On-lattice session key negotiation generation method based on password

Abstract

The invention provides an on-lattice concise password session key negotiation generation method. A user is allowed to use a password to negotiate a session key with a server and authenticate the identity of the user. The protocol is constructed based on an ideal lattice, so that the security of the protocol is established on a learning problem with errors on a ring, and quantum attacks can be effectively resisted. The password and the identity of the user are stored in the server side. During session key negotiation, the temporary public key is encrypted by using the password, so that the server can confirm the identity of the user. If the opponent has no password, even if the opponent obtains all information transmitted in the protocol, the opponent cannot obtain the temporary public key of the user to negotiate the session key. Thus, the protocol can resist impersonation attacks. In addition, the protocol adopts bidirectional key confirmation to ensure the consistency of session keys.

Description

Technical Field

[0001] The invention belongs to the field of information security technology, and in particular relates to a concise password session key negotiation generation technology on a lattice. Background Art

[0002] In the era of big data, cloud storage has become a vital service. With the help of cloud servers, users can store, retrieve, and share large amounts of data flexibly and conveniently. Cloud storage services have become an indispensable service for individuals and businesses. Despite these advantages, users' concerns about security, especially unauthorized access, have greatly increased. It is of great significance to ensure that only authorized users can store and access sensitive information.

[0003] Session key negotiation is a feasible solution to the above problems, which can provide both user authentication and session key negotiation. The former ensures that only legitimate users can access data, and the latter allows the establishment of session keys to protect the messages communicated between users and cloud servers. Specifically, during the registration process, the user selects a specific authentication factor, and the service provider stores the credentials of the authentication factor. When the user attempts to access the cloud storage service, she / he will provide the authentication factor. Only when the factor matches the stored credentials can the cloud server ensure the legitimacy of the user. In addition, the user and the cloud server will obtain a shared session key that can be used to encrypt the data communicated during service access. In session key negotiation, the authentication factor can be a password, a biometric feature, or a key. Among the three authentication factors, the password is the most widely used due to its simplicity and ease of operation. Password-based session key agreement (PAKE) allows users to perform identity authentication and session key negotiation based on a memorable password, which can effectively balance usability and security.

[0004] However, most existing PAKE protocols are constructed based on traditional difficult assumptions (e.g., discrete logarithm problems or large integer factorization), which are vulnerable to quantum attacks. Adversaries can use quantum computers to crack the security of the PAKE protocol. The present invention constructs a lattice-secure concise password session key negotiation generation method protocol on an ideal lattice based on the RLWE difficulty problem, which can effectively resist the attack of quantum computers. Summary of the invention

[0005] The problem to be solved by the present invention is to provide a method for generating a concise password session key negotiation on a lattice.

[0006] The technical solution adopted by the present invention to solve the above-mentioned problem is a concise password session key negotiation generation method on a lattice, characterized in that a protocol is constructed on an ideal lattice based on the RLWE difficulty problem to resist quantum attacks, a password is used to confirm the identity to resist attacks by imposters, and two-way key confirmation is used to ensure the consistency of the session key, and specifically includes the following steps:

[0007] System initialization phase: Initialize the system according to security parameters and determine the system's public parameters; users and servers select corresponding numbers uid and sid;

[0008] Registration stage:

[0009] (1) The user generates a user password pw;

[0010] (2) The user sends the user ID uid, server ID sid and user password pw to the server

[0011] (3) The server stores the user number uid and the server number sid in its security database.

[0012] Key negotiation phase:

[0013] (1) The user first randomly selects a seed and then uses the seed to generate vector a;

[0014] (2) The user randomly selects the user's temporary private key and disturbance Based on the RLWE difficulty problem, the user's temporary private key is used and disturbance Calculated user temporary public key Then use the password pw to encrypt the user's temporary public key Get the ciphertext C, and then send both seed and C to the server;

[0015] (3) After receiving seed and C, the server generates vector a based on seed and uses password pw to decrypt ciphertext C to obtain the decrypted user temporary public key

[0016] (4) The server randomly selects the server temporary private key and disturbance Using the server's temporary private key based on the RLWE difficulty problem and disturbance Calculate temporary public key

[0017] (5) The server uses the user's temporary public key to decrypt and the server's temporary private key Compute pre-key material Based on the pre-key material Get signal value Send server temporary public key and signal value To the user, and based on the server's temporary public key and signal value Calculate the server pre-key

[0018] (6) The user uses the temporary public key received from the server and signal value Compute pre-key material User Reuse For signal value Perform error elimination to obtain the user pre-key

[0019] (7) The user uses the user pre-key User temporary public key Server temporary public key The user number uid and the server number sid calculate the user key confirmation value σ1, and send σ1 to the server;

[0020] (8) The server uses the server pre-key Decrypted user temporary public key Server temporary public key The user number uid and the server number sid calculate the user temporary key confirmation value, and determine whether the received σ1 is equal to the user temporary key confirmation value. If so, use the server pre-key

[0021] Decrypted user temporary public key Server temporary public key The user number uid and the server number sid are used to calculate the server key confirmation value σ2 and the server-side session key And send σ2 to the user; if not, the session key negotiation fails;

[0022] (9) The user pre-keys User temporary public key Server temporary public key The user number uid and the server number sid calculate the server temporary key confirmation value, and determine whether the received server key confirmation value σ2 is equal to the server temporary key confirmation value. If so, use the user pre-key User temporary public key Server temporary public key The user ID uid and server ID sid generate the client session key The session key negotiation is completed. If not, the session key negotiation fails.

