A compact reusable method of quantum key encapsulation

Abstract

The application provides an anti-quantum key packaging method with compact reusability, which comprises the following steps: in step 1, a public key encryption scheme with IND-CPA security is designed based on the RLWE problem on a non-two-power cyclotomic ring through a security parameter, public parameters, a public key and a private key are generated, and the public parameters and the public key are published; in step 2, a secret random tape is used to encrypt a plaintext message into a ciphertext based on the obtained public parameters and the public key; and in step 3, the ciphertext is decrypted through the private key to obtain a corresponding plaintext. The method uses the Nussbaumer technique to realize the reusable NTT algorithm, uses the Karatsuba technique to realize the fast multiplication on a small convolution ring, and designs the reusable NTT algorithm for the public ring structure, and has the advantages of simple realization, low resource consumption and the like in the software and hardware implementation and optimization.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a compact and reusable quantum-resistant key encapsulation method. Background Technology

[0002] Quantum mechanics, together with relativity, forms the theoretical foundation of modern physics, with wide applications not only in physics but also playing a vital role in fields such as chemistry, materials science, and information science. Quantum computers, as computing devices based on the principles of quantum mechanics, utilize the properties of quantum superposition and quantum entanglement to demonstrate powerful parallel processing capabilities. Problems that require exponential time to solve in traditional computers can be completed in polynomial time by quantum computers. While this enormous computational advantage brings immense application potential, it also introduces potential security threats.

[0003] To safeguard national information security, there is an urgent need to migrate traditional public-key encryption schemes to quantum-resistant cryptographic schemes. Quantum-resistant cryptographic schemes are based on certain mathematically difficult problems widely considered resistant to quantum analysis, primarily including lattices, encoding, multivariables, homology, and hashing. Currently, structured lattice-based cryptographic schemes have achieved a good balance between performance and security, but some problems still exist. Among various lattice problems, the average-case Learning with Errors (LWE) problem can be reduced to the worst-case SVP problem; therefore, quantum-resistant public-key cryptography based on structured LWE problems has become mainstream, including ring-LWE and module-LWE variants. Limited by the power-of-two dimension, RLWE-based key encapsulation schemes struggle to achieve 192-bit security strength; MLWE-based key encapsulation schemes have a large random band, leading to a significant reduction in the computational efficiency of samplers and polynomial multiplication. Summary of the Invention

[0004] This invention provides a key encapsulation scheme based on the RLWE problem, employing non-binary power-order circular ring division. This scheme alleviates the security strength abruptness problem present in conventional RLWE-based public-key cryptography schemes while maintaining their high computational performance. The invention utilizes the Nussbaumer technique to implement a reusable NTT algorithm and the Karatsuba technique to implement fast multiplication on small convolutional rings. A reusable NTT algorithm is designed specifically for common ring structures, offering advantages such as simple implementation and low resource consumption in both hardware and software implementation and optimization.

[0005] This invention provides a compact and reusable quantum-resistant key packaging method, characterized by comprising:

[0006] Based on the RLWE problem on a non-binary power-divisible circular ring, we design an IND-CPA secure public-key encryption scheme.

[0007] By utilizing the Fujisaki-Okamoto transformation, an enhanced IND-CCA secure key encapsulation scheme is developed for the Random oracle model.

[0008] The IND-CPA secure public-key encryption scheme includes:

[0009] Step 1: Based on the RLWE problem on a non-two power-divisible circular ring, design an IND-CPA secure public-key encryption scheme. According to the security parameters, generate public parameters, a public key, and a private key, and publish the public parameters and the public key.

[0010] Step 2: Based on the obtained public parameters and public key, use a secret random tape to encrypt the plaintext message into ciphertext;

[0011] Step 3: Decrypt the ciphertext using the private key to obtain the corresponding plaintext.

