Lattice-based updatable private key password protection secret sharing method

Abstract

The invention discloses a lattice-based updatable private key password protection secret sharing method. The method comprises the steps of system initialization, a secret recovery method and a secret key share updating method. According to the method, a zero update technology is adopted, password protection secret sharing dynamic key update is achieved, key share update is achieved between servers, the correctness of key update is verified through a Lagrange interpolation polynomial, the key does not affect the value of a master key, the application range is expanded, and the method is suitable for popularization and application. According to the invention, quantum resistance, continuous leakage resistance and online password guess attack resistance are realized, authentication with a plurality of key servers can be carried out securely, an encryption key for decrypting cloud privacy data is reconstructed, user privacy is effectively guaranteed, secure storage and controllable access of data are realized, and key privacy protection is provided for a cloud storage technology. The method has the advantages of being good in robustness, high in secret key updating efficiency, high in reliability, wide in application range and the like, and can be applied to the technical field of privacy of password protection secret sharing.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and in particular relates to a quantum-resistant password-protected secret sharing method. Background Art

[0002] Cloud storage plays a crucial role in internet storage. For example, hospitals are implementing smart healthcare to provide medical services, uploading medical data to cloud servers. Individual users can also upload photo albums, documents, and other information through cloud storage. This creates numerous problems and security risks. For one thing, storing private data in the cloud can lead to data leaks if hackers exploit security vulnerabilities in cloud servers. Furthermore, third-party cloud storage servers can directly access private data. To ensure secure storage and access, the traditional approach is to encrypt data before uploading it. This encryption method is inefficient, and the management of encryption keys also imposes additional storage costs on users. Another solution is to introduce an independent third-party key management system that uses an encapsulation-decapsulation method to support users in managing large numbers of symmetric data encryption keys to encrypt outsourced data. However, this key encapsulation mechanism makes it easy for adversaries to obtain keys through man-in-the-middle attacks. This approach also creates management bottlenecks when a single third-party key management system has a large number of keys. Consequently, research is underway to address authentication issues between users and multiple servers. Password-protected secret sharing provides an elegant solution to these problems, which is to use a password that is easy for humans to remember to control the master key, realize distributed storage of secret shares, and users only need to use the password to recover the key.

[0003] Current mainstream password-protected secret sharing technologies generally rely on traditional number theory problems such as factorization and discrete logarithms. These methods pose security risks under quantum computing models. Although password-protected secret sharing methods based on lattice cryptography have been explored, most of them are static designs and lack the ability to dynamically update key shares, making them vulnerable to the threat of continuous leakage. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a lattice-based updateable private key password-protected secret sharing method with high security, strong reliability and support for dynamic update.

[0005] The technical solution adopted to solve the above technical problems consists of the following steps:

[0006] (1) System initialization

[0007] 1) Generate system parameters

[0008] Generate the sampling random matrix A and random matrix as follows

[0009]

[0010] Where m is the number of rows in the matrix, n is the number of columns in the matrix, and q is a large prime number.

[0011] Set the collision-resistant hash function H:

[0012] H:{0,1} * →Z q ;

[0013] Among them, {0,1} * Represents a bit string of arbitrary length consisting of 0s and 1s, Z q Represents an integer modulo q.

[0014] 2) Generate a key

[0015] Generate public keys pk1, pk2, and pk as follows:

[0016] pk1=[A×k1+e|A],

[0017] pk2=[A×k2+e|A]

[0018]

[0019] Where A represents an integer matrix with m rows and n columns. k1, k2 represent random vectors of length n, k1, represents a random vector of length n, e represents the error vector, e∈x m , x m represents a discrete Gaussian distribution, represents the error vector,

[0020] Use the Powerof2 method in the encryption method GSW to generate the private key sk2:

[0021]

[0022] 3) Secret shared master private key sk

[0023] Use the SS.Share method in Shamir's secret sharing method to secretly share the master private key sk and generate the server share sk i :

[0024] sk i =SS.Share(sk),

[0025] Wherein, i is the serial number of the server, and the value of i is a finite positive integer.

[0026] 4) Generate ciphertext and commitment

[0027] Generate a password using the Enc method in the threshold encryption method TFHE.Enc in the threshold fully homomorphic encryption method

[0028] Hash ciphertext C pw and the master key ciphertext C msk :

[0029] C pw =TFHE.Enc(pk1,H(pw)),

[0030] C msk =TFHE.Enc(pk2,msk),

[0031] Where pw represents the password, msk represents the master key, and matrix A1 and matrix A2 are constructed.

[0032] A1=[I m |A],

[0033]

[0034] Among them, I m is the identity matrix, 0 m×m is a zero matrix.

