Construction method and system of homomorphic friendly S box

Abstract

The invention discloses a homomorphic friendly S box construction method and system, and relates to the communication encryption technology, and the method comprises the steps: determining the feature size of a finite field # imgabs0 #; randomly selecting a non-zero constant alpha on a finite field # imgabs 1 #; selecting an irreducible polynomial f (x) on any field according to the determined finite field # imgabs2 # under the condition that q is equal to 2n, determining that addition and multiplication on the finite field # imgabs3 # are exclusive-or operation and multiplication on the field # imgabs4 # respectively, and determining that addition and multiplication on the finite field # imgabs5 # are modular p addition and modular p multiplication respectively under the condition that q is a prime number p; and executing specified mathematical operation on any input # imgabs6 # to obtain an output # imgabs7 # as a constructed homomorphic friendly S box. On the basis of a 4-branch generalized Feistel cryptographic structure, the round operation comprises multiplication and addition (q is a prime number p or a power 2n of 2) on a large feature finite field # imgabs8 #, four rounds of iteration are carried out on the round operation, and finally a homomorphic friendly S box is generated.

Description

Technical Field

[0001] The present application relates to the field of communication encryption technology, and in particular to a method and system for constructing a homomorphic friendly S-box. Background Art

[0002] Homomorphic encryption is the only cryptographic technology with non-interactive ciphertext calculation function. It can directly calculate the encrypted ciphertext, avoiding the traditional decryption before operation. It is a safe and effective data protection solution with broad application prospects in protecting cloud computing, big data, artificial intelligence and other fields. The hot spots of homomorphic encryption scheme design are mainly shallow homomorphic encryption and full homomorphic encryption. Since shallow homomorphic encryption is the basis for constructing full homomorphic encryption, the development paths of the two are consistent. Fully homomorphic encryption has developed into three generations of scheme types: the first generation of fully homomorphic encryption, represented by Gentry09 and DGHV schemes, achieves bootstrapping by compressing decryption circuits, but the ciphertext calculation efficiency is low and the security is non-standard assumptions; the second generation of fully homomorphic encryption, represented by BGV, BFV, CKKS schemes, requires the circuit multiplication depth to be input in advance, and the low growth rate of ciphertext noise is achieved through modular conversion or high-bit embedding technology of messages. It is a hierarchical fully homomorphic encryption scheme with the advantage of high ciphertext calculation efficiency. The third generation of fully homomorphic encryption, represented by the GSW and TFHE schemes, implements a fast bootstrap algorithm through double-layer homomorphic encryption. The single-bit bootstrap algorithm can achieve an efficiency of 10 milliseconds.

[0003] Existing semi- / full homomorphic encryption schemes generally have problems such as huge ciphertext expansion and slow encryption speed, and high computing and memory costs. In order to solve the problems of ciphertext expansion and low computing efficiency in existing semi- / full homomorphic encryption schemes, realize efficient engineering applications of homomorphic encryption schemes, and provide users with safe and efficient data protection support, scholars have proposed a data outsourcing computing scheme combined with symmetric encryption in recent years, the Hybrid Homomorphic Encryption (HHE) scheme. Under the premise of ensuring data privacy and security, the HHE scheme uses the performance advantages of symmetric encryption algorithms to achieve efficient and low communication overhead full homomorphic encryption, which is to achieve efficient landing engineering applications of full homomorphic encryption schemes. First, the user uses a symmetric encryption algorithm to encrypt the original data, and uses a homomorphic encryption scheme to encrypt the symmetric encryption key, and then sends the ciphertext and the encrypted key to the server. Before executing the ciphertext calculation, the server needs to homomorphically execute the decryption algorithm of the symmetric encryption algorithm to realize the conversion of the ciphertext of the symmetric encryption algorithm to the ciphertext encrypted by the homomorphic encryption algorithm. In this solution, users only need to transmit message data encrypted by symmetric encryption in the network, and then obtain the homomorphically encrypted message on the server.

