Key generation and decryption methods, devices, systems, and equipment resistant to quantum attacks

Abstract

This application discloses a quantum-resistant key generation and decryption method, apparatus, system, and device, designed to improve key security, reduce or avoid the risk of key leakage, simplify the key generation, publication, and usage processes, and enhance the usability and maintainability of the key system. The method provided in this application includes: determining a first public key; based on the first public key, determining a first parameter for generating a second public key; and transmitting the first public key and the first parameter for generating the second public key to a first terminal, causing the first terminal to generate the second public key.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, device, system, and equipment for generating and decrypting keys that are resistant to quantum attacks. Background Art

[0002] The ML-KEM algorithm is a quantum-resistant cryptographic algorithm. ML-KEM is a public key encryption and key encapsulation algorithm standardized in the FIPS203 standard. This algorithm is a standardized version of Kyber, the final algorithm selected by the National Institute of Standards and Technology (NIST) post-quantum cryptography project.

[0003] To address the issue of key security, existing technologies typically deploy cryptographic algorithms in a secure environment to reduce the risk of private key leakage. However, despite deploying cryptographic algorithms in a secure environment, these technologies still pose the risk of single points of failure. For example, the emergence of quantum computers significantly reduces the computational cost of cracking such keys, threatening the security of existing cryptographic systems. Once a secure environment is breached or fails, the key may be leaked or damaged, compromising the security of the entire encryption system. Summary of the Invention

[0004] The embodiments of the present application provide a quantum-resistant key generation and decryption method, apparatus, system, and device to improve key security, reduce or avoid the risk of key leakage, simplify the key generation, publication, and use processes, and improve the usability and maintainability of the key system.

[0005] An embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to a server side. The method includes:

[0006] Determine the first part of the public key;

[0007] Determining, based on the first partial public key, a first parameter for generating a second partial public key;

[0008] The first partial public key and the first parameter for generating the second partial public key are sent to the first terminal, so that the first terminal generates the second partial public key.

[0009] The embodiment of the present application uses a quantum attack-resistant key generation method provided by the server side to determine the first part of the public key on the server side, and based on the first part of the public key, further determine the first parameter for generating the second part of the public key, and send the first part of the public key and the first parameter for generating the second part of the public key to the first terminal, so that the first terminal generates the second part of the public key, realizing the collaborative generation of keys by the server and the terminal, making the key generation and storage mechanism more flexible and distributed, avoiding security problems caused by single key leakage or storage node failure, and improving the system's fault tolerance and overall reliability; ensuring that the system still has high security in the quantum computing era; and, the embodiment of the present application realizes a more rigorous key splitting and collaborative computing mechanism, enhances the private key protection capability in multi-party participation scenarios, reduces the overall key leakage risk caused by leakage by a single party, and ensures that the decryption operation can only be completed with the joint participation of both parties; and, the embodiment of the present application realizes a more optimized key splitting and collaborative computing process, reduces the complexity and management cost of the system, simplifies the key generation, distribution and use process, and improves the system's usability and maintainability.

[0010] In some embodiments, determining the first portion of the public key includes:

[0011] Get a random number of the preset number of bytes input;

[0012] The random number is used as a seed, and a first part of the public key is generated according to the seed and a preset matrix order.

[0013] Therefore, in the embodiment of the present application, the server side can generate the first part of the public key of the server side based on a random number of a preset number of bytes and a preset matrix order.

[0014] In some embodiments, determining a first parameter for generating a second partial public key based on the first partial public key includes:

[0015] Generate a public key matrix based on the first part of the public key;

[0016] determining a first partial private key and a first random error vector for storage in the server side;

[0017] A first parameter for generating a second partial public key is determined based on the public key matrix, the first partial private key, and the first random error vector.

[0018] Therefore, in the embodiment of the present application, the server side can determine the parameters for generating the second part of the public key based on the first part of the public key, the first part of the private key and the first random error vector on the server side, so as to facilitate the subsequent generation of the second part of the public key by the server side and the terminal side.

[0019] In some embodiments, the method further comprises:

[0020] Determine the second part of the public key;

[0021] Determine the public key of the server side by using the first part of the public key and the second part of the public key;

[0022] Comparing the public key on the server side with the public key published by the first terminal to see if they are the same;

[0023] When it is determined that the public key on the server side is different from the public key published by the first terminal, a process of regenerating the public key is triggered.

[0024] Therefore, the embodiment of the present application compares the public key on the server side with the public key published by the first terminal, and when the two are different, it can trigger the process of regenerating the public key, thereby avoiding the error situation that the public key on the server side is inconsistent with the public key published by the first terminal.

[0025] In some embodiments, determining the second partial public key includes:

[0026] receiving a second parameter for generating a second part of the public key sent by the first terminal;

[0027] The second part of the public key on the server side is generated using the first parameter and the second parameter; wherein the second part of the public key on the server side is generated in the same manner as the second part of the public key on the first terminal side.

[0028] Therefore, the embodiment of the present application generates the second part of the public key in the same way on the server side and the first terminal side, which can ensure that the public key generated on the server side is the same as the public key published by the first terminal, avoiding the error situation that the public key on the server side is inconsistent with the public key published by the first terminal.

[0029] Accordingly, an embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to a terminal side. The method includes:

[0030] Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server, and determining a second parameter for generating the second partial public key based on the first partial public key sent by the server;

[0031] Generate a second part of the public key on the terminal side using the first parameter and the second parameter;

[0032] The public key is obtained and published through the first part of the public key and the second part of the public key on the terminal side.

[0033] Similar to the server-side quantum attack-resistant key generation method provided in the above-mentioned embodiment of the present application, the terminal-side quantum attack-resistant key generation method provided in the above-mentioned embodiment of the present application realizes the collaborative generation of keys by the server and the terminal, so that the key generation and storage mechanism is more flexibly distributed, avoiding security issues caused by single key leakage or storage node failure, and improving the fault tolerance and overall reliability of the system; ensuring that the system still has high security in the era of quantum computing; and, the embodiment of the present application realizes a more rigorous key splitting and collaborative computing mechanism, enhances the private key protection capability in multi-party participation scenarios, reduces the overall key leakage risk caused by leakage by a single party, and ensures that the subsequent decryption operation can only be completed with the joint participation of both parties; and, the embodiment of the present application realizes a more optimized key splitting and collaborative computing process, reduces the complexity and management cost of the system, simplifies the key generation, distribution and use process, and improves the system's usability and maintainability.

[0034] In some embodiments, determining a second parameter for generating a second partial public key based on the first partial public key sent by the server side includes:

[0035] Generate a public key matrix based on the first part of the public key;

[0036] determining a second partial private key and a second random error vector for storage in the terminal side;

[0037] A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key, and the second random error vector.

[0038] Therefore, in the embodiment of the present application, on the first terminal side, the second parameter for generating the second part of the public key on the first terminal side can be determined based on the first part of the public key sent by the server side, the second part of the private key in the first terminal side, and the second random error vector.

