Quantum-attack-resistant secret key generation and decryption method, device, system and equipment

Abstract

The invention discloses an anti-quantum-attack key generation and decryption method, device, system and equipment, which are used for improving the security of a key, reducing or avoiding the risk of key leakage, simplifying the generation, publishing and use processes of the key and improving the usability and maintainability of a key system. The method provided by the invention comprises the following steps: determining a first part of public keys; determining a first parameter for generating a second part of public key based on the first part of public key; and sending the first part of public key and the first parameter for generating the second part of public key to a first terminal, so that the first terminal generates the second part of public key.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a quantum attack-resistant key generation and decryption method, device, system, and equipment. Background Art

[0002] The ML-KEM algorithm is a quantum-resistant cryptographic algorithm. ML-KEM is a public key encryption and key encapsulation algorithm standardized in the FIPS203 standard. This algorithm is a standardized version of Kyber, the final algorithm of the post-quantum cryptography project of the National Institute of Standards and Technology (NIST).

[0003] In order to solve the problem of key security protection, existing technologies usually deploy cryptographic algorithms in a secure environment to reduce the risk of private key leakage. However, although existing technologies deploy cryptographic algorithms in a secure environment, these technologies still have the risk of single point failure. For example, the emergence of quantum computers significantly reduces the computational cost of cracking such keys, threatening the security of existing cryptographic systems. Once a security environment is breached or fails, the key may be leaked or damaged, which in turn destroys the security of the entire encryption system. Summary of the invention

[0004] The embodiments of the present application provide a quantum-attack-resistant key generation and decryption method, apparatus, system, and device to improve key security, reduce or avoid the risk of key leakage, simplify the key generation, publication, and use processes, and improve the usability and maintainability of the key system.

[0005] An embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to a server side. The method includes:

[0006] Determine the first part of the public key;

[0007] Based on the first partial public key, determining a first parameter for generating a second partial public key;

[0008] The first partial public key and the first parameter for generating the second partial public key are sent to a first terminal, so that the first terminal generates the second partial public key.

[0009] The embodiment of the present application uses a quantum attack-resistant key generation method provided by the server side to determine the first part of the public key on the server side, and based on the first part of the public key, further determine the first parameter for generating the second part of the public key, and send the first part of the public key and the first parameter for generating the second part of the public key to the first terminal, so that the first terminal generates the second part of the public key, and realizes the collaborative generation of keys by the server and the terminal, so that the key generation and storage mechanism is more flexibly distributed, avoiding security problems caused by single key leakage or storage node failure, and improving the fault tolerance and overall reliability of the system; ensuring that the system still has high security in the era of quantum computing; and, the embodiment of the present application realizes a more rigorous key segmentation and collaborative computing mechanism, enhances the private key protection capability in multi-party participation scenarios, reduces the overall key leakage risk caused by single party leakage, and ensures that the decryption operation can only be completed with the joint participation of both parties; and, the embodiment of the present application realizes a more optimized key segmentation and collaborative computing process, reduces the complexity and management cost of the system, simplifies the key generation, distribution and use process, and improves the ease of use and maintainability of the system.

[0010] In some embodiments, determining the first portion of the public key includes:

[0011] Get a random number of the preset number of bytes input;

[0012] The random number is used as a seed, and a first part of a public key is generated according to the seed and a preset matrix order.

[0013] Therefore, in the embodiment of the present application, the server side can generate the first part of the public key of the server side based on a random number of a preset number of bytes and a preset matrix order.

[0014] In some embodiments, based on the first partial public key, determining a first parameter for generating a second partial public key includes:

[0015] Generate a public key matrix according to the first part of the public key;

[0016] determining a first partial private key and a first random error vector for storage in the server side;

[0017] A first parameter for generating a second partial public key is determined according to the public key matrix, the first partial private key and the first random error vector.

[0018] Therefore, in the embodiment of the present application, the server side can determine the parameters for generating the second part of the public key based on the first part of the public key, the first part of the private key and the first random error vector on the server side, so as to facilitate the subsequent generation of the second part of the public key by the server side and the terminal side.

[0019] In some embodiments, the method further comprises:

[0020] Determine the second part of the public key;

[0021] Determine the public key of the server side by using the first part of the public key and the second part of the public key;

[0022] Comparing whether the public key on the server side is the same as the public key published by the first terminal;

[0023] When it is determined that the public key on the server side is different from the public key published by the first terminal, a process of regenerating the public key is triggered.

[0024] Therefore, the embodiment of the present application compares the public key on the server side with the public key published by the first terminal, and when the two are different, it can trigger the process of regenerating the public key, thereby avoiding the error situation that the public key on the server side is inconsistent with the public key published by the first terminal.

[0025] In some embodiments, determining the second partial public key includes:

[0026] Receiving a second parameter sent by the first terminal for generating a second partial public key;

[0027] The second part of the public key on the server side is generated using the first parameter and the second parameter; wherein the second part of the public key on the server side is generated in the same manner as the second part of the public key on the first terminal side.

[0028] Therefore, the embodiment of the present application generates the second part of the public key in the same way on the server side and the first terminal side, which can ensure that the public key generated on the server side is the same as the public key published by the first terminal, avoiding the error situation that the public key on the server side is inconsistent with the public key published by the first terminal.

[0029] Accordingly, an embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to a terminal side, and the method includes:

[0030] Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server side, and determining a second parameter for generating the second partial public key according to the first partial public key sent by the server side;

[0031] Generate a second part of the public key of the terminal side by using the first parameter and the second parameter;

[0032] The public key is obtained and published through the first part of the public key and the second part of the public key on the terminal side.

