Anti-quantum distributed asynchronous random beacon method and system

Abstract

The invention relates to an anti-quantum distributed asynchronous random beacon method and system. The method comprises: a distribution stage of executing an anti-quantum asynchronous verifiable secret sharing method; an asynchronous common subset protocol is executed, distribution nodes corresponding to received effective secret shares serve as input, and a node set i with the size of t is consensus; executing a reconstruction stage of the anti-quantum asynchronous verifiable secret sharing method, reconstructing the secret value of each node in the set I, and if the reconstructed secret value is invalid, rejecting the node from the set I; and outputting the XOR sum of the secret values of the nodes in the set I as a public random number. According to the method, distributed generation of public random numbers is supported, the single-point fault problem is avoided, the system security can be ensured in an asynchronous network, and quantum computer attacks can be resisted.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a quantum-resistant distributed asynchronous random beacon method and system. Technical Background

[0002] The goal of the random beacon system is to continuously provide public random numbers. It is widely used in various security protocols and distributed systems, including but not limited to security parameter generation protocols, blockchain systems, privacy-preserving messaging services, electronic voting protocols, anonymous browsing, and smart contracts.

[0003] Existing randomness beacon systems can be categorized as centralized or distributed. Centralized randomness beacon systems rely on a trusted third party to generate random numbers, resulting in a relatively simple protocol flow. However, the security of these centralized randomness beacon systems relies on the reliability of the third party, resulting in excessive concentration of power and making them unsuitable for most security protocols and distributed systems. In contrast, distributed randomness beacon systems rely on multiple parties to jointly generate public random numbers, shifting the system's security assumptions from the reliability of the third party to the reliability of the nodes in the distributed system.

[0004] Furthermore, random beacon systems require different assumptions about the network environment, such as synchronous, semi-synchronous, or asynchronous. Asynchronous networks make the most relaxed assumptions about network latency, ensuring only that messages transmitted between nodes are ultimately reachable. This approach is closer to the actual Internet environment, and therefore, when deploying random beacon systems on the Internet, asynchronous random beacon systems are more suitable.

[0005] Finally, with the rapid development of quantum computing in recent years, some traditional cryptographic algorithms are vulnerable to cracking, posing a threat to system security. Therefore, the ability to resist quantum algorithms has become an important indicator of the security of randomness beacon systems. Summary of the Invention

[0006] In view of the technical problems existing in the prior art, the purpose of the present invention is to design an efficient quantum-resistant distributed asynchronous random beacon method and system.

[0007] The technical contents of the present invention include:

[0008] A quantum-resistant asynchronous verifiable secret sharing method (AVSS) is applicable to n participating nodes, denoted as p1, p2…, p n, where there are at most f malicious nodes, satisfying n≥3f+1; the method is applied to one of the nodes as the distributor of AVSS, and the remaining nodes in the system as receivers. The method includes a distribution phase and a reconstruction phase. In the distribution phase, the distributor secretly shares the secret value it selects and sends the corresponding secret share to each receiver. Each receiver can verify whether the secret share it receives is valid. In the reconstruction phase, the receiver broadcasts the valid secret share it receives. After receiving f+1 valid secret shares, the receiver can reconstruct the distributor's secret value and determine whether the reconstructed secret value is valid.

[0009] Furthermore, the steps of the distribution phase are as follows:

[0010] Step 1: The distributor locally selects two random numbers, one of which is the secret value and the other is used as a mask for the secret value;

[0011] Step 2: The distributor invokes a secret sharing scheme (secret sharing algorithm) to generate a masked secret value and a masked secret share, where the masked secret share is used to mask the secret share of the secret value.

[0012] Step 3: The distributor constructs a Merkle tree based on the masked secret share and the masked secret value's secret share, and generates the Merkle tree root and the Merkle proof corresponding to each secret share;

[0013] Step 4: The distributor sends each recipient its corresponding secret share, Merkle proof, and Merkle root. The distributor uses a reliable broadcast protocol to send the Merkle root.

[0014] Step 5: After receiving the secret share from the distributor in step 4 above, the recipient verifies the secret share, Merkle proof, and Merkle root. If the verification passes, the received secret share is considered valid.

[0015] Furthermore, the steps of the reconstruction phase are as follows:

[0016] Step 1: The recipient sends the received secret share, Merkle proof, and Merkle tree root to all other nodes;

[0017] Step 2: After receiving the secret shares from step 1 of the reconstruction phase, the receiver verifies the secret shares, Merkle proof, and Merkle tree root to determine whether the secret shares are valid. After receiving f+1 valid secret shares, the receiver reconstructs the mask and secret value.

