Password authentication key agreement method and system

Abstract

The application relates to the technical field of network communication and information security, and discloses a password authentication key agreement method and system, which comprises the following steps: a system pregenerates a public system public key and a password encoding vector group; a first participant generates a transformed password public key set by using a user password, a public key pair and the encoding vector group, and sends the transformed password public key set to a second participant; the second participant decodes the transformed public key set sent by the first participant by using the user password and the encoding vector group, and restores the public key pair set of the first participant; the second participant generates encrypted verification information by using the restored public key pair set, and sends the encrypted verification information to the first participant for verification; the first participant decrypts and verifies the encrypted verification information sent by the second participant; and if the verification is successful, the same shared key is generated by the two parties. The application uses public key encryption and a hash function to realize a new PAKE protocol with general security, resist quantum attacks, applies a hash in a high-entropy random number domain, reduces the dependence on the hash function, and maintains quantum security.

Description

Technical Field

[0001] This application relates to the fields of cryptography and network security technology, and in particular to password-based authentication and key negotiation (PAKE) technology. Background Technology

[0002] In recent years, password-based authentication and key negotiation have remained important in network communication because most users are more likely to remember passwords than manage keys. Traditional Password Authentication Key Negotiation (PAKE) protocols are mainly based on hash mapping of passwords, but this construction is less secure against attacks from quantum computers.

[0003] Currently, the main existing solution is Password-Based Authentication Key Agreement (PAKE), which allows two parties with the same password to securely establish a session key and mutually authenticate each other's identities over a public network. These protocols typically need to meet two conditions: correctness and security. Correctness ensures that both parties sharing the same password can obtain the same key, while security requires that even when exchanging information over a public network, attackers cannot obtain any information about the final negotiated key by guessing the password.

[0004] However, existing solutions have some drawbacks, such as:

[0005] 1) Existing PAKE schemes face the threat of quantum computer attacks: Existing PAKE schemes based on password hashes or symmetric encryption will be vulnerable to being cracked after the widespread use of quantum computers. This is because quantum algorithms can crack current hash and symmetric encryption in a very short time. Therefore, existing PAKE schemes lack resistance to quantum attacks.

[0006] 2) Existing solutions rely on high-strength symmetric encryption algorithms: Some existing PAKE schemes use symmetric encryption algorithms with passwords as keys, which requires very high-security symmetric encryption algorithms; otherwise, the entire scheme is easily compromised. However, such symmetric encryption algorithms are very complex to implement and difficult to deploy.

[0007] 3) Existing solutions have security weaknesses: PAKE solutions, which directly hash or encode passwords, rely on the inherent security strength of these operations. Because the password space is small, they are vulnerable to brute-force attacks. This results in certain security vulnerabilities in existing solutions.

[0008] 4) High cost of upgrading and maintaining existing solutions: To improve the security of existing PAKE solutions, it is necessary to frequently update the underlying hash function, symmetric encryption scheme, etc., which leads to high cost of maintenance and upgrading.

[0009] Therefore, there is an urgent need for a cryptographic authentication and key negotiation scheme that can resist quantum computer attacks while maintaining the simplicity and low cost of maintenance. Summary of the Invention

[0010] The purpose of this application is to provide a password authentication key negotiation method and system to solve the problems mentioned in the background art.

[0011] This application discloses a password authentication key negotiation method, including the following steps:

[0012] Step A: Pre-generate and publicly disclose the system's shared public key cpk and password encoding vector group in the system.

[0013] Step B: The first participant uses their user password pw and the system's publicly available password encoding vector group. Combine the user password pw with the user's public / private key pair {(pk) i ,sk i )} i∈

[128] Combined, a transformed public key set (vpk1, vpk2, ..., vpk) is generated. 128 ), and transmit it to the second participant;

[0014] Step C: The second participant uses their own user password pw and the password encoding vector group publicly available by the system. The transformed public key set (vpk1, vpk2, ..., vpk) sent to the first participant 128 Decode the data to recover the set of public key pairs (pk′1,…,pk′) of the first participant. 128 The second participant uses the recovered user public key to generate encrypted verification information and sends it to the first participant for verification.

[0015] Step D: The first participant decrypts and verifies the encrypted verification information sent by the second participant; when the verification is successful, both parties generate the same shared key according to the protocol.

[0016] In a preferred embodiment, step A specifically includes:

[0017] The first system entity generates the system shared public key cpk, wherein the system shared public key cpk is used to encrypt user password information;

[0018] The first system entity randomly generates the password encoding vector group. The password encoding vector group contains an encoding vector that encodes user password information;

[0019] The first system entity will use the system shared public key cpk and the password encoding vector group. public.

[0020] In a preferred embodiment, step B specifically includes:

[0021] The first participant obtains the system's shared public key cpk and the password encoding vector group.

[0022] The first participating party obtains the user password pw;

[0023] The first participant uses the user password pw and the password encoding vector group. The user password pw is compared with the user public key pk generated by the first participant. i Encode the password to generate the transformed public key vpk. i ;

[0024] The first participant will generate the transformed public key vpk for the password. i The transformed password public key set (vpk1, vpk2, ..., vpk) is transmitted to the second participant to form the transformed password public key set. 128 ).