[0033] Similar to the server-side quantum attack-resistant key generation method provided in the above-mentioned embodiment of the present application, the quantum attack-resistant key generation method applied to the terminal side provided in the above-mentioned embodiment of the present application realizes the method of collaboratively generating keys through the server and the terminal, so that the key generation and storage mechanism is more flexibly distributed, avoiding security issues caused by single key leakage or storage node failure, and improving the fault tolerance and overall reliability of the system; ensuring that the system still has high security in the era of quantum computing; and, the embodiment of the present application realizes a more rigorous key segmentation and collaborative computing mechanism, enhances the private key protection capability in multi-party participation scenarios, reduces the overall key leakage risk caused by single party leakage, and ensures that the subsequent decryption operation can only be completed with the joint participation of both parties; and, the embodiment of the present application realizes a more optimized key segmentation and collaborative computing process, reduces the complexity and management cost of the system, simplifies the key generation, distribution and use process, and improves the system's ease of use and maintainability.

[0034] In some embodiments, determining a second parameter for generating a second part of the public key according to the first part of the public key sent by the server side includes:

[0035] Generate a public key matrix according to the first part of the public key;

[0036] determining a second partial private key and a second random error vector for storage in the terminal side;

[0037] A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key and the second random error vector.

[0038] Therefore, in the embodiment of the present application, on the first terminal side, the second parameter for generating the second part of the public key on the first terminal side can be determined based on the first part of the public key sent by the server side, the second part of the private key in the first terminal side, and the second random error vector.

[0039] In some embodiments, the method further comprises:

[0040] The second parameter of the second part of the public key is sent to the server side.

[0041] Thus, the server side can generate the second part of the public key of the server side based on the second parameter of the second part of the public key sent by the terminal side.

[0042] Accordingly, an embodiment of the present application provides a quantum attack-resistant decryption method, which is applied to a server side, and the method includes:

[0043] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal;

[0044] Decompressing the ciphertext to obtain a first part of the ciphertext and a second part of the ciphertext;

[0045] According to the first partial ciphertext and the second partial ciphertext, and the pre-stored first partial private key, a partial decryption result of the ciphertext is determined and sent to the first terminal.

[0046] Corresponding to the quantum attack-resistant key generation method on the server side provided in the above-mentioned embodiment of the present application, the quantum attack-resistant decryption method applied to the server side provided in the above-mentioned embodiment of the present application realizes collaborative decryption by the server and the terminal, ensuring that the decryption operation can be completed only with the joint participation of both parties.

[0047] In some embodiments, determining a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext includes:

[0048] Generate random error values;

[0049] Generate a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key;

[0050] The first intermediate variable is used as a partial decryption result of the ciphertext.

[0051] Therefore, the server side provided by the embodiment of the present application can determine the partial decryption result of the ciphertext based on the first part of the ciphertext and the second part of the ciphertext obtained by decompressing the ciphertext on the server side, and the first part of the private key of the server side stored in advance.

[0052] Accordingly, an embodiment of the present application provides a quantum attack-resistant decryption method, which is applied to a terminal side, and the method includes:

[0053] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side;

[0054] Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

[0055] Similarly, corresponding to the quantum attack-resistant key generation method on the terminal side provided in the above-mentioned embodiment of the present application, the quantum attack-resistant decryption method applied to the terminal side provided in the above-mentioned embodiment of the present application realizes the collaborative decryption by the server and the terminal, ensuring that the decryption operation can be completed only with the joint participation of both parties.

[0056] In some embodiments, determining the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal includes:

[0057] Decompress the ciphertext to obtain a first part of the ciphertext;

[0058] Using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable required for decrypting the ciphertext according to the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext;

[0059] The second intermediate variable is compressed to obtain a plaintext corresponding to the ciphertext.

[0060] Therefore, the terminal side provided by the embodiment of the present application can decrypt the ciphertext based on the partial decryption result of the ciphertext provided by the server side and the second part of the private key pre-saved on the local first terminal side to obtain the corresponding plaintext.

[0061] An embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a server side. The device includes:

[0062] A first part public key unit, used to determine the first part public key;

[0063] A first parameter unit, configured to determine a first parameter for generating a second partial public key based on the first partial public key;

[0064] A sending unit is used to send the first part of the public key and the first parameter to a first terminal, so that the first terminal generates a second part of the public key.

[0065] In some embodiments, determining the first portion of the public key includes:

[0066] Get a random number of the preset number of bytes input;

[0067] The random number is used as a seed, and a first part of a public key is generated according to the seed and a preset matrix order.

[0068] In some embodiments, based on the first partial public key, determining a first parameter for generating a second partial public key includes:

[0069] Generate a public key matrix according to the first part of the public key;

[0070] determining a first partial private key and a first random error vector for storage in the server side;

[0071] A first parameter for generating a second partial public key is determined according to the public key matrix, the first partial private key and the first random error vector.

[0072] In some embodiments, the key generation device further comprises:

[0073] A second part public key unit, used to determine the second part public key;

[0074] A public key unit, used to determine the public key of the server side by using the first part of the public key and the second part of the public key;

[0075] A comparing unit, used to compare whether the public key on the server side is the same as the public key published by the first terminal;

[0076] A triggering unit is used to trigger a process of regenerating a public key when it is determined that the public key on the server side is different from the public key published by the first terminal.

[0077] In some embodiments, determining the second portion of the public key includes:

[0078] Receiving a second parameter sent by the first terminal for generating a second partial public key;

[0079] The second part of the public key on the server side is generated using the first parameter and the second parameter; wherein the second part of the public key on the server side is generated in the same manner as the second part of the public key on the first terminal side.

[0080] An embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a terminal side. The device includes:

[0081] A second parameter unit is used to receive the first partial public key sent by the server side and the first parameter used to generate the second partial public key, and determine the second parameter used to generate the second partial public key according to the first partial public key sent by the server side;

[0082] A second part public key unit, used to generate a second part public key of the terminal side by using the first parameter and the second parameter;

[0083] The public key publishing unit is used to obtain and publish the public key through the first part of the public key and the second part of the public key on the terminal side.