[0035] Generate server share sk as follows i Commitment i :

[0036] Com i =[A1×r i |A2×r i +sk i ];

[0037] Among them, r i represents a random vector, represents an m+n length vector consisting of integers modulo q.

[0038] 5) Output system parameters

[0039] Output system parameters st0, st i as follows:

[0040]

[0041] st i ={sk i ,r i}.

[0042] (2) Secret recovery method

[0043] 1) Encrypted password hash

[0044] User U selects a session set {sid1,sid2,…,sid j}, j is the serial number of the server, j is a finite positive integer, set the server set S:

[0045] S={1,2,…,t+1},where t represents the number of servers, and t is a finite positive integer. The sampling random matrix R pw , R pw ∈{0,1} n×m .

[0046] User U calculates the ciphertext C pw and C pw :

[0047] C pw =H(pw)×I N +Rp,

[0048] C pw =H(pw)×I N +Rp,

[0049] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ),

[0050] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ),

[0051]

[0052] Among them, I N Represents the unit matrix, N is the dimension of the matrix, N is a finite positive integer, Rp represents the matrix R pw Each element in ×pk1 is decomposed into a binary form and arranged from low to high to form an N×l vector; Rp represents the matrix R pw After each element in ×pk is decomposed into binary form, it is arranged from low to high to form an N×l vector, where l is the intermediate variable.

[0053] 2) Generate a key

[0054] Generate the public key pk and private key sk as follows:

[0055]

[0056] sk=Powerof2(1|-k|), where A represents a random matrix, represents an m-row n-column matrix consisting of integers modulo q, k represents a random vector, represents an n-length vector consisting of integers modulo q, represents the noise vector,

[0057] 3) Generate evidence

[0058] User U generates evidence using the NIZK.P method of zero-knowledge proof

[0059] C pw =TFHE.Enc(pk1,H(pw)),

[0060] C pw =TFHE.Enc(pk,H(pw)).

[0061] 4) User sends parameters

[0062] User U sets S, sid j 、C pw 、C pw ,pk,π 1,j Sent to the corresponding server S i .

[0063] 5) Verify evidence

[0064] Server S i Receive the parameters sent by user U and verify the evidence π of the zero-knowledge proof 1,j , if π 1,j =1 is established, continue.

[0065] 6) Partial decryption

[0066] Determine the partial decryption result p as follows j :

[0067]

[0068] Δ j =(C pw -C pw )·R j ,

[0069] in, Represents the vector sk j and The inner product, e j represents the noise vector, e j ∈x m , R j represents a random matrix, R j ∈{0,1} (N×l)×m .

[0070] 7) Generate evidence of partial decryption results

[0071] Determine the partial decryption result p as follows j Ciphertext

[0072]

[0073] Rpp=(Rpp 1,0 ,Rpp 1,1 ,…,Rpp 1,l-1 ,Rpp 2,0 ,Rpp 2,1 …,Rpp N,l-1 ),

[0074] Where Rpp represents the matrix R pw After each element in ×pk is decomposed into binary form, it is arranged from low to high to form an N×l vector.

[0075] Use zero-knowledge proof method to generate evidence π 2,j :

[0076]

[0077] in, Represents a statement, the content of the statement is: ciphertext Use the public key pk to encrypt the partial decryption result p j get.

[0078] Server S i sid j 、 π 2,j Sent to user U.

[0079] 8)Recovery message

[0080] User U receives a message from server S i The parameters sent to verify the equation π 2,j =1, if true, use the Dec method of the encryption method GSW to determine the partial decryption result p j :

[0081]

[0082] Restore the master key msk as follows:

[0083]

[0084] (3) Key share update method

[0085] Each server S i To update the server key share, follow these steps:

[0086] 1) Generate zero polynomial

[0087] Generate the zero polynomial U as follows j (X):

[0088]

[0089] Where X represents the zero polynomial U j (X) variable, α j,k Indicates server S j Randomly selected coefficient, α j,k ∈Z q .

[0090] 2) Determine zero share

[0091] Determine the server S as follows j Send to server S i Zero share z j→i :

[0092] z j→i =U j (i) mod q,

[0093] Determine the binary vector Z as follows:

[0094] Z=(Z1,Z2,…,Z h ),

[0095]

[0096] Among them, Z h Indicates zero share z j→i The value of the hth bit in binary, Z h The value is 1 or 0, h means zero share z j→i The length of the binary.

[0097] 3) Encrypted Zero Share

[0098] Server S j Determine the zero-share ciphertext c as follows j→i :

[0099]

[0100] Where x represents a randomly selected vector, x∈{0,1} m , m represents the dimension of vector x, Indicates server S i The private key of represents a random matrix, e T represents the noise vector, e T ∈χ m .

