learning M-LWE problem, the private key s and the first sub-private key s1 are both k-dimensional vectors, and the elements in the private key s and the first sub-private key s1 are all n-1 degree polynomials, where k is a security parameter.
[0014] In a second aspect, an embodiment of the present disclosure provides a lattice-based decryption device, characterized in that it includes:
[0015] The private key splitting module is configured to obtain a private key s and split the private key s into a first sub-private key s1 and a second sub-private key s2, wherein s2 = s-s1modq, q is a preset parameter;
[0016] The ciphertext acquisition module is configured to obtain the ciphertext (u, v) and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2;
[0017] The parameter acquisition module is configured based on Get the third decryption parameter m1, and based on Obtain a fourth decryption parameter m2, where d is an integer greater than or equal to 3;
[0018] The plaintext acquisition module is configured based on Get the plaintext m.
[0019] In one embodiment of the present disclosure, the private key s is taken from Z q A vector that satisfies a discrete Gaussian distribution, where Z q is the remainder class ring of modq.
[0020] In one embodiment of the present disclosure, the first sub-private key s1 is taken from Z q A vector that satisfies uniform random selection.
[0021] In one embodiment of the present disclosure, if the ciphertext is encrypted by a lattice encryption algorithm based on the error learning LWE problem, the private key s and the first sub-private key s1 are both n-dimensional vectors, where n is an integer greater than or equal to 2;
[0022] If the ciphertext is encrypted using a lattice encryption algorithm based on the R-LWE problem of ring error learning, then the private key s and the first child private key s1 are both polynomials of degree n-1;
[0023] If the ciphertext is encrypted by a lattice encryption algorithm based on the modular error learning M-LWE problem, the private key s and the first sub-private key s1 are both k-dimensional vectors, and the elements in the private key s and the first sub-private key s1 are all n-1 degree polynomials, where k is a security parameter.
[0024] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising a memory and a processor, wherein the memory is used to store one or more computer instructions, and wherein the one or more computer instructions are executed by the processor to implement a method as described in any one of the first aspects.
[0025] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, a method as described in any one of the first aspects is implemented.
[0026] In a fifth aspect, a chip is provided in an embodiment of the present disclosure, and the chip includes the lattice-based decryption device described in any one of the second aspects.
[0027] According to the technical solution provided by the embodiment of the present disclosure, by obtaining a private key s, and splitting the private key s into a first sub-private key s1 and a second sub-private key s2; obtaining a ciphertext (u, v), and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2; based on Get the third decryption parameter m1, and based on Obtain the fourth decryption parameter m2; based on Obtain the plaintext m. The above scheme is relatively simple and does not require multiple modular conversions and multiple addition and subtraction operations, thereby improving the decryption efficiency of the lattice-based ciphertext and reducing the decryption cost.
[0028] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS
[0029] Other features, objectives and advantages of the present disclosure will become more apparent through the following detailed description of non-limiting embodiments in conjunction with the accompanying drawings. In the accompanying drawings:
[0030] Figure 1 A flowchart of a lattice-based decryption method according to an embodiment of the present disclosure is shown.
[0031] Figure 2 A structural block diagram showing a lattice-based decryption device according to an embodiment of the present disclosure
[0032] Figure 3 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.
[0033] Figure 4 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION
[0034] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.
[0035] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, behaviors, components, parts, or a combination thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, behaviors, components, parts, or a combination thereof exist or are added.
[0036] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0037] In the present disclosure, if it involves operations of obtaining user information or user data or displaying user information or user data to others, the operations are all authorized and confirmed by the user, or actively selected by the user.
[0038] In the related art, since lattice-based cryptographic algorithms are vulnerable to side channel attacks, the main method of side channel protection for lattice-based cryptographic algorithms is mask protection, in which the main protection area is the calculation process involving the private key in the decryption process. In one embodiment, the arithmetic mask can be converted into a Boolean mask, and an XOR operation can be further performed based on the ciphertext to restore the plaintext.
[0039] However, the applicant has found that the above decryption process is relatively complicated and requires multiple modular conversions and multiple addition and subtraction operations, thereby reducing the decryption efficiency and increasing the decryption cost.
[0040] In order to solve the above problems, the embodiments of the present disclosure provide a lattice-based decryption method, apparatus, device, medium and chip. The method can be understood as a masked decryption protection scheme that can resist first-order side channel attacks.