[0084] In some embodiments, determining a second parameter for generating a second part of the public key according to the first part of the public key sent by the server side includes:

[0085] Generate a public key matrix according to the first part of the public key;

[0086] determining a second partial private key and a second random error vector for storage in the terminal side;

[0087] A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key and the second random error vector.

[0088] In some embodiments, the key generation device further comprises:

[0089] A sending unit is used to send the second parameter of the second part of the public key to the server side.

[0090] An embodiment of the present application provides a quantum attack-resistant decryption device, which is applied to a server side. The device includes:

[0091] A ciphertext unit, used to obtain a ciphertext generated by the second terminal based on the public key published by the first terminal;

[0092] A decompression unit, configured to decompress the ciphertext to obtain a first ciphertext portion and a second ciphertext portion;

[0093] The sending unit is used to determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the partial decryption result to the first terminal.

[0094] In some embodiments, determining a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext includes:

[0095] Generate random error values;

[0096] Generate a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key;

[0097] The first intermediate variable is used as a partial decryption result of the ciphertext.

[0098] An embodiment of the present application provides a quantum attack-resistant decryption device, which is applied to a terminal side. The device includes:

[0099] A receiving unit, configured to obtain a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side;

[0100] Determine a plaintext unit, which is used to determine the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal.

[0101] In some embodiments, determining the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal includes:

[0102] Decompress the ciphertext to obtain a first part of the ciphertext;

[0103] Using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable required for decrypting the ciphertext according to the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext;

[0104] The second intermediate variable is compressed to obtain a plaintext corresponding to the ciphertext.

[0105] Accordingly, an embodiment of the present application provides a system, including a server and a first terminal; wherein:

[0106] The server is used for:

[0107] Determine the first part of the public key;

[0108] Based on the first partial public key, determining a first parameter for generating a second partial public key;

[0109] Sending the first partial public key and the first parameter for generating the second partial public key to the first terminal, so that the first terminal generates the second partial public key;

[0110] The first terminal is used for:

[0111] Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server side, and determining a second parameter for generating the second partial public key according to the first partial public key sent by the server side;

[0112] Generate a second part of the public key of the terminal side by using the first parameter and the second parameter;

[0113] Obtaining and publishing a public key through the first part of the public key and the second part of the public key on the terminal side;

[0114] and / or,

[0115] The server is used for:

[0116] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal;

[0117] Decompressing the ciphertext to obtain a first part of the ciphertext and a second part of the ciphertext;

[0118] Determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the result to the first terminal;

[0119] The first terminal is used for:

[0120] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side;

[0121] Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

[0122] Another embodiment of the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store program instructions, and the processor is used to call the program instructions stored in the memory and execute any of the above methods according to the obtained program. BRIEF DESCRIPTION OF THE DRAWINGS

[0123] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0124] Figure 1 A schematic diagram of a flow chart of a quantum attack-resistant key generation method on a server side provided in an embodiment of the present application;

[0125] Figure 2 A schematic diagram of a flow chart of another method for generating a key resistant to quantum attacks on a server side provided in an embodiment of the present application;

[0126] Figure 3 A schematic diagram of a process for generating a key resistant to quantum attacks on a terminal side provided in an embodiment of the present application;

[0127] Figure 4 A schematic diagram of a flow chart of another method for generating a key resistant to quantum attacks on a terminal side provided in an embodiment of the present application;

[0128] Figure 5 A flowchart of a quantum attack-resistant decryption method on a server side provided in an embodiment of the present application;

[0129] Figure 6 A schematic diagram of a flow chart of a quantum attack-resistant decryption method on a terminal side provided in an embodiment of the present application;

[0130] Figure 7 A schematic diagram of a system architecture provided for an embodiment of the present application;

[0131] Figure 8 Another schematic diagram of a system architecture provided for an embodiment of the present application;

[0132] Fig. 9A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0133] Fig.10 A schematic diagram of the structure of a quantum attack-resistant key generation device on the server side provided in an embodiment of the present application;

[0134] Fig.11 A schematic diagram of the structure of a quantum attack-resistant key generation device on the terminal side provided in an embodiment of the present application;

[0135] Fig.12 A schematic diagram of the structure of a quantum attack-resistant decryption device on the server side provided in an embodiment of the present application;

[0136] Fig.13 A schematic diagram of the structure of a quantum attack-resistant decryption device on the terminal side provided in an embodiment of the present application. DETAILED DESCRIPTION

[0137] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0138] The embodiments of the present application provide a quantum-attack-resistant key generation and decryption method, apparatus, system, device, and medium to improve key security, reduce or avoid the risk of key leakage, simplify the key generation, publication, and use processes, and improve the usability and maintainability of the key system.

[0139] Among them, the method and the device, system, equipment, and medium are based on the same application concept. Since the principles of solving problems by the method and the device, equipment, and medium are similar, the implementation of the device, equipment, medium, and method can refer to each other, and the repeated parts will not be repeated.

[0140] The terms "first", "second", etc. (if any) in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than the content illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, device, system, product or equipment comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0141] The following examples and embodiments are to be understood as illustrative examples only. Although this specification may refer to "one", "an" or "some" examples or embodiments in several places, this does not mean that each such reference relates to the same example or embodiment, nor does it mean that the feature applies only to a single example or embodiment. Individual features of different embodiments may also be combined to provide other embodiments. In addition, terms such as "including" and "comprising" should be understood as not limiting the described embodiments to only those features that have been mentioned; such examples and embodiments may also include features, structures, units, modules, etc. that are not specifically mentioned.

[0142] The following is a detailed description of each embodiment of the present application in conjunction with the accompanying drawings. It should be noted that the display order of the embodiments of the present application only represents the order of the embodiments, and does not represent the advantages and disadvantages of the technical solutions provided by the embodiments.