[0101] 4) Zero-share signature

[0102] Use the GSign method in the GPV signature method and use the server's S j Private key sk j Signature share ciphertext c j→i , get the signature σ j :

[0103] σ j ←GSign(sk j ,c j→i );

[0104] 5) Broadcast Message

[0105] Server S j Press the button to confirm the broadcast message Msg j :

[0106] Msg j ={j,ω,c j→i ,σ j},

[0107] Among them, ω represents the period counter, which takes a finite positive integer value. The server S j Will broadcast message Msg j Broadcast to all servers.

[0108] 6) Verify the signature

[0109] Server S i Collect at least t+1 broadcast messages Msg j , using the GVerify method in the GPV signature method, using the public key pk j Verify signature σ j :

[0110] GVerify(pk j ,σ j )=1,

[0111] If the above equation holds, continue.

[0112] 7) Update private key

[0113] Press the key to update the private key sk i ':

[0114]

[0115] z j→i =(-s i ,1) T ×c j→i ,

[0116] Among them, the vector s i Represents a vector The transpose of , update the commitment Com according to the formula i ':

[0117] Com i '=[A1×r i |A2×r i '+sk i '];

[0118] Among them, r' i is a random vector, Update the period counter ω' as follows:

[0119] ω'=ω+1.

[0120] 8) Update server status

[0121] Update the public parameter st'0 as follows:

[0122]

[0123] Update the server status by pressing i ':

[0124] st i '={sk i ',r i '},

[0125] Output public parameter st'0 and server status st i '.

[0126] In step (1) system initialization of the present invention, the system parameters generated in step (1) are:

[0127] Generate the sampling random matrix A and random matrix as follows

[0128]

[0129] Among them, m is the number of rows of the matrix, and the value of m is 700 to 1024. n is the number of columns of the matrix, and the value of n is 784 to 1024. q is a large prime number, and the value of q is 2.50 ~2 70 .

[0130] In step (1) system initialization of the present invention, the 3) secret shared master private key sk is:

[0131] Use the SS.Share method in Shamir's secret sharing method to secretly share the master private key sk and generate the server share sk i :

[0132] sk i =SS.Share(sk),

[0133] Here, i is the serial number of the server, and the value of i ranges from 50 to 100.

[0134] In the secret recovery method of step (2) of the present invention, the encrypted password hash of step 1) is:

[0135] User U selects a session set {sid1,sid2,…,sid j}, j is the server number, j ranges from 50 to 100, set the server set S:

[0136] S={1,2,…,t+1},where t represents the number of servers, and the value of t ranges from 100 to 120. The sampling random matrix R pw , R pw ∈{0,1} n×m .

[0137] User U calculates the ciphertext C pw and C pw :

[0138] C pw =H(pw)×I N +Rp,

[0139] C pw =H(pw)×I N +Rp,

[0140] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ),

[0141] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,RpN,l-1 ),

[0142]

[0143] Among them, I N Represents the unit matrix, N is the dimension of the matrix, N is 100 to 120, Rp represents the matrix R pw Each element in ×pk1 is decomposed into a binary form and arranged from low to high to form an N×l vector; Rp represents the matrix R pw After each element in ×pk is decomposed into binary form, it is arranged from low to high to form an N×l vector, where l is the intermediate variable.

[0144] This paper addresses the bottleneck of key management in data privacy cloud storage scenarios by proposing a password-protected secret sharing scheme based on lattice cryptography that is resistant to quantum attacks and supports dynamic key share updates. This scheme utilizes zero-update technology to achieve dynamic key updates for password-protected secret sharing. This approach requires no user involvement, requiring only key share updates between servers. The correctness of key updates is verified using Lagrange interpolation polynomials, and the updated keys do not affect the value of the master key. Furthermore, the system can be expanded to public key encryption, broadening its application scope and achieving quantum resistance, resistance to persistent leaks, and resistance to online password guessing attacks. This method allows users to securely authenticate with multiple distributed key servers using only a memorable password, thereby reconstructing the encryption key used to decrypt private data in the cloud. This not only effectively protects user privacy but also enables secure data storage and controllable access, providing critical privacy protection infrastructure support for cloud storage technology. This approach offers advantages such as robustness, high key update efficiency, strong reliability, and wide application, making it suitable for the privacy technology field of password-protected secret sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0145] Figure 1 It is a flow chart of Example 1 of the present invention. DETAILED DESCRIPTION

[0146] The present invention will be further described in detail below with reference to the accompanying drawings and examples, but the present invention is not limited to the following examples.