[0039] In some embodiments, the method further comprises:

[0040] Send the second parameter of the second part of the public key to the server side.

[0041] Thus, the server side can generate the second part of the public key of the server side based on the second parameter of the second part of the public key sent by the terminal side.

[0042] Accordingly, an embodiment of the present application provides a quantum attack-resistant decryption method, which is applied to the server side and includes:

[0043] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal;

[0044] Decompressing the ciphertext to obtain a first ciphertext portion and a second ciphertext portion;

[0045] According to the first partial ciphertext and the second partial ciphertext, and the pre-stored first partial private key, a partial decryption result of the ciphertext is determined and sent to the first terminal.

[0046] Corresponding to the quantum attack-resistant key generation method on the server side provided in the above-mentioned embodiment of the present application, the quantum attack-resistant decryption method applied to the server side provided in the above-mentioned embodiment of the present application realizes the collaborative decryption by the server and the terminal, ensuring that the decryption operation can only be completed with the joint participation of both parties.

[0047] In some embodiments, determining a partial decryption result of the ciphertext based on the first ciphertext portion and the second ciphertext portion includes:

[0048] Generate random error values;

[0049] Generate a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key;

[0050] The first intermediate variable is used as a partial decryption result of the ciphertext.

[0051] Therefore, the server side provided in the embodiment of the present application can determine the partial decryption result of the ciphertext based on the first and second parts of the ciphertext obtained by decompressing the ciphertext on the server side, and the first part of the private key of the server side stored in advance.

[0052] Accordingly, an embodiment of the present application provides a quantum attack-resistant decryption method, which is applied to a terminal side. The method includes:

[0053] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server;

[0054] Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

[0055] Similarly, corresponding to the quantum attack-resistant key generation method on the terminal side provided in the above-mentioned embodiment of the present application, the quantum attack-resistant decryption method applied to the terminal side provided in the above-mentioned embodiment of the present application realizes the collaborative decryption by the server and the terminal, ensuring that the decryption operation can only be completed with the joint participation of both parties.

[0056] In some embodiments, determining the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal includes:

[0057] Decompress the ciphertext to obtain a first part of the ciphertext;

[0058] Using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable required for decrypting the ciphertext based on the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext;

[0059] The second intermediate variable is compressed to obtain a plaintext corresponding to the ciphertext.

[0060] Therefore, the terminal side provided by the embodiment of the present application can decrypt the ciphertext based on the partial decryption result of the ciphertext provided by the server side and the second part of the private key pre-saved on the local first terminal side to obtain the corresponding plaintext.

[0061] An embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a server side. The device includes:

[0062] A first part public key unit, used to determine the first part public key;

[0063] A first parameter unit, configured to determine a first parameter for generating a second partial public key based on the first partial public key;

[0064] A sending unit is configured to send the first partial public key and the first parameter to a first terminal, so that the first terminal generates a second partial public key.

[0065] In some embodiments, determining the first portion of the public key includes:

[0066] Get a random number with a preset number of bytes input;

[0067] The random number is used as a seed, and a first part of the public key is generated according to the seed and a preset matrix order.

[0068] In some embodiments, determining a first parameter for generating a second partial public key based on the first partial public key includes:

[0069] Generate a public key matrix based on the first part of the public key;

[0070] determining a first partial private key and a first random error vector for storage in the server side;

[0071] A first parameter for generating a second partial public key is determined based on the public key matrix, the first partial private key, and the first random error vector.

[0072] In some embodiments, the key generation device further comprises:

[0073] The second part of the public key unit is used to determine the second part of the public key;

[0074] A public key unit, configured to determine the public key of the server side by using the first part of the public key and the second part of the public key;

[0075] a comparing unit, configured to compare whether the public key on the server side is identical to the public key published by the first terminal;

[0076] The triggering unit is configured to trigger a process of regenerating a public key when it is determined that the public key on the server side is different from the public key published by the first terminal.

[0077] In some embodiments, determining the second portion of the public key includes:

[0078] receiving a second parameter for generating a second part of the public key sent by the first terminal;

[0079] The second part of the public key on the server side is generated using the first parameter and the second parameter; wherein the second part of the public key on the server side is generated in the same manner as the second part of the public key on the first terminal side.

[0080] An embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a terminal side. The device includes:

[0081] A second parameter unit is configured to receive the first partial public key and the first parameter for generating the second partial public key sent by the server side, and determine the second parameter for generating the second partial public key according to the first partial public key sent by the server side;

[0082] A second part public key unit, configured to generate a second part public key of the terminal side using the first parameter and the second parameter;

[0083] The public key publishing unit is used to obtain and publish a public key through the first part of the public key and the second part of the public key on the terminal side.

[0084] In some embodiments, determining a second parameter for generating a second partial public key based on the first partial public key sent by the server side includes:

[0085] Generate a public key matrix based on the first part of the public key;

[0086] determining a second partial private key and a second random error vector for storage in the terminal side;

[0087] A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key, and the second random error vector.

[0088] In some embodiments, the key generation device further comprises:

[0089] A sending unit is used to send the second parameter of the second part of the public key to the server side.

[0090] An embodiment of the present application provides a quantum attack-resistant decryption device, which is applied to a server side and includes:

[0091] A ciphertext unit, configured to obtain ciphertext generated by the second terminal based on the public key published by the first terminal;

[0092] A decompression unit, configured to decompress the ciphertext to obtain a first ciphertext portion and a second ciphertext portion;

[0093] The sending unit is used to determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the partial decryption result to the first terminal.

[0094] In some embodiments, determining a partial decryption result of the ciphertext based on the first ciphertext portion and the second ciphertext portion includes:

[0095] Generate random error values;

[0096] Generate a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key;

[0097] The first intermediate variable is used as a partial decryption result of the ciphertext.

[0098] An embodiment of the present application provides a quantum attack-resistant decryption device, which is applied to a terminal. The device includes:

[0099] a receiving unit, configured to obtain a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side;

[0100] Determine a plaintext unit, which is used to determine the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal.

[0101] In some embodiments, determining the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal includes:

[0102] Decompress the ciphertext to obtain a first part of the ciphertext;

[0103] Using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable required for decrypting the ciphertext based on the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext;

[0104] The second intermediate variable is compressed to obtain a plaintext corresponding to the ciphertext.

