Anti-quantum key exchange method and device, storage medium and electronic equipment

Abstract

The invention provides an anti-quantum key exchange method and device, a storage medium and electronic equipment, and relates to the technical field of network security, and the method comprises the steps: encrypting a first exchange data plaintext, and transmitting an encrypted first exchange data ciphertext to a second user for data ciphertext exchange, obtaining a second exchange data ciphertext calculated by a second user; calculating first truncation data and a first temporary variable of the first exchange data ciphertext, and calculating second truncation data corresponding to the second exchange data ciphertext by using a first anti-quantum private key of the first user; and inputting the coordinate value of the target elliptic curve point, the first hash value and the second hash value into a key derivation function for calculation to obtain a negotiation key. According to the anti-quantum key exchange method and device, the storage medium and the electronic equipment provided by the invention, the SM2 algorithm can be compatible, and the security of data transmission can be ensured under the condition that quantum computers are widely available.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a quantum-resistant key exchange method, device, storage medium, and electronic device. Background Art

[0002] With the development of information technology and computer technology, while people enjoy the many benefits brought by informatization, cybersecurity has become a common challenge faced by mankind in the information age. However, with the rapid development of quantum computing technology, quantum computers pose a significant threat to existing cryptographic algorithms.

[0003] Quantum computers, leveraging the properties of qubits and quantum entanglement, can perform computations that are difficult or impossible for conventional computers. This allows them to crack encryption systems based on large number factorization or discrete logarithm problems, such as the asymmetric RSA encryption algorithm, the elliptic curve encryption algorithm ECC, and SM2. Some quantum-resistant cryptographic schemes exist in related technologies, but these are mostly targeted at specific encryption algorithms and have limited compatibility with SM2.

[0004] Based on this, in order to resist the threat of quantum computers, there is an urgent need for a quantum-resistant cryptographic scheme that is not only compatible with the SM2 algorithm, but also can ensure the security of data transmission when quantum computers are widely available. Summary of the Invention

[0005] The purpose of this application is to provide a quantum-resistant key exchange method, device, storage medium and electronic device that are not only compatible with the SM2 algorithm, but also can ensure the security of data transmission when quantum computers are widely available.

[0006] This application provides a quantum-resistant key exchange method, comprising: The first exchange data plaintext is encrypted using a quantum-resistant encryption algorithm negotiated with the second user to obtain a first exchange data ciphertext, and the first exchange data ciphertext is sent to the second user for data ciphertext exchange to obtain a second exchange data ciphertext calculated by the second user. The first exchange data plaintext is an elliptic curve point calculated based on a first random number. First truncated data of the first exchange data ciphertext is calculated, and a first temporary variable is calculated using the first truncated data and the first random number. Second truncated data corresponding to the second exchange data ciphertext is calculated using the first quantum-resistant private key of the first user. A target elliptic curve point is calculated using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data. The coordinates of the target elliptic curve point, a first hash value, and a second hash value are input into a key derivation function for calculation to obtain a negotiated key. The first hash value is a hash value calculated based on the first public key of the first user. The second hash value is a hash value calculated based on the second public key. The second exchange data plaintext is obtained by decrypting the second exchange data ciphertext.

[0007] In this way, the second user can calculate the negotiated key according to the above steps, and the negotiated key calculated by the second user is the same as the negotiated key calculated by the first user. Afterwards, encrypted data can be transmitted based on the negotiated public key.

[0008] Optionally, the encrypting the first exchange data plaintext using the quantum-resistant encryption algorithm negotiated with the second user to obtain the first exchange data ciphertext includes: using a random number generator to generate the first random number, and using the elliptic curve point calculated using the first random number as the first exchange data plaintext; using the second public key to perform quantum-resistant encryption on the first exchange data plaintext to obtain the first exchange data ciphertext; wherein the quantum-resistant encryption is implemented based on the quantum-resistant encryption algorithm.

[0009] In this way, using the calculated first exchange data ciphertext, the data ciphertext can be exchanged with the second user to obtain the second exchange data ciphertext of the second user. Afterwards, the first user and the second user can use the obtained exchange data ciphertext to calculate exactly the same negotiated key.

[0010] Optionally, the calculation of the first truncated data of the first exchange data ciphertext and the calculation of the first temporary variable using the first truncated data and the first random number include: extracting a first domain element from the first exchange data plaintext, converting the data type of the first domain element into an integer type, and then calculating the truncated data to obtain the first truncated data; using the first truncated data, the first domain element and the first private key of the first user to calculate the first temporary variable.

[0011] Optionally, the calculating the second truncated data corresponding to the second exchange data ciphertext using the first quantum-resistant private key of the first user includes: performing quantum-resistant decryption on the second exchange data ciphertext using the first quantum-resistant private key to obtain a second exchange data plaintext corresponding to the second exchange data ciphertext; the first quantum-resistant private key is: a private key decapsulated by a quantum-resistant key; extracting a second field element from the second exchange data plaintext, converting the data type of the second field element to an integer type, and then calculating the truncated data to obtain the second truncated data; wherein the quantum-resistant decryption is implemented based on a quantum-resistant decryption algorithm corresponding to the quantum-resistant encryption algorithm.

[0012] In this way, after the first user decrypts the second exchange data ciphertext provided by the second user, the first user can use the decrypted second exchange data plaintext to calculate the negotiated key, which can greatly improve the ability to resist quantum cracking.

[0013] Optionally, after inputting the coordinate value, the first hash value and the second hash value of the target elliptic curve point into a key derivation function for calculation to obtain the negotiated key, the method further includes: converting the data types of the coordinate value of the first exchange data plaintext, the coordinate value of the second exchange data plaintext and the coordinate value of the target elliptic curve point into bit strings to obtain a first bit string corresponding to the coordinate value of the first exchange data plaintext, a second bit string corresponding to the coordinate value of the second exchange data plaintext and a third bit string corresponding to the coordinate value of the target elliptic curve point; inputting the first bit string, the second bit string, the third bit string, the first hash value and the second hash value into a first hash algorithm respectively to obtain a first verification value; performing hash iterations on the first verification value the same number of times as the first hash value corresponds to obtain a first secret verification value.