[0025] In a preferred embodiment, step C specifically includes:

[0026] The second participant obtains the system's shared public key cpk and the password encoding vector group (vpk1, vpk2, ..., vpk). 128 );

[0027] The second participant obtains the user password pw from the second participant;

[0028] The second participant uses the user password pw and the password encoding vector group. The transformed password public key set (vpk1, vpk2, ..., vpk) sent to the first participant 128 Decode the key to recover the public key pk′ of the first participant. i ;

[0029] The second participant randomly generates multiple random numbers z1, ..., z2. 128 The second participant uses two hash functions G1 and G2 to generate a random number seed r and a negotiation key k based on the calculated random number sum m. The second participant then uses the generated random number seed r and the recovered user public key pk′. i For the generated random numbers z1, ..., z 128 Encryption is performed, resulting in multiple encrypted random numbers (c1, ..., c). 128As encrypted verification information, the second participant will generate encrypted verification information {c1, ..., c...}. 128 Along with the password pw of the second participant encrypted using the system's shared public key cpk and the encrypted random number {c1, ..., c}, the system also encrypts the random number {c1, ..., c}. 128 The resulting verification ciphertext C is then sent to the first participant.

[0030] In a preferred embodiment, step D specifically includes:

[0031] The first participant obtains the user password pw from the first participant;

[0032] The first participant obtains the user's public and private key pair set {(pk i ,sk i )} i∈

[128] ;

[0033] The first participant receives the encrypted verification information (c1, ..., c) sent by the second participant. 128 ) and verification ciphertext C;

[0034] The first participant uses their own user private key (sk1, ..., sk2) 128 The received encrypted random number ciphertext (c1, ..., c) 128 Decrypt the data to obtain the decryption random number ((z1′,...,z...)). 128 ′), and calculate the sum m' of the decrypted random numbers;

[0035] The first participant uses two hash functions, G1 and G2, to generate a decryption random number seed r' and a negotiation key k' based on the sum m' of the calculated decryption random numbers.

[0036] The first participant uses the aforementioned decryption random number seed r' and the user's public key (pk1, pk2, ..., pk) recovered from the password decoding. 128 The decryption random number ((z1′,...,z′) is used to determine the decryption random number ((z1′,...,z′)). 128 The ciphertext is re-encrypted to obtain the re-encrypted random number ciphertext ((c′1, c′2, ..., c′2). 128 ′);

[0037] If we re-encrypt the random number ciphertext (c′1, c′2, ..., c′2), 128 ′) is not equal to the received encrypted random number ciphertext (c1, c2, ..., c′). 128 The first participating party withdraws from the agreement;

[0038] The first participant uses the publicly shared system key cpk to verify their user password pw and the encrypted random number ciphertext (c1, c2, ..., cc5). 128Re-encrypt and generate the verification ciphertext C';

[0039] If the regenerated verification ciphertext C' is not equal to the received verification ciphertext V, the first participant withdraws from the protocol;

[0040] Ultimately, the first and second participants will use the negotiation key k' calculated by the second participant as the shared key finally negotiated and generated by both parties.

[0041] In a preferred embodiment, the first participant and the second participant may represent the client and the server, two different devices, or two independently running programs, respectively.

[0042] In a preferred embodiment, the first participant and the second participant are selected from the group consisting of: personal computers, mobile phones, tablet computers, and smart devices capable of network communication and electronic transactions.

[0043] This application also discloses a password authentication key negotiation system, in which a shared public key cpk and a password encoding vector group \_(i∈

[128] ) are pre-generated and publicly disclosed in the system, the system comprising:

[0044] The first device is used to determine the password based on the user's password pw and the password encoding vector set publicly available by the system. Combine the user password pw with the user's public / private key pair {(pk) i ,sk i )} i∈

[128] Combined, a transformed public key set (vpk1, vpk2, ..., vpk) is generated. 128 ), and transmit it to the second device;

[0045] The second device is used to determine the password based on the user's password pw and the password encoding vector set publicly available by the system. The transformed password public key set (vpk1, vpk2, ..., vpk) sent to the first device 128 Decode the data to recover the set of user public key pairs (pk′1, ..., pk′) of the first device. 128 The second device uses the recovered user public key to generate encrypted verification information and transmits it to the first device for verification.

[0046] The first device is further configured to decrypt and verify the encrypted verification information sent by the second device; when the verification is successful, both parties ultimately generate the same shared key according to the protocol.

[0047] In a preferred embodiment, the first device and the second device may represent a client and a server, two different devices, or two independently running programs, respectively.

[0048] In a preferred embodiment, the first device and the second device are selected from the group consisting of: personal computers, mobile phones, tablet computers, and smart devices capable of network communication and electronic transactions.

[0049] Compared with the prior art, this application has the following differences and technical effects:

[0050] This application improves security, especially its ability to resist quantum attacks, by using publicly available random numbers to encode passwords and public key vectors, avoiding direct hashing or symmetric encryption of passwords.

[0051] Furthermore, this application adds a mechanism for encrypting and verifying passwords and some negotiated information using a public key generated by a trusted third party, thereby further improving security.

[0052] Furthermore, this application enhances the overall security of the protocol by designing a random number distribution and a re-encryption verification mechanism to establish a correlation between different public key vectors.

[0053] Furthermore, this application simplifies the operation process, eliminates the need to rely on complex symmetric encryption and hash functions, and is easier to implement and apply.

[0054] Furthermore, this application enhances the user experience, simplifies the process for greater user-friendliness, and does not compromise security.

[0055] In summary, this application provides a PAKE scheme that maintains high security, is easy to implement and use, and is an efficient, economical and easy-to-deploy secure communication solution in the face of quantum computer threats.