[0018] Step 3: The receiver verifies the validity of its reconstructed secret value. Specifically, the receiver invokes a secret sharing scheme to generate the reconstructed secret value and a secret share of the masked secret value, constructs a Merkle tree for each, and calculates the corresponding Merkle tree root. The receiver compares its reconstructed Merkle tree root with the Merkle tree root from the distributor. If the two match, the reconstructed secret value is valid; otherwise, the reconstructed secret value is invalid.

[0019] A quantum-resistant distributed asynchronous random beacon method based on the quantum-resistant asynchronous verifiable secret sharing method is constructed, and the execution process steps of the method are as follows:

[0020] Step 1: The node executes the distribution phase of the quantum-resistant asynchronous verifiable secret sharing method;

[0021] Step 2: The nodes execute the asynchronous common subset protocol, taking the distribution nodes corresponding to the valid secret shares they receive as input, and reach a consensus on a node set I of size t, where t is the minimum of the security parameter λ and f+1. λ satisfies the requirement that, with negligible error probability, a set of size λ is randomly selected from n nodes, containing at least one honest node. It should be noted that for the sake of protocol execution efficiency, it is recommended to select the minimum of all λ values that meet the requirements as the system parameter.

[0022] Step 3: The node performs the reconstruction phase of the quantum-resistant asynchronous verifiable secret sharing method to reconstruct the secret value of each node in set I. If the reconstructed secret value is invalid, the node is removed from set I.

[0023] Step 4: The node outputs the XOR sum of the secret values shared by the nodes in set I as the final output random number.

[0024] A quantum-resistant distributed asynchronous random beacon system constructed based on the quantum-resistant asynchronous verifiable secret sharing method. The execution process of the system cyclically executes the random beacon method and outputs a public random number at each execution. The system includes:

[0025] A distribution module, configured to execute the distribution phase of the quantum-resistant asynchronous verifiable secret sharing method;

[0026] The asynchronous common subset protocol execution module is used to execute the asynchronous common subset protocol. It takes the distribution nodes corresponding to the valid secret shares it receives as input and reaches a consensus on a node set I of size t, where t is the minimum of the security parameter λ and f+1. λ satisfies the requirement that a set of size λ is randomly selected from n nodes with a negligible error probability, and contains at least one honest node. It should be noted that for the sake of protocol execution efficiency, it is recommended to select the minimum of all λ values that meet the requirements as the system parameter.

[0027] A reconstruction module, configured to execute the reconstruction phase of the quantum-resistant asynchronous verifiable secret sharing method, reconstruct the secret value of each node in set I, and remove the node from set I if the reconstructed secret value is invalid;

[0028] The output module is used to output the XOR sum of the secret values of the nodes in set I as the random number output of this execution.

[0029] Compared with existing technologies, the present invention not only supports the distributed generation of public random numbers and avoids single point failure problems, but also can ensure system security under asynchronous networks. Moreover, if the components used in the system, such as the reliable broadcast protocol, the asynchronous common subset protocol, and cryptographic algorithms such as hash functions, can resist quantum computer attacks, the system of the present invention as a whole can also resist quantum attacks, and these components and algorithms have been designed to be quantum secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a flow chart of the secret sharing algorithm of the present invention.

[0031] Figure 2 It is a flowchart of the secret reconstruction algorithm of the present invention.

[0032] Figure 3 This is a flow chart of the quantum-resistant distributed asynchronous random beacon system of the present invention. Specific implementation methods

[0033] The present invention includes a quantum-resistant asynchronous verifiable secret sharing method, as well as a quantum-resistant distributed asynchronous random beacon method and system constructed based on the quantum-resistant asynchronous verifiable secret sharing method. Below, in conjunction with the accompanying drawings, a feasible implementation method of the present invention is specifically described using a system with n nodes (the maximum number of malicious nodes is f).

[0034] 1. Quantum-resistant asynchronous verifiable secret sharing method

[0035] like Figure 1 and Figure 2As shown in Figure 2, the method consists of two phases: the distribution phase and the reconstruction phase. In the distribution phase, the distributor divides its secret value into multiple secret shares, and each node in the system holds a secret share. In the reconstruction phase, any f+1 honest nodes can reconstruct the distributor's secret value. The specific process is as follows:

[0036] 1. Distribution phase execution process:

[0037] 1) The distributor generates the mask r and secret value m locally;

[0038] 2) The distributor calls the Shamir secret sharing scheme with a threshold of f+1 to generate the secret shares {r1,…,r n} and {m1,…,m n}. Then, the distributor uses the secret share of the mask r to mask the secret share of the secret value m and calculates the secret share of the masked secret value m {s1,…,s n},in H is the hash function;

[0039] 3) The distributor is based on {r1,…,r n} and {s1,…,s n}Build two Merkle trees T respectively r and T s , where T r The leaf nodes are r1,…,r n , the root of the tree is denoted as r root , T s The leaf nodes are s1,…,s n , the root of the tree is denoted as s root ;

[0040] 4) The distributor sends secret shares to other nodes. Specifically, the distributor sends r i and s i Send to node p i , and the corresponding Merkle proof and in, It can be proved that the data r i is included in r root In the corresponding Merkle tree, It can be proved that data i is included in root In the corresponding Merkle tree;

[0041] 5) Each node p i After receiving the secret share from the distributor in 4) above, according to the Merkle proof and Verify r i and si Is it included in r root and s root In the corresponding Merkle tree, the secret share that passes the above verification is recorded as the valid secret share.