[0012] Step 1 further includes:

[0013] From the set Select a random seed and Then through the Perform scalable output functions After the operation Transformation ;

[0014] Each and , After connection, through a pseudo-random function and the corresponding sampler and Then in the ring Above calculation ;

[0015] right Compress and packaging Operation obtained ,Will As a public key , As a private key ;

[0016] in, and All are random seeds. , This represents the constant value used to obtain the independent random oracle machine, and FastMul represents fast polynomial multiplication.

[0017] Step 2 further includes:

[0018] Through the public key through and Operation obtained For the public key Unpack and Decompress to obtain ;

[0019] Random belts and , , After connection, a pseudo-random function is used. and the corresponding sampler , , In the ring Above calculation and

[0020] right conduct Compressed and packaged ,right Cut off Compressed and packaged ciphertext ;

[0021] in, This indicates the error correction code encoding algorithm.

[0022] Step 3 further includes:

[0023] Enter private key and ciphertext ,right Unpack and Decompress to obtain ,right Unpack and Decompress to obtain ;

[0024] In the ring Above calculation ,use right Subtract the above calculation result and decode to obtain the message. ;

[0025] in, Indicates coefficient truncation technique, This represents the error correction code decoding algorithm.

[0026] The non-two power-order fractional ring It is a fast polynomial multiplication method with a compact parameter set and reusable operation; its underlying algebraic structure is...

[0027]

[0028] in, It is a fixed positive integer. These are parameters that control the security level of a cryptographic scheme. The compact parameter set includes dimensions. and modulus And the conditions are met. .

[0029] The reusable fast polynomial multiplication method described herein utilizes the Nussbaumer technique to achieve the following ring isomorphism.

[0030]

[0031] in, It is The residue system of the order-partial circular integer ring, parameters Meet the conditions .

[0032] The fast polynomial multiplication includes the following steps: reusing the NTT algorithm through multi-level ring isomorphism iteration; the first ring isomorphism uses a method similar to Cooley-Tukey's butterfly algorithm; the subsequent two ring isomorphisms use the mixed-radix NTT algorithm.

[0033] The fast multiplication on the ring further includes: embedding the ring coefficients into the polynomial ring and homomorphically mapping them to the target ring; according to the Chinese Remainder Theorem, the following ring isomorphism exists.

[0034] .

[0035] In this context, polynomial multiplication is computed in the two polynomial rings on the right-hand side of the aforementioned isomorphic formula. The former requires only three modular multiplications, while the latter depends on... The value requires 0 to 4 modular multiplication operations; the Karatsuba algorithm is used to calculate the overflow term of the polynomial product, which is then combined with the two polynomial products mentioned above to obtain the ring. The product result.

[0036] This invention provides a compact and reusable quantum-resistant key packaging method, which innovatively employs... The non-second power-order circular ring effectively alleviates the security jump problem in conventional RLWE-based key encapsulation schemes, and the selection of parameter sets is more flexible, with more compact parameter selection and scheme examples.

[0037] Specifically, compared to MLWE-based cryptographic schemes, the cryptographic scheme designed in this invention has a public key whose first component is only... This significantly reduces the overhead of XOF, resulting in extremely high computational efficiency. This invention combines the Nussbaumer trick, the NTT algorithm, and the Karastuba trick to propose a fast polynomial multiplication algorithm with code reusability. This algorithm can handle large-scale decomposition of circular rings. An isomorphic mapping is a common, medium-sized annulus. On The NTT module of the polynomial ring can be fully reused for different parameter sets, which is very beneficial for the software and hardware implementation and optimization of the algorithm.

[0038] Specifically, the key encapsulation method proposed in this invention provides three compact parameter sets, achieving security strengths of 128, 192, and 256 bits respectively. The underlying circular rings instantiated from these parameter sets share a common ring structure in a homogeneous sense. This invention designs a reusable NTT algorithm for this common ring structure, which offers advantages such as simple implementation and low resource consumption in both hardware and software implementation and optimization. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0040] Figure 1 This is a design framework diagram of the public-key cryptography scheme in the key encapsulation method provided by the present invention;

[0041] Figure 2 A flowchart illustrating the public key encryption scheme in the key encapsulation method provided by this invention;

