A password-based session key agreement generation method on a lattice

Abstract

The application provides a simple password session key agreement generation method on a lattice, which allows a user to use a password to agree with a server on a session key and authenticate the user identity. The protocol is constructed based on an ideal lattice, and its security is established on a ring with an error learning problem, so that the protocol can effectively resist quantum attacks. The password and identity of the user are stored on the server side. During the session key agreement, the password is used to encrypt a temporary public key, so that the server can confirm the user identity. If an enemy does not have the password, even if he obtains all the information of the transmission in the protocol, he cannot obtain the temporary public key of the user to agree on the session key. Therefore, the protocol can resist impersonation attacks. In addition, the protocol uses two-way key confirmation to ensure the consistency of the session key.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and particularly relates to a simple password session key agreement generation technology on a lattice. BACKGROUND

[0002] In the era of big data, cloud storage has become a vital service. With the help of cloud servers, users can store, retrieve, and share large amounts of data flexibly and conveniently. Cloud storage services have become indispensable for individuals and businesses. Despite these advantages, users' concerns about security, especially unauthorized access, have increased significantly. It is of great significance to ensure that only authorized users can store and access sensitive information.

[0003] Session key agreement is a feasible solution to the above problems, which can provide both user authentication and session key agreement functions. The former ensures that only legitimate users can access data, and the latter allows the establishment of a session key to protect the messages communicated between the user and the cloud server. Specifically, during the registration process, the user selects a specific authentication factor, and the service provider stores the credentials of the authentication factor. When the user tries to access the cloud storage service, he / she will provide the authentication factor. Only when the factor matches the stored credentials, the cloud server can ensure the legitimacy of the user. In addition, the user and the cloud server will obtain a shared session key that can be used to encrypt the data communicated during service access. In the session key agreement, the authentication factor can be a password, a biometric feature, or a key. Among the three authentication factors, passwords are most widely used due to their simple and easy-to-operate characteristics. Password-based session key agreement (PAKE) allows users to perform identity authentication and session key agreement based on a memorable password, which can effectively balance usability and security.

[0004] However, most existing PAKE protocols are constructed based on traditional difficult assumptions (e.g., discrete logarithm problem or large integer factorization), which are vulnerable to quantum attacks. An adversary can use a quantum computer to break the security of the PAKE protocol. The present application constructs a lattice-based secure simple password session key agreement generation method protocol based on the RLWE difficult problem on the ideal lattice, which can effectively resist attacks by quantum computers. SUMMARY

[0005] The problem to be solved by the present application is to provide a simple password session key agreement generation method on a lattice.

[0006] The application discloses a simple password session key agreement generation method on a lattice, and is characterized in that: a protocol is constructed on an ideal lattice based on an RLWE difficult problem to resist quantum attacks, a password is used to confirm identity to resist impersonation attacks, and bidirectional key confirmation is adopted to ensure the consistency of a session key, and the method specifically comprises the following steps:

[0007] System initialization stage: system initialization is performed according to security parameters, and public parameters of the system are determined; a user and a server select corresponding numbers uid and sid;

[0008] Registration stage:

[0009] (1) a user generates a user password pw;

[0010] (2) the user sends a user number uid, a server number sid and the user password pw to the server

[0011] (3) the server stores the user number uid and the server number sid in a secure database thereof.

[0012] Key agreement stage:

[0013] (1) the user first randomly selects a seed seed, and then generates a vector a by using the seed;

[0014] (2) the user randomly selects a user temporary private key and a disturbance a user temporary public key is calculated based on an RLWE difficult problem by using the user temporary private key and the disturbance Then, the user temporary public key is encrypted by using the password pw to obtain a ciphertext C, and then the seed and C are sent to the server;

[0015] (3) after receiving the seed and C, the server generates the vector a according to the seed, and decrypts the ciphertext C by using the password pw to obtain a decrypted user temporary public key

[0016] (4) the server randomly selects a server temporary private key and a disturbance a temporary public key is calculated based on an RLWE difficult problem by using the server temporary private key and the disturbance

[0017] (5) the server calculates a session key K by using the decrypted user temporary public key and the server temporary private key Computing pre-key material Further based on the pre-key material Obtaining signal value Sending server temporary public key And signal value To the user, and according to the server temporary public key And signal value Computing server pre-key

[0018] (6) The user uses the received server temporary public key And signal value Computing pre-key material The user further uses Error elimination processing on the signal value Obtaining user pre-key

[0019] (7) The user uses the user pre-key User temporary public key Server temporary public key User number uid and server number sid to calculate user key confirmation value σ1, and send σ1 to the server;

[0020] (8) The server uses the server pre-key Decrypted user temporary public key Server temporary public key User number uid and server number sid to calculate user temporary key confirmation value, judge whether the received σ1 is equal to the user temporary key confirmation value, if yes, use the server pre-key

[0021] Decrypted user temporary public key Server temporary public key User number uid and server number sid to calculate server key confirmation value σ2 and server session key And send σ2 to the user; if not, the session key negotiation fails;

[0022] (9) The user uses the user pre-key User temporary public key Server temporary public key User number uid and server number sid to calculate server temporary key confirmation value, judge whether the received server key confirmation value σ2 is equal to the server temporary key confirmation value, if yes, use the user pre-key User temporary public key Server temporary public key User number uid and server number sid to generate user session key Session key agreement is completed, no, session key agreement fails.