[0014] Optionally, after obtaining the first secret verification value, the method further includes: sending the first secret verification value and the first hash value to the second user for secret verification value exchange, obtaining the second secret verification value calculated by the second user and the second hash number calculated by the second user; inputting the first bit string, the second bit string, the third bit string, the first hash value and the second hash value into the second hash algorithm respectively to obtain a second verification value, and performing hash iterations on the second verification value for the same number of times as the second hash number to obtain a third secret verification value; comparing the third secret verification value with the second secret verification value, if they are the same, the negotiated key verification is successful, otherwise, the negotiated key verification fails; wherein, the second hash algorithm and the first hash algorithm are constructed based on different identification numbers.

[0015] In this way, through the second data exchange, the calculated negotiated key can be verified for consistency, so as to confirm the correctness of the negotiated key.

[0016] The present application also provides a quantum-resistant key exchange device, comprising: A ciphertext generation module is configured to encrypt a first exchange data plaintext using a quantum-resistant encryption algorithm negotiated with the second user to obtain a first exchange data ciphertext; a data exchange module is configured to send the first exchange data ciphertext to the second user for data ciphertext exchange, to obtain a second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on a first random number; a key generation module is configured to calculate first truncated data of the first exchange data ciphertext, calculate a first temporary variable using the first truncated data and the first random number, and calculate second truncated data corresponding to the second exchange data ciphertext using the first quantum-resistant private key of the first user; the key generation module is further configured to calculate a target elliptic curve point using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data, and input the coordinates of the target elliptic curve point, a first hash value, and a second hash value into a key derivation function for calculation to obtain a negotiated key; wherein the first hash value is a hash value calculated based on the first public key of the first user; and the second hash value is a hash value calculated based on the second public key.

[0017] Optionally, the ciphertext generation module is specifically used to use a random number generator to generate the first random number, and use the elliptic curve point calculated using the first random number as the first exchange data plaintext; the ciphertext generation module is also specifically used to use the second public key to perform quantum-resistant encryption on the first exchange data plaintext to obtain the first exchange data ciphertext; wherein, the quantum-resistant encryption is implemented based on the quantum-resistant encryption algorithm.

[0018] Optionally, the key generation module is specifically used to extract the first domain element from the first exchange data plaintext, and convert the data type of the first domain element into an integer type and then calculate the truncated data to obtain the first truncated data; the ciphertext generation module is also specifically used to use the first truncated data, the first domain element and the first private key of the first user to calculate the first temporary variable.

[0019] Optionally, the key generation module is specifically used to use the first quantum-resistant private key to perform quantum-resistant decryption on the second exchange data ciphertext to obtain the second exchange data plaintext corresponding to the second exchange data ciphertext; the first quantum-resistant private key is: the private key of the quantum-resistant key decapsulation; the key generation module is further specifically used to extract the second field element from the second exchange data plaintext, and convert the data type of the second field element into an integer type, and then perform truncated data calculation to obtain the second truncated data; wherein the quantum-resistant decryption is: implemented based on the quantum-resistant decryption algorithm corresponding to the quantum-resistant encryption algorithm.

[0020] Optionally, the device also includes: a key verification module; the key verification module is used to convert the data types of the coordinate values of the first exchange data plaintext, the coordinate values of the second exchange data plaintext and the coordinate values of the target elliptic curve point into bit strings, and obtain a first bit string corresponding to the coordinate values of the first exchange data plaintext, a second bit string corresponding to the coordinate values of the second exchange data plaintext and a third bit string corresponding to the coordinate values of the target elliptic curve point; the key verification module is also used to input the first bit string, the second bit string, the third bit string, the first hash value and the second hash value into a first hash algorithm respectively to obtain a first verification value; the key verification module is also used to perform hash iterations on the first verification value for the same number of times as the first hash value corresponds to obtain a first secret verification value.

[0021] Optionally, the data exchange module is further used to send the first secret verification value and the first hash value to the second user for secret verification value exchange, to obtain the second secret verification value calculated by the second user and the second hash number calculated by the second user; the key verification module is further used to input the first bit string, the second bit string, the third bit string, the first hash value and the second hash value into the second hash algorithm respectively to obtain a second verification value, and perform hash iterations on the second verification value for the same number of times as the second hash number of times to obtain a third secret verification value; the key verification module is further used to compare the third secret verification value with the second secret verification value; if they are the same, the negotiated key verification is successful; otherwise, the negotiated key verification fails; wherein, the second hash algorithm and the first hash algorithm are constructed based on different identification numbers.

[0022] The present application also provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of any of the above-described quantum-resistant key exchange methods.

[0023] The present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-described quantum-resistant key exchange methods are implemented.

[0024] The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described quantum-resistant key exchange methods.

[0025] The quantum-resistant key exchange method, apparatus, storage medium, and electronic device provided by the present application first encrypt a first exchange data plaintext using a quantum-resistant encryption algorithm negotiated with a second user to obtain a first exchange data ciphertext, and then send the first exchange data ciphertext to the second user for data ciphertext exchange to obtain a second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on a first random number; then, first truncated data of the first exchange data ciphertext is calculated, and a first temporary variable is calculated using the first truncated data and the first random number, and second truncated data corresponding to the second exchange data ciphertext is calculated using the first quantum-resistant private key of the first user; finally, a target elliptic curve point is calculated using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data, and the coordinate value, first hash value, and second hash value of the target elliptic curve point are input into a key derivation function for calculation to obtain a negotiated key; wherein the first hash value is: a hash value calculated based on the first public key of the first user; the second hash value is: a hash value calculated based on the second public key. In this way, the quantum-resistant cryptography method is not only compatible with the SM2 algorithm, but also can ensure the security of data transmission when quantum computers are widely available. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0027] Figure 1 This is a schematic diagram of the system architecture used by the quantum-resistant key exchange method provided in this application; Figure 2 This is a flowchart of the quantum-resistant key exchange method provided by this application; Figure 3 This is a schematic diagram of the structure of the quantum-resistant key exchange device provided by this application; Figure 4 It is a structural diagram of the electronic device provided in this application. DETAILED DESCRIPTION