[0004] The symmetric encryption algorithm used in HHE should be able to perform this conversion operation efficiently, with low multiplication complexity and small multiplication depth. This symmetric encryption algorithm suitable for homomorphic operations is called a homomorphic-friendly symmetric encryption algorithm. The homomorphic-friendly symmetric encryption algorithm used in the hybrid homomorphic encryption scheme is studied. Under the premise of ensuring data privacy and security, the performance advantages of the symmetric encryption algorithm are used to achieve efficient and low-communication overhead homomorphic encryption.

[0005] The core of the design of homomorphic friendly symmetric encryption algorithms is to find homomorphic friendly nonlinear components. For traditional symmetric cryptographic algorithm nonlinear components, their nonlinearity is generally required to be as high as possible to ensure security, but this conflicts with the homomorphic friendly characteristic requirements and is difficult to meet at the same time. Existing fully homomorphic encryption schemes such as BGV and BFV operate more on finite fields with large features. On (where q is 2 n or large prime number p), for the HHE scheme designed based on this operation domain, the underlying symmetric encryption algorithm needs to complete the encryption of data on a large characteristic finite field. The conventional small-scale S-box is no longer suitable for algorithm design, and a larger-scale S-box is needed. However, as the scale of the S-box increases, there are two main problems: first, its cryptographic properties such as differential uniformity, linearity, algebraic number, etc. cannot be directly calculated, and its security cannot be ensured; second, in order to ensure a certain degree of security, the operation of large-scale S-boxes is generally very complicated, and the corresponding multiplication complexity and multiplication depth are high, which is not suitable for the design of homomorphic friendly symmetric cryptographic algorithms. Summary of the invention

[0006] The embodiment of the present application proposes a homomorphic friendly S-box construction method and system, based on a 4-branch generalized Feistel cipher structure, and the round operation contains a large characteristic finite field Multiplication and addition on (where q is a prime number p or a power of 2 n ), perform 4 rounds of round operations and finally generate a homomorphic friendly S-box.

[0007] The present application embodiment provides a method for constructing a homomorphic friendly S-box, including:

[0008] Determine the finite field The characteristic size of

[0009] Randomly select a finite field The upper non-zero constant α;

[0010] According to a certain finite field At q = 2 n In the case of , choose an irreducible polynomial f(x) on any field and determine the finite field The addition and multiplication on are XOR and domain respectively. Multiplication operation on ;

[0011] For any input Perform the specified mathematical operation and get the output Homomorphically friendly S-boxes as constructions.

[0012] Optionally, determine the finite field The characteristic size includes: determining the value of q, where q is a prime number p or a power of 22 n .

[0013] Optionally, it also includes: according to a determined finite field When q=p, determine the finite field Addition and multiplication on are modular p addition and modular p multiplication.

[0014] Optional, for any input Performs specified mathematical operations including:

[0015] For any input Perform the following mathematical operations:

[0016] y0=x1x2+x0+α

[0017] y1=x2(x0x1+x3+α)+x1+α

[0018] y2=(x0x1+x3+α)(x1x2+x0+α)+x2+α

[0019] y3=x0x1+x3+α.

[0020] Optionally, it also includes a finite field determined according to In the finite field, we select In the case of any input The multiplications in the mathematical operations performed are all bitwise AND operations.

[0021] An embodiment of the present application also proposes a homomorphic friendly S-box construction system, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the aforementioned homomorphic friendly S-box construction method are implemented.

[0022] The embodiment of the present application is based on a 4-branch generalized Feistel cipher structure, and the round operation includes a large characteristic finite field. Multiplication and addition on (where q is a prime number p or a power of 2 n ), perform 4 rounds of round operations and finally generate a homomorphic friendly S-box.

[0023] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0025] Figure 1 The following is a basic flow diagram of a method for constructing a homomorphic friendly S-box according to an embodiment of the present application;

[0026] Figure 2 A schematic diagram of the homomorphic friendly S-box structure of the method for constructing a homomorphic friendly S-box according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] The present application embodiment proposes a method for constructing a homomorphic friendly S-box, such as Figure 1 As shown, the following steps are included:

[0029] In step S1, a finite field is determined The characteristic size of , that is, in some embodiments, determines the finite field The characteristic size includes: determining the value of q, where q is a prime number p or a power of 22 n .