[0023] The application provides a simple password session key agreement generation method on a lattice, which allows a user to use a password to negotiate a session key with a server and authenticate the user identity. The protocol is constructed based on an ideal lattice, and the security is established on a ring with an error learning problem (RLWE), so that the protocol can effectively resist quantum attacks. The identity and password of the user are stored on the server side, and when the session key is established, the password is used to encrypt the user's temporary public key to confirm the server identity. In addition, the protocol uses two-way key confirmation to ensure the consistency of the session key and verify the user identity at the same time.

[0024] The application has the beneficial effects that: a simple password session key agreement generation method on a lattice is designed based on the RLWE difficult problem, which can effectively resist quantum attacks; the password is used to encrypt the user's temporary public key to resist impersonation attacks and combine the session key exchange to negotiate the session key; and two-way key confirmation is used to ensure the consistency of the session key. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 The application provides a simple password session key agreement generation method on a lattice, which allows a user to use a password to negotiate a session key with a server and authenticate the user identity.

[0026] Figure 2 The application provides a simple password session key agreement generation method on a lattice, which allows a user to use a password to negotiate a session key with a server and authenticate the user identity. DETAILED DESCRIPTION

[0027] (I) System initialization stage

[0028] Determine the system public parameter set according to the security parameters Wherein, n is a power of 2, q is an odd prime number; R q is a polynomial ring modulo q, x is an element in the residue class ring; Set Set represents the floor, represents the rounding integer; Gen_a is a generation function for generating a polynomial coefficient vector a using a seed, wherein each element a i is randomly selected from 0 to q-1; Sig is a signal function satisfying , v is an element input to the signal function; Mod2 is an error elimination function satisfying b is the weight value; if element v uses its polynomial coefficients (v0, v1, ..., v...), then b is the weight value. n-1 The representation is given by the fact that there exists a weight value vector b = (b0, b1, ..., b...). n-1 )∈{0,1} n Let n represent the dimension, then Sig(v) = (Sig(v0), ..., Sig(v...)). n-1 ))and

[0029] Mod2(v,b)=(Mod2(v0,b0),…,Mod2(v n-1 ,b n-1 Enc / Dec are symmetric encryption / decryption algorithms. It is an n-dimensional integer vector space A discrete Gaussian distribution with a variance of 0 and a standard deviation of σ>0, for any variable satisfy t is the cumulative variable; χ α It is a discrete Gaussian distribution. Where α is a positive real number; H and H ′ All are hash functions, H:{0,1} * →{0,1} κ and H ′ :{0,1} * →{0,1} κ , where κ is the length of the session key, and * indicates any length.

[0030] (ii) Registration stage, such as Figure 1 As shown:

[0031] (1) User Generate a user password pw;

[0032] (2) User Send user ID (uid), server ID (sid), and user password (pw) to the server.

[0033] (3) Server It stores {uid,pw} in its secure database.

[0034] (III) Key negotiation phase, such as Figure 2 As shown:

[0035] (1) User First, randomly select a seed ∈ {0,1}. N Then, use seed to generate a = Gen_a(seed), where N is the length of the seed;

[0036] (2) User Randomly select a user ephemeral private key and a perturbation Compute a user ephemeral public key Then encrypt using password pw Get ciphertext Then send seed and C to the server ← r denotes choosing a real number;

[0037] (3) After the server receives seed and C, it generates a = Gen_a(seed) according to seed, and decrypts ciphertext C using password pw to get

[0038] (4) The server randomly selects a server ephemeral private key and a perturbation Compute a server ephemeral public key

[0039] (5) The server computes server pre-key material and a signal value Then send the server ephemeral public key and the signal value to the user, and the server computes the pre-key

[0040] (6) After the user receives the server ephemeral public key and the signal value , compute the user pre-key material The user error-corrects to get the pre-key

[0041] (7) The user computes the user key confirmation value and sends it to the server;

[0042] (8) After the server receives σ1, it computes the user ephemeral key confirmation value

[0043] Judge whether σ1 is equal to If not, set the server key confirmation value σ2 = ⊥, the server session key Otherwise, compute and the server session key

[0044] Then send σ2 to the user;

[0045] (9) After the user receives σ2, it computes the server ephemeral key confirmation value

[0046] determine whether sigma2 is equal to

[0047] if not, set else set the user session key

[0048]

[0049] The password-based session key agreement generation method is usually constructed based on traditional difficult problems, and is vulnerable to quantum computer attacks. In order to resist quantum attacks, the present application provides a simple password session key agreement generation method on a lattice and introduces the protocol in detail. The principles and implementation modes of the present application are described by applying specific examples. The above examples are only used to help understand the method of the present application and its core idea. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, the present application can be improved and modified in several ways, and these improvements and modifications also fall within the protection scope of the claims of the present application.