[0028] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0029] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0030] The SM2 algorithm is a public key cryptography algorithm whose security is based on the difficulty of the elliptic curve discrete logarithm problem. However, since quantum computers can run Shor's algorithm, an algorithm that efficiently factors large integers, they can quickly crack cryptographic systems based on the elliptic curve discrete logarithm problem, including the SM2 algorithm. Combining the SM2 algorithm with quantum-resistant cryptographic algorithms is of great significance and value during the migration phase to quantum-resistant cryptography. First, this approach ensures information security. With the advancement of quantum computing technology, the SM2 algorithm faces the risk of being cracked by quantum computers. Quantum-resistant cryptographic algorithms are resistant to quantum computing attacks, and combining them with the SM2 algorithm can further enhance system security. Second, this approach ensures a smooth migration. Before quantum-resistant cryptography technology matures, a large number of infrastructure and application systems already use the SM2 algorithm. Combining the two algorithms allows for a smooth transition from traditional cryptographic algorithms to quantum-resistant algorithms, reducing migration costs. Third, this approach ensures system compatibility. Combining the SM2 algorithm with quantum-resistant cryptographic algorithms ensures compatibility of existing systems and devices, avoiding system reconstruction required by algorithm changes. Furthermore, by combining the two algorithms, the lifecycle of existing systems can be extended without replacing hardware, reducing upgrade costs. In summary, during the quantum-resistant cryptography migration phase, combining the SM2 algorithm with quantum-resistant cryptography algorithms is of great significance for ensuring information security, promoting cryptographic technology innovation, and responding to international competition.

[0031] In the related art of quantum-resistant cryptography, there is no good key agreement algorithm that is both compatible with the existing SM2 algorithm and resistant to quantum attacks. Based on this, the embodiments of the present application provide a quantum-resistant key exchange method that is compatible with the SM2 algorithm. This method is both compatible with the existing SM2 cryptographic algorithm and achieves the function of mutual key negotiation by both parties, while also being secure and resistant to quantum attacks. It is an SM2-compatible key agreement solution that can resist quantum attacks.

[0032] like Figure 1 As shown, this is a schematic diagram of the system architecture of a key agreement system applied to the quantum-resistant key exchange method provided in an embodiment of the present application. The system includes a first user and a second user. The first user and the second user perform key agreement by exchanging data to generate the same agreed key.

[0033] The following is a detailed explanation of the professional terms involved in the embodiments of this application: ①, H: cryptographic hash algorithm; KDF: key derivation function, which can be implemented according to the method given in 5.4.3 of GB / T32918.3-2016.

[0034] ②、The first user has a length of entlen A Bit-based ID A , ENTL A is represented by the integer entlen A The converted two bytes.

[0035] ③、The second user has a length of entlen B Bit-based ID B , ENTL B is represented by the integer entlen B The converted two bytes.

[0036] ④. The first user's SM2 key pair includes its private key d A and public key P A =[d A ]G=(x A ,y A ); The second user's SM2 key pair includes its private key d B and public key P B =[d B ]G=(x B ,y B ).

[0037] ⑤. The Z value of the first user is the hash value Z of the first user's identifiable identifier, some elliptic curve system parameters and the first user's public key. A, can be calculated using the following formula: Z A =H(ENTL A ‖ID A ‖a‖b‖x G ‖y G ‖x A ‖y A ) (Formula 1) Among them, the coordinates x of the elliptic curve equation parameters a, b, and G can be calculated according to the methods given in 4.2.5 and 4.2.6 of GB / T 32918.1-2016. G 、y G and P A The x coordinate A 、y A Converts the data type to a bit string.

[0038] ⑥ The Z value of the second user is the hash value Z of the second user's identifiable identifier, part of the elliptic curve system parameters and the second user's public key B , can be calculated using the following formula 2: Z B =H(ENTL B ‖ID B ‖a‖b‖x G ‖y G ‖x B ‖y B ) (Formula 2) Among them, the coordinates x of the elliptic curve equation parameters a, b, and G can be calculated according to the methods given in 4.2.5 and 4.2.6 of GB / T32918.1-2016. G 、y G and P B The x coordinate B 、y B Converts the data type to a bit string.

[0039] ⑦. w =(log2( n ) / 2)-1, represents the effective data length intercepted from the first exchanged data.

[0040] ⑧、 Trunc ( w , x )function: Trunc ( x )=2 w +( x AND(2 w -1)) is the input value x , intercept its low w After bit, wThe bit is complemented with a bit 1. AND is a bitwise AND operation.

[0041] It should be noted that before executing the quantum-resistant key exchange method provided in the embodiments of the present application, the first user and the second user have already generated their respective key pairs (including public and private keys) and relevant parameters of the SM2 algorithm. Furthermore, the first user and the second user have each obtained the other's public key and the hash value corresponding to the public key.

[0042] The following describes in detail the quantum-resistant key exchange method provided by the embodiments of the present application through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0043] like Figure 2 As shown, an embodiment of the present application provides a quantum-resistant key exchange method, which may include the following steps 201 to 203: Step 201: Use the quantum-resistant encryption algorithm negotiated with the second user to encrypt the first exchange data plaintext to obtain a first exchange data ciphertext, and send the first exchange data ciphertext to the second user for data ciphertext exchange to obtain a second exchange data ciphertext calculated by the second user.

[0044] The first exchange data plaintext is an elliptic curve point calculated based on a first random number.

[0045] For example, after the first user and the second user obtain the public key provided by the other party and the hash value corresponding to the public key, they can calculate the ciphertext of the exchanged data.

[0046] It should be noted that the embodiments of the present application are described with the first user as the execution subject, and the method steps executed by the second user are exactly the same as those executed by the first user.

[0047] Specifically, in the above step 201, the step of calculating the first exchange data ciphertext may further include the following steps 201a and 201a2: Step 201a1: Generate the first random number using a random number generator, and use the elliptic curve point calculated using the first random number as the first exchange data plaintext.

[0048] Step 201a2: Use the second public key to perform quantum-resistant encryption on the first exchanged data plaintext to obtain the first exchanged data ciphertext.

[0049] The quantum-resistant encryption is implemented based on the quantum-resistant encryption algorithm.