[0041] According to the technical solution provided by the embodiment of the present disclosure, by obtaining a private key s, and splitting the private key s into a first sub-private key s1 and a second sub-private key s2; obtaining a ciphertext (u, v), and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2; based on Get the third decryption parameter m1, and based on Obtain the fourth decryption parameter m2; based on Obtain the plaintext m. The above scheme is relatively simple and does not require multiple modular conversions and multiple addition and subtraction operations. It can resist first-order side channel attacks, thereby improving the decryption efficiency of lattice-based ciphertexts and reducing the decryption cost.
[0042] Figure 1 FIG. 1 is a flowchart of a lattice-based decryption method according to an embodiment of the present disclosure. Figure 1 As shown, the lattice-based decryption method includes the following steps S101-S104:
[0043] In step S101, a private key s is obtained, and the private key s is split into a first sub-private key s1 and a second sub-private key s2;
[0044] Where s2=s-s1modq, q is the preset parameter, mod is the modulus operator;
[0045] In step S102, the ciphertext (u, v) is obtained, and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2;
[0046] Among them, s1 T is the transpose of s1, s2 T is the transpose of s2.
[0047] In step S103, based on Get the third decryption parameter m1, and based on Obtain the fourth decryption parameter m2;
[0048] Wherein, d is an integer greater than or equal to 3, For (2 d / q)*w1 rounded down, For (2 d / q)*w2 rounded down;
[0049] In step S104, based on Get the plaintext m;
[0050] in, Yes Perform rounding operation, that is, take the distance The nearest integer.
[0051] In one implementation of the present disclosure, the decryption method provided in the embodiment of the present disclosure can be applied to decrypt ciphertext encrypted by a Regev encryption algorithm, a lattice encryption algorithm based on a learning with errors (LWE) problem, a lattice encryption algorithm based on a ring learning with errors (R-LWE) problem, or a lattice encryption algorithm based on a module learning with errors (M-LWE) problem.
[0052] In one implementation of the present disclosure, the ciphertext can be obtained by encrypting the command generated by the demand-side system master station in the power supply and distribution system, and the command can be a parameter setting command, a load control command, etc. Specifically, when the demand-side system master station (encryption party) needs to issue a command (i.e., plain text, such as a parameter setting command, a load control command, etc.), the corresponding key can be obtained according to the terminal address, and then the key and the data plaintext organized in advance by the master station are used together to encrypt the data plaintext by calling the encryption program, and finally the data ciphertext is packaged into a data message and sent to the corresponding terminal (decryption party). After receiving the ciphertext data, the terminal unpacks the data to obtain the ciphertext. The terminal decrypts the ciphertext through the lattice-based decryption method provided in the embodiment of the present disclosure, and can obtain the command issued by the demand-side system master station.
[0053] In an implementation of the present disclosure, q may be a prime number or a power of 2.
[0054] In one embodiment of the present disclosure, the private key s can be obtained from Z q A vector that satisfies a discrete Gaussian distribution, where Z q is the remainder class ring of modq.
[0055] In one embodiment of the present disclosure, the first sub-private key s1 can be taken from Z q A vector that satisfies uniform random selection.
[0056] In one embodiment of the present disclosure, if the ciphertext is encrypted by a lattice encryption algorithm based on the error learning LWE problem, the private key s and the first sub-private key s1 are both n-dimensional vectors, where n is an integer greater than or equal to 2;
[0057] If the ciphertext is encrypted using a lattice encryption algorithm based on the R-LWE problem of ring error learning, then the private key s and the first child private key s1 are both polynomials of degree n-1;
[0058] If the ciphertext is encrypted by a lattice encryption algorithm based on the modular error learning M-LWE problem, the private key s and the first sub-private key s1 are both k-dimensional vectors, and the elements in the private key s and the first sub-private key s1 are all n-1 degree polynomials, where k is a security parameter.
[0059] In one embodiment of the present disclosure, if the third decryption parameter m1 and the fourth decryption parameter m2 are both integers, the third decryption parameter m1 and the fourth decryption parameter m2 can be substituted into Perform operations to obtain the plaintext m.
[0060] In one embodiment of the present disclosure, if the third decryption parameter m1 is a vector The fourth decryption parameter m2 is a vector Then the elements at the corresponding positions in the third decryption parameter m1 and the fourth decryption parameter m2 can be substituted into Perform operations to obtain the plaintext The elements at the corresponding positions in .