[0056] The specification of this application contains numerous technical features distributed across various technical solutions. Listing all possible combinations of these technical features (i.e., technical solutions) would make the specification excessively lengthy. To avoid this problem, the various technical features disclosed in the above-described invention, the various technical features disclosed in the following embodiments and examples, and the various technical features disclosed in the accompanying drawings can be freely combined to form various new technical solutions (all of which are considered to have been described in this specification), unless such a combination of technical features is technically infeasible. For example, one example discloses feature A+B+C, and another example discloses feature A+B+D+E. Features C and D are equivalent technical means that serve the same function, and technically only one needs to be used; they cannot be used simultaneously. Feature E can technically be combined with feature C. Therefore, the solution A+B+C+D should not be considered as described because it is technically infeasible, while the solution A+B+C+E should be considered as described. Attached Figure Description

[0057] Figure 1 This is a flowchart illustrating the password authentication key negotiation method according to the first embodiment of this application;

[0058] Figure 2 This is a conceptual schematic diagram of the password authentication key negotiation method according to the first embodiment of this application;

[0059] Figure 3 This is a schematic diagram of the password authentication key negotiation system according to the second embodiment of this application. Detailed Implementation

[0060] In the following description, many technical details are presented to help the reader better understand this application. However, those skilled in the art will understand that the technical solutions claimed in this application can be implemented even without these technical details and various variations and modifications based on the following embodiments.

[0061] Explanation of some concepts:

[0062] Password Authenticated Key Exchange (PAKE) is a protocol that enables two parties (such as a client and a server) with the same password to securely establish a session key and authenticate each other's identities over a public network. In simple terms, a PAKE protocol must meet the following two conditions: 1) Correctness: For two parties sharing the same password, executing the PAKE protocol will result in the same key. 2) Security: Because passwords are easy to remember, their security is relatively weak. Therefore, a secure PAKE protocol must be able to resist offline dictionary attacks, meaning that an attacker can see the information exchanged over a public network but still cannot obtain any information about the final negotiated key by guessing the password.

[0063] General composability is a higher security requirement for the PAKE protocol. General composability requires that the PAKE protocol maintain the security of the final negotiated key even when running in parallel with other protocols or undergoing complex combinations.

[0064] A symmetric encryption scheme consists of two algorithms, SE.Enc and SE.Dec. SE.Enc(k, m): This algorithm takes a key k and a message m as input and outputs a ciphertext c. SE.Dec(k, c): This algorithm takes a key k and a ciphertext c as input and outputs a message m.

[0065] A public-key cryptography scheme, specifically a symmetric cryptography scheme, comprises three algorithms: PKE.KeyGen, PKE.Enc, and PKE.Dec. PKE.KeyGen: This is a randomization algorithm that outputs a public-private key pair (pk, sk). PKE.Enc(pk, m; r): This algorithm takes a public key pk and a message m as input and outputs a ciphertext c. Additionally, this algorithm can accept an extra random number r as input for the entire algorithm; if r is not input, it is uniformly randomly generated by default. PKE.Dec(sk, c): This algorithm takes a private key sk and a ciphertext c as input and outputs a plaintext m.

[0066] The following is a brief summary of some of the innovative aspects of this application:

[0067] The inventors of this application believe that there is an urgent need for a PAKE scheme that is both resistant to quantum attacks and simple to implement. This scheme should avoid directly hashing or encoding the password, thereby reducing reliance on hash and encoding functions and lowering security risks. Furthermore, compared to schemes relying on high-strength symmetric encryption algorithms, this PAKE scheme should employ an easily implemented and reliable encryption mechanism. If these requirements can be met, a highly secure and easily deployed PAKE solution can be obtained. Therefore, a password authentication key negotiation solution is proposed. According to the overall concept of this scheme, instead of directly hashing or symmetrically encrypting the password, authentication and key negotiation are achieved through public key encryption and password encoding to avoid easy cracking on quantum computers. Furthermore, a mechanism is added where a trusted third party generates a public key to encrypt and verify the password and part of the negotiated information, further improving security. Furthermore, a related random number distribution and re-encryption verification mechanism is designed to enhance the correlation between different public key vectors and improve the overall security of the protocol. Furthermore, relying only on simple public key encryption and hashing operations, without the need for complex symmetric encryption and hash functions, it is easier to implement and apply. Furthermore, the user experience is improved by simplifying the process. The technical concept of this application avoids direct password manipulation, relying on a reliable public-key encryption mechanism while ensuring both security and ease of use. Its design philosophy is integrated into the specific algorithm description, resulting in a PAKE scheme with excellent overall technical performance. In summary, the technical concept of this application is to design a quantum-resistant, highly secure, and easy-to-use PAKE protocol through public-key encryption, password encoding, adding verification mechanisms, and optimizing random number distribution. This makes it an efficient and economical secure communication solution to address the problems of existing PAKE schemes.

[0068] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0069] The first embodiment of this application relates to a password authentication key negotiation method, the process of which is as follows: Figure 1 As shown, the method includes the following steps:

[0070] Step 10: System Initialization Steps:

[0071] The system pre-generates and publishes the system-shared public key (cpk) and password encoding vector group.

[0072] Step 20: Encrypted transmission steps:

[0073] The first participant uses their user password pw and the password encoding vector group publicly available by the system. Combine the user password pw with the user's public / private key pair {(pk) i ,sk i )} i∈

[128] Combined, a transformed public key set (vpk1, vpk2, ..., vpk) is generated. 128 ), and transmit it to the second participant;

[0074] Step 30: Decryption and verification steps:

[0075] The second participant uses their own user password pw and the password encoding vector group publicly available by the system. The transformed public key set (vpk1, vpk2, ..., vpk) sent to the first participant 128 Decode the data to recover the set of public key pairs (pk′1, ..., pk′) of the first participant. 128 The second participant uses the recovered user public key to generate encrypted verification information and sends it to the first participant for verification.

[0076] Step 40: Key Generation Steps:

[0077] The first participant decrypts and verifies the encrypted verification information sent by the second participant; when the verification is successful, both parties generate the same shared key according to the protocol.

[0078] Optionally, the above system initialization steps specifically include:

[0079] The first system entity generates the system shared public key cpk, wherein the system shared public key cpk is used to encrypt user password information;

[0080] The first system entity randomly generates the password encoding vector group. The password encoding vector group contains encoding vectors that encode user password information;

[0081] The first system entity will use the system shared public key cpk and the password encoding vector group. public.