[0105] Accordingly, an embodiment of the present application provides a system including a server and a first terminal; wherein,

[0106] The server is used to:

[0107] Determine the first part of the public key;

[0108] Determining, based on the first partial public key, a first parameter for generating a second partial public key;

[0109] Sending the first partial public key and the first parameter for generating the second partial public key to the first terminal, so that the first terminal generates the second partial public key;

[0110] The first terminal is configured to:

[0111] Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server, and determining a second parameter for generating the second partial public key based on the first partial public key sent by the server;

[0112] Generate a second part of the public key on the terminal side using the first parameter and the second parameter;

[0113] Obtain and publish a public key using the first part of the public key and the second part of the public key on the terminal side;

[0114] and / or,

[0115] The server is used to:

[0116] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal;

[0117] Decompressing the ciphertext to obtain a first ciphertext portion and a second ciphertext portion;

[0118] Determine a partial decryption result of the ciphertext based on the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the result to the first terminal;

[0119] The first terminal is configured to:

[0120] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server;

[0121] Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

[0122] Another embodiment of the present application provides an electronic device, which includes a memory and a processor, wherein the memory is used to store program instructions, and the processor is used to call the program instructions stored in the memory and execute any of the above methods according to the obtained program. BRIEF DESCRIPTION OF THE DRAWINGS

[0123] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0124] Figure 1 A schematic diagram of a flow chart of a quantum attack-resistant key generation method on the server side provided in an embodiment of the present application;

[0125] Figure 2 A schematic diagram of a flow chart of another quantum attack-resistant key generation method on the server side provided in an embodiment of the present application;

[0126] Figure 3 A schematic diagram of a flow chart of a quantum attack-resistant key generation method on a terminal side provided in an embodiment of the present application;

[0127] Figure 4 A schematic diagram of a flow chart of another method for generating a key resistant to quantum attacks on a terminal side provided in an embodiment of the present application;

[0128] Figure 5 A flowchart of a quantum attack-resistant decryption method on the server side provided in an embodiment of the present application;

[0129] Figure 6 A schematic diagram of a flow chart of a quantum attack-resistant decryption method on a terminal side provided in an embodiment of the present application;

[0130] Figure 7 A schematic diagram of a system architecture provided in an embodiment of the present application;

[0131] Figure 8 Another system architecture diagram provided for an embodiment of the present application;

[0132] Figure 9A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0133] Figure 10 A schematic diagram of the structure of a quantum attack-resistant key generation device on the server side provided in an embodiment of the present application;

[0134] Figure 11 A schematic diagram of the structure of a quantum attack-resistant key generation device on the terminal side provided in an embodiment of the present application;

[0135] Figure 12 A schematic diagram of the structure of a quantum attack-resistant decryption device on the server side provided in an embodiment of the present application;

[0136] Figure 13 A schematic diagram of the structure of a quantum attack-resistant decryption device on the terminal side provided in an embodiment of the present application. DETAILED DESCRIPTION

[0137] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0138] The embodiments of the present application provide a quantum-resistant key generation and decryption method, apparatus, system, device, and medium to improve key security, reduce or avoid the risk of key leakage, simplify the key generation, publication, and use processes, and improve the usability and maintainability of the key system.

[0139] Among them, the methods and devices, systems, equipment, and media are based on the same application concept. Since the principles of solving problems by the methods and devices, equipment, and media are similar, the implementation of the devices, equipment, media, and methods can refer to each other, and the repeated parts will not be repeated.

[0140] The terms "first", "second", etc. (if any) in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, device, system, product or equipment comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0141] The following examples and embodiments are to be understood as illustrative examples only. Although this specification may refer to "one," "an," or "some" examples or embodiments at several places, this does not mean that each such reference relates to the same example or embodiment, nor does it mean that the feature applies only to a single example or embodiment. Individual features of different embodiments may also be combined to provide further embodiments. Furthermore, terms such as "comprises" and "comprising" should be understood as not limiting the described embodiments to consisting only of those features already mentioned; such examples and embodiments may also include features, structures, units, modules, etc. that are not specifically mentioned.

[0142] The following describes in detail the various embodiments of the present application in conjunction with the accompanying drawings. It should be noted that the order in which the embodiments of the present application are presented only represents the order of the embodiments, and does not represent the advantages or disadvantages of the technical solutions provided by the embodiments.

[0143] In an embodiment of the present application, a key generation and decryption scheme based on the collaboration of the server and the terminal is proposed, which aims to strengthen the private key protection mechanism of the ML-KEM algorithm through the participation of multiple parties. The scheme adopts key splitting and distributed computing technology. The two participants jointly generate the public key, and the private key is not concentrated on a single party, thereby avoiding the problem of single point failure. Each participant only holds part of the key information and cannot independently restore the complete private key, which effectively improves the security and robustness of the system. During the decryption process, the two participants, the server and the terminal, need to jointly participate in the decryption operation to ensure that even if the key of one party is leaked or lost, the attacker cannot easily obtain the complete key or decryption information, thereby having efficient computing performance and scalability, and can adapt to different application scenarios.

[0144] The ML-KEM solution provided in the embodiments of this application introduces a server that collaborates with the first terminal to run a key generation algorithm, denoted as DK-PKE.KeyGen. This allows the server and the first terminal to each hold partial private key information, and neither can obtain the complete private key. A two-party collaborative decryption algorithm, denoted as DK-PKE.Decrypt, is also provided. With the assistance of the server, the first terminal completes the decryption operation. The encryption process of the message by the second terminal is unaffected. The collaborative key generation algorithm DK-PKE.KeyGen and the collaborative decryption algorithm DK-PKE.Decrypt are described separately below.

[0145] The relevant symbols and parameters provided in the embodiments of this application are as follows:

[0146] q: represents the prime number 3329;

[0147] represents the ring of integers generated modulo q;

[0148] R q : represents a polynomial ring R q Any element in Where n=256.

[0149] Represents R q k-dimensional vector on .

[0150] Represents a byte whose value is the set {0,1,…,255}.

[0151] G: To convert a byte string of arbitrary length into a 32-byte output, function G can be implemented using a hash function with an output length of 32 bytes.

[0152] Generate R based on seed q The k×k matrix on , where k is 3 or 4. Specifically, an extensible output function can be used to sequentially generate each element of the matrix according to the seed seed.

[0153] Randomly generate R q The k-dimensional vector is generated and obeys the central binomial distribution with parameter η, where η represents the scale of the number of binomial distribution trials, that is, the value range of each component of the generated k-dimensional vector is [-η,η].

[0154] Compression algorithm d :

[0155] Decompression algorithm d :

[0156] When the input information is a vector, the compression algorithm and the decompression algorithm mean that compression and decompression are performed on each component in the vector respectively.

[0157] η1: The private key and error vector generated when generating the public-private key pair, as well as the parameters of the distribution of the random vector generated in the encryption phase.

[0158] η2: The error vector generated during the encryption phase and the parameters of the distribution of random values;

[0159] d u : Compression and decompression parameters of the first part of the ciphertext;

[0160] d v : Compression and decompression parameters of the second part of the ciphertext;

[0161] x←$ SampleCBD(η,S): Generates a random value x from the set S, where x follows a central binomial distribution with parameter η, and each value is independently randomized.

[0162] ∥M∥ ∞ :For any element M=M0+M1X+…+M 255 X 255 ∈R q , Remember ∥M∥ ∞ =max{M i :0=0,1,…,255}.