[0061] For example, it can be based on Perform calculations to obtain the plaintext
[0062] In one embodiment of the present disclosure, if the third decryption parameter m1 and the fourth decryption parameter m2 are both polynomials, that is, m1=m 10 +m 11 x+…+m 1n x n , m2=m 20 +m 21 x+…+m 2n x n , the coefficients of the same power terms in the third decryption parameter m1 and the fourth decryption parameter m2 can be substituted into Perform operations to obtain the coefficients of the corresponding power terms in the plaintext m.
[0063] Exemplarily, the plaintext m may be obtained by calculation based on the following formula:
[0064]
[0065] In one embodiment of the present disclosure, if the third decryption parameter m1 and the fourth decryption parameter m2 are both matrices, the matrix elements at the same position in the third decryption parameter m1 and the fourth decryption parameter m2 can be substituted into Perform operations to obtain the matrix elements at the corresponding positions in the plaintext m.
[0066] According to the technical solution provided by the embodiment of the present disclosure, by obtaining a private key s, and splitting the private key s into a first sub-private key s1 and a second sub-private key s2; obtaining a ciphertext (u, v), and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2; based on Get the third decryption parameter m1, and based on Obtain the fourth decryption parameter m2; based on Obtain the plaintext m. The above scheme is relatively simple and does not require multiple modular conversions and multiple addition and subtraction operations, thereby improving the decryption efficiency of the lattice-based ciphertext and reducing the decryption cost.
[0067] Figure 2 The structure block diagram of the lattice-based decryption device according to the embodiment of the present disclosure is shown. The device can be implemented as part or all of the electronic device through software, hardware or a combination of both.
[0068] like Figure 2 As shown, the lattice-based decryption device 200 includes:
[0069] The private key splitting module 201 is configured to obtain a private key s and split the private key s into a first sub-private key s1 and a second sub-private key s2, where s2 = s-s1modq, q is a preset parameter;
[0070] The ciphertext acquisition module 202 is configured to obtain the ciphertext (u, v) and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2;
[0071] The parameter acquisition module 203 is configured based on Get the third decryption parameter m1, and based on Obtain a fourth decryption parameter m2, where d is an integer greater than or equal to 3;
[0072] The plaintext acquisition module 204 is configured based on Get the plaintext m.
[0073] In one implementation of the present disclosure, the decryption method provided in the embodiment of the present disclosure can be applied to decrypt ciphertext encrypted by a Regev encryption algorithm, a lattice encryption algorithm based on the error learning problem, a lattice encryption algorithm based on the error learning problem on a ring, or a lattice encryption algorithm based on the modular error learning problem.
[0074] In one implementation of the present disclosure, the ciphertext can be obtained by encrypting the command generated by the demand-side system master station in the power supply and distribution system, and the command can be a parameter setting command, a load control command, etc. Specifically, when the demand-side system master station (encryption party) needs to issue a command (i.e., plain text, such as a parameter setting command, a load control command, etc.), the corresponding key can be obtained according to the terminal address, and then the key and the data plaintext organized in advance by the master station are used together to encrypt the data plaintext by calling the encryption program, and finally the data ciphertext is packaged into a data message and sent to the corresponding terminal (decryption party). After receiving the ciphertext data, the terminal unpacks the data to obtain the ciphertext. The terminal decrypts the ciphertext through the lattice-based decryption method provided in the embodiment of the present disclosure, and can obtain the command issued by the demand-side system master station.
[0075] In an implementation of the present disclosure, q may be a prime number or a power of 2.
[0076] In one embodiment of the present disclosure, the private key s can be obtained from Z q A vector that satisfies a discrete Gaussian distribution, where Z q is the remainder class ring of modq.
[0077] In one embodiment of the present disclosure, the first sub-private key s1 can be taken from Z q A vector that satisfies uniform random selection.
[0078] In one embodiment of the present disclosure, if the ciphertext is encrypted by a lattice encryption algorithm based on the error learning LWE problem, the private key s and the first sub-private key s1 are both n-dimensional vectors, where n is an integer greater than or equal to 2;
[0079] If the ciphertext is encrypted using a lattice encryption algorithm based on the R-LWE problem of ring error learning, then the private key s and the first child private key s1 are both polynomials of degree n-1;
[0080] If the ciphertext is encrypted by a lattice encryption algorithm based on the modular error learning M-LWE problem, the private key s and the first sub-private key s1 are both k-dimensional vectors, and the elements in the private key s and the first sub-private key s1 are all n-1 degree polynomials, where k is a security parameter.