[0143] In the embodiment of the present application, a key generation and decryption scheme based on the collaboration of the server and the terminal is proposed, which aims to strengthen the private key protection mechanism of the ML-KEM algorithm through multi-party participation. The scheme adopts key splitting and distributed computing technology, and the two parties jointly generate the public key, and the private key is not concentrated on a single party, thereby avoiding the problem of single point failure. Each participant only holds part of the key information and cannot independently restore the complete private key, which effectively improves the security and robustness of the system. During the decryption process, the two parties, the server and the terminal, need to jointly participate in the decryption operation to ensure that even if the key of one party is leaked or lost, the attacker cannot easily obtain the complete key or decryption information, so as to have efficient computing performance and scalability, and can adapt to different application scenarios.

[0144] In the ML-KEM solution provided in the embodiment of the present application, a server is introduced, and the key generation algorithm is run collaboratively by the server and the first terminal, which is denoted as DK-PKE.KeyGen, so that the server and the first terminal respectively grasp part of the private key information, and neither can obtain the complete private key; and a two-party collaborative decryption algorithm, denoted as DK-PKE.Decrypt, is used to enable the first terminal to complete the decryption operation through the assistance of the server. The encryption process of the message by the second terminal is not affected. The collaborative key generation algorithm DK-PKE.KeyGen and the collaborative decryption algorithm DK-PKE.Decrypt will be introduced separately later.

[0145] The relevant symbols and parameters provided in the embodiments of the present application are as follows:

[0146] q: represents the prime number 3329;

[0147] represents the ring of integers generated modulo q;

[0148] R q : represents a polynomial ring R q Any element in Among them, n=256.

[0149] Represents R q k-dimensional vector on .

[0150] Represents a byte whose value is the set {0,1,…,255}.

[0151] G: To convert a byte string of arbitrary length into a 32-byte output, function G can be implemented using a hash function with an output length of 32 bytes.

[0152] Generate R from seed q A k×k matrix on , where k is 3 or 4. Specifically, an extensible output function can be used to sequentially generate each element of the matrix according to the seed seed.

[0153] Randomly generate R q The k-dimensional vector is generated and obeys the central binomial distribution with parameter η, where η represents the scale of the number of binomial distribution trials, that is, the value range of each component of the generated k-dimensional vector is [-η,η].

[0154] Compression algorithmCompress d :

[0155] Decompression algorithm Decompress d :

[0156] When the input information is a vector, the compression algorithm and the decompression algorithm mean that compression and decompression are performed on each component in the vector respectively.

[0157] η1: The private key and error vector generated when generating the public-private key pair, as well as the distribution parameters of the random vector generated in the encryption phase.

[0158] η2: the error vector generated during the encryption phase and the parameters of the distribution of random values;

[0159] d u : Compression and decompression parameters of the first part of the ciphertext;

[0160] d v : Compression and decompression parameters of the second part of the ciphertext;

[0161] x←$ SampleCBD(η,S): Generates a random value x in the set S, where x follows a central binomial distribution with parameter η and is independently randomized each time.

[0162] ∥M∥ ∞ :For any element M=M0+M1X+…+M 255 X 255 ∈R q , Remember ∥M∥ ∞ =max{M i :0=0,1,…,255}.

[0163] The values ​​of some parameters are shown in Table 1 below:

[0164] n q k <![CDATA[η1]]> <![CDATA[η2]]> <![CDATA[d u ]]> <![CDATA[d v ]]> ML-KEM-512 256 3329 2 3 2 10 4 ML-KEM-768 256 3329 3 2 2 10 4 ML-KEM-1024 256 3329 4 2 2 11 5

[0165] Table 1

[0166] The following is an example of the key generation, encryption, and quantum attack-resistant decryption method process from the server side and the terminal side.

[0167] In the embodiment of the present application, the key generation method (DK-PKE.KeyGen) of the server and the first terminal to cooperate against quantum attacks is as follows:

[0168] See also Figure 1 , a quantum attack-resistant key generation method provided in an embodiment of the present application is applied to a server side, and the method includes:

[0169] S101, determining the first part of the public key;

[0170] In some embodiments, step S101 includes:

[0171] Get a random number of the preset number of bytes input;

[0172] The preset number of bytes is, for example, 32 bytes.

[0173] Using the random number as a seed, and generating a first part of a public key (for example, represented by ρ) according to the seed and a preset matrix order (for example, represented by k);

[0174] For example, seeds

[0175] The first part of the public key ρ = G (seed ∥ k);

[0176] S102: Based on the first part of the public key, determine a first parameter for generating a second part of the public key;

[0177] In some embodiments, step S102 includes:

[0178] Generate a public key matrix (e.g., represented as A) according to the first part of the public key;

[0179] For example, the public key matrix A is derived using the following formula:

[0180]

[0181] Determining a first partial private key (e.g., denoted as s') and a first random error vector (e.g., denoted as e') for storage in the server side;

[0182] For example, the following formula is used to generate a partial private key s′ (i.e., a first partial private key, which is stored in the local server) for storage in the local server:

[0183]

[0184] Among them, η1 represents the parameter of the central binomial distribution that the private key obeys, and its value is 3 or 2.

[0185] Represents R q k-dimensional vector on the . That is, the sampled s′ is R q k-dimensional vector on , and the coefficient range of each component of s′ is

[0186] For example, the first random error vector e′ is generated using the following formula:

[0187]

[0188] It should be noted that ← $ The symbol represents random generation, and the result of each generation is independent and random, and the result is different. Therefore, here e' follows the same probability distribution as s' above, but the result is different.

[0189] Determine a first parameter (e.g., represented as t') for generating a second partial public key according to the public key matrix, the first partial private key and the first random error vector;

[0190] For example, according to the public key matrix A, the first part of the private key s′, and the first random error vector e′, the following formula is used to calculate the first parameter t′ used to generate the second part of the public key:

[0191] t′=A·s′+e′;

[0192] S103: Send the first partial public key and the first parameter for generating the second partial public key to a first terminal, so that the first terminal generates the second partial public key.