[0163] The values ​​of some parameters are shown in Table 1 below:

[0164] n q k <![CDATA[η1]]> <![CDATA[η2]]> <![CDATA[d u ]]> <![CDATA[d v ]]> ML-KEM-512 256 3329 2 3 2 10 4 ML-KEM-768 256 3329 3 2 2 10 4 ML-KEM-1024 256 3329 4 2 2 11 5

[0165] Table 1

[0166] The following examples illustrate the key generation, encryption, and quantum attack-resistant decryption method processes from the server side and the terminal side.

[0167] In the embodiment of the present application, the collaborative quantum-resistant key generation method (DK-PKE.KeyGen) between the server and the first terminal is as follows:

[0168] See also Figure 1 , an embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to the server side, and the method includes:

[0169] S101, determining the first part of the public key;

[0170] In some embodiments, step S101 includes:

[0171] Get a random number of the preset number of bytes input;

[0172] The preset number of bytes is, for example, 32 bytes.

[0173] Using the random number as a seed, and generating a first part of the public key (e.g., denoted as ρ) according to the seed and a preset matrix order (e.g., denoted as k);

[0174] For example, seeds

[0175] The first part of the public key ρ = G (seed ∥ k);

[0176] S102: Determine a first parameter for generating a second part of the public key based on the first part of the public key;

[0177] In some embodiments, step S102 includes:

[0178] Generate a public key matrix (e.g., represented by A) based on the first part of the public key;

[0179] For example, the public key matrix A is derived using the following formula:

[0180]

[0181] Determining a first partial private key (e.g., denoted as s') and a first random error vector (e.g., denoted as e') for storage in the server side;

[0182] For example, the following formula is used to generate a partial private key s′ (i.e., a first partial private key, which is stored in the local server) for storage in the local server:

[0183]

[0184] Among them, η1 represents the parameter of the central binomial distribution that the private key obeys, and its value is 3 or 2.

[0185] Represents R q k-dimensional vector on . That is, the sampled s′ is R q The k-dimensional vector on , and the coefficient range of each component of s′ is

[0186] For example, the first random error vector e′ is generated using the following formula:

[0187]

[0188] It should be noted that ← $ The symbol represents random generation, and the result of each generation is independent and random, and the result is different. Therefore, here e' follows the same probability distribution as s' above, but the result is different.

[0189] Determining a first parameter (e.g., denoted as t') for generating a second partial public key based on the public key matrix, the first partial private key, and the first random error vector;

[0190] For example, based on the public key matrix A, the first part of the private key s′, and the first random error vector e′, the following formula is used to calculate the first parameter t′ used to generate the second part of the public key:

[0191] t′=A·s′+e′;

[0192] S103: Send the first partial public key and the first parameter for generating the second partial public key to the first terminal, so that the first terminal generates the second partial public key.

[0193] In some embodiments, step S103 includes:

[0194] The first partial public key and the first parameter are sent to a first terminal, so that the first terminal generates a second partial public key.

[0195] That is, the server stores the first part of the private key s′ as the server-side private key, and sends the first part of the public key ρ and the first parameter t′ for generating the second part of the public key to the first terminal, so that the first terminal generates the second part of the public key.

[0196] In some embodiments, see Figure 2 , the method further comprises:

[0197] S104, determining the second part of the public key;

[0198] In some embodiments, step S104 includes:

[0199] Receiving a second parameter (for example, represented as t") sent by the first terminal and used to generate a second partial public key;

[0200] Generate a second partial public key (e.g., t) on the server side using the first parameter and the second parameter. The second partial public key on the server side is generated in the same manner as the second partial public key on the first terminal side. For example, each second partial public key is calculated using the following formula:

[0201] t=t”+t';

[0202] S105: Construct a public key on the server side using the first part of the public key and the second part of the public key on the server side;

[0203] The public key is, for example, represented by (t, ρ), i.e., includes two components, t and ρ;

[0204] S106. Compare the public key on the server side with the public key published by the first terminal to see if they are the same; wherein the public key published by the first terminal is composed of the first partial public key and the second partial public key on the first terminal side;

[0205] S107: When it is determined that the public key on the server side is different from the public key published by the first terminal, a process of regenerating the public key is triggered.

[0206] For example, when it is determined that the public key on the server side is different from the public key published by the first terminal, the above step S101 is executed again. Thus, it can be ensured that the public key on the server side is the same as the public key published by the first terminal.

[0207] Accordingly, see Figure 3 , an embodiment of the present application provides a quantum attack-resistant key generation method, which is applied to a terminal side, and the method includes:

[0208] S201, receiving a first partial public key and a first parameter for generating a second partial public key sent by a server side; and determining a second parameter for generating the second partial public key based on the first partial public key sent by the server side;

[0209] In some embodiments, determining a second parameter for generating a second partial public key based on the first partial public key sent by the server side includes:

[0210] Step 1: Generate a public key matrix (e.g., represented by A) based on the first part of the public key;

[0211] For example, according to ρ, the public key matrix A is derived using the following formula:

[0212]

[0213] in, Represents R q A k×k matrix on .

[0214] Gen is a deterministic algorithm that can generate the same result based on the same ρ. Therefore, the A generated in this step is the same as the A generated on the server side.

[0215] Step 2: Determine a second partial private key (for example, represented by s") and a second random error vector (for example, represented by e") for storage in the terminal side;

[0216] For example, the following formula is used to generate the second part of the private key s″ for storage on the local first terminal side:

[0217]

[0218] Same as above, ← $ The symbol represents random generation, and the result of each generation is independent and random. Therefore, s″ in this step is different from s′ generated in step S3 on the server side.

[0219] For example, the following formula is used to generate the second random error vector e″:

[0220]

[0221] Same as above, ← $ The symbol represents random generation, and the result of each generation is independent and random. Therefore, the e″ in this step is different from the e′ generated in step S4 on the server side.

[0222] Step 3: Determine a second parameter (e.g., denoted as t") for generating the second part of the public key based on the public key matrix, the second part of the private key, and the second random error vector;

[0223] For example, based on the public key matrix A, the second part of the private key s″ and the second random error vector e″, the second parameter t″ used to generate the second part of the public key is calculated using the following formula:

[0224] t″=A·s″+e″;

[0225] S202: Generate a second partial public key (e.g., denoted as t) on the terminal side using the first parameter and the second parameter;

[0226] For example, based on the first parameter t′ and the second parameter t″, the second part of the public key t (i.e., the complete value of the second part of the public key) is calculated using the following formula:

[0227] t=t″+t′;

[0228] S203: Obtain and publish a public key using the first part of the public key and the second part of the public key on the terminal side.

[0229] The public key is, for example, represented by (t, ρ), which includes two components, ρ and t, namely, the first part of the public key and the second part of the public key.

[0230] In some embodiments, see Figure 4 , the method further comprises:

[0231] S204: Send the second parameter of the second part of the public key to the server. This can assist the server in generating a server-side public key based on the second parameter of the second part of the public key. Furthermore, the server can compare the server-side public key with the public key published by the first terminal to see if they are identical. If they are not identical, re-keying can be triggered to ensure that the server-side public key is identical to the public key published by the first terminal.