[0023] The present invention provides a concise password session key negotiation generation method on a lattice, which allows a user to use a password to negotiate a session key with a server and authenticate the user's identity. The protocol is constructed based on an ideal lattice, so that its security is established on a ring learning problem with errors (RLWE), and can effectively resist quantum attacks. The protocol stores the user's identity and password on the server side. When establishing a session key, the password is used to encrypt the user's temporary public key to confirm the server's identity. If the adversary does not have the password, even if he can obtain all the traffic in the protocol, he cannot obtain the correct user's temporary public key and use it to negotiate a session key. Therefore, the protocol can resist attacks by imposters. In addition, the protocol uses two-way key confirmation to ensure the consistency of the session key and verify the user's identity at the same time.

[0024] The beneficial effects of the present invention are as follows: a concise password session key negotiation generation method on a lattice is designed based on the RLWE difficulty problem, which can effectively resist quantum attacks; a user's temporary public key is encrypted with a password to resist imposter attacks and the session key is negotiated in combination with session key exchange; and two-way key confirmation is used to ensure the consistency of the session key. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A schematic diagram of the registration phase of a concise password session key negotiation generation method on a grid in the present invention;

[0026] Figure 2 It is a schematic diagram of the login phase of a concise password session key negotiation generation method on a grid in the present invention. DETAILED DESCRIPTION

[0027] (I) System initialization phase

[0028] Determine the system common parameter set based on security parameters Where n is a power of 2, q is an odd prime number; R q is a polynomial residue class ring modulo q, x is an element in the remainder class ring; the set gather Indicates rounding down. Indicates rounding to the nearest integer; Gen_a is the generating function of the coefficient vector a using a seed generating polynomial, where each element a in vector a i Uniformly randomly selected from 0 to q-1; Sig satisfies signal function, v is the element of the input signal function; Mod2 is the error elimination function, satisfying b is the weight value; if the element v is expressed by its polynomial coefficient (v0, v1, …, v n-1 ) and there exists a weight value vector b=(b0,b1,…,b n-1 )∈{0,1} n , n represents the dimension, then Sig(v)=(Sig(v0),…,Sig(v n-1 ))and

[0029] Mod2(v,b)=(Mod2(v0,b0),…,Mod2(v n-1 ,b n-1 )); Enc / Dec is a symmetric encryption / decryption algorithm, is an n-dimensional integer vector space For any variable, a discrete Gaussian distribution with a variance of 0 and a standard deviation of σ>0 is satisfy t is the cumulative variable; χ α is a discrete Gaussian distribution, where α is a positive real number; H and H ′ All are hash functions, H:{0,1} * →{0,1} κ and H ′ :{0,1} * →{0,1} κ , where κ is the length of the session key and * indicates any length.

[0030] (ii) Registration stage, such as Figure 1 As shown:

[0031] (1) User Generate a user password pw;

[0032] (2) User Send user ID uid, server ID sid and user password pw to the server

[0033] (3) Server Stores {uid,pw} in its secure database.

[0034] (III) Key negotiation phase, such as Figure 2 As shown:

[0035] (1) User First, randomly select a seed seed∈{0,1} N Then use seed to generate a=Gen_a(seed), where N is the length of the seed;

[0036] (2) User Randomly select a user's temporary private key and disturbance Calculate the user's temporary public key Then encrypt with the password pw Get the ciphertext Then send both seed and C to the server ← r Indicates the selection of real numbers;

[0037] (3) After receiving seed and C, the server generates a=Gen_a(seed) based on seed, and uses the password pw to decrypt the ciphertext C to obtain

[0038] (4) The server randomly selects the server temporary private key and disturbance Calculate the server's temporary public key

[0039] (5) The server calculates the server pre-key material and signal value Then send the server temporary public key and signal value For the user, the server calculates the pre-key

[0040] (6) The user receives the server's temporary public key and signal value After that, calculate the user pre-key material User Perform error elimination to obtain the pre-key

[0041] (7) The user calculates the user key confirmation value and send it to the server;

[0042] (8) After receiving σ1, the server calculates the user's temporary key confirmation value

[0043] Determine whether σ1 is equal to If they are not equal, set the server key confirmation value σ2 = ⊥, the server session key Otherwise calculate and the server-side session key

[0044] Then send σ2 to the user;

[0045] (9) After receiving σ2, the user calculates the server's temporary key confirmation value

[0046] Determine whether σ2 is equal to

[0047] If not equal, set Otherwise set the client session key

[0048]