[0050] For example, the first user first uses a random number generator to generate a random number (i.e., the first random number mentioned above), and then calculates the elliptic curve point using the following formula 3, and uses the obtained elliptic curve point as the exchange data plaintext , that is, the plaintext of the first exchange data: (Formula 3) Among them, the random number ; is the coordinate value of the elliptic curve point; A Indicates one's own side, i.e. the first user; n is the order of the base point (n is a prime factor of #E(Fq)), where #E(Fq) is the number of elements in the set of all rational points of the elliptic curve E (including points at infinity).

[0051] It should be noted that the random number generator in the embodiments of the present application can be any random number generation algorithm or device.

[0052] For example, after calculating the first exchange data plaintext, the first user can use the public key of the quantum-resistant encryption algorithm pre-negotiated with the second user (i.e., the second public key of the second user mentioned above) to perform quantum-resistant encryption on the first exchange data plaintext to obtain the first exchange data ciphertext .

[0053] It should be noted that in the above steps, if the quantum-resistant cryptographic algorithm is not suitable for directly encrypting elliptic curve points, a digital envelope technique combining a quantum-resistant cryptographic algorithm with a symmetric cryptographic algorithm can be used to encrypt the elliptic curve points. If this is implemented, then, in the subsequent step of decrypting the second exchange data ciphertext sent by the second user, the digital envelope technique combining a quantum-resistant cryptographic algorithm with a symmetric cryptographic algorithm should also be used to decrypt the elliptic curve points.

[0054] For example, after calculating the first exchange data ciphertext, the first user may send the first exchange data ciphertext to the second user, and receive the second exchange data ciphertext calculated by the second user based on the same calculation method, thereby completing the first data exchange.

[0055] It should be noted that the quantum-resistant encryption algorithm in the embodiment of the present application may be the NTRU (Number Theory Research Unit) quantum-resistant encryption algorithm, or the CRYSTALS-KYBER algorithm, the CTRU algorithm, etc.

[0056] Step 202: Calculate first truncated data of the first exchanged data ciphertext, calculate a first temporary variable using the first truncated data and the first random number, and calculate second truncated data corresponding to the second exchanged data ciphertext using the first quantum-resistant private key of the first user.

[0057] For example, after completing the first data exchange, the first user may decrypt the second exchange data ciphertext obtained by the exchange, and use the obtained second exchange data plaintext to generate a negotiation key.

[0058] Specifically, in step 202, the step of calculating the first truncated data of the first exchange data ciphertext and calculating the first temporary variable using the first truncated data and the first random number may further include the following steps 202a1 and 202a2: Step 202a1: extract a first field element from the first exchange data plaintext, convert the data type of the first field element to an integer type, and then perform truncated data calculation to obtain the first truncated data.

[0059] Step 202a2: Calculate the first temporary variable using the first truncated data, the first domain element, and the first private key of the first user.

[0060] For example, when the first user calculates the negotiated key, he first needs to calculate the first exchange data plaintext Extract the domain elements In the embodiment of the present application, the domain element can be converted into The data type is converted to an integer, and the first truncated data of the first exchanged data plain text of the first user is calculated using the following formula 4 : (Formula 4) in, , indicating the effective data length intercepted from the first exchange data.

[0061] For example, after obtaining the first truncated data, the first temporary variable of the first user can be calculated using the following formula 5: : (Formula 5) in, is the private key of the first user, that is, the first quantum-resistant private key.

[0062] Specifically, in step 202 above, the step of calculating the second truncated data corresponding to the second exchanged data ciphertext using the first quantum-resistant private key of the first user may further include the following steps 202b1 and 202b2: Step 202b1: Use the first quantum-resistant private key to perform quantum-resistant decryption on the second exchange data ciphertext to obtain a second exchange data plaintext corresponding to the second exchange data ciphertext.

[0063] The first quantum-resistant private key is: a quantum-resistant key decapsulated private key.

[0064] Step 202b2: Extract the second field element from the second exchange data plaintext, convert the data type of the second field element to an integer type, and then perform truncated data calculation to obtain the second truncated data.

[0065] The quantum-resistant decryption is implemented based on a quantum-resistant decryption algorithm corresponding to the quantum-resistant encryption algorithm.

[0066] For example, when calculating the second truncated data of the second user, it is first necessary to use the quantum-resistant private key of the first user (i.e., the first user) sk A The second exchange data ciphertext received by the second user Decrypt and obtain the second exchange data plaintext of the second user . Indicates the other party, that is, the second user.

[0067] In a possible implementation, after obtaining the second exchange data plaintext, it is further possible to verify whether the second exchange data plaintext satisfies the elliptic curve equation. If so, the next step can be performed; otherwise, it indicates that the negotiation has failed.

[0068] Illustratively, after successful verification, the truncated data of the second exchange data plaintext, ie, the second truncated data, may be calculated according to the calculation steps of the first truncated data.

[0069] Step 203: Calculate a target elliptic curve point using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data, and input the coordinate value of the target elliptic curve point, the first hash value, and the second hash value into a key derivation function for calculation to obtain a negotiated key.

[0070] The first hash value is a hash value calculated based on the first public key of the first user; the second hash value is a hash value calculated based on the second public key; and the second exchange data plaintext is obtained by decrypting the second exchange data ciphertext.

[0071] For example, after calculating the second truncated data, the elliptic curve point is calculated using the following formula 6 in combination with the previously calculated first temporary variable, the second exchange data plaintext, and the previously obtained second public key, i.e., the target elliptic curve point : (Formula 6) in, is the coordinate value of the target elliptic curve point, if If it is a point at infinity, it means the negotiation has failed.

[0072] For example, after obtaining the coordinate value of the target elliptic curve point, the negotiated key can be calculated using the following formula 7: K A : (Formula 7) in, is the length of the negotiated key, is the first hash value of the first public key, It should be noted that the second user can also use the above formula 7 to calculate the negotiated key. The difference is that when the second user calculates the negotiated key, the coordinate value of the elliptic curve calculated by the second user is used.

[0073] It should be noted that the second user can calculate the negotiated public key according to the above steps, and the negotiated public key calculated by the second user is the same as the negotiated public key calculated by the first user. In this way, encrypted data can be transmitted based on the negotiated public key.