[0042] Figure 3 A flowchart illustrating the key encapsulation scheme in the key encapsulation method provided by this invention;

[0043] Figure 4 This is a module structure diagram of the public key encryption scheme in the key encapsulation method provided by the present invention;

[0044] Figure 5 This is a schematic diagram of fast polynomial multiplication in the key encapsulation method provided by the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0046] To clearly illustrate the embodiments of this invention, the conceptual technical terms used are explained below: Public-key encryption (PKE) is a public-key cryptography used for data encryption; Key encapsulation mechanism (KEM) is a type of public-key cryptography used for key distribution; Data encapsulation mechanism (DEM) is a type of symmetric cryptography used for data encryption. Indistinguishability under chosen-plaintext attack (IND-CPA) is a security property of public-key encryption schemes, where an adversary in the model only has the ability to passively listen to the channel content; Indistinguishability under chosen-ciphertext attack (IND-CCA) is a stronger security property of public-key encryption schemes, where an adversary in the model has the ability to actively tamper with the channel content. The Fujisaki-Okamoto conversion is a general technique for enhancing an IND-CPA-secure public-key encryption scheme to an IND-CCA-secure public-key encryption scheme. The KEM-DEM hybrid encryption paradigm is a method for combining existing KEM and DEM schemes into a PKE scheme.

[0047] Key Encapsulation Mechanism (KEM) is a modern encryption technique that encapsulates a symmetric key within ciphertext using an asymmetric encryption algorithm to ensure secure key transmission. In KEM, the initiator runs an encapsulation algorithm to generate a session key and its corresponding ciphertext, then encapsulates and sends the session key to the receiver. The receiver runs a decapsulation algorithm to obtain the same session key as the initiator. This mechanism combines the advantages of symmetric and asymmetric encryption, ensuring both encryption speed and secure key distribution. KEM introduces randomness into the session key distribution process, ensuring that each generated key is unique and enhancing system security. Furthermore, KEM can employ lattice-based cryptography, providing resistance to quantum computing attacks.

[0048] Traditional key encapsulation techniques have significant drawbacks in modern network environments. First, the key distribution process is complex, especially in multi-party communication scenarios where key management becomes exceptionally cumbersome. Second, traditional techniques are limited in performance when handling large-scale data transmission, making them unsuitable for the demands of modern high-speed networks. Furthermore, with the advancement of computing power, particularly quantum computing, the security of traditional public-key cryptography algorithms based on large number factorization and discrete logarithm problems faces serious challenges.

[0049] In summary, this invention proposes a key encapsulation method based on the non-binary power-law circular ring division problem of the RLWE problem, effectively mitigating the security strength jump problem in traditional RLWE-based public-key cryptography schemes while maintaining high computational performance. The method of this invention designs an IND-CPA-secure public-key encryption scheme, generates and publishes public parameters and a public key, encrypts plaintext messages into ciphertext using a secret random band, and decrypts the ciphertext using a private key to obtain the plaintext. Compared to schemes based on the MLWE problem, this invention has a smaller first component of the public key and significantly reduces the computational overhead based on the XOF sampler. Furthermore, this invention provides three compact parameter sets, achieving security strengths of 128, 192, and 256 bits respectively, enhancing the system's security.

[0050] Figures 1 to 5 These are, respectively, the design framework diagram of the public-key cryptography scheme, the workflow diagram of the public-key encryption scheme, the workflow diagram of the key encapsulation scheme, the module structure diagram of the public-key encryption scheme, and the schematic diagram of fast polynomial multiplication in the key encapsulation method provided by this invention. Figures 1 to 5 As shown, the present invention provides a compact and reusable quantum-resistant key encapsulation method, comprising: designing an IND-CPA-secure public key encryption scheme based on the RLWE problem on a non-binary power-order circular ring; and enhancing the key encapsulation scheme to an IND-CCA-secure scheme using the Fujisaki-Okamoto transformation under the Random oracle model.