[0232] In some embodiments, the method (K-PKE.Encrypt) for encrypting plaintext m using the public key (t, ρ) published by the first terminal on the second terminal side provided in the embodiments of the present application includes:

[0233] Step 1: Obtain a 32-byte plaintext message m and the public key (t, ρ) published by the first terminal;

[0234] in,

[0235] Step 2: Derive the public key matrix based on ρ:

[0236]

[0237] Step 3: Generate random vectors:

[0238]

[0239] Step 4: Generate random error vectors:

[0240]

[0241] Step 5: Generate random error values:

[0242] e2← $ SampleCBD(η2,R q );

[0243] Step 6. Calculate the first part of the ciphertext to get the intermediate information:

[0244] u=A T y+e1;

[0245] Step 7. Calculate the first part of the ciphertext:

[0246]

[0247] Step 8. Map the plaintext to R q Elements in:

[0248] μ = Decompress1(m);

[0249] Step 9. Calculate the median value of the second part of the ciphertext:

[0250] v=t T ·y+e2+μ;

[0251] Step 10. Calculate the second part of the ciphertext:

[0252]

[0253] Step 11. Generate and output ciphertext: (c1, c2).

[0254] Accordingly, after receiving the ciphertext (c1, c2), the first terminal and the server collaborate to decrypt the ciphertext (DK-PKE.Decrypt) as follows:

[0255] See also Figure 5 , an embodiment of the present application provides a quantum attack-resistant decryption method, applied to the server side, the method comprising:

[0256] S301. Obtain ciphertext generated by the second terminal based on the public key published by the first terminal;

[0257] The ciphertext is, for example, represented as (C1, C2);

[0258] S302. Decompress the ciphertext to obtain a first ciphertext portion (e.g., represented as u') and a second ciphertext portion (e.g., represented as v');

[0259] For example, for the ciphertext (c1, c2), the first part of the ciphertext u′ is decompressed as follows:

[0260]

[0261] For the ciphertext (c1, c2), decompress it as follows to get the second ciphertext v′:

[0262]

[0263] S303: Determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and the pre-stored first partial private key, and send the partial decryption result to the first terminal.

[0264] In some embodiments, step S303 includes:

[0265] Step 1: Generate a random error value (e.g., e2');

[0266] For example, based on the preset parameters η2, R q , use the following formula to generate the random error value e′2:

[0267] e′2← $ SampleCBD(η2,R q );

[0268] Step 2: Generate a first intermediate variable (e.g., represented as w') based on the first and second ciphertext parts, a random error value, and a pre-stored first private key;

[0269] In some embodiments, generating a first intermediate variable according to the first ciphertext portion and the second ciphertext portion, a random error value, and a pre-stored first private key includes:

[0270] The first intermediate variable w′ is generated using the following formula:

[0271] w′=v′-s′ T u′+e′2;

[0272] Wherein, v′ represents the second part of the ciphertext;

[0273] s′ T represents the transpose of the first part of the private key (vector or matrix);

[0274] u′ represents the first part of the ciphertext;

[0275] e′2 represents the random error value.

[0276] Step 3: Use the first intermediate variable as a partial decryption result of the ciphertext.

[0277] Accordingly, see Figure 6 , an embodiment of the present application provides a quantum attack-resistant decryption method, applied to a terminal side, the method comprising:

[0278] S401. Obtaining a ciphertext generated by a second terminal based on a public key published by a first terminal, and a partial decryption result of the ciphertext sent by a server;

[0279] A partial decryption result of the ciphertext sent by the server, for example, a first intermediate variable sent by the server as a partial decryption result generated for the ciphertext;

[0280] The ciphertext is, for example, represented as (C1, C2);

[0281] S402: Determine the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal.

[0282] In some embodiments, step S402 includes:

[0283] Step 1: Decompress the ciphertext to obtain a first portion of the ciphertext (e.g., represented as u');

[0284] For example, for the ciphertext (c1, c2), decompression obtains the first part of the ciphertext u′:

[0285]

[0286] Step 2: Using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable (e.g., denoted as w) required for decrypting the ciphertext based on the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext;

[0287] In some embodiments, determining a second intermediate variable required for decrypting the ciphertext based on the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext includes:

[0288] The second intermediate variable w is generated using the following formula:

[0289] w=w′-s″T u′ ;

[0290] Wherein, w′ represents the first intermediate variable;

[0291] s″ T represents the transpose of the second part of the private key;

[0292] u′ represents the first part of the ciphertext.

[0293] Step 3: compress the second intermediate variable to obtain the plaintext corresponding to the ciphertext (for example, represented as m').

[0294] For example, compress the second intermediate variable w to obtain the plaintext m′:

[0295] m′=Compress1(w);

[0296] Finally, the decrypted plaintext m′ can be output.

[0297] If the calculation is correct, the plaintext m′ decrypted by the first terminal should be the same as the plaintext m input into the second terminal.

[0298] It should be noted that the second ciphertext v' has been processed in step S302 on the server side and further processed into the first intermediate variable w' in step S302 and sent to the first terminal. Therefore, the first terminal does not need to process the second ciphertext v' again.

[0299] In summary:

[0300] 1. From step S105 on the server side and steps S204 and S205 on the first terminal side in the collaborative quantum attack-resistant key generation method DK-PKE.KeyGen provided by the above embodiment of the present application, it can be seen that:

[0301] t=A·(s′+s″)+e′+e″;

[0302] Therefore, the real private key in the collaborative key generation scheme provided in the embodiment of the present application is:

[0303] s=s′+s″;

[0304] We can remember e=e′+e″.

[0305] 2. From step S304 on the server side and step S403 on the first terminal side in the collaborative quantum attack-resistant decryption method DK-PKE.Decrypt provided by the embodiment of the present application, it can be seen that:

[0306]

[0307]

[0308] in,

[0309] 3. When When:

[0310]

[0311] Therefore, Compress1(w)=Compress1(Decompress1(m))=m.

[0312] It should be noted that the probability of successful decryption can be adjusted according to actual needs by adjusting the values ​​of the relevant parameters involved in the above calculation process (that is, in the embodiment of the present application, it is not limited to the parameter values ​​shown in Table 1 above) so that the probability of successful decryption meets the actual application needs.

[0313] In the embodiments of the present application, the first terminal and the server collaborate to perform key generation and decryption, avoiding the single point of failure that occurs when the first terminal independently controls the private key. Furthermore, the first terminal and the server cannot derive each other's partial private key; that is, neither party possesses the complete private key. Decryption can only be completed through collaboration between the two parties. Therefore, an attacker can only recover the complete private key by simultaneously obtaining the private keys of the server and the first terminal. This makes cracking the private key more difficult and resists quantum computing attacks. Furthermore, the collaborative participation of the server reduces the computational effort required for key generation and decryption on the terminal side.