[0147] Example 1

[0148] exist Figure 1 The lattice-based updateable private key password-protected secret sharing method of this embodiment consists of the following steps:

[0149] (1) System initialization

[0150] 1) Generate system parameters

[0151] Generate the sampling random matrix A and random matrix as follows

[0152]

[0153] Among them, m is the number of rows of the matrix, and the value of m is 700 to 1024. n is the number of columns of the matrix, and the value of n is 784 to 1024. q is a large prime number, and the value of q is 2. 50 ~2 70 In this embodiment, m is 800, n is 850, and q is 2. 60 .

[0154] Set up a collision-resistant hash function:

[0155] H:{0,1} * →Z q ;

[0156] Among them, {0,1} * Represents a bit string of arbitrary length consisting of 0s and 1s, Z q Represents an integer modulo q.

[0157] 2) Generate a key

[0158] Generate public keys pk1, pk2, and pk as follows:

[0159] pk1=[A×k1+e|A],

[0160] pk2=[A×k2+e|A]

[0161]

[0162] Where A represents an integer matrix with m rows and n columns. k1, k2 represent random vectors of length n, k1, represents a random vector of length n, e represents the error vector, e∈χ m , x m represents a discrete Gaussian distribution, represents the error vector,

[0163] The Powerof2 method in the encryption method GSW (Gentry, C., Sahai, A., Waters, B. (2013). Homomorphic Encryption from Learning with Errors: Conceptually-Simpler, Asymptotically-Faster, Attribute-Based. In: Canetti, R., Garay, JA (eds) Advances in Cryptology–CRYPTO 2013. CRYPTO 2013. Lecture Notes in Computer Science, vol8042. Springer, Berlin, Heidelberg.) is used to generate the private key sk2:

[0164]

[0165] 3) Secret shared master private key sk

[0166] Use the SS.Share method in Shamir's secret sharing method (Adi Shamir.1979.How to share a secret.Commun.ACM 22,11(Nov.1979),612–613.) to secretly share the master private key sk and generate the server share sk i :

[0167] sk i =SS.Share(sk),

[0168] Here, i is the serial number of the server, and the value of i ranges from 50 to 100. In this embodiment, the value of i is 75.

[0169] 4) Generate ciphertext and commitment

[0170] The threshold encryption method TFHE.Enc in the threshold fully homomorphic encryption method is used to generate the password hash ciphertext C (Dan Boneh, Rosario Gennaro, Steven Goldfeder, Aayush Jain, Sam Kim, Peter MRRasmussen, and Amit Sahai. 2018. Threshold Cryptosystems from Threshold Fully Homomorphic Encryption. In Advances in Cryptology–CRYPTO 2018: 38th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 19–23, 2018, Proceedings, Part I. Springer-Verlag, Berlin, Heidelberg, 565–596.). pw and the master key ciphertext C msk :

[0171] C pw =TFHE.Enc(pk1,H(pw)),

[0172] C msk =TFHE.Enc(pk2,msk),

[0173] Where pw represents the password and msk represents the master key. Matrix A1 and matrix A2 are constructed as follows:

[0174] A1=[I m |A],

[0175]

[0176] Among them, I m is the identity matrix, 0 m×m is a zero matrix.

[0177] Generate server share sk as follows i Commitment i :

[0178] Com i =[A1×r i |A2×r i +sk i ];

[0179] Among them, r i represents a random vector, represents an m+n length vector consisting of integers modulo q.

[0180] 5) Output system parameters

[0181] Output system parameters st0, st i as follows:

[0182]

[0183] st i ={sk i ,r i}.

[0184] (2) Secret recovery method

[0185] 1) Encrypted password hash

[0186] User U selects a session set {sid1,sid2,…,sid j}, j is the serial number of the server, j ranges from 50 to 100, and in this embodiment, the value of j is 75. Set the server set S:

[0187] S={1,2,…,t+1},where t represents the number of servers, and the value of t ranges from 100 to 120. In this embodiment, the value of t is 110. The sampling random matrix R pw , R pw ∈{0,1} n×m .

[0188] User U calculates the ciphertext C pw and C pw :

[0189] C pw =H(pw)×I N +Rp,

[0190] C pw =H(pw)×I N +Rp,

[0191] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ),

[0192] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1),

[0193]

[0194] Among them, I N represents the unit matrix, N is the dimension of the matrix, N is 100 to 120, and in this embodiment, N is 110, and Rp represents the matrix R pw Each element in ×pk1 is decomposed into a binary form and arranged from low to high to form an N×l vector; Rp represents the matrix R pw After each element in ×pk is decomposed into binary form, it is arranged from low to high to form an N×l vector, where l is the intermediate variable.