[0030] In step S2, a finite field is randomly selected A nonzero constant α.

[0031] In step S3, according to the determined finite field At q = 2 n In the case of , choose an irreducible polynomial f(x) on any field and determine the finite field The addition and multiplication on are XOR and domain respectively. In some examples, when q is a prime number p, the addition and multiplication on the field are respectively modulo p addition and modulo p multiplication.

[0032] In step S4, for any input Perform the specified mathematical operation and get the output Homomorphically friendly S-boxes as constructions.

[0033] The embodiment of the present application is based on a 4-branch generalized Feistel cipher structure, and the round operation includes a large characteristic finite field. Multiplication and addition on (where q is a prime number p or a power of 2 n ), the round operation is iterated for 4 rounds, and finally a homomorphic friendly S box is generated. The homomorphic friendly S box designed in this application can be used for the design of symmetric cryptographic algorithms in the hybrid homomorphic encryption transcoding framework. The user end uses the symmetric cryptographic algorithm to encrypt local data before transmitting it to the cloud, which can strictly guarantee the security of outsourced data. Its low multiplication complexity and depth can effectively improve the computational efficiency of the homomorphic encryption scheme and significantly reduce the communication overhead between the user end and the server.

[0034] In some examples, for any input Performs specified mathematical operations including:

[0035] For any input like Figure 2 As shown, the following mathematical operations are performed:

[0036] y0=x1x2+x0+α

[0037] y1=x2(x0x1+x3+α)+x1+α

[0038] y2=(x0x1+x3+α)(x1x2+x0+α)+x2+α

[0039] y3=x0x1+x3+α.

[0040] In some examples, the method further includes determining a finite field according to the determined finite field. In the finite field, we select In the case of any input The multiplications in the mathematical operations performed are all bitwise AND operations.

[0041] The present application also proposes a plurality of implementation cases of a method for constructing a homomorphic friendly S-box:

[0042] Implementation case 1:

[0043] For q=2, a 4-bit S-box can be constructed according to the following specific steps.

[0044] S1, determine the finite field The characteristic size of , let q = 2;

[0045] S2, select a constant α=0x01 in a finite field;

[0046] S3, when the finite field is selected as When , the multiplication operation on the field is a bitwise AND operation;

[0047] S4, for any 4-bit input calculate

[0048]

[0049] Get 4 bits output

[0050] The corresponding truth table of the 4-bit S-box is shown in Table 1, where all numbers are expressed in hexadecimal.

[0051] Table 1 4-bit S-box truth table

[0052] X 0 1 2 3 4 5 6 7 8 9 A B C D E F S(X) D E B C 9 A 5 0 7 6 1 4 2 3 8 F

[0053] The differential uniformity of the generated S-box is 4, and the linearity is 4, that is, the cryptographic property is maintained as differential uniformity of 2. 2 And the linearity is 2 3 , the corresponding maximum difference probability and maximum linear probability are both 2 -2 , is the optimal 4-bit S-box.

[0054] Implementation case 2:

[0055] For q=2 2 , an 8-bit S-box can be constructed according to the following specific steps.

[0056] S1, determine the finite field The characteristic size of , let q = 2 2 ;

[0057] S2, select a constant α=0x03 in a finite field;

[0058] S3, select Irreducible polynomial f(x)=x over a field 2 +x+1, determine the multiplication operation on the field;