[0074] Optionally, in an embodiment of the present application, after both parties calculate the negotiated key, the consistency of the negotiated key may be verified through the exchange of secondary data.

[0075] Illustratively, after step 203 above, the quantum-resistant key exchange method provided in the embodiment of the present application may further include the following steps 204 to 206: Step 204: Convert the data types of the coordinate values of the first exchange data plaintext, the coordinate values of the second exchange data plaintext, and the coordinate values of the target elliptic curve point into bit strings to obtain a first bit string corresponding to the coordinate values of the first exchange data plaintext, a second bit string corresponding to the coordinate values of the second exchange data plaintext, and a third bit string corresponding to the coordinate values of the target elliptic curve point.

[0076] Step 205: Input the first bit string, the second bit string, the third bit string, the first hash value, and the second hash value into a first hash algorithm respectively to obtain a first verification value.

[0077] Step 206: Perform hash iterations on the first verification value for the same number of times as the first hash value, to obtain a first secret verification value.

[0078] For example, before the second data exchange, the data to be exchanged needs to be calculated. First, the exchange data provided by the other party can be calculated according to the method given in 4.2.6 and 4.2.5 of GB / T 32918.1-2016. Coordinates 、 Exchange data with your own calculations Coordinates 、 The data type is converted into a bit string, and a first verification value of the first user is calculated.

[0079] Exemplarily, the first user may use the following formula 8 to calculate the secret verification value, ie, the first verification value mentioned above: (Formula 8) Here, 0x03 is 3 expressed in hexadecimal.

[0080] Illustratively, after the first verification value is completed, hash iteration may be performed on the first verification value in a hash iteration manner to obtain a final first secret verification value.

[0081] For example, in the embodiment of the present application, hash iteration can be performed by the following steps: Set the number of quadratic hashing iterations ( is 0 or a positive integer), and S A Execute as follows Iterative hashing of times: ①h0= S A ;②For i=1,2,…, implement: h i =H( h i-1 ) END i ③ S A = hi .implement The hash value after the iterative hashing is still recorded as S A .like If it is 0, no hash iteration is performed.

[0082] For example, after calculating the first secret verification value, the first user may send the first secret verification value to the second user, and receive the second secret verification value sent by the second user, thereby completing the second data exchange.

[0083] It should be noted that the first user can and S A Sent to the second user only if When it is 0, it can be not sent to be compatible with the key negotiation of the SM2 algorithm.

[0084] Illustratively, after step 206, the quantum-resistant key exchange method provided in the embodiment of the present application may further include the following steps 207 to 209: Step 207: Send the first secret verification value and the first hash value to the second user to exchange secret verification values, and obtain a second secret verification value calculated by the second user and a second hash number calculated by the second user.

[0085] Step 208: Input the first bit string, the second bit string, the third bit string, the first hash value, and the second hash value into a second hash algorithm respectively to obtain a second verification value, and perform hash iterations on the second verification value the same number of times as the second hash iterations to obtain a third secret verification value.

[0086] Step 209: Compare the third secret verification value with the second secret verification value. If they are the same, the negotiated key verification succeeds; otherwise, the negotiated key verification fails.

[0087] The second hash algorithm (ie, the above formula 8) and the first hash algorithm (ie, the following formula 9) are constructed based on different identification numbers (ie, 2 and 3 in hexadecimal representation).

[0088] For example, after the first user receives the second secret verification value and the corresponding number of iterations (i.e., the second hash number) sent by the second user, the first user can calculate the third verification value using the following formula 9: (Formula 9) Here, 0x02 is 2 expressed in hexadecimal.

[0089] Afterwards, proceed After the hash iterations (i.e., the second hash iterations), the third secret verification value is obtained. , and verify Is it true? If so, the negotiated key verification is successful; otherwise, the negotiated key verification fails.

[0090] Exemplarily, the first hash value and the second hash number are both preset. For example, the first hash value may be 10,000 times, and the second hash number may be 20,000 times.

[0091] It should be noted that the second user also calculates the second secret verification value according to the above formula nine. After receiving the second secret verification value sent by the second user, the first user uses formula nine to calculate a new secret verification value (i.e., the above third secret verification value) and compares it with the second secret verification value. If they are the same, the negotiated key verification is successful; otherwise, the negotiated key verification fails.

[0092] In actual application, the first user and the second user can negotiate to select the hash function H used by both parties, negotiate to select the quantum-resistant encryption algorithm used by both parties, and negotiate to select whether to perform secondary data exchange.

[0093] The quantum-resistant key exchange method provided in the embodiments of the present application can achieve the following technical goals: 1. Compatibility with the SM2 algorithm: This method maintains the negotiation characteristics of the SM2 algorithm as much as possible while ensuring security, so as to facilitate migration and quick deployment of existing systems using the SM2 cryptographic algorithm.

[0094] 2. Resist quantum attacks: This method uses a quantum-resistant cryptographic algorithm to encrypt temporary public keys during data exchange for key negotiation, ensuring that the security of key negotiation is not threatened by quantum computers.

[0095] 3. Maintaining negotiation characteristics: This method continues to use the SM2 key negotiation algorithm in subsequent processes and maintains the negotiation characteristics to ensure that the shared key is negotiated by both parties and prevent the shared key from being unilaterally controlled by any participating party.

[0096] 4. Increase attack complexity: After the shared key is generated through negotiation, this method performs multiple hashing on the verification data. This can increase the complexity of the attacker's attack, enhance the ability of the quantum-resistant algorithm to resist side-channel attacks, and further improve the security of the key negotiation of this scheme.

[0097] The quantum-resistant key exchange method provided in an embodiment of the present application includes: first, encrypting a first exchange data plaintext using a quantum-resistant encryption algorithm negotiated with the second user to obtain a first exchange data ciphertext, and sending the first exchange data ciphertext to the second user for data ciphertext exchange to obtain a second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on a first random number; then, calculating first truncated data of the first exchange data ciphertext, and using the first truncated data and the first random number to calculate a first temporary variable, and using the first quantum-resistant private key of the first user to calculate second truncated data corresponding to the second exchange data ciphertext; finally, using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data to calculate a target elliptic curve point, and inputting the coordinate value, first hash value, and second hash value of the target elliptic curve point into a key derivation function for calculation to obtain a negotiated key; wherein the first hash value is: a hash value calculated based on the first public key of the first user; the second hash value is: a hash value calculated based on the second public key. In this way, the quantum-resistant cryptography method is not only compatible with the SM2 algorithm, but also can ensure the security of data transmission when quantum computers are widely available.