[0195] 2) Generate a key

[0196] Generate the public key pk and private key sk as follows:

[0197]

[0198] sk=Powerof2(1|-k|),

[0199] Where A represents a random matrix, represents an m-row n-column matrix consisting of integers modulo q, k represents a random vector, represents an n-length vector consisting of integers modulo q, represents the noise vector,

[0200] 3) Generate evidence

[0201] User U generates a proof using the NIZK.P method (Peikert, C., Shiehian, S. (2019). Noninteractive Zero Knowledge for NP from (Plain) Learning with Errors. In: Boldyreva, A., Micciancio, D. (eds) Advances in Cryptology–CRYPTO 2019. CRYPTO 2019. Lecture Notes in Computer Science (), vol 11692. Springer, Cham.) using zero-knowledge proof.

[0202]

[0203] C pw =TFHE.Enc(pk1,H(pw)),

[0204] Cpw =TFHE.Enc(pk,H(pw)).

[0205] 4) User sends parameters

[0206] User U sets S, sid j 、C pw 、C pw ,pk,π 1,j Sent to the corresponding server S i .

[0207] 5) Verify evidence

[0208] Server S i Receive the parameters sent by user U and verify the evidence π of the zero-knowledge proof 1,j , if π 1,j =1 is established, continue.

[0209] 6) Partial decryption

[0210] Determine the partial decryption result p as follows j :

[0211]

[0212] Δ j =(C pw -C pw )·R j ,

[0213] in, Represents the vector sk j and The inner product, e j represents the noise vector, e j ∈x m , R j represents a random matrix, R j ∈{0,1} (N×l)×m .

[0214] 7) Generate evidence of partial decryption results

[0215] Determine the partial decryption result p as follows j Ciphertext

[0216]

[0217] Rpp=(Rpp 1,0 ,Rpp 1,1 ,…,Rpp 1,l-1 ,Rpp 2,0 ,Rpp 2,1 …,Rpp N,l-1 ),

[0218] Where Rpp represents the matrix R pw After each element in ×pk is decomposed into binary form, it is arranged from low to high to form an N×l vector.

[0219] Use zero-knowledge proof method to generate evidence π 2,j :

[0220]

[0221] in, Represents a statement, the content of the statement is: ciphertext Use the public key pk to encrypt the partial decryption result p j get.

[0222] Server S i sid j 、 π 2,j Sent to user U.

[0223] 8)Recovery message

[0224] User U receives a message from server S i The parameters sent to verify the equation π 2,j =1, if true, use the Dec method of the encryption method GSW to determine the partial decryption result p j :

[0225]

[0226] Restore the master key msk as follows:

[0227]

[0228] (3) Key share update method

[0229] Each server S i To update the server key share, follow these steps:

[0230] 1) Generate zero polynomial

[0231] Generate the zero polynomial U as follows j (X):

[0232]

[0233] Where X represents the zero polynomial U j (X) variable, α j,k Indicates server S j Randomly selected coefficient, α j,k ∈Z q .

[0234] 2) Determine zero share

[0235] Determine the server S as follows j Send to server S i Zero share z j→i :

[0236] z j→i =U j (i) mod q,

[0237] Determine the binary vector Z as follows:

[0238] Z=(Z1,Z2,…,Z h ),

[0239]

[0240] Among them, Z h Indicates zero share z j→i The value of the hth bit in binary, Z h The value is 1 or 0, h means zero share z j→i The length of the binary.

[0241] 3) Encrypted Zero Share

[0242] Server S j Determine the zero-share ciphertext c as follows j→i :

[0243]

[0244]

[0245] Where x represents a randomly selected vector, x∈{0,1} m , m represents the dimension of vector x, Indicates server S i The private key of represents a random matrix, e T represents the noise vector, e T ∈χ m .

[0246] 4) Zero-share signature

[0247] The GSign method in the GPV signature method is used (Craig Gentry, Chris Peikert, and Vinod Vaikuntanathan. 2008. Trapdoors for hard lattices and new cryptographic constructions. In Proceedings of the fortieth annual ACM symposium on Theory of computing (STOC'08). Association for Computing Machinery, New York, NY, USA, 197–206.), using the server's S j Private key sk j Signature share ciphertext c j→i , get the signature σ j :

[0248] σ j ←GSign(sk j ,c j→i ).

[0249] 5) Broadcast Message

[0250] Server S j Press the button to confirm the broadcast message Msg j :

[0251] Msg j ={j,ω,c j→i ,σ j},

[0252] Among them, ω represents the period counter, which takes a finite positive integer value. The server S j Will broadcast message Msg j Broadcast to all servers.

[0253] 6) Verify the signature

[0254] Server S i Collect at least t+1 broadcast messages Msg j , using the GVerify method in the GPV signature method, using the public key pk j Verify signature σ j :

[0255] GVerify(pk j ,σ j )=1,

[0256] If the above equation holds, continue.