[0059] S4, for any 8-bit input calculate

[0060] Get 8-bit output

[0061] The truth table of the generated S-box is

[0062] S

[256] ={0xf7,0xfa,0xf1,0xfc,0xc3,0xde,0xe5,0xf8,0xef,0xc2,0xd9,0xf4,0xdb,0xe6,0xcd,0xf0,0xe7,0xea,0xe1,0xec,0x9f,0x86,0xb1,0xa8,0x7b,0x5e,0x41,0x64,0x03,0x32,0x11,0x20,0xd7,0xda,0xd1,0xdc,0x67,0x72,0x4d,0x58,0x07,0x26,0x35,0x14,0xb7,0x8e,0xa9,0x90,0xc7,0xca,0xc1,0xcc,0x3b,0x2a,0x19,0x08,0x93,0xba,0xad,0x84,0x6f,0x5a,0x75,0x40,0xbb,0xb2,0xb5,0xbc,0x8f,0x96,0xa1,0xb8,0xa3,0x8a,0x9d,0xb4,0x97,0xae,0x89,0xb0,0xa2,0xab,0xac,0xa5,0xce,0xd3,0xe8,0xf5,0x16,0x37,0x24,0x05,0x7a,0x4f,0x60,0x55,0x95,0x9c,0x9b,0x92,0x09,0x18,0x2b,0x3a,0x71,0x54,0x4b,0x6e,0xed,0xd0,0xfb,0xc6,0x8c,0x85,0x82,0x8b,0x48,0x5d,0x62,0x77,0xc4,0xe9,0xf2,0xdf,0x00,0x31,0x12,0x23,0x73,0x76,0x79,0x7c,0x47,0x52,0x6d,0x78,0x6b,0x4e,0x51,0x74,0x5f,0x6a,0x45,0x70,0x69,0x6c,0x63,0x66,0x39,0x28,0x1b,0x0a,0xc9,0xe4,0xff,0xd2,0x99,0xa0,0x87,0xbe,0x5c,0x59,0x56,0x53,0xd8,0xc5,0xfe,0xe3,0x94,0xbd,0xaa,0x83,0x10,0x21,0x02,0x33,0x46,0x43,0x4c,0x49,0xa6,0xbf,0x88,0x91,0x36,0x17,0x04,0x25,0xd6,0xeb,0xc0,0xfd,0x3f,0x3e,0x3d,0x3c,0x0b,0x1a,0x29,0x38,0x27,0x06,0x15,0x34,0x13,0x22,0x01,0x30,0x2c,0x2d,0x2e,0x2f,0x 68,0x7d,0x42,0x57,0xa4,0x8d,0x9a,0xb3,0xe0,0xdd,0xf6,0xcb,0x1e,0x1f,0x1c, 0x1d,0xb6,0xaf,0x98,0x81,0xe2,0xcf,0xd4,0xf9,0x4a,0x7f,0x50,0x65,0x0d,0x0 c,0x0f,0x0e,0xd5,0xc8,0xf3,0xee,0x61,0x44,0x5b,0x7e,0xb9,0x80,0xa7,0x9e}. ,

[0063] The corresponding generated S-box has a differential uniformity of 16 and a linearity of 64, that is, the cryptographic property is maintained as a differential uniformity of 2. 4 And the linearity is 2 6 , the corresponding maximum difference probability is 2 -4 And the maximum linear probability is 2 -4 .

[0064] Implementation case three:

[0065] For q=2 4 , a 16-bit S-box can be constructed according to the following specific steps.

[0066] S1, determine the large characteristic finite field The characteristic size of , let q = 2 4 ;

[0067] S2, select a constant α=0x09 in a finite field;

[0068] S3, select Irreducible polynomial f(x)=x over a field 4 +x+1, determine the multiplication operation on the field;

[0069] S4, for any 16-bit input calculate

[0070] Get 16-bit output

[0071] The corresponding generated S-box has a differential uniformity of 256 and a nonlinearity of 30720, that is, the cryptographic property is maintained as a differential uniformity of 2. 8 And the linearity is 2 12 , the corresponding maximum difference probability is 2-8 And the maximum linear probability is 2 -8 .

[0072] Implementation Case 4:

[0073] For q=2 8 , a 32-bit S-box can be constructed according to the following specific steps.