[0051] The Fujisaki-Okamoto conversion is a cryptographic technique used to transform a public-key encryption scheme that is only resistant to Selected Ciphertext Attacks (IND-CPA) into a public-key encryption scheme that is resistant to both Selected Ciphertext Attacks and Selected Key Attacks (IND-CCA). Through the Fujisaki-Okamoto conversion, an encryption scheme that originally only possessed IND-CPA security can be upgraded to IND-CCA security. This means that the encryption scheme can resist more sophisticated attacks, including attacks where attackers might attempt to obtain the encryption key.

[0052] The random oracle machine model is an idealized model used in cryptography to analyze and design cryptographic systems. In this model, all hash functions and random number generators are assumed to be ideal random functions, meaning that the hash values ​​or random numbers they output are completely random and unpredictable.

[0053] In the random oracle machine model, the analysis of the security of cryptographic schemes can be simplified because the hash function can be assumed to be perfect, making security proofs more direct and clear. Furthermore, the security of many cryptographic systems can be enhanced because attackers cannot exploit any non-randomness of the hash function to launch attacks.

[0054] The key encapsulation method includes: Step 1, designing an IND-CPA secure public-key encryption scheme based on the RLWE problem on a non-two power-law circular ring using security parameters, generating public parameters, a public key, and a private key, and publishing the public parameters and the public key; Step 2, encrypting the plaintext message into ciphertext using a secret random band based on the obtained public parameters and public key; Step 3, decrypting the ciphertext using the private key to obtain the corresponding plaintext.

[0055] The RLWE problem based on non-two power-order circular rings refers to the construction of the RLWE (Ring-Learning with Errors) problem in cryptography, particularly in the field of lattice cryptography, using non-two power-order circular rings (i.e., the dimensions of the rings are not powers of 2) as a foundation. The RLWE problem is a difficult mathematical problem, considered unsolvable even by quantum computers. It has mature security analysis and is therefore widely used in designing quantum-resistant cryptographic algorithms.

[0056] In public-key cryptography, "public parameters" typically refer to information known to all participants. This information is used for algorithm initialization, such as specific mathematical problem instances or system parameters. The "public key" is the key used in the encryption process and can be made public to anyone. It is used to encrypt information, ensuring that only the recipient with the corresponding "private key" can decrypt it. The "private key," on the other hand, is the key used to decrypt information and must be kept secret, known only to the intended recipient.

[0057] The secret random band typically refers to the random numbers or values ​​used in the encryption process. These values ​​are kept secret and are unique for each encryption. The random value, used together with the public key, ensures that even if an attacker possesses the public key, they cannot predict or decrypt the plaintext because they are unaware of the random value used for encryption. This design increases the security of the encryption, ensuring that the encryption scheme remains secure even in the face of chosen-ciphertext attacks (where an attacker can obtain a portion of the ciphertext and its corresponding plaintext).

[0058] Step 1 further includes: from the set Select a random seed and Then through the Perform scalable output functions After the operation Transformation ; respectively and , After connection, through a pseudo-random function and the corresponding sampler and Then in the ring Above calculation right Compress and packaging Operation obtained ,Will As a public key , As a private key ;

[0059] in, and All are random seeds. , This represents the constant value used to obtain the independent random prophecy machine. This represents fast polynomial multiplication.

[0060] Among them, the Used for random selection Generate a scalable random output, which is then passed through The transformation is performed to generate the polynomial in the public key. The necessary randomness is provided to ensure the security of the public key.

[0061] Among them, the The function here is to... The output is converted to be suitable for use in the circular ring. The value to be operated on This transformation ensures a smooth transition from the random seed to the ring element.

[0062] Among them, the from Generating secret polynomials and error items These values ​​are directly related to the generation of the public key. It provides the necessary pseudo-randomness to maintain the security of the encryption scheme and its ability to resist various cryptanalysis attacks.

[0063] Among them, the Used to calculate polynomials and secret polynomial The product of the two terms, plus the incorrect terms. To obtain the polynomial in the public key This fast multiplication operation can improve the efficiency of the algorithm while maintaining the security of the encryption scheme.