[0042] 2. Execution process of the reconstruction phase:

[0043] 1) Node p i Broadcast the valid secret share it received from the distributor, along with the corresponding Merkle proof and

[0044] 2) Node p i After receiving the secret share sent from other nodes, check and Is it correct? If not, discard it directly. When receiving f+1 valid secret shares from different nodes, p i Call Shamir's secret reconstruction algorithm to reconstruct {r1,…,r n} and {m1,…,m n}, and the secret value m;

[0045] 3)p i Continue to perform the following two tests to determine whether the reconstructed secret value is valid:

[0046] a) Test 1: p i Based on {r1,…,r n Generate Merkle tree T′ r , if T′ r The Merkle root r′ root Not equal to r sent by the distributor root , the test fails;

[0047] b) Test 2: p i Based on {m1,…,m n}, calculate {s1,…,s n},in H is a hash function. Based on {s1,…,s n Generate Merkle tree T′ s , if T′ s The Merkle root s′ root Not equal to s sent by the distributor root , the test fails.

[0048] If both of the above tests pass, then p i The reconstructed secret value is determined to be valid; otherwise, the reconstructed secret value is determined to be invalid.

[0049] 2. Quantum-resistant distributed asynchronous random beacon method and system

[0050] The following is a further detailed description of the operation process of the quantum-resistant distributed asynchronous random beacon method in a single execution of the present invention. Figure 3 As shown, the following steps are included:

[0051] 1) Any node p in the system i executing a distribution phase of the quantum-resistant asynchronous verifiable secret sharing method;

[0052] 2) Node p i After receiving valid secret shares from nf different nodes, the quantum-resistant asynchronous common subset protocol is executed with the nf different nodes as input, and the two Merkle tree roots corresponding to their own secrets are used as input to reach a consensus on a node set I = {k1, ..., k t}, and the Merkle tree roots corresponding to these nodes;

[0053] 3) Node p i In 2) the asynchronous common subset protocol outputs the node set I = {k1,…,k t After that, the reconstruction phase of the quantum-resistant asynchronous verifiable secret sharing method is executed to reconstruct the secret value of each node in the set I and determine whether the reconstructed secret value is valid; if the node k j If the secret value of is invalid, it will be removed from the set I;

[0054] 4) For each node in set I, node p i The verification process in 3) is executed and the final node set I′={k′1,…,k′ |I′|}, where |I′| is the size of set I′. i Calculate the XOR sum of the secret values corresponding to the nodes in I′ as the random number output of this execution.

[0055] Corresponding to the above method, the present invention also provides a quantum-resistant distributed asynchronous random beacon system constructed based on the quantum-resistant asynchronous verifiable secret sharing method. The execution process of the system will cyclically execute the above random beacon method and output a public random number after each execution. The system includes a distributed asynchronous random beacon system deployed at any node p i The following modules:

[0056] A distribution module, configured to execute the distribution phase of the quantum-resistant asynchronous verifiable secret sharing method;

[0057] The asynchronous common subset protocol execution module is used to execute the quantum-resistant asynchronous common subset protocol after receiving valid secret shares from nf different nodes, taking the two Merkle tree roots corresponding to its own secret as input, and consensus on a node set I = {k1,…,k t}, and the Merkle tree roots corresponding to these nodes;

[0058] Reconstruction module, used for asynchronous common subset protocol output node set I={k1,…,k t After that, the reconstruction phase of the quantum-resistant asynchronous verifiable secret sharing method is executed to reconstruct the secret value of each node in the set I and determine whether the reconstructed secret value is valid; if the node k j If the secret value of is invalid, it will be removed from the set I;

[0059] Output module, used to obtain the final node set I′={k′1,…,k′ |i′|}, calculate the XOR sum of the secret values corresponding to the nodes in i′ as the public random number.

[0060] Another embodiment of the present invention provides a computer device (computer, server, smart phone, etc.), which includes a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the method of the present invention.

[0061] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, magnetic disk, optical disk), wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the steps of the method of the present invention are implemented.

[0062] The specific embodiments of the present invention disclosed above are intended to facilitate understanding and implementation of the present invention. Those skilled in the art will appreciate that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the embodiments disclosed in this specification; the scope of protection of the present invention shall be determined by the scope defined in the claims.