[0049] The password-based session key negotiation generation method is usually constructed based on traditional difficult problems and is vulnerable to attacks by quantum computers. In order to resist quantum attacks, the present invention provides a simple password session key negotiation generation method on a lattice and introduces the protocol in detail. This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A method for generating a concise password session key agreement on a lattice, characterized in that: The following steps are involved: System initialization phase: Initialize the system according to security parameters and determine the system's public parameters; users and servers select corresponding numbers uid and sid; Registration stage: (1) The user generates a user password pw; (2) The user sends the user ID uid, server ID sid and user password pw to the server (3) The server stores the user number uid and the server number sid in its security database. Key negotiation phase: (1) The user first randomly selects a seed and then uses the seed to generate vector a; (2) The user randomly selects the user's temporary private key and disturbance Based on the RLWE difficulty problem, the user's temporary private key is used and disturbance Calculated user temporary public key Then use the password pw to encrypt the user's temporary public key Get the ciphertext C, and then send both seed and C to the server; (3) After receiving seed and C, the server generates vector a based on seed and uses password pw to decrypt ciphertext C to obtain the decrypted user temporary public key (4) The server randomly selects the server temporary private key and disturbance Using the server's temporary private key based on the RLWE difficulty problem and disturbance Calculate temporary public key (5) The server uses the user's temporary public key to decrypt And the server temporary private key Compute pre-key material Based on the pre-key material Get signal value Send server temporary public key and signal value To the user, and based on the server's temporary public key and signal value Calculate the server pre-key (6) The user uses the temporary public key received from the server and signal value Compute pre-key material User Reuse For signal value Perform error elimination to obtain the user pre-key (7) The user uses the user pre-key User temporary public key Server temporary public key The user number uid and the server number sid calculate the user key confirmation value σ1, and send σ1 to the server; (8) The server uses the server pre-key Decrypted user temporary public key Server temporary public key The user number uid and the server number sid calculate the user temporary key confirmation value, and determine whether the received σ1 is equal to the user temporary key confirmation value. If so, use the server pre-key Decrypted user temporary public key Server temporary public key The user number uid and the server number sid are used to calculate the server key confirmation value σ2 and the server-side session key And send σ2 to the user; if not, the session key negotiation fails; (9) The user pre-keys User temporary public key Server temporary public key The user number uid and the server number sid calculate the server temporary key confirmation value, and determine whether the received server key confirmation value σ2 is equal to the server temporary key confirmation value. If so, use the user pre-key User temporary public key Server temporary public key The user ID uid and server ID sid generate the client session key The session key negotiation is completed. If not, the session key negotiation fails.

2. The method according to claim 1, characterized in that: The specific steps of the system initialization phase are: Determine the system common parameter set based on the security parameters Where n is a power of 2, q is an odd prime number; R q is a polynomial residue class ring modulo q, x is an element in the remainder class ring; the set gather Indicates rounding down. Indicates rounding; Gen_a is the generating function of the coefficient vector a using a seed generating polynomial, where each element a in vector a i Uniformly randomly selected from 0 to q-1; Sig satisfies signal function, v is the element of the input signal function; Mod2 is the error elimination function, satisfying b is the weight value; Enc / Dec is the symmetric encryption / decryption algorithm, is an n-dimensional integer vector space For any variable, a discrete Gaussian distribution with a variance of 0 and a standard deviation of σ>0 is satisfy t is the cumulative variable; χ α is a discrete Gaussian distribution, Where α is a positive real number; H and H′ are both hash functions, H:{0,1} * →{0,1} k and H′:{0,1} * →{0,1} κ , where κ is the length of the session key and * indicates any length.

3. The method according to claim 2, characterized in that: The element v is expressed by its polynomial coefficients (v0,v1,…,v n-1 ) and there exists a weight value vector b=(b0,b1,…,b n-1 )∈{0,1} n , n represents the dimension, then Sig(v)=(Sig(v0),…,Sig(v n-1 )), Mod2(v,b)=(Mod2(v0,b0),…,Mod2(v n-1 ,b n-1 ))。 4. The method according to claim 3, characterized in that: The specific steps of the login phase are as follows: (1) User First, randomly select a seed seed∈{0,1} N Then use seed to generate a=Gen_a(seed), where N is the length of the seed; (2) User Randomly select a user's temporary private key and disturbance Calculate the user's temporary public key Then encrypt with the password pw Get the ciphertext Then send both seed and C to the server ← r Indicates the selection of real numbers; (3) After receiving seed and C, the server generates a=Gen_a(seed) based on seed, and uses the password pw to decrypt the ciphertext C to obtain (4) The server randomly selects the server temporary private key and disturbance Calculate the server's temporary public key (5) The server calculates the server pre-key material and signal value Then send the server temporary public key and signal value For the user, the server calculates the pre-key (6) The user receives the server's temporary public key and signal value After that, calculate the user pre-key material User Perform error elimination to obtain the pre-key (7) The user calculates the user key confirmation value and send it to the server; (8) After receiving σ1, the server calculates the user's temporary key confirmation value Determine whether σ1 is equal to If they are not equal, set the server key confirmation value σ2 = ⊥, the server session key Otherwise calculate and the server-side session key Then send σ2 to the user; (9) After receiving σ2, the user calculates the server's temporary key confirmation value Determine whether σ2 is equal to If not equal, set Otherwise set the client session key

Images