[0081] In one embodiment of the present disclosure, if the third decryption parameter m1 and the fourth decryption parameter m2 are both integers, the third decryption parameter m1 and the fourth decryption parameter m2 can be substituted into Perform operations to obtain the plaintext m.
[0082] In one embodiment of the present disclosure, if the third decryption parameter m1 is a vector The fourth decryption parameter m2 is a vector Then the elements at the corresponding positions in the third decryption parameter m1 and the fourth decryption parameter m2 can be substituted into Perform operations to obtain the plaintext The elements at the corresponding positions in .
[0083] For example, it can be based on Perform calculations to obtain the plaintext
[0084] In one embodiment of the present disclosure, if the third decryption parameter m1 and the fourth decryption parameter m2 are both polynomials, that is, m1=m 10 +m 11 x+…+m 1n x n , m2=m 20 +m 21 x+…+m 2n x n , the coefficients of the same power terms in the third decryption parameter m1 and the fourth decryption parameter m2 can be substituted into Perform operations to obtain the coefficients of the corresponding power terms in the plaintext m.
[0085] Exemplarily, the plaintext m may be obtained by calculation based on the following formula:
[0086]
[0087] In one embodiment of the present disclosure, if the third decryption parameter m1 and the fourth decryption parameter m2 are both matrices, the matrix elements at the same position in the third decryption parameter m1 and the fourth decryption parameter m2 can be substituted into Perform operations to obtain the matrix elements at the corresponding positions in the plaintext m.
[0088] According to the technical solution provided by the embodiment of the present disclosure, by obtaining a private key s, and splitting the private key s into a first sub-private key s1 and a second sub-private key s2; obtaining a ciphertext (u, v), and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2; based on Get the third decryption parameter m1, and based on Obtain the fourth decryption parameter m2; based on Obtain the plaintext m. The above scheme is relatively simple and does not require multiple modular conversions and multiple addition and subtraction operations, thereby improving the decryption efficiency of the lattice-based ciphertext and reducing the decryption cost.
[0089] The present disclosure also discloses an electronic device, Figure 3 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.
[0090] like Figure 3 As shown, the electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to an embodiment of the present disclosure.
[0091] The present disclosure provides a lattice-based decryption method, including:
[0092] Get the private key s, and split the private key s into the first sub-private key s1 and the second sub-private key s2, where s2 = s-s1modq, q is a preset parameter;
[0093] Get the ciphertext (u,v), and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2;
[0094] based on Get the third decryption parameter m1, and based on Obtain a fourth decryption parameter m2, where d is an integer greater than or equal to 3;
[0095] based on Get the plaintext m.
[0096] In one embodiment of the present disclosure, the private key s is taken from Z q A vector that satisfies a discrete Gaussian distribution, where Z q is the remainder class ring of modq.
[0097] In one embodiment of the present disclosure, the first sub-private key s1 is taken from Z q A vector that satisfies uniform random selection.
[0098] In one embodiment of the present disclosure, if the ciphertext is encrypted by a lattice encryption algorithm based on the error learning LWE problem, the private key s and the first sub-private key s1 are both n-dimensional vectors, where n is an integer greater than or equal to 2;
[0099] If the ciphertext is encrypted using a lattice encryption algorithm based on the R-LWE problem of ring error learning, then the private key s and the first child private key s1 are both polynomials of degree n-1;
[0100] If the ciphertext is encrypted by a lattice encryption algorithm based on the modular error learning M-LWE problem, the private key s and the first sub-private key s1 are both k-dimensional vectors, and the elements in the private key s and the first sub-private key s1 are all n-1 degree polynomials, where k is a security parameter.
[0101] Figure 4 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown.
[0102] like Figure 4 As shown, the computer system includes a processing unit, which can perform the various methods in the above-mentioned embodiments according to the program stored in the read-only memory (ROM) or the program loaded from the storage part into the random access memory (RAM). In the RAM, various programs and data required for the operation of the computer system are also stored. The processing unit, ROM and RAM are connected to each other through a bus. The input / output (I / O) interface is also connected to the bus.