[0314] The following introduces the system, equipment or device provided in the embodiments of the present application, in which the explanations or examples of technical features that are the same as or corresponding to those described in the above method are not repeated hereafter.

[0315] See also Figure 7 , an embodiment of the present application provides a system, comprising a server 70 and at least one first terminal 71; wherein,

[0316] The server 70 is used to:

[0317] Determine the first part of the public key;

[0318] Determining, based on the first partial public key, a first parameter for generating a second partial public key;

[0319] Sending the first partial public key and the first parameter for generating the second partial public key to the first terminal, so that the first terminal generates the second partial public key;

[0320] The first terminal 71 is configured to:

[0321] Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server, and determining a second parameter for generating the second partial public key based on the first partial public key sent by the server;

[0322] Generate a second part of the public key on the terminal side using the first parameter and the second parameter;

[0323] The public key is obtained and published through the first part of the public key and the second part of the public key on the terminal side.

[0324] and / or:

[0325] The server 70 is used to:

[0326] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal;

[0327] Decompressing the ciphertext to obtain a first ciphertext portion and a second ciphertext portion;

[0328] Determine a partial decryption result of the ciphertext based on the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the result to the first terminal;

[0329] The first terminal 71 is configured to:

[0330] Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server;

[0331] Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

[0332] Of course, in some embodiments, see Figure 8 The system may further include at least one second terminal 72 for encryption, the specific functions of which are as described in the encryption method on the second terminal side above, and will not be repeated here.

[0333] An electronic device provided in an embodiment of the present application may be the above-mentioned server or the above-mentioned terminal. Figure 9 , the electronic device includes, for example: a processor 600 and a memory 620.

[0334] The processor 600 is used to read the program in the memory 620 and execute any one of the method processes provided in the above-mentioned embodiments of the present application, and the details will not be repeated here.

[0335] In some embodiments, the processor 600 is also used to read the program in the memory 620 and execute the above-mentioned encryption process on the second terminal side (the details will not be repeated here). That is to say, the electronic device provided in the embodiment of the present application, when used as a terminal, can simultaneously have the key generation, encryption, and decryption functions provided in the above-mentioned embodiment of the present application.

[0336] The transceiver 610 is configured to receive and send data under the control of the processor 600 .

[0337] Among them, Figure 9 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 600 and memory represented by memory 620. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 610 may be a plurality of components, i.e., a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, such as a wireless channel, a wired channel, an optical cable, and the like. For different user devices, the user interface 630 may also be an interface capable of connecting external or internal devices as required, and the connected devices include but are not limited to a keypad, a display, a speaker, a microphone, a joystick, and the like.

[0338] The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 can store data used by the processor 600 when performing operations.

[0339] In some embodiments, the processor 600 may be a CPU (central processing unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a CPLD (Complex Programmable Logic Device), and the processor may also adopt a multi-core architecture.

[0340] The processor calls the computer program stored in the memory to execute any of the methods provided in the embodiments of the present application according to the obtained executable instructions. The processor and the memory can also be arranged physically separately.

[0341] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0342] See also Figure 10 The embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a server side. The device includes:

[0343] A first part public key unit 11, used to determine the first part public key;

[0344] A first parameter unit 12 is configured to determine a first parameter for generating a second partial public key based on the first partial public key;

[0345] The sending unit 13 is configured to send the first partial public key and the first parameter to the first terminal, so that the first terminal generates a second partial public key.

[0346] In some embodiments, the key generation device further comprises:

[0347] The second part of the public key unit is used to determine the second part of the public key;

[0348] A public key unit, configured to determine the public key of the server side by using the first part of the public key and the second part of the public key;

[0349] a comparing unit, configured to compare whether the public key on the server side is identical to the public key published by the first terminal;

[0350] The triggering unit is configured to trigger a process of regenerating a public key when it is determined that the public key on the server side is different from the public key published by the first terminal.

[0351] In some embodiments, determining the first portion of the public key includes:

[0352] Get a random number of the preset number of bytes input;

[0353] The random number is used as a seed, and a first part of the public key is generated according to the seed and a preset matrix order.

[0354] In some embodiments, determining a first parameter for generating a second partial public key based on the first partial public key includes:

[0355] Generate a public key matrix based on the first part of the public key;

[0356] determining a first partial private key and a first random error vector for storage in the server side;

[0357] A first parameter for generating a second partial public key is determined based on the public key matrix, the first partial private key, and the first random error vector.

[0358] In some embodiments, determining the second partial public key includes:

[0359] receiving a second parameter for generating a second part of the public key sent by the first terminal;

[0360] The second part of the public key on the server side is generated using the first parameter and the second parameter; wherein the second part of the public key on the server side is generated in the same manner as the second part of the public key on the first terminal side.

[0361] Accordingly, see Figure 11 , an embodiment of the present application provides a quantum attack-resistant key generation device, which is applied to a terminal side, and the device includes:

[0362] The second parameter unit 21 is configured to receive the first partial public key and the first parameter for generating the second partial public key sent by the server side, and determine the second parameter for generating the second partial public key according to the first partial public key sent by the server side;

[0363] A second partial public key unit 22, configured to generate a second partial public key on the terminal side using the first parameter and the second parameter;

[0364] The public key publishing unit 23 is configured to obtain and publish a public key using the first part of the public key and the second part of the public key on the terminal side.

[0365] In some embodiments, determining a second parameter for generating a second partial public key based on the first partial public key sent by the server side includes:

[0366] Generate a public key matrix based on the first part of the public key;

[0367] determining a second partial private key and a second random error vector for storage in the terminal side;

[0368] A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key, and the second random error vector.

[0369] In some embodiments, the key generation device further comprises:

[0370] A sending unit is used to send the second parameter of the second part of the public key to the server side.

[0371] Accordingly, see Figure 12, an embodiment of the present application provides a quantum attack-resistant decryption device, which is applied to a server side, and the device includes:

[0372] The ciphertext unit 31 is used to obtain the ciphertext generated by the second terminal based on the public key published by the first terminal;

[0373] A decompression unit 32 is configured to decompress the ciphertext to obtain a first ciphertext portion and a second ciphertext portion;

[0374] The sending unit 33 is configured to determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the partial decryption result to the first terminal.

[0375] In some embodiments, determining a partial decryption result of the ciphertext based on the first ciphertext portion and the second ciphertext portion includes:

[0376] Generate random error values;

[0377] Generate a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key;

[0378] The first intermediate variable is used as a partial decryption result of the ciphertext.

[0379] In some embodiments, generating a first intermediate variable according to the first ciphertext portion and the second ciphertext portion, a random error value, and a pre-stored first private key includes:

[0380] The first intermediate variable w′ is generated using the following formula:

[0381] w′=v′-s′ T u′+e′2;

[0382] Wherein, v′ represents the second part of the ciphertext;

[0383] s′ T represents the transpose of the first part of the private key;

[0384] u′ represents the first part of the ciphertext;

[0385] e′2 represents the random error value.