[0082] Optionally, the above-mentioned encrypted transmission steps specifically include:

[0083] The first participant obtains the system's shared public key cpk and the password encoding vector group.

[0084] The first participating party obtains the user password pw;

[0085] The first participant uses the user password pw and the password encoding vector group. The user password pw is compared with the user public key pk generated by the first participant. i Encode the password to generate the transformed public key vpk. i ;

[0086] The first participant will generate the transformed public key vpk for the password. i The transformed password public key set (vpk1, vpk2, ..., vpk) is transmitted to the second participant to form the transformed password public key set. 128 ).

[0087] Optionally, the above decryption and verification steps specifically include:

[0088] The second participant obtains the system's shared public key cpk and the password encoding vector group (vpk1, vpk2, ..., vpk). 128 );

[0089] The second participant obtains the user password pw from the second participant;

[0090] The second participant uses the user password pw and the password encoding vector group. The transformed password public key set (vpk1, vpk2, ..., vpk) sent to the first participant 128 Decode the key to recover the public key pk′ of the first participant. i ;

[0091] The second participant randomly generates multiple random numbers z1, ..., z2. 128 The second participant uses two hash functions G1 and G2 to generate a random number seed r and a negotiation key k based on the calculated random number sum m. The second participant then uses the generated random number seed r and the recovered user public key pk′. i For the generated random numbers z1, ..., z 128 Encryption is performed, resulting in multiple encrypted random numbers (c1, ..., c).128 As encrypted verification information, the second participant will generate encrypted verification information {c1, ..., c...}. 128 Along with the password pw of the second participant encrypted using the system's shared public key cpk and the encrypted random number {c1, ..., c}, the system also encrypts the random number {c1, ..., c}. 128 The resulting verification ciphertext C is then sent to the first participant.

[0092] Optionally, the above key generation steps specifically include:

[0093] The first participant obtains the user password pw from the first participant;

[0094] The first participant obtains the user's public and private key pair set {(pk i ,sk i )} i∈

[128] ;

[0095] The first participant receives the encrypted verification information (c1, ..., c) sent by the second participant. 128 ) and verification ciphertext C;

[0096] The first participant uses their own user private key (sk1, ..., sk2) 128 The received encrypted random number ciphertext (c1, ..., c) 128 Decrypt the data to obtain the decryption random number ((z1′,...,z...)). 128 ′), and calculate the sum m' of the decrypted random numbers;

[0097] The first participant uses two hash functions, G1 and G2, to generate a decryption random number seed r' and a negotiation key k' based on the sum m' of the calculated decryption random numbers.

[0098] The first participant uses the aforementioned decryption random number seed r' and the user's public key (pk1, pk2, ..., pk) recovered from the password decoding. 128 The decryption random number ((z1′,...,z′) is used to determine the decryption random number ((z1′,...,z′)). 128 The ciphertext is re-encrypted to obtain the re-encrypted random number ciphertext ((c′1, c′2, ..., c′2). 128 ′);

[0099] If we re-encrypt the random number ciphertext (c′1, c′2, ..., c′2), 128 ′) is not equal to the received encrypted random number ciphertext (c1, c2, ..., c′). 128 The first participating party withdraws from the agreement;

[0100] The first participant uses the publicly shared system key cpk to verify their user password pw and the encrypted random number ciphertext (c1, c2, ..., cc5).128 Re-encrypt and generate the verification ciphertext C';

[0101] If the regenerated verification ciphertext C' is not equal to the received verification ciphertext C, the first participant withdraws from the protocol;

[0102] Ultimately, the first and second participants will use the negotiation key k' calculated by the second participant as the shared key finally negotiated and generated by both parties.

[0103] Optionally, the first participant and the second participant may represent the client and the server, two different devices, or two independently running programs, respectively.

[0104] Optionally, the first participant and the second participant are selected from the group consisting of: personal computers, mobile phones, tablet computers, and smart devices capable of network communication and electronic transactions.

[0105] The above embodiments have the following technical effects:

[0106] 1) General composable security: The PAKE protocol proposed in the above embodiments not only possesses basic security attributes but also conforms to a general composable security framework, meaning it can be used securely with other security protocols to enhance the overall security of the network environment. This flexibility makes the protocol more suitable for complex and ever-changing modern network applications.

[0107] 2) Quantum Attack Resistance: By utilizing a public-key encryption scheme combined with specific hash function applications, the above-described embodiments can effectively resist the potential threats of quantum computers. In particular, the scheme avoids direct hash mapping of passwords, instead applying hash functions to high-entropy random numbers. This method significantly reduces the reliance on the security of hash functions, thus maintaining security even in the face of quantum attacks.

[0108] 3) Reduced reliance on hash function security: Compared to the traditional PAKF protocol, the scheme in the above embodiments reduces the need for strong hash functions. This not only alleviates the reliance on the quantum resistance of hash functions but also reduces system complexity and maintenance costs, making the protocol more stable and economical.

[0109] 4) Enhanced User Experience and Security: The simplified authentication process and user-friendly design make it easy for non-professional users to use, while ensuring the security of data transmission. Users do not need to understand complex encryption processes; they can achieve secure communication with simple operations, which greatly enhances the user experience and ensures high security in the communication process.

[0110] In summary, the technical advantage of the above embodiments is that they provide a PAKF protocol that can maintain high security even in the face of future quantum computing challenges, while optimizing system complexity and user experience, and providing an efficient, economical and easy-to-deploy solution for secure communication.

[0111] To better understand the technical solution of this application, a specific example is provided below. The details listed in this example are mainly for ease of understanding and are not intended to limit the scope of protection of this application.