[0193] In some embodiments, step S103 includes:

[0194] The first part of the public key and the first parameter are sent to a first terminal, so that the first terminal generates a second part of the public key.

[0195] That is, the server stores the first part of the private key s′ as the private key on the server side, and sends the first part of the public key ρ and the first parameter t′ for generating the second part of the public key to the first terminal, so that the first terminal generates the second part of the public key.

[0196] In some embodiments, see Figure 2 , the method further comprises:

[0197] S104, determining the second part of the public key;

[0198] In some embodiments, step S104 includes:

[0199] Receiving a second parameter (for example, represented as t") sent by the first terminal and used to generate a second partial public key;

[0200] Generate a second part of the public key of the server side (for example, represented by t) by using the first parameter and the second parameter; wherein the second part of the public key of the server side is generated in the same manner as the second part of the public key of the first terminal side, for example, the respective second part of the public key is calculated by the following formula:

[0201] t=t"+t';

[0202] S105. Construct a public key of the server side by using the first part of the public key and the second part of the public key of the server side;

[0203] The public key is, for example, represented by (t, ρ), that is, it includes two components, t and ρ;

[0204] S106: Compare the public key on the server side with the public key published by the first terminal to see whether they are the same; wherein the public key published by the first terminal is composed of the first part of the public key and the second part of the public key on the first terminal side;

[0205] S107: When it is determined that the public key on the server side is different from the public key published by the first terminal, a process of regenerating the public key is triggered.

[0206] For example, when it is determined that the public key on the server side is different from the public key published by the first terminal, the above step S101 is re-executed. Thus, it can be ensured that the public key on the server side is the same as the public key published by the first terminal.

[0207] Accordingly, see Figure 3 , a quantum attack-resistant key generation method provided in an embodiment of the present application is applied to a terminal side, and the method includes:

[0208] S201, receiving a first part of the public key and a first parameter for generating a second part of the public key sent by the server side; and determining a second parameter for generating the second part of the public key according to the first part of the public key sent by the server side;

[0209] In some embodiments, determining a second parameter for generating a second part of the public key according to the first part of the public key sent by the server side includes:

[0210] Step 1: Generate a public key matrix (for example, represented by A) according to the first part of the public key;

[0211] For example, according to ρ, the public key matrix A is derived using the following formula:

[0212]

[0213] in, Represents R q A k×k matrix on .

[0214] Gen is a deterministic algorithm that can generate the same result based on the same ρ, so the A generated in this step is the same as the A generated on the server side.

[0215] Step 2: determining a second partial private key (for example, represented by s") and a second random error vector (for example, represented by e") for storage in the terminal side;

[0216] For example, the following formula is used to generate the second part of the private key s″ for storage at the local first terminal:

[0217]

[0218] Same as above, ← $ The symbol represents random generation, and the result of each generation is independent and random, so the s″ in this step is different from the s′ generated in step S3 on the server side.

[0219] For example, the following formula is used to generate the second random error vector e″:

[0220]

[0221] Same as above, ← $ The symbol represents random generation, and the result of each generation is independent and random, so the e″ in this step is different from the e′ generated in step S4 on the server side.

[0222] Step 3: Determine a second parameter (for example, expressed as t") for generating the second part of the public key according to the public key matrix, the second part of the private key and the second random error vector;

[0223] For example, according to the public key matrix A, the second part private key s″ and the second random error vector e″, the second parameter t″ used to generate the second part public key is calculated using the following formula:

[0224] t″=A·s″+e″;

[0225] S202: Generate a second partial public key (for example, represented by t) on the terminal side by using the first parameter and the second parameter;

[0226] For example, according to the first parameter t′ and the second parameter t″, the second part of the public key t (that is, the complete value of the second part of the public key) is calculated using the following formula:

[0227] t=t″+t′;

[0228] S203: Obtain and publish a public key through the first part of the public key and the second part of the public key on the terminal side.

[0229] The public key is, for example, represented by (t, ρ), that is, it includes two components, ρ and t, namely, the first part of the public key and the second part of the public key.

[0230] In some embodiments, see Figure 4 , the method further comprises:

[0231] S204: Send the second parameter of the second part of the public key to the server side. Thus, the server side can be assisted in generating a public key of the server side based on the second parameter of the second part of the public key, and further the server side can compare the public key of the server side with the public key published by the first terminal to see if they are the same. If they are not the same, the key generation process can be triggered to be re-executed to ensure that the public key of the server side is the same as the public key published by the first terminal.

[0232] In some embodiments, the method (K-PKE.Encrypt) for encrypting plaintext m using the public key (t, ρ) published by the first terminal on the second terminal side provided in the embodiment of the present application includes:

[0233] Step 1: Obtain a 32-byte plaintext message m and a public key (t, ρ) published by the first terminal;

[0234] in,

[0235] Step 2: Derive the public key matrix based on ρ:

[0236]

[0237] Step 3: Generate a random vector:

[0238]

[0239] Step 4: Generate random error vector:

[0240]

[0241] Step 5: Generate random error values:

[0242] e2← $ SampleCBD(η2,R q );

[0243] Step 6: Calculate the first part of the ciphertext to get the intermediate information:

[0244] u=A T y+e1;

[0245] Step 7: Calculate the first part of the ciphertext:

[0246]

[0247] Step 8: Map the plaintext to R q Elements in:

[0248] μ = Decompress1(m);

[0249] Step 9: Calculate the intermediate value of the second part of the ciphertext:

[0250] v=t T ·y+e2+μ;

[0251] Step 10: Calculate the second part of the ciphertext:

[0252]

[0253] Step 11. Generate and output ciphertext: (c1, c2).