[0103] The following components are connected to the I / O interface: an input part including a keyboard, a mouse, etc.; an output part including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage part including a hard disk, etc.; and a communication part including a network interface card such as a LAN card, a modem, etc. The communication part performs a communication process via a network such as the Internet. The drive is also connected to the I / O interface as needed. Removable media, such as disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on the drive as needed so that the computer program read therefrom is installed into the storage part as needed. Among them, the processing unit can be implemented as a processing unit such as a CPU, a GPU, a TPU, an FPGA, an NPU, etc.
[0104] In particular, according to an embodiment of the present disclosure, the method described above can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the above method. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium.
[0105] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.
[0106] The units or modules involved in the embodiments described in the present disclosure may be implemented by software or programmable hardware. The units or modules described may also be set in a processor, and the names of these units or modules do not constitute limitations on the units or modules themselves in some cases.
[0107] As another aspect, the present disclosure further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the electronic device or computer system in the above embodiment; or a computer-readable storage medium that exists independently and is not assembled into a device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the method described in the present disclosure.
[0108] As another aspect, the present disclosure further provides a chip, which may be a chip included in the electronic device or computer system in the above embodiment; or a chip that exists independently and is not assembled in the electronic device. The chip may include a lattice-based decryption device provided in the embodiment of the present disclosure.
[0109] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present disclosure is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other.
Claims
1. A lattice-based decryption method, characterized in that: include: Get the private key s, and split the private key s into the first sub-private key s1 and the second sub-private key s2, where s2 = s-s1modq, q is a preset parameter; Get the ciphertext (u,v), and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2; based on Get the third decryption parameter m1, and based on Obtain a fourth decryption parameter m2, where d is an integer greater than or equal to 3; based on Get the plaintext m.
2. The method according to claim 1, characterized in that The private key s is taken from Z q A vector that satisfies a discrete Gaussian distribution, where Z q is the remainder class ring of modq.
3. The method according to claim 2, characterized in that The first sub-private key s1 is taken from Z q A vector that satisfies uniform random selection.
4. The method according to claim 3, characterized in that If the ciphertext is encrypted by a lattice encryption algorithm based on the error learning LWE problem, the private key s and the first sub-private key s1 are both n-dimensional vectors, where n is an integer greater than or equal to 2; If the ciphertext is encrypted using a lattice encryption algorithm based on the ring error learning R-LWE problem, the private key s and the first sub-private key s1 are both polynomials of degree n-1; If the ciphertext is encrypted using a lattice encryption algorithm based on the modular error learning M-LWE problem, the private key s and the first sub-private key s1 are both k-dimensional vectors, and the elements in the private key s and the first sub-private key s1 are both n-1 degree polynomials, where k is a security parameter.
5. A lattice-based decryption device, characterized in that: include: The private key splitting module is configured to obtain a private key s and split the private key s into a first sub-private key s1 and a second sub-private key s2, wherein s2 = s-s1modq, q is a preset parameter; The ciphertext acquisition module is configured to obtain the ciphertext (u, v) and based on w1=v-s1 T umodq obtains the first decryption parameter w1, based on w2=-s2 T umodq obtains the second decryption parameter w2; The parameter acquisition module is configured based on Get the third decryption parameter m1, and based on Obtain a fourth decryption parameter m2, where d is an integer greater than or equal to 3; The plaintext acquisition module is configured based on Get the plaintext m.
6. The device according to claim 5, characterized in that The private key s is taken from Z q A vector that satisfies a discrete Gaussian distribution, where Z q is the remainder class ring of modq.
7. The device according to claim 6, characterized in that The first sub-private key s1 is taken from Z q A vector that satisfies uniform random selection.
8. The device according to claim 7, characterized in that If the ciphertext is encrypted by a lattice encryption algorithm based on the error learning LWE problem, the private key s and the first sub-private key s1 are both n-dimensional vectors, where n is an integer greater than or equal to 2; If the ciphertext is encrypted using a lattice encryption algorithm based on the ring error learning R-LWE problem, the private key s and the first sub-private key s1 are both polynomials of degree n-1; If the ciphertext is encrypted using a lattice encryption algorithm based on the modular error learning M-LWE problem, the private key s and the first sub-private key s1 are both k-dimensional vectors, and the elements in the private key s and the first sub-private key s1 are both n-1 degree polynomials, where k is a security parameter.
9. An electronic device, characterized in that: The method comprises a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method steps described in any one of claims 1 to 4.
10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the method steps of any one of claims 1 to 4 are implemented.
11. A chip, characterized in that: The chip comprises the lattice-based decryption device according to any one of claims 5-8.