[0112] The password authentication key negotiation method in this example includes the following steps:

[0113] Step 100: System Initialization Steps

[0114] Assuming the password is 128 bits long (i.e., a 128-bit 01 string), in this example, the following parameters need to be public (i.e., public to all users):

[0115] A public key cpk needs to be generated by a trusted third party (i.e., no one other than the generator knows its corresponding private key).

[0116] 128 * 2 = 256 vectors Each vector is selected uniformly and randomly from the public key space.

[0117] Although this scheme requires a trusted third party to generate the aforementioned public parameters, compared to traditional public key infrastructures, this scheme only requires a trusted third party to generate the public parameters once, and the generated public parameters can be used for all subsequent key negotiations by all users.

[0118] More specifically, step 100 describes the system initialization steps, which is the process of establishing initial parameters in a secure communication system to ensure that subsequent communication is secure.

[0119] The following is a detailed explanation of the process:

[0120] Password length:

[0121] In this example, let's assume the password length is 128 bits. This means the password is a string consisting of 128 0s or 1s. This length is chosen to ensure sufficient security, as a sufficiently long password is more difficult to guess or crack.

[0122] Public parameters:

[0123] Public parameters are parameters that are accessible to all users and are crucial for the operation of secure communication systems. In this example, the public parameters include:

[0124] A public key cpk:

[0125] This was generated by a trusted third party. The public key is used to encrypt information, and only the individual holding the corresponding private key can decrypt it. The public key is public, but the private key is kept secret and known only to the generator.

[0126] 256 vectors:

[0127] These vectors appear in pairs, denoted as . For each i, the range is from 1 to 128. Each pair of vectors is uniformly and randomly selected from the public key space, a selection designed to ensure the security of the system.

[0128] The role of a trusted third party:

[0129] This system requires a trusted third party to generate the aforementioned public parameters. The difference between this system and traditional Public Key Infrastructure (PKI) is that this system only requires a trusted third party to generate these parameters once, while traditional PKI might require a trusted authority to generate new parameters or certificates for each user or each communication. The publicly generated parameters can be reused by all subsequent users in all key negotiation processes, thereby reducing the complexity and cost of system operation and maintenance.

[0130] Step 100 provides the necessary initialization settings for the system, ensuring the security of all subsequent communications. By using a public key and a uniformly randomly selected vector, and by introducing a trusted third party to generate these parameters, the system can guarantee both security and efficiency.

[0131] Step 200: Encrypted Transmission Steps

[0132] User 1 first generates 128 pairs of public and private keys {(pk i ,sk i )} i∈

[128] The public key space is a vector space. Since the user's password is a 128-bit 01 string, for i = 1, 2, ..., 128, if the i-th bit of user 1's password pw is 0, then calculate... If the i-th bit of the user password pw is 1, then calculate in This is the public vector in the system's public parameters. Finally, User 1 sends 128 encrypted public keys (vpk1, vpk2, ..., vpk). 128 ) Give to user 2.

[0133] Specifically, step 200 describes the encrypted transmission steps, which are explained in detail below:

[0134] Generate public / private key pair:

[0135] User 1 generates 128 public-private key pairs (pk i ,sk i For i = 1 to 128, the public key space is treated as a vector space. This means that each public key is composed of elements in the vector space, ensuring the diversity and security of encryption.

[0136] Password-dependent public key transformation: User 1's password is a 128-bit 01 string. For each bit i (from 1 to 128), User 1 will perform the following operations based on their password:

[0137] If the i-th bit of the password is 0, then calculate the transformed public key.

[0138] If the i-th bit of the password is 1, then calculate the transformed public key.

[0139] in, It is a publicly available vector used to transform a user's public key based on different bits of the user's password, thereby increasing security.

[0140] Send the encrypted public key: After completing the transformation of all 128 public keys, User 1 will send these transformed public keys (i.e., vpk1, vpk2, ..., vpk) to the network. 128 This is sent to User 2. This means that User 2 will receive a set of public keys that have been encrypted and modified according to User 1's password.

[0141] Step 200 involves User 1 performing a specific cryptographic transformation on the generated public key based on their password, and then sending these encrypted public keys to User 2. This step is crucial to ensuring secure communication between the two parties using the password-related public keys without directly exchanging passwords. In this way, even if someone intercepts these transformed public keys, they cannot directly obtain the user's password or the original public key, thus increasing communication security.

[0142] Step 300: Decryption and Verification Steps

[0143] When user 2 receives the message (vpk1, vpk2, ..., vpk) sent by user 1, 128 After that, User 2 first recovers the original public key using their password pw: for i = 1, 2, ..., 128, if the i-th bit of User 2's password pw is 0, then calculate... If the i-th bit of user 2's password pw is 1, then calculate In this way, user 2 obtained 128 public keys (pk′1, ..., pk′). 128 ).

[0144] User 2 then randomly generates 128 random numbers z1, ..., z2. 128 Calculate m = z1 + z2 + ... + z 128 ,

[0145] Using two hash functions G1 and G2, r = G1(m) and k = G2(m) are calculated. User 2 will then use r as the random number seed for the public-key encryption scheme, pk′1, pk′2, ..., pk′2. k128 The public key, used as a public-key encryption scheme, is used to encrypt random numbers z1, z2, ..., z3 respectively. 128 Encryption yields 128 ciphertexts (c1, ..., c...). 128 Then, user 2 will use the public key cpk from the public parameters to set their password pw and 128 ciphertexts (c1, ..., c...). 128 Encryption is performed to obtain ciphertext C.

[0146] End user 2 uses k as the final negotiated key and puts 128 ciphertexts (c1, ..., c2) into the key. 128 ) and 1 verification ciphertext C are sent to user 1.