[0074] S1, determine the finite field The characteristic size of , let q = 2 8 ;

[0075] S2, select Irreducible polynomial f(x)=x over a field 8 +x 4 +x 3 +x+1, determine the multiplication operation on the field;

[0076] S3, select a constant α=0xCD in a finite field;

[0077] S4, for any 32-bit input calculate

[0078] Get 32-bit output

[0079] The cryptographic property of the generated S-box is that the differential uniformity does not exceed 2 16 And the linearity does not exceed 2 24 , the corresponding maximum difference probability does not exceed 2 -16 And the maximum linear probability does not exceed 2 -16 .

[0080] Implementation Case 5:

[0081] For q=65537, the S-box can be constructed according to the following specific steps.

[0082] S1, determine the finite field The characteristic size of , let q = 65537;

[0083] S2, the addition and multiplication operations on the field are mod 65537 addition and mod 65537 multiplication;

[0084] S3, select a constant α=0xFC in a finite field;

[0085] S4, for any input Calculate y0=x1x2+x0+0xFC, y1=x2(x0x1+x3+0xFC)+x1+0xFC, y2=(x0x1+x3+0xFC)(x1x2+x0+0xFC)+x2+0xFC, y3=x0x1+x3+0xFC, and get the output

[0086]

[0087] The cryptographic property of the generated S-box is to maintain a differential uniformity not exceeding 65537 2 And the linearity does not exceed 65537 3 , the corresponding maximum difference probability is less than 2 -16 And the maximum linear probability is less than 2 -16 .

[0088] The S-box constructed by the method of the embodiment of the present application has excellent cryptographic properties and can be proven to be applicable to large domains. Element-wise operation on (where q is a prime number p or a power of 2 n ), low multiplication complexity, small multiplication circuit depth, few addition operations, high homomorphic decryption efficiency, and its cryptographic properties are maintained as the maximum differential probability and the maximum linear probability do not exceed q -2 In the specific implementation, you can choose to implement 2 rounds of iterative operations at a time, then only 2 rounds of 2 iterations are needed to achieve it. Correspondingly, its implementation only requires 4 domain multiplications, and the multiplication depth is only 2, which is particularly suitable for homomorphic friendly symmetric cryptographic algorithms to ensure implementation efficiency.

[0089] An embodiment of the present application also proposes a homomorphic friendly S-box construction system, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the aforementioned homomorphic friendly S-box construction method are implemented.

[0090] It should be noted that in the various embodiments of the present application, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0091] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0092] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0093] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for constructing a homomorphic friendly S-box, characterized in that: include: Determine the finite field The characteristic size of Randomly select a finite field The upper non-zero constant α; According to a certain finite field At q = 2 n In the case of , choose an irreducible polynomial f(x) on any field and determine the finite field The addition and multiplication on are XOR and domain respectively. Multiplication operation on ; For any input Perform the specified mathematical operation and get the output Homomorphically friendly S-boxes as constructions.

2. The method for constructing a homomorphic friendly S-box according to claim 1, characterized in that: Determine the finite field The characteristic size includes: determining the value of q, where q is a prime number p or a power of 22 n .

3. The method for constructing a homomorphic friendly S-box according to claim 1, characterized in that: Also includes: According to a certain finite field When q=p, determine the finite field Addition and multiplication on are modular p addition and modular p multiplication.

4. The method for constructing a homomorphic friendly S-box according to claim 3, characterized in that: For any input Performs specified mathematical operations including: For any input Perform the following mathematical operations: y0=x1x2+x0+α y1=x2(x0x1+x3+α)+x1+α y2=(x0x1+x3+α)(x1x2+x0+α)+x2+α y3=x0x1+x3+α.

5. The method for constructing a homomorphic friendly S-box according to claim 4, characterized in that: It also includes finite fields determined by In the finite field, we select In the case of any input The multiplications in the mathematical operations performed are all bitwise AND operations.

6. A homomorphic friendly S-box construction system, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the method for constructing a homomorphic friendly S-box as described in any one of claims 1 to 5 are implemented.

Images