[0386] Accordingly, see Figure 13 , an embodiment of the present application provides a quantum attack-resistant decryption device, which is applied to a terminal side, and the device includes:

[0387] The receiving unit 41 is configured to obtain a ciphertext generated by the second terminal based on the public key published by the first terminal, and a partial decryption result of the ciphertext sent by the server side;

[0388] A plaintext determination unit 42 is configured to determine a plaintext corresponding to the ciphertext based on a partial decryption result of the ciphertext and a second partial private key pre-stored by the local first terminal;

[0389] In some embodiments, determining the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal includes:

[0390] Decompress the ciphertext to obtain a first part of the ciphertext;

[0391] Using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable required for decrypting the ciphertext based on the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext;

[0392] The second intermediate variable is compressed to obtain a plaintext corresponding to the ciphertext.

[0393] In some embodiments, determining a second intermediate variable required for decrypting the ciphertext based on the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext includes:

[0394] The second intermediate variable w is generated using the following formula:

[0395] w=w′-s″T u′ ;

[0396] Wherein, w′ represents the first intermediate variable;

[0397] s″ T represents the transpose of the second part of the private key;

[0398] u′ represents the first part of the ciphertext.

[0399] It should be noted that the division of units in the embodiments of the present application is schematic and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0400] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0401] Any of the devices or apparatuses provided in the embodiments of the present application may specifically be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), etc. They may include a central processing unit (CPU), a memory, input / output devices, etc. Input devices may include a keyboard, a mouse, a touch screen, etc. Output devices may include a display device, such as a liquid crystal display (LCD) or a cathode ray tube (CRT).

[0402] The memory may include a read-only memory (ROM) and a random access memory (RAM), and provides program instructions and data stored in the memory to the processor. In an embodiment of the present application, the memory may be used to store the program of any of the methods provided in the embodiments of the present application.

[0403] The processor calls the program instructions stored in the memory, and the processor is used to execute any of the methods provided in the embodiments of the present application according to the obtained program instructions.

[0404] The present application embodiment also provides a computer program product or computer program, which includes computer instructions, which are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions so that the computer device performs any of the methods described in the above embodiments. The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0405] The present invention provides a computer-readable storage medium for storing computer program instructions used by the apparatus provided in the above embodiments of the present invention, which includes a program for executing any of the methods provided in the above embodiments of the present invention. The computer-readable storage medium may be a non-transitory computer-readable medium.

[0406] The computer-readable storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (such as ROMs, EPROMs, EEPROMs, non-volatile memories (NANDFLASH), solid-state drives (SSDs)), etc.

[0407] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A quantum attack-resistant key generation method, characterized in that: Applied to the server side, the method includes: Determine the first part of the public key; Determining, based on the first partial public key, a first parameter for generating a second partial public key; Sending the first partial public key and the first parameter for generating the second partial public key to the first terminal, so that the first terminal generates the second partial public key; The determining of the first part of the public key includes: Get a random number of the preset number of bytes input; Using the random number as a seed, and generating a first part of the public key according to the seed and a preset matrix order; Determining, based on the first partial public key, a first parameter for generating a second partial public key includes: Generate a public key matrix based on the first part of the public key; determining a first partial private key and a first random error vector for storage in the server side; Determining a first parameter for generating a second partial public key based on the public key matrix, the first partial private key, and the first random error vector; Enabling the first terminal to generate the second part of the public key includes enabling the first terminal to generate the second part of the public key in the following manner: Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server, and determining a second parameter for generating the second partial public key based on the first partial public key sent by the server; Adding the first parameter and the second parameter to generate a second part of the public key on the terminal side; The first terminal obtains and publishes a public key using the first partial public key and the second partial public key on the terminal side; wherein the first partial public key and the second partial public key on the terminal side are two components of the public key published by the first terminal; The step of determining, based on the first part of the public key sent by the server side, a second parameter for generating the second part of the public key comprises: Generate a public key matrix based on the first part of the public key; determining a second partial private key and a second random error vector for storage in the terminal side; A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key, and the second random error vector.

2. The method according to claim 1, characterized in that The method further comprises: Determine the second part of the public key; Determine the public key of the server side by using the first part of the public key and the second part of the public key; Comparing the public key on the server side with the public key published by the first terminal to see if they are the same; When it is determined that the public key on the server side is different from the public key published by the first terminal, a process of regenerating the public key is triggered.

3. The method according to claim 2, characterized in that Determine the second part of the public key, including: Receiving a second parameter sent by the first terminal for generating a second part of the public key; The second part of the public key on the server side is generated using the first parameter and the second parameter; wherein the second part of the public key on the server side is generated in the same manner as the second part of the public key on the first terminal side.

4. A quantum attack-resistant key generation method, characterized in that: Applied to the terminal side, the method includes: Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server, and determining a second parameter for generating the second partial public key based on the first partial public key sent by the server; Adding the first parameter and the second parameter to generate a second part of the public key on the terminal side; Obtain and publish a public key using the first public key and the second public key on the terminal side; wherein the first public key and the second public key on the terminal side are two components of the published public key; The step of determining, based on the first part of the public key sent by the server side, a second parameter for generating the second part of the public key comprises: Generate a public key matrix based on the first part of the public key; determining a second partial private key and a second random error vector for storage in the terminal side; A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key, and the second random error vector.

5. The method according to claim 4, characterized in that The method further comprises: Send the second parameter of the second part of the public key to the server side.

6. A decryption method resistant to quantum attacks, characterized in that: Applied to the server side, the method includes: Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal using the method of claim 4; Decompressing the ciphertext to obtain a first ciphertext portion and a second ciphertext portion; According to the first partial ciphertext and the second partial ciphertext, and the pre-stored first partial private key, a partial decryption result of the ciphertext is determined and sent to the first terminal.

7. The method according to claim 6, characterized in that Determining a partial decryption result of the ciphertext based on the first ciphertext portion and the second ciphertext portion includes: Generate random error values; Generate a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key; The first intermediate variable is used as a partial decryption result of the ciphertext.

8. A decryption method resistant to quantum attacks, characterized in that: Applied to the terminal side, the method includes: Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal using the method of claim 4, and a partial decryption result of the ciphertext sent by the server; Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

9. The method according to claim 8, characterized in that Determining a plaintext corresponding to the ciphertext based on a partial decryption result of the ciphertext and a second partial private key pre-stored by the local first terminal includes: Decompress the ciphertext to obtain a first part of the ciphertext; Using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable required for decrypting the ciphertext based on the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext; The second intermediate variable is compressed to obtain a plaintext corresponding to the ciphertext.