[0147] Specifically, step 300 describes a decryption verification step in a secure communication process, which is a cryptographic protocol used to securely transmit information between users. In this scenario, there are two users, User 1 and User 2. User 2 attempts to verify the information sent by User 1 and establish a secure communication key. The following is a detailed explanation of this step:

[0148] Public key recovery:

[0149] User 1 sends a series of encrypted public keys to User 2. Each public key (vpki) is associated with User 2's password (pw). User 2 recovers the original public key using their own password. Specifically, for each number (0 or 1) in the password, User 2 adjusts the received encrypted public key accordingly. If the i-th bit of the password is 0, User 2 will adjust the vpki... i Subtract the preset value To obtain the original public key pk′ i If the i-th bit of the password is 1, then subtract another preset value. In this way, User 2 can recover 128 original public keys.

[0150] Random number generation and encryption:

[0151] User 2 generates 128 random numbers z1, z2, ..., zn. 128They are then summed to obtain m. Then, two hash functions G1 and G2 are used to generate two values ​​based on m: r and k. r is used as the random number seed for the public-key encryption scheme, while k will be used as the final negotiation key. Next, user 2 uses the recovered public key (pk′1, pk′2, ..., pk...) 128 The seed r is used to encrypt each random number zi, generating 128 ciphertexts (c1, ..., c2). 128 ).

[0152] Verification of ciphertext generation:

[0153] User 2 uses a public key (cpk) to encrypt their own password (pw) and all generated ciphertext ((c1, ..., c...). 128 The result of this encryption is the verification ciphertext C. This step ensures that only the recipient with the correct key can decrypt this information.

[0154] Send verification message:

[0155] User 2 will generate the ciphertext (c1, ..., c...). 128 User 1 sends k and the verification ciphertext C to User 2. Meanwhile, User 2 keeps k as the final negotiated key.

[0156] This process ensures that both parties can securely share information while verifying each other's identities. In this way, even in insecure communication channels, both parties can ensure that the exchanged information remains confidential and intact.

[0157] Step 400: Key Generation Step

[0158] When user 1 receives the message (c1, ..., c) sent by user 2 128 After C, User 1 uses their private key (sk1, ..., sk...) 128 For ciphertext (c1, ..., c) 128 Decryption yields (z1′, ..., z) 128 ′), and calculate m′=z′1+z′2+…+z′ 128 Then, using two hash functions G1 and G2, r′ = G1(m′) and k′ = G2(m′) are calculated. User 1 then uses r′ as the random number seed for the public-key encryption scheme, pk1, pk2, ..., pk 128 The public key pairs used in the public-key encryption scheme are respectively paired with the messages (z1', ..., z). 128 Encrypting (c′1, c′2, ..., c′2) yields ciphertext (c′1, c′2, ..., c′2). 128 If the obtained ciphertext is (c′1, c′2, ..., c′), then... 128′) is not equal to the received message (c1, c2, ..., c 128 User 1 will then exit the protocol. Afterwards, User 1 will use the public key cpk from the public parameters to set their password pw and 128 ciphertext characters (c1, ..., c...). 128 The message is encrypted to obtain ciphertext C′. If C′ is not equal to the received message C, user 1 will exit the protocol. Finally, user 2 will use k′ as the final negotiated key.

[0159] Specifically, step 400 describes a key generation process, the details of which are as follows:

[0160] Encryption and message reconstruction:

[0161] When user 1 receives the encrypted message (ciphertext) (c1, c2, ..., c2) sent by user 2 128 When they encounter another ciphertext C, they will use their own private keys (sk1, ..., sk2). 128 For (c1, c2, ..., c) 128 Decryption is performed. The decrypted value is a series of values ​​((z1′, ..., z...). 128 These values ​​will be summed to form a new message m' (i.e., m' = z'1 + z'2 + ... + z''). 128 This process is actually the process of converting the received encrypted information back into the original information.

[0162] Hash function generation:

[0163] Next, User 1 uses two hash functions, G1 and G2. They input m' into these two functions and get two outputs: r' and k'. Here, r' will be used as a random number seed (for the public-key encryption scheme), while k' is the key to be negotiated.

[0164] Public key encryption and authentication:

[0165] User 1 is now using the public key (pk1, pk2, ..., pk...). 128 The message ((z1′,...,z)) and a random number seed r' are used to re-encrypt the message ((z1′,...,z)). 128 (c′1, c′2, ..., c′2) generates a new ciphertext ((c′1, c′2, ..., c′2)). 128 This step verifies that User 1 has correctly decrypted and reconstructed the message. If this newly generated ciphertext sequence does not match the originally received one, User 1 will terminate the protocol, as this indicates that the message may have been tampered with.

[0166] Final verification and key negotiation:

[0167] User 1 then uses the public key cpk from the public parameters to set their password pw and 128 original ciphertexts (c1, c2, ..., c...). 128 The encryption process generates a new ciphertext C'. This step is to further verify the integrity and security of the communication. If C' does not match the initially received C, User 1 will exit the protocol, as this may indicate a security issue during communication. If everything is normal, User 2's k' will be accepted as the final negotiated key.

[0168] The above process ensures the security of communication and the integrity of data through multi-step verification. It utilizes encryption, decryption, hash functions, and public-key cryptography to ensure that only authorized users can successfully complete key negotiation and ultimately obtain a shared key for subsequent secure communication.

[0169] Figure 2 The overall technical concept of this example is shown.

[0170] The specific application scenarios of this application are further explained below.

[0171] This application involves various environments in daily life that require password authentication, such as bank payments, online account logins, and e-commerce. Currently, most network devices lack Public Key Infrastructure (PKI), making password-based authentication and key exchange the mainstream method. The proposed scheme in this application, namely the Cryptographic Authentication Key Exchange (PAKE) protocol based on a difficult problem on a lattice, is particularly suitable for these scenarios. Because this scheme is resistant to attacks by quantum computers, it can also serve as an upgrade option for existing protocols, enhancing system security.