[0257] 7) Update private key

[0258] Press the key to update the private key sk i ':

[0259]

[0260] z j→i =(-s i ,1) T ×c j→i ,

[0261] Among them, the vector s i Represents a vector The transpose of , update the commitment Com according to the formula i ':

[0262] Com i '=[A1×r i |A2×r i '+sk i '].

[0263] Among them, r' i is a random vector, Update the period counter ω' as follows:

[0264] ω'=ω+1.

[0265] 8) Update server status

[0266] Update the public parameter st'0 as follows:

[0267]

[0268] Update the server status by pressing i ':

[0269] st i '={sk i ',r i '},

[0270] Output public parameter st'0 and server status st i '.

[0271] Because the present invention utilizes zero-update technology, it enables dynamic key updates for password-protected secret sharing. This approach requires no user involvement, requiring only key shares to be updated between servers. The correctness of key updates is verified using Lagrange interpolation polynomials, and the updated key does not affect the value of the master key. Furthermore, the system can be expanded to public-key cryptography, broadening its scope of application and achieving resistance to quantum retrieval, persistent leakage, and online password guessing attacks.

[0272] Complete the lattice-based renewable private key password-protected secret sharing method.

[0273] Example 2

[0274] The lattice-based, updateable private key password-protected secret sharing method of this embodiment comprises the following steps:

[0275] (1) System initialization

[0276] 1) Generate system parameters

[0277] Generate the sampling random matrix A and random matrix as follows

[0278]

[0279] Among them, m is the number of rows of the matrix, and the value of m is 700 to 1024. n is the number of columns of the matrix, and the value of n is 784 to 1024. q is a large prime number, and the value of q is 2. 50 ~2 70 In this embodiment, m is 700, n is 784, and q is 2. 50 The other steps of this step are the same as those in Example 1.

[0280] 2) Generate a key

[0281] This step is the same as in Example 1.

[0282] 3) Secret shared master private key sk

[0283] Use the SS.Share method in Shamir's secret sharing method to secretly share the master private key sk and generate the server share sk i :

[0284] sk i =SS.Share(sk),

[0285] Here, i is the serial number of the server, and the value of i ranges from 50 to 100. In this embodiment, the value of i is 50.

[0286] The other steps of this step are the same as those in Example 1.

[0287] (2) Secret recovery method

[0288] 1) Encrypted password hash

[0289] User U selects a session set {sid1,sid2,…,sid j}, j is the serial number of the server, j ranges from 50 to 100, and in this embodiment, j is 50. Set the server set S:

[0290] S={1,2,…,t+1},where t represents the number of servers, and the value of t ranges from 100 to 120. In this embodiment, the value of t is 100. The sampling random matrix R pw , R pw ∈{0,1} n×m .

[0291] User U calculates the ciphertext C pw and C pw :

[0292] C pw =H(pw)×I N +Rp,

[0293] C pw =H(pw)×I N +Rp,

[0294] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ),

[0295] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ),

[0296]

[0297] Among them, I N represents the identity matrix, N is the dimension of the matrix, and the value of N is 100 to 120. In this embodiment, the value of N is 100. The meanings and value ranges of other parameters and variables are the same as those in Example 1.

[0298] The other steps are the same as those in Example 1. The lattice-based renewable private key password-protected secret sharing method is completed.

[0299] Example 3

[0300] The lattice-based, updateable private key password-protected secret sharing method of this embodiment comprises the following steps:

[0301] (1) System initialization

[0302] 1) Generate system parameters

[0303] Generate the sampling random matrix A and random matrix as follows

[0304]

[0305] Among them, m is the number of rows of the matrix, and the value of m is 700 to 1024. n is the number of columns of the matrix, and the value of n is 784 to 1024. q is a large prime number, and the value of q is 2. 50 ~2 70 In this embodiment, the value of m is 1024, the value of n is 1024, and the value of q is 2 70 The other steps of this step are the same as those in Example 1.

[0306] 2) Generate a key

[0307] This step is the same as in Example 1.

[0308] 3) Secret shared master private key sk

[0309] Use the SS.Share method in Shamir's secret sharing method to secretly share the master private key sk and generate the server share sk i :

[0310] sk i =SS.Share(sk),

[0311] Here, i is the serial number of the server, and the value of i ranges from 50 to 100. In this embodiment, the value of i is 100.

[0312] The other steps of this step are the same as those in Example 1.

[0313] (2) Secret recovery method

[0314] 1) Encrypted password hash

[0315] User U selects a session set {sid1,sid2,…,sid j}, j is the serial number of the server, j has a value of 50 to 100, and in this embodiment, j has a value of 100. Set the server set S:

[0316] S={1,2,…,t+1},where t represents the number of servers, and the value of t ranges from 100 to 120. In this embodiment, the value of t is 120. The sampling random matrix R pw , R pw ∈{0,1} n×m .