Claims

1. A method for generating a simple password session key agreement on a lattice, characterized by, The steps include: System initialization stage: system initialization according to security parameters, determining the public parameters of the system; user and server select corresponding number uid and sid; Registration stage: (1) The user generates a user password pw; (2) The user sends the user number uid, the server number sid and the user password pw to the server (3) The server stores the user number uid and the server number sid in its security database; Key agreement stage: (1) The user first randomly selects a seed seed, and then uses seed to generate vector a; (2) User randomly selects a user temporary private key and perturbation Based on the RLWE difficult problem, the user temporary private key is used and perturbation The user temporary public key calculated Then the user temporary public key is encrypted using the password pw Get the ciphertext C, and then send the seed and C to the server; (3) After receiving the seed and C, the server generates the vector a according to the seed, and decrypts the ciphertext C using the password pw to obtain the decrypted user temporary public key (4) The server randomly selects a server temporary private key and perturbations Based on the RLWE hard problem, the server temporary private key is utilized and perturbations The temporary public key is calculated (5) The server computes a pre-key material using the decrypted user temporary public key and the server temporary private key ​​​​​​​​ (6) The user utilizes the received server temporary public key and the signal value to calculate the pre-key material The user re-uses the signal value to perform error correction processing to obtain the user pre-key (7) The user calculates a user key confirmation value σ1 based on the user pre-key and the server pre-key, and sends σ1 to the server. User temporary public key Server temporary public key The user calculates a user key confirmation value σ1 based on the user pre-key and the server pre-key, and sends σ1 to the server. (8) The server decrypts the user temporary public key using the server pre- key The decrypted user temporary public key The server temporary public key The user number uid and the server number sid are used to calculate a user temporary key confirmation value σ1, and it is determined whether the received σ1 is equal to the user temporary key confirmation value. If yes, the server pre-key is used to decrypt the server temporary public key The decrypted user temporary public key The server temporary public key The user number uid and the server number sid are used to calculate a server key confirmation value σ2 and a server session key and σ2 is sent to the user; if no, the session key negotiation fails. (9) The user calculates the server temporary key confirmation value according to the user pre-key User temporary public key Server temporary public key The user number uid and the server number sid calculate the server temporary key confirmation value, judge whether the received server key confirmation value σ2 is equal to the server temporary key confirmation value, if yes, use the user pre-key User temporary public key Server temporary public key The user number uid and the server number sid generate the user end session key The session key negotiation is completed, if not, the session key negotiation fails.

2. The method of claim 1, wherein, The specific steps of the system initialization stage are: determining a system public parameter set according to a security parameter wherein n is a power of 2, q is an odd prime number; R q is a polynomial residue class ring modulo q, x is an element in the residue class ring; the set the set represents rounding down, represents rounding up; Gen_a is a generating function of a coefficient vector a of a seed generating polynomial, wherein each element a i in the vector a is randomly selected uniformly between 0 and q-1; Sig is a signal function satisfying , v is an element input into the signal function; Mod2 is an error elimination function satisfying b is a weight value; Enc / Dec is a symmetric encryption / decryption algorithm, is an n-dimensional integer vector space with a discrete Gaussian distribution with a mean of 0 and a standard deviation of σ>0, for any variable satisfying t is an accumulated variable; χ α is a discrete Gaussian distribution, wherein α is a positive real number; H and H' are both hash functions, H:{0,1} * →{0,1} k and H':{0,1} * →{0,1} κ , wherein κ is the length of a session key, and * represents any length.

3. The method of claim 2, wherein, The element v is represented by its polynomial coefficients (v0, v1, ..., v). n-1 The representation is given by the fact that there exists a weight value vector b = (b0, b1, ..., b...). n-1 )∈{0,1} n Let n represent the dimension, then Sig(v) = (Sig(v0), ..., Sig(v...)). n-1 )), Mod2(v, b) = (Mod2(v0, b0),..., Mod2(v n-1 ,b n-1 )).

4. The method of claim 3, wherein, The specific steps of the login stage are as follows: (1) User First, randomly select a seed seed ∈ {0, 1} N Then use seed to generate a = Gen_a(seed), N is the length of seed (2) User Randomly select user ephemeral private key And perturb Compute user ephemeral public key Then encrypt with password pw Get ciphertext Then send both seed and C to server ← r Indicates that a real number is selected; (3) After the server receives the seed and C, it generates a = Gen_a(seed) according to the seed, and decrypts the ciphertext C using the password pw to obtain (4) The server randomly selects a server temporary private key and perturbations computes a server temporary public key (5) Server computes server pre-key material and signal value Post-send server ephemeral public key and signal value To user, server computes pre-key (6) The user receives the server's temporary public key and the signal value The user then computes the user pre-key material The user applies error correction to the pre-key material to obtain the pre-key (7) the user calculates a user key confirmation value and sends it to the server; (8) The server, upon receipt of σ1, computes the user temporary key confirmation value determines whether σ1 is equal to If not, sets the server key confirmation value σ2 = ⊥, the server-side session key Otherwise computes and the server-side session key and sends σ2 to the user; (9) The user, upon receipt of σ2, computes the server ephemeral key confirmation value Determine if σ2 is equal to If not, set Otherwise set the user end session key

Images