[0098] It should be noted that the quantum-resistant key exchange method provided in the embodiments of the present application can be executed by a quantum-resistant key exchange device, or a control module in the quantum-resistant key exchange device for executing the quantum-resistant key exchange method. In the embodiments of the present application, the quantum-resistant key exchange device executing the quantum-resistant key exchange method is used as an example to illustrate the quantum-resistant key exchange device provided in the embodiments of the present application.

[0099] It should be noted that the quantum-resistant key exchange methods shown in the figures in the embodiments of this application are each illustrated by way of example in conjunction with one of the figures in the embodiments of this application. In specific implementations, the quantum-resistant key exchange methods shown in the figures in the figures in the above methods may also be implemented in conjunction with any other combinable figures shown in the above embodiments, and will not be further described here.

[0100] The quantum-resistant key exchange device provided by the present application is described below. The quantum-resistant key exchange method described below can be referenced to each other.

[0101] Figure 3 This is a schematic diagram of the structure of the quantum-resistant key exchange device provided in the embodiment of the present application, as shown in FIG. Figure 3 As shown, specifically including: The ciphertext generation module 301 is used to encrypt the first exchange data plaintext using the quantum-resistant encryption algorithm negotiated with the second user to obtain the first exchange data ciphertext; the data exchange module 302 is used to send the first exchange data ciphertext to the second user for data ciphertext exchange, and obtain the second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on the first random number; the key generation module 303 is used to calculate the first truncated data of the first exchange data ciphertext, and use the first truncated data and the first random number to calculate the first temporary variable, and use the first quantum-resistant private key of the first user to calculate the first temporary variable. The second truncated data corresponding to the second exchange data ciphertext; the key generation module 303 is further used to use the first temporary variable, the second exchange data plaintext, the second public key of the second user and the second truncated data to calculate the target elliptic curve point, and input the coordinate value, first hash value and second hash value of the target elliptic curve point into the key derivation function for calculation to obtain the negotiated key; wherein, the first hash value is: a hash value calculated based on the first public key of the first user; the second hash value is: a hash value calculated based on the second public key; the second exchange data plaintext is obtained by decrypting the second exchange data ciphertext.

[0102] Optionally, the ciphertext generation module 301 is specifically used to use a random number generator to generate the first random number, and use the elliptic curve point calculated using the first random number as the first exchange data plaintext; the ciphertext generation module 301 is also specifically used to use the second public key to perform quantum-resistant encryption on the first exchange data plaintext to obtain the first exchange data ciphertext; wherein, the quantum-resistant encryption is implemented based on the quantum-resistant encryption algorithm.

[0103] Optionally, the key generation module 303 is specifically used to extract the first domain element from the first exchange data plaintext, and convert the data type of the first domain element into an integer type and then calculate the truncated data to obtain the first truncated data; the key generation module 303 is also specifically used to use the first truncated data, the first domain element and the first private key of the first user to calculate the first temporary variable.

[0104] Optionally, the key generation module 303 is specifically configured to perform quantum-resistant decryption on the second exchange data ciphertext using a first quantum-resistant private key to obtain a second exchange data plaintext corresponding to the second exchange data ciphertext; the first quantum-resistant private key is: a private key decapsulated by the quantum-resistant key; the key generation module 303 is further configured to extract a second field element from the second exchange data plaintext, convert the data type of the second field element into an integer type, and then perform a truncated data calculation to obtain the second truncated data; wherein the quantum-resistant decryption is implemented based on a quantum-resistant decryption algorithm corresponding to the quantum-resistant encryption algorithm.

[0105] Optionally, the device also includes: a key verification module; the key verification module is used to convert the data types of the coordinate values of the first exchange data plaintext, the coordinate values of the second exchange data plaintext and the coordinate values of the target elliptic curve point into bit strings, and obtain a first bit string corresponding to the coordinate values of the first exchange data plaintext, a second bit string corresponding to the coordinate values of the second exchange data plaintext and a third bit string corresponding to the coordinate values of the target elliptic curve point; the key verification module is also used to input the first bit string, the second bit string, the third bit string, the first hash value and the second hash value into a first hash algorithm respectively to obtain a first verification value; the key verification module is also used to perform hash iterations on the first verification value for the same number of times as the first hash value corresponds to obtain a first secret verification value.

[0106] Optionally, the data exchange module 302 is further used to send the first secret verification value and the first hash value to the second user for secret verification value exchange, to obtain the second secret verification value calculated by the second user and the second hash number calculated by the second user; the key verification module is further used to input the first bit string, the second bit string, the third bit string, the first hash value and the second hash value into the second hash algorithm respectively to obtain a second verification value, and perform hash iterations on the second verification value for the same number of times as the second hash number of times to obtain a third secret verification value; the key verification module is further used to compare the third secret verification value with the second secret verification value; if they are the same, the negotiated key verification is successful; otherwise, the negotiated key verification fails; wherein, the second hash algorithm and the first hash algorithm are constructed based on different identification numbers.

[0107] The quantum-resistant key exchange device provided by the present application first encrypts a first exchange data plaintext using a quantum-resistant encryption algorithm negotiated with a second user to obtain a first exchange data ciphertext, and sends the first exchange data ciphertext to the second user for data ciphertext exchange to obtain a second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on a first random number; then, first truncated data of the first exchange data ciphertext is calculated, and a first temporary variable is calculated using the first truncated data and the first random number, and second truncated data corresponding to the second exchange data ciphertext is calculated using the first quantum-resistant private key of the first user; finally, a target elliptic curve point is calculated using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data, and the coordinate value, first hash value, and second hash value of the target elliptic curve point are input into a key derivation function for calculation to obtain a negotiated key; wherein the first hash value is: a hash value calculated based on the first public key of the first user; the second hash value is: a hash value calculated based on the second public key. In this way, the quantum-resistant cryptography method is not only compatible with the SM2 algorithm, but also can ensure the security of data transmission when quantum computers are widely available.