10. A quantum attack-resistant key generation device, characterized in that: Applied to the server side, the device includes: A first part public key unit, used to determine the first part public key; A first parameter unit, configured to determine a first parameter for generating a second partial public key based on the first partial public key; a sending unit, configured to send the first partial public key and the first parameter to a first terminal, so that the first terminal generates a second partial public key; The determining of the first part of the public key includes: Get a random number with a preset number of bytes input; Using the random number as a seed, and generating a first part of the public key according to the seed and a preset matrix order; Determining, based on the first partial public key, a first parameter for generating a second partial public key includes: Generate a public key matrix based on the first part of the public key; determining a first partial private key and a first random error vector for storage in the server side; Determining a first parameter for generating a second partial public key based on the public key matrix, the first partial private key, and the first random error vector; Enabling the first terminal to generate the second part of the public key includes enabling the first terminal to generate the second part of the public key in the following manner: Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server, and determining a second parameter for generating the second partial public key based on the first partial public key sent by the server; Adding the first parameter and the second parameter to generate a second part of the public key on the terminal side; The first terminal obtains and publishes a public key using the first partial public key and the second partial public key on the terminal side; wherein the first partial public key and the second partial public key on the terminal side are two components of the public key published by the first terminal; The step of determining, based on the first part of the public key sent by the server side, a second parameter for generating the second part of the public key comprises: Generate a public key matrix based on the first part of the public key; determining a second partial private key and a second random error vector for storage in the terminal side; A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key, and the second random error vector.

11. The device according to claim 10, characterized in that The key generating device further comprises: The second part of the public key unit is used to determine the second part of the public key; A public key unit, configured to determine the public key of the server side by using the first part of the public key and the second part of the public key; a comparing unit, configured to compare whether the public key on the server side is identical to the public key published by the first terminal; The triggering unit is configured to trigger a process of regenerating a public key when it is determined that the public key on the server side is different from the public key published by the first terminal.

12. The device according to claim 11, characterized in that Determining the second part of the public key includes: Receiving a second parameter sent by the first terminal for generating a second part of the public key; The second part of the public key on the server side is generated using the first parameter and the second parameter; wherein the second part of the public key on the server side is generated in the same manner as the second part of the public key on the first terminal side.

13. A quantum attack-resistant key generation device, characterized in that: Applied to the terminal side, the device includes: A second parameter unit is configured to receive the first partial public key and the first parameter for generating the second partial public key sent by the server side, and determine the second parameter for generating the second partial public key according to the first partial public key sent by the server side; A second part public key unit, configured to add the first parameter and the second parameter to generate a second part public key on the terminal side; a public key publishing unit, configured to obtain and publish a public key using the first partial public key and the second partial public key on the terminal side; wherein the first partial public key and the second partial public key on the terminal side are two components of the published public key; The step of determining, based on the first part of the public key sent by the server side, a second parameter for generating the second part of the public key comprises: Generate a public key matrix based on the first part of the public key; determining a second partial private key and a second random error vector for storage in the terminal side; A second parameter for generating a second partial public key is determined according to the public key matrix, the second partial private key, and the second random error vector.

14. The device according to claim 13, characterized in that The key generating device further comprises: A sending unit is used to send the second parameter of the second part of the public key to the server side.

15. A quantum attack-resistant decryption device, characterized in that: Applied to the server side, the device includes: A ciphertext unit, configured to obtain a ciphertext generated by the second terminal based on the public key published by the first terminal using the method of claim 4; A decompression unit, configured to decompress the ciphertext to obtain a first ciphertext portion and a second ciphertext portion; The sending unit is used to determine a partial decryption result of the ciphertext according to the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the partial decryption result to the first terminal.

16. The device according to claim 15, characterized in that Determining a partial decryption result of the ciphertext based on the first ciphertext portion and the second ciphertext portion includes: Generate random error values; Generate a first intermediate variable according to the first ciphertext and the second ciphertext, a random error value, and a pre-stored first private key; The first intermediate variable is used as a partial decryption result of the ciphertext.

17. A quantum attack-resistant decryption device, characterized in that: Applied to the terminal side, the device includes: a receiving unit, configured to obtain a ciphertext generated by the second terminal based on the public key published by the first terminal using the method of claim 4, and a partial decryption result of the ciphertext sent by the server side; Determine a plaintext unit, which is used to determine the plaintext corresponding to the ciphertext based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal.

18. The device according to claim 17, characterized in that Determining a plaintext corresponding to the ciphertext based on a partial decryption result of the ciphertext and a second partial private key pre-stored by the local first terminal includes: Decompress the ciphertext to obtain a first part of the ciphertext; Using the partial decryption result of the ciphertext as a first intermediate variable, and determining a second intermediate variable required for decrypting the ciphertext based on the first intermediate variable, the second partial private key pre-stored by the local first terminal, and the first partial ciphertext; The second intermediate variable is compressed to obtain a plaintext corresponding to the ciphertext.

19. A system, characterized in that: comprising a server and a first terminal; wherein, The server is used to: Determine the first part of the public key; Determining, based on the first partial public key, a first parameter for generating a second partial public key; Sending the first partial public key and the first parameter for generating the second partial public key to the first terminal, so that the first terminal generates the second partial public key; The determining of the first part of the public key includes: Get a random number with a preset number of bytes input; Using the random number as a seed, and generating a first part of the public key according to the seed and a preset matrix order; Determining, based on the first partial public key, a first parameter for generating a second partial public key includes: Generate a public key matrix based on the first part of the public key; determining a first partial private key and a first random error vector for storage in the server side; Determining a first parameter for generating a second partial public key based on the public key matrix, the first partial private key, and the first random error vector; The first terminal is configured to: Receiving a first partial public key and a first parameter for generating a second partial public key sent by the server, and determining a second parameter for generating the second partial public key based on the first partial public key sent by the server; Adding the first parameter and the second parameter to generate a second part of the public key on the terminal side; Obtain and publish a public key using the first public key and the second public key on the terminal side; wherein the first public key and the second public key on the terminal side are two components of the published public key; The step of determining, based on the first part of the public key sent by the server side, a second parameter for generating the second part of the public key comprises: Generate a public key matrix based on the first part of the public key; determining a second partial private key and a second random error vector for storage in the terminal side; Determining a second parameter for generating a second partial public key based on the public key matrix, the second partial private key, and the second random error vector; and / or, The server is used to: Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal using the method of claim 4; Decompressing the ciphertext to obtain a first ciphertext portion and a second ciphertext portion; Determine a partial decryption result of the ciphertext based on the first partial ciphertext and the second partial ciphertext, and a pre-stored first partial private key, and send the result to the first terminal; The first terminal is configured to: Obtaining a ciphertext generated by the second terminal based on the public key published by the first terminal using the method of claim 4, and a partial decryption result of the ciphertext sent by the server; Based on the partial decryption result of the ciphertext and the second partial private key pre-stored by the local first terminal, the plaintext corresponding to the ciphertext is determined.

20. An electronic device, characterized in that: include: a memory for storing program instructions; A processor, configured to call the program instructions stored in the memory and execute the method according to any one of claims 1 to 9 according to the obtained program.

Images