[0172] The following further explains the users 1 and 2 mentioned in the embodiments of this application.

[0173] User 1 initiates the key negotiation process. In step 200, User 1 generates a set of 128 public-private key pairs, and then combines its own password with the system's publicly available password encoding vector set to generate an encrypted password public key set, which is the encryption information for the first stage. User 1 sends the encrypted password public key set to User 2 to share key information with User 2 without directly exposing the password.

[0174] User 2 is the party responding to the key negotiation process in this scheme. In step 300, after receiving the encrypted password public key set sent by User 1, User 2 uses its own password combined with the password encoding vector set to decode and recover User 1's original public key set. User 2 further generates encrypted verification information, including an encrypted random number set and verification ciphertext, and sends it back to User 1 for authentication.

[0175] Throughout the protocol, User 1 and User 2 do not directly exchange passwords. Instead, they securely verify their identities and ultimately negotiate a shared key through public-key encryption and encoding mechanisms to prevent password leakage. This scheme is suitable for environments without PKI and is resistant to quantum attacks.

[0176] Optionally, User 1 and User 2 can represent the client and server, two different devices, or two independently running programs, all of which are parties requiring secure communication. Furthermore, the entities that can be User 1 and User 2 are broad, including but not limited to personal computers, mobile phones, tablets, and other smart devices capable of network communication and electronic transactions.

[0177] Technical effects:

[0178] This example demonstrates general composable security, allowing it to be combined with other protocols to enhance the overall security of the network environment. Furthermore, public-key encryption and avoidance of direct hash mapping passwords effectively defend against attacks from quantum computers. Moreover, compared to traditional schemes, it reduces reliance on strong hash functions, lowering complexity and maintenance costs. Finally, a simplified authentication process and a superior user experience ensure high data transmission security.

[0179] In summary, this example provides a PAKE scheme that maintains high security, is easy to implement and use, and is an efficient, economical and easy-to-deploy secure communication solution in the face of quantum computer threats.

[0180] The second embodiment of this application relates to a password authentication key negotiation system, in which a system-shared public key cpk and a password encoding vector group are pre-generated and publicly disclosed. The system includes:

[0181] The first device, also known as the "initiator unit," is used to determine the user's password pw and the password encoding vector set publicly available by the system. Combine the user password pw with the user's public / private key pair {(pk) i ,sk i )} i∈

[128] Combined, a transformed public key set (vpk1, vpk2, ..., vpk) is generated. 128 ), and transmit it to the second device;

[0182] The second device, also known as the "responder unit," is used to determine the response unit based on its own user password pw and the password encoding vector set publicly available by the system. The transformed password public key set (vpk1, vpk2, ..., vpk) sent to the first device 128 Decode the data to recover the set of user public key pairs (pk′1, ..., pk′) of the first device.128 The second device uses the recovered user public key to generate encrypted verification information and transmits it to the first device for verification.

[0183] The first device is further configured to decrypt and verify the encrypted verification information sent by the second device; when the verification is successful, both parties ultimately generate the same shared key according to the protocol.

[0184] Optionally, the first device and the second device may represent the client and the server, two different devices, or two independently running programs, respectively.

[0185] Optionally, the first device and the second device are selected from the group consisting of: personal computers, mobile phones, tablet computers, and smart devices capable of network communication and electronic transactions.

[0186] The first embodiment is a method embodiment corresponding to this embodiment. The technical details in the first embodiment can be applied to this embodiment, and the technical details in this embodiment can also be applied to the first embodiment.

[0187] It should be noted that those skilled in the art should understand that the implementation functions of each module shown in the above-described embodiments of the password authentication key negotiation system for network communication and electronic transactions can be understood with reference to the relevant descriptions of the password authentication key negotiation method for network communication and electronic transactions. The functions of each module shown in the above-described embodiments of the password authentication key negotiation system for network communication and electronic transactions can be implemented by a program (executable instructions) running on a processor, or by specific logic circuits. If the above-described password authentication key negotiation system for network communication and electronic transactions is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any particular combination of hardware and software.

[0188] Accordingly, this application also provides a computer storage medium storing computer-executable instructions, which, when executed by a processor, implement the various method implementations of this application.

[0189] Furthermore, this application also provides a password authentication key negotiation system for network communication and electronic transactions, including a memory for storing computer-executable instructions and a processor; the processor is used to implement the steps in the above-described method embodiments when executing the computer-executable instructions in the memory. The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The aforementioned memory can be read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or solid-state drive, etc. The steps of the methods disclosed in the various embodiments of this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

[0190] It should be noted that in the application documents of this application, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. In the application documents of this application, if it refers to performing an action according to an element, it means performing the action at least according to that element, including two cases: performing the action only according to that element, and performing the action according to that element and other elements. Expressions such as "multiple," "repeatedly," and "various" include two, two times, two kinds, and more than two, more than two times, and more than two kinds.

[0191] All documents mentioned in this application are considered to be incorporated in their entirety into the disclosure of this application so that they can serve as a basis for modifications if necessary. Furthermore, it should be understood that after reading the foregoing disclosure of this application, those skilled in the art can make various alterations or modifications to this application, and these equivalent forms also fall within the scope of protection claimed in this application.