[0064] Wherein, for the polynomial Perform compression and packaging operations to generate a compact public key. This operation not only reduces the size of the public key, making it easier to store and transmit, but also ensures the practicality of the public key in various application scenarios.

[0065] Step 2 further includes: using the public key via expandable output function and Operation obtained For the public key Unpack and Decompress to obtain ; respectively random tape With constant values , , After connection, a pseudo-random function is used. and the corresponding sampler , , In the ring Above calculation and ;right conduct Compressed and packaged ,right Cut off Compressed and packaged ciphertext ;

[0066] in, This indicates the error correction code encoding algorithm.

[0067] Among them, the random band With different constant values , , The connection is used to generate multiple different random seeds, which are then passed through... The sampler generates different random polynomials. , , This increases the randomness and diversity of the encryption process, making each encrypted ciphertext unique and enhancing the security of the encryption scheme.

[0068] The sampler is used to extract from... A suitable random polynomial is drawn from the generated random seed. The use of a sampler ensures that the generated random polynomial conforms to a cycle. The mathematical structure required is to maintain the security and correctness of the encryption scheme.

[0069] Among them, in the ring Above calculation and This is to utilize the algebraic structure of rings to perform encryption operations; this computational method not only leverages the mathematical properties of rings to enhance security, but also... Fast polynomial multiplication improves the efficiency of the encryption process.

[0070] Among them, for and Compression and packaging are performed to convert the encrypted results into a format suitable for transmission and storage. Compression reduces the data size, while packaging ensures data integrity and availability. The truncation operation may be to remove unnecessary information, further reduce the size of the ciphertext, make the ciphertext more compact, and facilitate its transmission over the network.

[0071] Step 3 further includes: inputting the private key. and ciphertext ,right Unpack and Decompress to obtain ,right Unpack and Decompress to obtain ; in the ring Above calculation ,use right Subtract the above calculation result and decode to obtain the message. ;

[0072] Among them, the Indicates coefficient truncation technique, This represents the error correction code decoding algorithm.

[0073] During the decryption process, for and Unpacking and decompressing are performed to restore the polynomials used in the encryption process. and This step is fundamental to the decryption process; it allows the decryption algorithm to access the polynomial structure used during encryption, thereby recovering the original message.

[0074] The truncation operation It is aimed at the ring The calculations were performed to reduce the length of the coefficient vector to match the size of the original message, thereby reducing the size of the ciphertext.

[0075] Among them, the Operations are used to extract from Subtract the truncated part As a result, the original message was recovered. In the RLWE scheme, due to the introduction of errors during the encryption process, a decoding algorithm is necessary. This algorithm must be able to tolerate a certain degree of error and recover the original correct information from noisy data.

[0076] Wherein, the non-two power-order fractional annulus It is a fast polynomial multiplication method with a compact parameter set and reusable operation; its underlying algebraic structure is...

[0077]

[0078] Among them, the It is a fixed positive integer. It is a parameter that controls the security level of a cryptographic scheme.

[0079] The non-two power-order fractional ring The design utilizes a compact parameter set and reusable fast polynomial multiplication. A compact parameter set means smaller parameter values, which helps reduce algorithm complexity and improve efficiency. In cryptography, parameter set design is crucial for algorithm performance and security. A compact parameter set reduces storage and computational burden, making the algorithm more suitable for resource-constrained environments such as mobile devices or embedded systems.

[0080] The reusable fast polynomial multiplication means that the algorithm can be efficiently reused in different contexts and operations without requiring dedicated polynomial multiplication for different modules or cryptographic instances. This facilitates modular implementation of the algorithm and can significantly improve resource utilization and overall performance. Furthermore, fast polynomial multiplication helps reduce power consumption and computational latency, which is particularly important for applications requiring rapid response.

[0081] Specifically, the circumsplicing polynomial of the annulus The level It is shaped like Integers. For modulo ,definition It is the modulus of the circumscribed integer ring. Remaining series.