[0254] Accordingly, after receiving the ciphertext (c1, c2), the method (DK-PKE.Decrypt) for collaborative decryption between the first terminal and the server is as follows:

[0255] See also Figure 5 , a quantum attack-resistant decryption method provided in an embodiment of the present application is applied to a server side, and the method includes:

[0256] S301, obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal;

[0257] The ciphertext is, for example, represented as (C1, C2);

[0258] S302, decompressing the ciphertext to obtain a first ciphertext portion (for example, represented as u') and a second ciphertext portion (for example, represented as v');

[0259] For example, for the ciphertext (c1, c2), the first part of the ciphertext u′ is decompressed as follows:

[0260]

[0261] For the ciphertext (c1, c2), the second ciphertext v′ is decompressed as follows:

[0262]

[0263] S303: Determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the result to the first terminal.

[0264] In some embodiments, step S303 includes:

[0265] Step 1: Generate a random error value (e.g., expressed as e2');

[0266] For example, based on the preset parameters η2, R q , use the following formula to generate the random error value e′2:

[0267] e′2← $ SampleCBD(η2,R q );

[0268] Step 2: Generate a first intermediate variable (for example, represented as w') according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key;

[0269] In some embodiments, generating a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key includes:

[0270] The first intermediate variable w′ is generated using the following formula:

[0271] w′=v′-s′ T u′+e′2;

[0272] Wherein, v′ represents the second part of the ciphertext;

[0273] s′ T represents the transpose of the first part of the private key (vector or matrix);

[0274] u′ represents the first part of the ciphertext;

[0275] e′2 represents the random error value.

[0276] Step three: Use the first intermediate variable as a partial decryption result for the ciphertext.

[0277] Accordingly, see Figure 6 , an embodiment of the present application provides a quantum attack-resistant decryption method, which is applied to a terminal side, and the method includes:

[0278] S401, obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side;

[0279] A partial decryption result of the ciphertext sent by the server, for example, a first intermediate variable sent by the server as a partial decryption result generated for the ciphertext;

[0280] The ciphertext is, for example, represented as (C1, C2);

[0281] S402: Determine the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal.

[0282] In some embodiments, the step S402 includes:

[0283] Step 1: decompress the ciphertext to obtain a first part of the ciphertext (for example, represented as u');

[0284] For example, for the ciphertext (c1, c2), decompression obtains the first part of the ciphertext u′:

[0285]

[0286] Step 2: using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable (for example, represented as w) required for decrypting the ciphertext according to the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext;

[0287] In some embodiments, determining the second intermediate variable required for decrypting the ciphertext according to the first intermediate variable, the second part of the private key pre-stored by the local first terminal, and the first part of the ciphertext includes:

[0288] The second intermediate variable w is generated using the following formula:

[0289] w=w′-s″T u′ ;

[0290] Wherein, w′ represents the first intermediate variable;

[0291] s″ T represents the transpose of the second part of the private key;

[0292] u′ represents the first part of the ciphertext.

[0293] Step 3: compress the second intermediate variable to obtain the plaintext corresponding to the ciphertext (for example, represented as m').

[0294] For example, compress the second intermediate variable w to obtain the plaintext m′:

[0295] m′=Compress1(w);

[0296] Finally, the decrypted plaintext m′ can be output.

[0297] If the calculation is correct, the plaintext m′ decrypted by the first terminal should be the same as the plaintext m input into the second terminal.

[0298] It should be noted that the second ciphertext v′ has been processed in step S302 on the server side and further processed into the first intermediate variable w′ in step S302 and sent to the first terminal. Therefore, the first terminal does not need to process the second ciphertext v′ again.

[0299] In summary:

[0300] 1. From step S105 on the server side in the collaborative quantum-resistant key generation method DK-PKE.KeyGen provided by the above embodiment of the present application, and steps S204 and S205 on the first terminal side, it can be known that:

[0301] t=A·(s′+s″)+e′+e″;

[0302] Therefore, the real private key in the collaborative key generation scheme provided in the embodiment of the present application is:

[0303] s=s′+s″;

[0304] We can remember that e=e′+e″.

[0305] 2. From step S304 on the server side and step S403 on the first terminal side in the collaborative anti-quantum attack decryption method DK-PKE.Decrypt provided by the embodiment of the present application, it can be seen that:

[0306]

[0307]

[0308] in,

[0309] 3. When When:

[0310]

[0311] Therefore, Compress1(w)=Compress1(Decompress1(m))=m.

[0312] It should be noted that the probability of successful decryption can be adjusted according to actual needs by adjusting the values ​​of relevant parameters involved in the above calculation process (that is, in the embodiment of the present application, not limited to the parameter values ​​shown in Table 1 above) so that the probability of successful decryption meets actual application needs.

[0313] In the embodiment of the present application, the first terminal and the server collaborate to complete key generation and decryption, avoiding the single point failure problem when the first terminal independently masters the private key. In addition, the first terminal and the server cannot derive each other's partial private key, that is, neither party has the complete private key, and only the collaboration of the two parties can complete the decryption operation. Therefore, the attacker can only recover the complete private key by obtaining the private keys of the server and the first terminal at the same time. Therefore, it is more difficult to crack the private key and can resist quantum computing attacks. In addition, due to the collaborative participation of the server, the computational complexity of key generation and decryption on the terminal side is reduced.

[0314] The following is an introduction to the system, device or apparatus provided in the embodiments of the present application, in which explanations or examples of technical features that are the same as or corresponding to those described in the above method are not repeated hereafter.

[0315] See also Figure 7 , a system provided by an embodiment of the present application includes a server 70 and at least one first terminal 71; wherein,

[0316] The server 70 is used for:

[0317] Determine the first part of the public key;

[0318] Based on the first partial public key, determining a first parameter for generating a second partial public key;

[0319] Sending the first partial public key and the first parameter for generating the second partial public key to the first terminal, so that the first terminal generates the second partial public key;

[0320] The first terminal 71 is used for:

[0321] Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server side, and determining a second parameter for generating the second partial public key according to the first partial public key sent by the server side;

[0322] Generate a second part of the public key of the terminal side by using the first parameter and the second parameter;

[0323] The public key is obtained and published through the first part of the public key and the second part of the public key on the terminal side.