Claims

1. A password authentication key negotiation method, characterized in that, Includes the following steps: Step A: Pre-generate and publish the system's shared public key in the system. and password encoding vector group The method employs a public-key encryption scheme based on a lattice-hard problem, where the public key space is a vector space; each password encoding vector in the password encoding vector group... , All of them are vectors that are uniformly and randomly selected from the public key space; express Take an integer from 1 to 128; Step B: The first participant uses their user password. and the password encoding vector group publicly available by the system Password User public / private key pair Combined, a transformed password public key set is generated. and transmit it to the second participant; among which, and The first party generated the first party The user's public key and private key from the user's public and private keys; the user password. A 01 string of length 128; for If the first participant's user password The If the bit is 0, then calculate If the first participant's user password The If the bit is 1, then calculate ; Step C: The second participant uses their own user password. and the password encoding vector group publicly available by the system The transformed public key set of passwords sent to the first participant. Decode the key to recover the public key set of the first participant. Among them, for If the second party's user password The If the bit is 0, then calculate If the second party's user password The If the bit is 1, then calculate The second participant uses the recovered user public key set to generate encrypted verification information and sends it to the first participant for verification. Step D: The first participant decrypts and verifies the encrypted verification information sent by the second participant; when the verification is successful, both parties generate the same shared key according to the protocol.

2. The method according to claim 1, characterized in that, Step A specifically includes: The first system entity generates the system's shared public key. The system in which the public key is shared Used to encrypt user password information; The first system entity randomly generates the password encoding vector group. The password encoding vector group contains an encoding vector that encodes user password information. The first system entity will share the system's public key. and the password encoding vector group public.

3. The method according to claim 2, characterized in that, Step B specifically includes: The first participant obtains the shared public key of the system. and the password encoding vector group ; The first participating party obtains the user password. ; The first participant uses the user password. and the password encoding vector group The user password The user public key generated with the first participant Encode the password to generate the transformed public key. ; The first participant will generate the transformed public key for the password. The transformed password public key set is transmitted to the second participant. .

4. The method according to claim 3, characterized in that, Step C specifically includes: The second participant obtains the shared public key of the system. and the password encoding vector group ; The second participant obtains the user password of the second participant. ; The second participant uses the user password. and the password encoding vector group The transformed password public key set sent by the first participant Decode the key to recover the public key of the first participant. ; The second participant randomly generates multiple random numbers. And calculate the sum of random numbers. The second participant uses two hash functions. , Based on the sum of the calculated random numbers Generate random number seed and negotiation key ,in , The second participant uses the generated random number seed. A random number encrypted with the public key, used to recover the user's public key. As a public key, multiple random numbers are generated. Each ciphertext is encrypted separately, resulting in multiple encrypted random number ciphertexts. As encrypted verification information; the second participant will generate the encrypted verification information. Together with a shared public key used by the system Encrypting the user password of the second participant and the encrypted random number ciphertext The obtained verification ciphertext Send them together to the first participant.

5. The method according to claim 4, characterized in that, Step D specifically includes: The first participant obtains the user password of the first participant. ; The first participating party obtains the user's public and private key pair set. ; The first participant receives the encrypted verification information sent by the second participant. and the verification ciphertext ; The first participant uses their own user private key. The received encrypted random number ciphertext Decryption is performed to obtain the decryption random number. And calculate the sum of the decrypted random numbers. ; The first participant uses the two hash functions. , Based on the sum of the calculated decryption random numbers Generate a seed for decrypting random numbers and negotiation key ,in , ; The first participant uses the aforementioned decryption random number seed The random number is encrypted using the public key, and is generated using the first participant's own user public key. As the public key, the decryption random number Each ciphertext is re-encrypted to obtain a re-encrypted random number ciphertext. ); If the random number ciphertext is re-encrypted ( The received encrypted random number ciphertext is not equal to the received encrypted random number ciphertext. The first participating party withdraws from the agreement; The first participant uses the publicly disclosed system-shared public key. Your own user password and the encrypted random number ciphertext Re-encrypt and generate verification ciphertext. ; If the regenerated verification ciphertext Not equal to the received verification ciphertext The first participating party withdraws from the agreement; Finally, the first participant uses the negotiated key it has calculated. As the negotiation key, the second participant uses the negotiation key it has calculated. This serves as the negotiation key; when the above verification is successful, the negotiation key... With the negotiated key Same means that the two parties ultimately negotiate and generate the same shared key.

6. The method as described in claim 1, characterized in that, The first participant and the second participant may represent the client and the server, two different devices, or two independently running programs, respectively.

7. The method as described in claim 6, characterized in that, The first participant and the second participant are selected from the group consisting of: personal computers, mobile phones, tablet computers, and smart devices capable of network communication and electronic transactions.

8. A password authentication key negotiation system, characterized in that, Pre-generate and publish the system's shared public key within the system. and password encoding vector group The system employs a public-key encryption scheme based on a lattice-hard problem, where the public key space is a vector space; each password encoding vector in the password encoding vector group... , All of them are vectors that are uniformly and randomly selected from the public key space; express The system comprises: integers from 1 to 128; The first device is used to verify its user password. and the password encoding vector group publicly available by the system Password User public / private key pair Combined, a transformed password public key set is generated. And transmit it to the second device; wherein... and The first device generates the first The user's public key and private key from the user's public and private keys; the user password. A 01 string of length 128; for If the user password of the first device The If the bit is 0, then calculate If the user password of the first device The If the bit is 1, then calculate ; The second device is used to verify its user password. and the password encoding vector group publicly available by the system The transformed password public key set sent to the first device Decode the device to recover the user's public key set. Among them, for If the user password of the second device The If the bit is 0, then calculate If the user password of the second device The If the bit is 1, then calculate The second device uses the recovered user public key set to generate encrypted verification information and transmits it to the first device for verification. The first device is further configured to decrypt and verify the encrypted verification information sent by the second device; when the verification is successful, both parties ultimately generate the same shared key according to the protocol.

9. The system as described in claim 8, characterized in that, The first device and the second device may represent the client and the server, two different devices, or two independently running programs, respectively.

10. The system as described in claim 9, characterized in that, The first device and the second device are selected from the group consisting of: personal computers, mobile phones, tablet computers, and smart devices capable of network communication and electronic transactions.

Images