[0082] The ring sampling algorithm The steps are as follows: Selected parameters Make It is an even number, defined as First, in the ring expansion For each coefficient according to the parameters The central binomial distributions are sampled independently, and the sampling results are denoted as... Then calculate and output. It is a ring The short element on, and its canonical embedding is The sphere on the surface ensures that RLWE instances satisfy the reduction master theorem.

[0083] The compact parameter set includes dimensions. and modulus And the conditions are met. .

[0084] Preferred, dimension Fixed selection is Modulus Fixed selection is The conditions are met. For the three safety levels, separate settings are provided. The corresponding ideal lattice dimensions are respectively Based on the asymmetric RLWE assumption, i.e., secret and noise These are taken from central binomial distributions with different parameters. Due to the modulus... Relatively small, distribution parameters The value is only... or This allows its sampler to consume only a small amount of entropy. Furthermore, based on the decryption failure rate derivation formula, appropriate compression parameters are selected. This can significantly reduce the size of the public key and ciphertext.

[0085] The reusable fast polynomial multiplication method described herein utilizes the Nussbaumer technique to achieve the following ring isomorphism.

[0086]

[0087] in, It is The residue system of the order-partial circular integer ring, parameters Meet the conditions .

[0088] The selected parameters Meet the conditions ,therefore There exists The original unit root According to the Chinese Remainder Theorem, factorization can be used to... ,as well as and The following ring isomorphisms exist.

[0089]

[0090]

[0091]

[0092] The fast polynomial multiplication includes the following steps: reusing the NTT algorithm through multi-level ring isomorphism iteration; wherein, the first ring isomorphism uses a method similar to Cooley-Tukey's butterfly algorithm; and the subsequent two ring isomorphisms use the mixed-radix NTT algorithm.

[0093] Through iterative multi-layered cyclic isomorphisms, the cyclic isomorphisms and their inverse mappings require only quasi-linear computational complexity. Due to the selected... Since the integer is fixed, the NTT algorithm can be fully reused by algorithm instances with different security levels. For hardware and software implementation and optimization, the code reuse characteristic makes the public-key cryptographic scheme designed in this invention more advantageous; especially for FPGA or ASIC designs, this characteristic can significantly reduce the number of logic gates and the area size.

[0094] The fast multiplication on the ring further includes: embedding the ring coefficients into the polynomial ring and homomorphically mapping them to the target ring; according to the Chinese Remainder Theorem, the following ring isomorphism exists.

[0095]

[0096] Specifically, by combining the above four ring isomorphisms, we obtain... That is, ring Addition and multiplication on the same surface are equivalent in the sense of isomorphism to: Each ring Parallel addition and multiplication on top of. For This invention uses basic textbook multiplication, requiring only four non-scalar multiplications and one scalar multiplication. For This invention uses the Karatsuba technique to achieve rings. Fast multiplication on the ring: First, multiply the ring... Coefficients embedded in the polynomial ring Internally, then homomorphically mapped to .because and They are coprime. According to the Chinese Remainder Theorem, there exists the following ring isomorphism:

[0097] .

[0098] In the ring In a ring, polynomial multiplication requires only three modular multiplication operations. Calculating polynomial multiplication in Chinese: If ,So Therefore, only one modular multiplication operation is needed; if So it is Using textbook multiplication requires four modular multiplication operations.

[0099] The polynomial ring The polynomial multiplication is performed as follows: the polynomial multiplication is calculated in the two polynomial rings on the right-hand side of the above isomorphic formula; the overflow term of the polynomial product is calculated using the Karatsuba algorithm and combined with the two polynomial products to obtain the product result of the polynomial rings.

[0100] Specifically, given two polynomials and Using the aforementioned ring embedding, ring homomorphism, and ring isomorphism, we can calculate... To restore it to And thus recover to The overflow item still needs to be calculated. The value of is calculated first in this invention. Then calculate it with The product: for Only one modular multiplication operation is needed; for This invention uses the Karatsuba algorithm, which requires three modular multiplication operations. Ultimately, for The above algorithm takes 5 modular multiplication operations, for The algorithm described above required 10 modular multiplication operations.