[0317] User U calculates the ciphertext C pw and C pw :

[0318] C pw =H(pw)×I N +Rp,

[0319] C pw =H(pw)×I N +Rp,

[0320] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ),

[0321] Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ),

[0322]

[0323] Among them, I N represents the identity matrix, N is the dimension of the matrix, and the value of N ranges from 100 to 120. In this embodiment, the value of N is 120. The meanings and value ranges of other parameters and variables are the same as those in embodiment 1.

[0324] The other steps are the same as those in Example 1. The lattice-based renewable private key password-protected secret sharing method is completed.

Claims

1. A lattice-based secret sharing method with renewable private key password protection, characterized in that It consists of the following steps: (1) System initialization 1) Generate system parameters Generate the sampling random matrix A and random matrix as follows Where m is the number of rows of the matrix, n is the number of columns of the matrix, and q is a large prime number; Set the collision-resistant hash function H: H:{0,1} * →Z q ; Among them, {0,1} * Represents a bit string of arbitrary length consisting of 0s and 1s, Z q represents an integer modulo q; 2) Generate a key Generate public keys pk1, pk2, and pk as follows: pk1=[A×k1+e|A], pk2=[A×k2+e|A] Where A represents an integer matrix with m rows and n columns. k1, k2 represent random vectors of length n, represents a random vector of length n, e represents the error vector, represents a discrete Gaussian distribution, represents the error vector, Use the Powerof2 method in the encryption method GSW to generate the private key sk2: 3) Secret shared master private key sk Use the SS.Share method in Shamir's secret sharing method to secretly share the master private key sk and generate the server share sk i : sk i =SS.Share(sk), Where i is the serial number of the server, and the value of i is a finite positive integer; 4) Generate ciphertext and commitment Use the Enc method in the threshold encryption method TFHE.Enc in the threshold fully homomorphic encryption method to generate the password hash ciphertext C pw and the master key ciphertext C msk : C pw =TFHE.Enc(pk1,H(pw)), C msk =TFHE.Enc(pk2,msk), Where pw represents the password and msk represents the master key. Matrix A1 and matrix A2 are constructed as follows: A1=[I m |A], Among them, I m is the identity matrix, 0 m×m is a zero matrix; Generate server share sk as follows i Commitment i : Com i =[A1×r i |A2×r i +sk i ]; Among them, r i represents a random vector, represents a vector of length m+n consisting of integers modulo q; 5) Output system parameters Output system parameters st0, st i as follows: Wed i ={en i ,r i }; (2) Secret recovery method 1) Encrypted password hash User U selects a session set {sid1,sid2,…,sid j }, j is the serial number of the server, j is a finite positive integer, set the server set S: S={1,2,…,t+1}, Among them, t represents the number of servers, t is a finite positive integer, and the sampling random matrix R pw , R pw ∈{0,1} n×m , User U calculates the ciphertext C pw and C pw : C pw =H(pw)×I N +Rp, C pw =H(pw)×I N +Rp, Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ), Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ), Among them, I N Represents the unit matrix, N is the dimension of the matrix, N is a finite positive integer, Rp represents the matrix R pw Each element in ×pk1 is decomposed into a binary form and arranged from low to high to form an N×l vector; Rp represents the matrix R pw After each element in ×pk is decomposed into binary, it is arranged from low to high to form an N×l vector, where l is the intermediate variable; 2) Generate a key Generate the public key pk and private key sk as follows: sk=Powerof2(1|-k|), Where A represents a random matrix, represents an m-row n-column matrix consisting of integers modulo q, k represents a random vector, represents an n-length vector consisting of integers modulo q, represents the noise vector, 3) Generate evidence User U generates evidence using the NIZK.P method of zero-knowledge proof C pw =TFHE.Enc(pk1,H(pw)), C pw =TFHE.Enc(pk,H(pw)); 4) User sends parameters User U sets S, sid j 、C pw 、C pw ,pk,π 1,j Sent to the corresponding server S i ; 5) Verify evidence Server S i Receive the parameters sent by user U and verify the evidence π of the zero-knowledge proof 1,j , if π 1,j =1 established, continue; 6) Partial decryption Determine the partial decryption result p as follows j : D j =(C pw -C pw )·R j , in, Represents the vector sk j and The inner product, e j represents the noise vector, R j represents a random matrix, R j ∈{0,1} (N×l)×m ; 7) Generate evidence of partial decryption results Determine the partial decryption result p as follows j Ciphertext Rpp=(Rpp 1,0 ,Rpp 1,1 ,…,Rpp 1,l-1 ,Rpp 2,0 ,Rpp 2,1 …,Rpp N,l-1 ), Where Rpp represents the matrix R pw After each element in ×pk is decomposed into binary, it is arranged from low to high to form an N×l vector; Use zero-knowledge proof method to generate evidence π 2,j : in, Represents a statement, the content of the statement is: ciphertext Use the public key pk to encrypt the partial decryption result p j get; Server S i Sid j 、 π 2,j Send to user U; 8)Recovery message User U receives a message from server S i The parameters sent to verify the equation π 2,j =1, if true, use the Dec method of the encryption method GSW to determine the partial decryption result p j : Restore the master key msk as follows: (3) Key share update method Each server S i To update the server key share, follow these steps: 1) Generate zero polynomial Generate the zero polynomial U as follows j (X): Where X represents the zero polynomial U j (X) variable, α j,k Indicates server S j Randomly selected coefficient, α j,k ∈Z q ; 2) Determine zero share Determine the server S as follows j Send to server S i Zero share z j→i : z j→i =U j (i)mod q, Determine the binary vector Z as follows: Z=(Z1,Z2,…,Z h ), Among them, Z h Indicates zero share z j→i The value of the hth bit in binary, Z h The value is 1 or 0, h means zero share z j→i The length of the binary; 3) Encrypted Zero Share Server S j Determine the zero-share ciphertext c as follows j→i : Where x represents a randomly selected vector, x∈{0,1} m , m represents the dimension of vector x, Indicates server S i The private key of represents a random matrix, e T represents the noise vector, 4) Zero-share signature Use the GSign method in the GPV signature method and use the server's S j Private key sk j Signature share ciphertext c j→i , get the signature σ j : σ j ←GSign(en j ,c j→i ); 5) Broadcast Message Server S j Press the button to confirm the broadcast message Msg j : Message j ={j,ω,c j→i ,s j }, Among them, ω represents the period counter, which takes a finite positive integer value. The server S j Will broadcast message Msg j Broadcast to all servers; 6) Verify the signature Server S i Collect at least t+1 broadcast messages Msg j , using the GVerify method in the GPV signature method, using the public key pk j Verify signature σ j : GVerify(pk j ,σ j )=1, If the above equation is established, continue; 7) Update private key Press the key to update the private key sk i ': z j→i =(-s i ,1) T ×c j→i , Among them, the vector s i Represents a vector The transpose of , update the commitment Com according to the formula i ': Com i '=[A1×r i |A2×r i '+sk i ']; Among them, r' i is a random vector, Update the period counter ω' as follows: ω'=ω+1; 8) Update server status Update the public parameter st'0 as follows: Update the server status by pressing i ': Wed i '={en i ',r i '}, Output public parameter st'0 and server status st i '.