Claims

1. A quantum-resistant asynchronous verifiable secret sharing method, characterized in that: The method is applicable to n participating nodes, denoted as p1, p2…, p n , where there are at most f malicious nodes, satisfying n≥3f+1; the method is applied to one of the nodes as a distributor, and the remaining nodes as receivers; the method includes a distribution phase and a reconstruction phase; In the distribution phase, the distributor shares the secret value it chooses and sends the corresponding secret share to each receiver. Each receiver verifies whether the secret share it receives is valid. In the reconstruction phase, the receiver broadcasts the valid secret shares it has received. After receiving f+1 valid secret shares, the receiver reconstructs the distributor's secret value and determines whether the reconstructed secret value is valid.

2. The method according to claim 1, characterized in that The distribution phase includes: The distributor locally selects two random numbers, one of which is the secret value and the other is used as a mask for the secret value; The distributor invokes a secret sharing scheme to generate a secret value and a masked secret share, wherein the masked secret share is used to mask the secret share of the secret value; The distributor constructs a Merkle tree based on the masked secret share and the masked secret value's secret share, and generates the Merkle tree root and the Merkle proof corresponding to each secret share; The distributor sends each recipient its corresponding secret share, Merkle proof, and Merkle root, where the distributor uses a reliable broadcast protocol to send the Merkle root; After receiving the secret share from the distributor in step 4 above, the recipient verifies the secret share, Merkle proof, and Merkle tree root. If the verification is successful, the received secret share is considered valid.

3. The method according to claim 2, characterized in that The secret sharing scheme is the Shamir secret sharing scheme.

4. The method according to claim 1, wherein The reconstruction phase includes: The recipient sends the received secret share, Merkle proof, and Merkle root. After receiving the secret shares from the reconstruction phase, the receiver verifies the secret shares, Merkle proof, and Merkle tree root to determine whether the secret shares are valid. After receiving f+1 valid secret shares, the receiver reconstructs the mask and secret value. The receiver verifies that its reconstructed secret value is valid.

5. The method according to claim 4, characterized in that The receiver verifies that the reconstructed secret value is valid, including: The receiver invokes the secret sharing scheme to generate the reconstructed secret value and the secret share of the masked secret value, constructs Merkle trees for each, and calculates the corresponding Merkle tree roots. The receiver compares its reconstructed Merkle root with the Merkle root from the distributor. If the two are consistent, the reconstructed secret value is valid; otherwise, the reconstructed secret value is invalid.

6. A quantum-resistant distributed asynchronous random beacon method, characterized in that: The following steps are involved: The node executes the distribution phase of the quantum-resistant asynchronous verifiable secret sharing method according to any one of claims 1 to 5; The nodes execute the asynchronous common subset protocol, taking the distribution nodes corresponding to the valid secret shares they receive as input, and reach a consensus on a node set I of size t, where t is the minimum of the security parameter λ and f+1; λ satisfies the requirement that a set of size λ is randomly selected from n nodes with negligible error probability, and contains at least one honest node. The node executes the reconstruction phase of the quantum-resistant asynchronous verifiable secret sharing method according to any one of claims 1 to 5, reconstructs the secret value of each node in the set I, and removes the node from the set I if the reconstructed secret value is invalid; The XOR sum of the secret values shared by the nodes in the node output set I is used as The final output Random number.

7. The method according to claim 6, characterized in that The minimum value among all λ values that meet the requirements is selected as the safety parameter.

8. A quantum-resistant distributed asynchronous random beacon system, characterized in that: The system cyclically executes the quantum-resistant distributed asynchronous random beacon method according to claim 6, outputting a random number each time the method is executed; the system comprises: A distribution module, configured to execute the distribution phase of the quantum-resistant asynchronous verifiable secret sharing method according to any one of claims 1 to 5; The asynchronous common subset protocol execution module is used to execute the asynchronous common subset protocol. It takes the distribution nodes corresponding to the valid secret shares it receives as input and agrees on a node set I of size t, where t is the minimum of the security parameter λ and f+1. λ satisfies the requirement that a set of size λ is randomly selected from n nodes with a negligible error probability, and contains at least one honest node. It should be noted that for the sake of protocol execution efficiency, it is recommended to select the minimum of all λ values that meet the requirements as the system parameter. a reconstruction module, configured to execute the reconstruction phase of the quantum-resistant asynchronous verifiable secret sharing method according to any one of claims 1 to 5, reconstruct the secret value of each node in set I, and remove the node from set I if the reconstructed secret value is invalid; The output module is used to output the XOR sum of the secret values of the nodes in set I as the random number output of this execution.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method according to any one of claims 1 to 7 is implemented.

Images