[0101] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0102] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A compact reusable method of resistance to quantum key encapsulation characterized by, The application relates to a public key encryption scheme based on an RLWE problem on a non-power-of-two cyclotomic ring, and the scheme is IND-CPA secure. A key encapsulation scheme is enhanced to be IND-CCA secure in a random oracle model by using Fujisaki-Okamoto transformation. The IND-CPA secure public key encryption scheme comprises the following steps: Step 1: generating public parameters, a public key and a private key according to a security parameter, and publishing the public parameters and the public key; Step 2: encrypting a plaintext message into a ciphertext by using a secret random tape based on the obtained public parameters and the public key; Step 3: decrypting the ciphertext by using the private key to obtain a corresponding plaintext. The step 1 further comprises the following steps: Wherein, rho and sigma are random seeds, 0x00 and 0x01 are constant values for obtaining independent random oracles, and FastMul represents fast polynomial multiplication. A random seed p and s are selected from the set {0, 1} 256 and then a is obtained by performing an XOF operation on p and converting the result to a number using the function Prase. After connecting σ with 0x00, 0x01 respectively, s and e are obtained through the pseudo-random function PRF and the corresponding sampler, and then b = FastMul(a, s) + e is calculated in the ring R q above. compressing b and packing operation Pack to get t, and (p, t) as the public key pk, s as the private key sk; The step 2 further comprises the following steps: Wherein, Encode represents an error correction code encoding algorithm. a is obtained by the ρ in the public key through the expandable output function XOF and the numerical conversion function Prase operation ′ , unpacking t in the public key and b is obtained by decompression ′ ; The random tape r is concatenated with the constant values 0x02, 0x04, 0x08, respectively, and passed through a pseudo-random function PRF and the corresponding sampler s ′ ′ ″ On the ring R q , compute u = FastMul(a ′ , s ′ ) + e ′ and v = FastMul(b ′ , s ′ ) + e ″ + Encode(m);​​ c1 = compress and pack u c2 = compress and pack v ct = (c1, c2) The step 3 further comprises the following steps: Wherein, Trunc represents a coefficient truncation technique, and Decode represents an error correction code decoding algorithm. Input the private key sk = s and the ciphertext ct = (c1, c2), unpack c1 and decompress to get u ′ unpack c2 and decompress to get v ′ ; In the loop R q Trunc(FastMul(u ′ ,s)) is computed, v ′ is decoded using Decode, and the result of the above computation is subtracted to obtain the message m ′ ; The underlying algebraic structure of the cryptographic algorithm is The non-power-of-two cyclotomic ring R q Fast polynomial multiplication with compact parameter sets and reusability Wherein, the compact parameter set comprises a dimension n and a modulus q, and satisfies the condition 3n|(q-1). wherein, is a fixed positive integer, k e {2, 3, 4} is a parameter controlling the security level of the password scheme; The reusable fast polynomial multiplication uses Nussbaumer technique to realize ring isomorphism as follows The fast polynomial multiplication comprises the following steps: The parameters q, n satisfy the condition 3n | (q - 1); The reuse of the NTT algorithm is realized by multi-layer ring isomorphism iteration. Wherein, the first ring isomorphism uses the Cooley-Tukey butterfly method; The following two ring isomorphisms use the mixed-radix NTT algorithm. The fast multiplication on the ring further comprises the following steps: According to the Chinese Remainder Theorem (CRT), there is a ring isomorphism as follows embedding into a polynomial ring ​​ The polynomial ring is processed as follows: The polynomial multiplication is calculated in the two polynomial rings at the right end of the isomorphism formula, and the former only needs three modulus multiplication operations, and the latter needs 0 to 4 modulus multiplication operations depending on the value of k. ​ Using the Karatsuba algorithm, the overflow term of the polynomial multiplication is computed, combined with the two polynomial multiplications described above, to obtain the product result in the ring .

Images