2. The lattice-based, renewable private key password-protected secret sharing method according to claim 1, characterized in that In step (1) system initialization, the system parameters generated in step 1) are: Generate the sampling random matrix A and random matrix as follows Among them, m is the number of rows of the matrix, and the value of m is 700 to 1024. n is the number of columns of the matrix, and the value of n is 784 to 1024. q is a large prime number, and the value of q is 2. 50 ~2 70 .

3. The lattice-based renewable private key password-protected secret sharing method according to claim 1, characterized in that In step (1) system initialization, the 3) secret shared master private key sk is: Use the SS.Share method in Shamir's secret sharing method to secretly share the master private key sk and generate the server share sk i : sk i =SS.Share(sk), Here, i is the serial number of the server, and the value of i ranges from 50 to 100.

4. The lattice-based, renewable private key password-protected secret sharing method according to claim 1, characterized in that In step (2) of the secret recovery method, the encrypted password hash of step 1) is: User U selects a session set {sid1,sid2,…,sid j }, j is the server number, j ranges from 50 to 100, set the server set S: S={1,2,…,t+1}, Where t represents the number of servers, t ranges from 100 to 120, and the sampling random matrix R pw , R pw ∈{0,1} n×m , User U calculates the ciphertext C pw and C pw : C pw =H(pw)×I N +Rp, C pw =H(pw)×I N +Rp, Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ), Rp=(Rp 1,0 ,Rp 1,1 ,…,Rp 1,l-1 ,Rp 2,0 ,Rp 2,1 …,Rp N,l-1 ), Among them, I N Represents the unit matrix, N is the dimension of the matrix, N is 100 to 120, Rp represents the matrix R pw Each element in ×pk1 is decomposed into a binary form and arranged from low to high to form an N×l vector; Rp represents the matrix R pw After each element in ×pk is decomposed into binary form, it is arranged from low to high to form an N×l vector, where l is the intermediate variable.

Images