[0324] and / or:

[0325] The server 70 is used for:

[0326] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal;

[0327] Decompressing the ciphertext to obtain a first part of the ciphertext and a second part of the ciphertext;

[0328] Determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the result to the first terminal;

[0329] The first terminal 71 is used for:

[0330] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side;

[0331] Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

[0332] Of course, in some embodiments, see Figure 8 The system may further include at least one second terminal 72 for encryption, and its specific functions are as described in the encryption method on the second terminal side, which will not be repeated here.

[0333] An electronic device provided in an embodiment of the present application may be the above-mentioned server or the above-mentioned terminal. Fig. 9 The electronic device, for example, includes: a processor 600 and a memory 620.

[0334] The processor 600 is used to read the program in the memory 620 and execute any one of the method processes provided in the above-mentioned embodiments of the present application, and the details are not repeated here.

[0335] In some embodiments, the processor 600 is also used to read the program in the memory 620 and execute the encryption process on the second terminal side (the details will not be repeated here). That is to say, the electronic device provided in the embodiment of the present application, when used as a terminal, can simultaneously have the key generation, encryption, and decryption functions provided in the above-mentioned embodiment of the present application.

[0336] The transceiver 610 is configured to receive and send data under the control of the processor 600 .

[0337] Among them, Fig. 9 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 600 and various circuits of memory represented by memory 620 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 610 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, including wireless channels, wired channels, optical cables, and other transmission media. For different user devices, the user interface 630 may also be an interface capable of externally and internally connecting required devices, and the connected devices include but are not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

[0338] The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 can store data used by the processor 600 when performing operations.

[0339] In some embodiments, the processor 600 may be a CPU (central processing unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array) or a CPLD (Complex Programmable Logic Device), and the processor may also adopt a multi-core architecture.

[0340] The processor calls the computer program stored in the memory to execute any of the methods provided in the embodiments of the present application according to the obtained executable instructions. The processor and the memory can also be arranged physically separately.

[0341] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0342] See also Fig.10 , an embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a server side, and the device includes:

[0343] A first part public key unit 11, used to determine a first part public key;

[0344] A first parameter unit 12, configured to determine a first parameter for generating a second partial public key based on the first partial public key;

[0345] The sending unit 13 is used to send the first part of the public key and the first parameter to the first terminal, so that the first terminal generates a second part of the public key.

[0346] In some embodiments, the key generation device further comprises:

[0347] A second part public key unit, used to determine the second part public key;

[0348] A public key unit, used to determine the public key of the server side by using the first part of the public key and the second part of the public key;

[0349] A comparing unit, used to compare whether the public key on the server side is the same as the public key published by the first terminal;

[0350] A triggering unit is used to trigger a process of regenerating a public key when it is determined that the public key on the server side is different from the public key published by the first terminal.

[0351] In some embodiments, determining the first portion of the public key includes:

[0352] Get a random number of the preset number of bytes input;

[0353] The random number is used as a seed, and a first part of a public key is generated according to the seed and a preset matrix order.

[0354] In some embodiments, based on the first partial public key, determining a first parameter for generating a second partial public key includes:

[0355] Generate a public key matrix according to the first part of the public key;

[0356] determining a first partial private key and a first random error vector for storage in the server side;

[0357] A first parameter for generating a second partial public key is determined according to the public key matrix, the first partial private key and the first random error vector.

[0358] In some embodiments, determining the second partial public key includes:

[0359] Receiving a second parameter sent by the first terminal for generating a second partial public key;

[0360] The second part of the public key on the server side is generated using the first parameter and the second parameter; wherein the second part of the public key on the server side is generated in the same manner as the second part of the public key on the first terminal side.

[0361] Accordingly, see Fig.11 , an embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a terminal side, and the device includes:

[0362] The second parameter unit 21 is used to receive the first partial public key sent by the server side and the first parameter used to generate the second partial public key, and determine the second parameter used to generate the second partial public key according to the first partial public key sent by the server side;

[0363] A second part public key unit 22, used to generate a second part public key of the terminal side using the first parameter and the second parameter;

[0364] The public key publishing unit 23 is used to obtain and publish a public key through the first part of the public key and the second part of the public key on the terminal side.

[0365] In some embodiments, determining a second parameter for generating a second part of the public key according to the first part of the public key sent by the server side includes:

[0366] Generate a public key matrix according to the first part of the public key;

[0367] determining a second partial private key and a second random error vector for storage in the terminal side;

[0368] A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key and the second random error vector.

[0369] In some embodiments, the key generation device further comprises:

[0370] A sending unit is used to send the second parameter of the second part of the public key to the server side.

[0371] Accordingly, see Fig.12, a quantum attack-resistant decryption device provided in an embodiment of the present application is applied to a server side, and the device includes:

[0372] The ciphertext unit 31 is used to obtain the ciphertext generated by the second terminal based on the public key published by the first terminal;

[0373] A decompression unit 32, configured to decompress the ciphertext to obtain a first ciphertext portion and a second ciphertext portion;

[0374] The sending unit 33 is used to determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the partial decryption result to the first terminal.

[0375] In some embodiments, determining a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext includes:

[0376] Generate random error values;

[0377] Generate a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key;

[0378] The first intermediate variable is used as a partial decryption result of the ciphertext.

[0379] In some embodiments, generating a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key includes:

[0380] The first intermediate variable w′ is generated using the following formula:

[0381] w′=v′-s′ T u′+e′2;

[0382] Wherein, v′ represents the second part of the ciphertext;

[0383] s′ T represents the transpose of the first part of the private key;

[0384] u′ represents the first part of the ciphertext;

[0385] e′2 represents the random error value.