[0108] Figure 4 An example of a physical structure diagram of an electronic device is shown below. Figure 4As shown, the electronic device may include: a processor (processor) 410 , a communication interface (Communications Interface) 420 , a memory (memory) 430 and a communication bus 440 , wherein the processor 410 , the communication interface 420 , and the memory 430 communicate with each other via the communication bus 440 . The processor 410 may invoke logic instructions in the memory 430 to execute a quantum-resistant key exchange method, the method comprising: first, encrypting a first exchange data plaintext using a quantum-resistant encryption algorithm negotiated with the second user to obtain a first exchange data ciphertext, and sending the first exchange data ciphertext to the second user for data ciphertext exchange to obtain a second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on a first random number; then, calculating first truncated data of the first exchange data ciphertext, calculating a first temporary variable using the first truncated data and the first random number, and calculating second truncated data corresponding to the second exchange data ciphertext using the first quantum-resistant private key of the first user; finally, calculating a target elliptic curve point using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data, and inputting the coordinates of the target elliptic curve point, a first hash value, and a second hash value into a key derivation function for calculation to obtain a negotiated key; wherein the first hash value is a hash value calculated based on the first public key of the first user; and the second hash value is a hash value calculated based on the second public key. In this way, the quantum-resistant cryptography method is not only compatible with the SM2 algorithm, but also can ensure the security of data transmission when quantum computers are widely available.

[0109] In addition, the logical instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the existing technology, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0110] On the other hand, the present application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the quantum-resistant key exchange method provided by the above methods, and the method includes: first, using the quantum-resistant encryption algorithm negotiated with the second user to encrypt the first exchange data plaintext to obtain a first exchange data ciphertext, and sending the first exchange data ciphertext to the second user for data ciphertext exchange to obtain a second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on a first random number; thereafter, calculating the first exchange data plaintext The first truncated data of the exchange data ciphertext is used, and a first temporary variable is calculated using the first truncated data and the first random number, and a second truncated data corresponding to the second exchange data ciphertext is calculated using the first quantum-resistant private key of the first user. Finally, a target elliptic curve point is calculated using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data. The coordinate value of the target elliptic curve point, the first hash value, and the second hash value are input into a key derivation function for calculation to obtain a negotiated key. The first hash value is a hash value calculated based on the first public key of the first user, and the second hash value is a hash value calculated based on the second public key. In this way, the quantum-resistant cryptography method is not only compatible with the SM2 algorithm, but also can ensure the security of data transmission when quantum computers are widely available.

[0111] On the other hand, the present application also provides a computer-readable storage medium having a computer program stored thereon, which is implemented by a processor to perform the above-mentioned quantum-resistant key exchange method, the method comprising: first, using the quantum-resistant encryption algorithm negotiated with the second user to encrypt the first exchange data plaintext to obtain a first exchange data ciphertext, and sending the first exchange data ciphertext to the second user for data ciphertext exchange to obtain a second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on a first random number; thereafter, calculating the first truncated data of the first exchange data ciphertext, and using the The first truncated data and the first random number are used to calculate a first temporary variable, and the first user's first quantum-resistant private key is used to calculate the second truncated data corresponding to the second exchanged data ciphertext. Finally, the first temporary variable, the second exchanged data plaintext, the second user's second public key, and the second truncated data are used to calculate a target elliptic curve point. The coordinate values of the target elliptic curve point, the first hash value, and the second hash value are input into a key derivation function for calculation to obtain a negotiated key. The first hash value is a hash value calculated based on the first public key of the first user, and the second hash value is a hash value calculated based on the second public key. In this way, the quantum-resistant cryptography method is not only compatible with the SM2 algorithm, but also ensures the security of data transmission when quantum computers are widely available.

[0112] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0113] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A quantum-resistant key exchange method, characterized in that: A first user applied to a key agreement system, the key agreement system further comprising: a second user; The method comprises: Encrypting the first exchange data plaintext using a quantum-resistant encryption algorithm negotiated with the second user to obtain a first exchange data ciphertext, and sending the first exchange data ciphertext to the second user for data ciphertext exchange to obtain a second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on the first random number; Calculating first truncated data of the first exchange data ciphertext, calculating a first temporary variable using the first truncated data and the first random number, and calculating second truncated data corresponding to the second exchange data ciphertext using the first quantum-resistant private key of the first user; Calculating a target elliptic curve point using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data, and inputting the coordinate value of the target elliptic curve point, the first hash value, and the second hash value into a key derivation function for calculation to obtain a negotiated key; The first hash value is a hash value calculated based on the first public key of the first user; the second hash value is a hash value calculated based on the second public key; and the second exchange data plaintext is obtained by decrypting the second exchange data ciphertext.

2. The method according to claim 1, characterized in that The step of encrypting the first exchange data plaintext using the quantum-resistant encryption algorithm negotiated with the second user to obtain the first exchange data ciphertext includes: generating the first random number using a random number generator, and using an elliptic curve point calculated using the first random number as the first exchange data plaintext; Performing quantum-resistant encryption on the first exchanged data plaintext using the second public key to obtain the first exchanged data ciphertext; Wherein, the quantum-resistant encryption is implemented based on the quantum-resistant encryption algorithm.

3. The method according to claim 1, characterized in that The calculating of the first truncated data of the first exchange data ciphertext and calculating the first temporary variable using the first truncated data and the first random number includes: Extracting a first field element from the first exchange data plaintext, converting a data type of the first field element to an integer type, and then performing a truncated data calculation to obtain the first truncated data; The first temporary variable is calculated using the first truncated data, the first domain element, and the first private key of the first user.

4. The method according to claim 1, wherein The calculating, using the first quantum-resistant private key of the first user, the second truncated data corresponding to the second exchanged data ciphertext includes: Performing quantum-resistant decryption on the second exchange data ciphertext using the first quantum-resistant private key to obtain a second exchange data plaintext corresponding to the second exchange data ciphertext; wherein the first quantum-resistant private key is: a private key for quantum-resistant key decapsulation; extracting a second field element from the second exchange data plaintext, converting a data type of the second field element to an integer type, and then performing a truncation calculation to obtain the second truncation data; The quantum-resistant decryption is implemented based on a quantum-resistant decryption algorithm corresponding to the quantum-resistant encryption algorithm.

5. The method according to claim 1, wherein After inputting the coordinate value of the target elliptic curve point, the first hash value, and the second hash value into a key derivation function for calculation to obtain a negotiated key, the method further includes: Converting the data types of the coordinate values of the first exchange data plaintext, the coordinate values of the second exchange data plaintext, and the coordinate values of the target elliptic curve point into bit strings, thereby obtaining a first bit string corresponding to the coordinate values of the first exchange data plaintext, a second bit string corresponding to the coordinate values of the second exchange data plaintext, and a third bit string corresponding to the coordinate values of the target elliptic curve point; Inputting the first bit string, the second bit string, the third bit string, the first hash value, and the second hash value into a first hash algorithm to obtain a first verification value; Perform hash iterations on the first verification value for the same number of times as the first hash value, to obtain a first secret verification value.

6. The method according to claim 5, characterized in that After obtaining the first secret verification value, the method further includes: Sending the first secret verification value and the first hash value to the second user for secret verification value exchange, to obtain a second secret verification value calculated by the second user and a second hash number calculated by the second user; inputting the first bit string, the second bit string, the third bit string, the first hash value, and the second hash value into a second hash algorithm to obtain a second verification value, and performing a number of hash iterations on the second verification value equal to a number of hash iterations to obtain a third secret verification value; Comparing the third secret verification value with the second secret verification value, if they are the same, the negotiated key verification succeeds; otherwise, the negotiated key verification fails; The second hash algorithm and the first hash algorithm are constructed based on different identification numbers.

7. A quantum-resistant key exchange device, characterized in that: A first user applied to a key agreement system, the key agreement system further comprising: a second user; The device comprises: a ciphertext generation module, configured to encrypt the first exchanged data plaintext using a quantum-resistant encryption algorithm negotiated with the second user to obtain a first exchanged data ciphertext; A data exchange module, configured to send the first exchange data ciphertext to the second user for data ciphertext exchange, and obtain a second exchange data ciphertext calculated by the second user; the first exchange data plaintext is an elliptic curve point calculated based on the first random number; a key generation module, configured to calculate first truncated data of the first exchanged data ciphertext, calculate a first temporary variable using the first truncated data and the first random number, and calculate second truncated data corresponding to the second exchanged data ciphertext using the first quantum-resistant private key of the first user; The key generation module is further configured to calculate a target elliptic curve point using the first temporary variable, the second exchange data plaintext, the second public key of the second user, and the second truncated data, and input the coordinate value of the target elliptic curve point, the first hash value, and the second hash value into a key derivation function for calculation to obtain a negotiated key; The first hash value is a hash value calculated based on the first public key of the first user; the second hash value is a hash value calculated based on the second public key; and the second exchange data plaintext is obtained by decrypting the second exchange data ciphertext.

8. The device according to claim 7, characterized in that The ciphertext generation module is specifically configured to use a random number generator to generate the first random number, and use the elliptic curve point calculated using the first random number as the first exchange data plaintext; The ciphertext generation module is further configured to perform quantum-resistant encryption on the first exchange data plaintext using the second public key to obtain the first exchange data ciphertext; Wherein, the quantum-resistant encryption is implemented based on the quantum-resistant encryption algorithm.

9. The device according to claim 7, characterized in that The key generation module is specifically configured to extract a first field element from the first exchange data plaintext, convert the data type of the first field element into an integer type, and then perform truncated data calculation to obtain the first truncated data; The key generation module is further configured to calculate the first temporary variable using the first truncated data, the first domain element, and the first private key of the first user.

10. The device according to claim 7, characterized in that The key generation module is specifically configured to perform quantum-resistant decryption on the second exchange data ciphertext using the first quantum-resistant private key to obtain the second exchange data plaintext corresponding to the second exchange data ciphertext; the first quantum-resistant private key is: a private key for quantum-resistant key decapsulation; The key generation module is further configured to extract a second field element from the second exchange data plaintext, convert the data type of the second field element into an integer type, and then perform truncated data calculation to obtain the second truncated data; The quantum-resistant decryption is implemented based on a quantum-resistant decryption algorithm corresponding to the quantum-resistant encryption algorithm.

11. The device according to claim 7, characterized in that The device further comprises: a key verification module; The key verification module is configured to convert the data types of the coordinate values of the first exchange data plaintext, the coordinate values of the second exchange data plaintext, and the coordinate values of the target elliptic curve point into bit strings, thereby obtaining a first bit string corresponding to the coordinate values of the first exchange data plaintext, a second bit string corresponding to the coordinate values of the second exchange data plaintext, and a third bit string corresponding to the coordinate values of the target elliptic curve point; The key verification module is further configured to input the first bit string, the second bit string, the third bit string, the first hash value, and the second hash value into a first hash algorithm to obtain a first verification value; The key verification module is further configured to perform hash iterations on the first verification value for the same number of times as the first hash value, to obtain a first secret verification value.

12. The device according to claim 11, characterized in that The data exchange module is further configured to send the first secret verification value and the first hash value to the second user for secret verification value exchange, to obtain a second secret verification value calculated by the second user and a second hash value calculated by the second user; The key verification module is further configured to input the first bit string, the second bit string, the third bit string, the first hash value, and the second hash value into a second hash algorithm to obtain a second verification value, and perform hash iterations on the second verification value for a number of times corresponding to the second hashing number of times to obtain a third secret verification value; The key verification module is further configured to compare the third secret verification value with the second secret verification value; if they are the same, the negotiated key verification succeeds; otherwise, the negotiated key verification fails; The second hash algorithm and the first hash algorithm are constructed based on different identification numbers.

13. An electronic device, characterized in that: The invention comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the quantum-resistant key exchange method according to any one of claims 1 to 6 are implemented.

14. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the steps of the quantum-resistant key exchange method according to any one of claims 1 to 6 are implemented.

Images