[0386] Accordingly, see Fig.13 , an embodiment of the present application provides a quantum attack-resistant decryption device, which is applied to a terminal side, and the device includes:

[0387] The receiving unit 41 is used to obtain the ciphertext generated by the second terminal based on the public key published by the first terminal, and the partial decryption result of the ciphertext sent by the server side;

[0388] A plaintext determination unit 42, configured to determine the plaintext corresponding to the ciphertext based on a partial decryption result of the ciphertext and a second partial private key pre-stored by the local first terminal;

[0389] In some embodiments, determining the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal includes:

[0390] Decompress the ciphertext to obtain a first part of the ciphertext;

[0391] Using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable required for decrypting the ciphertext according to the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext;

[0392] The second intermediate variable is compressed to obtain a plaintext corresponding to the ciphertext.

[0393] In some embodiments, determining the second intermediate variable required for decrypting the ciphertext according to the first intermediate variable, the second part of the private key pre-stored by the local first terminal, and the first part of the ciphertext includes:

[0394] The second intermediate variable w is generated using the following formula:

[0395] w=w′-s″T u′ ;

[0396] Wherein, w′ represents the first intermediate variable;

[0397] s″ T represents the transpose of the second part of the private key;

[0398] u′ represents the first part of the ciphertext.

[0399] It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0400] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0401] Any of the devices or apparatuses provided in the embodiments of the present application may specifically be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), etc. It may include a central processing unit (CPU), a memory, an input / output device, etc. The input device may include a keyboard, a mouse, a touch screen, etc. The output device may include a display device, such as a liquid crystal display (LCD), a cathode ray tube (CRT), etc.

[0402] The memory may include a read-only memory (ROM) and a random access memory (RAM), and provides the processor with program instructions and data stored in the memory. In an embodiment of the present application, the memory may be used to store the program of any of the methods provided in the embodiments of the present application.

[0403] The processor calls the program instructions stored in the memory, and the processor is used to execute any of the methods provided in the embodiments of the present application according to the obtained program instructions.

[0404] The present application embodiment also provides a computer program product or computer program, which includes a computer instruction, which is stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction so that the computer device executes any of the methods described in the above embodiments. The program product can use any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0405] The embodiment of the present application provides a computer-readable storage medium for storing computer program instructions used by the apparatus provided in the embodiment of the present application, which includes a program for executing any of the methods provided in the embodiment of the present application. The computer-readable storage medium may be a non-transitory computer-readable medium.

[0406] The computer-readable storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

[0407] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A quantum attack-resistant key generation method, characterized in that: Applied to the server side, the method includes: Determine the first part of the public key; Based on the first partial public key, determining a first parameter for generating a second partial public key; The first partial public key and the first parameter for generating the second partial public key are sent to a first terminal, so that the first terminal generates the second partial public key.

2. A quantum attack-resistant key generation method, characterized in that: Applied to the terminal side, the method includes: Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server side, and determining a second parameter for generating the second partial public key according to the first partial public key sent by the server side; Generate a second part of the public key of the terminal side by using the first parameter and the second parameter; The public key is obtained and published through the first part of the public key and the second part of the public key on the terminal side.

3. A decryption method resistant to quantum attacks, characterized in that: Applied to the server side, the method includes: Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal; Decompressing the ciphertext to obtain a first part of the ciphertext and a second part of the ciphertext; According to the first partial ciphertext and the second partial ciphertext, and the pre-stored first partial private key, a partial decryption result of the ciphertext is determined and sent to the first terminal.

4. A decryption method resistant to quantum attacks, characterized in that: Applied to the terminal side, the method includes: Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side; Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

5. A quantum attack-resistant key generation device, characterized in that: Applied to the server side, the device comprises: A first part public key unit, used to determine the first part public key; A first parameter unit, configured to determine a first parameter for generating a second partial public key based on the first partial public key; A sending unit is used to send the first part of the public key and the first parameter to a first terminal, so that the first terminal generates a second part of the public key.

6. A quantum attack-resistant key generation device, characterized in that: Applied to the terminal side, the device includes: A second parameter unit is used to receive the first partial public key sent by the server side and the first parameter used to generate the second partial public key, and determine the second parameter used to generate the second partial public key according to the first partial public key sent by the server side; A second part public key unit, used to generate a second part public key of the terminal side by using the first parameter and the second parameter; The public key publishing unit is used to obtain and publish the public key through the first part of the public key and the second part of the public key on the terminal side.

7. A decryption device resistant to quantum attacks, characterized in that: Applied to the server side, the device comprises: A ciphertext unit, used to obtain a ciphertext generated by the second terminal based on the public key published by the first terminal; A decompression unit, configured to decompress the ciphertext to obtain a first ciphertext portion and a second ciphertext portion; The sending unit is used to determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the partial decryption result to the first terminal.

8. A decryption device resistant to quantum attacks, characterized in that: Applied to the terminal side, the device includes: A receiving unit, configured to obtain a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side; Determine a plaintext unit, which is used to determine the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal.

9. A system, characterized in that: It includes a server and a first terminal; wherein, The server is used for: Determine the first part of the public key; Based on the first partial public key, determining a first parameter for generating a second partial public key; Sending the first partial public key and the first parameter for generating the second partial public key to the first terminal, so that the first terminal generates the second partial public key; The first terminal is used for: Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server side, and determining a second parameter for generating the second partial public key according to the first partial public key sent by the server side; Generate a second part of the public key of the terminal side by using the first parameter and the second parameter; Obtaining and publishing a public key through the first part of the public key and the second part of the public key on the terminal side; and / or, The server is used for: Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal; Decompressing the ciphertext to obtain a first part of the ciphertext and a second part of the ciphertext; Determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the result to the first terminal; The first terminal is used for: Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side; Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

10. An electronic device, characterized in that: include: A memory for storing program instructions; A processor, configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 4 according to the obtained program.

Images