Anti-quantum message authentication code construction method and system adopting adjustable block cipher

Abstract

The invention belongs to the field of passwords, and discloses an anti-quantum message authentication code construction method and system adopting an adjustable block cipher. The MAC generation method comprises the steps that two communication parties share a key value K generated by a key generation algorithm, the label length tau = Tag is agreed, the tau is limited to be smaller than or equal to n, and n represents the packet length; and taking the key K, the message M and the unique value N as input to generate a tau-bit message authentication code Tag. Furthermore, the MAC verification method verifies the generated message authentication code, and judges whether the message is correct or not and whether the message is accepted or not. According to the method, the adjustment handle value is an encryption result of a unique value initially, and then the adjustment handle is updated by using a function h when the adjustable block cipher is called every time. The method has the quantum attack resisting capability, and compared with the existing known MAC scheme with the quantum attack resisting capability, the required storage is small under the condition of providing the same quantum security intensity.

Description

Technical Field

[0001] This invention belongs to the field of cryptography and discloses a method and system for constructing quantum-resistant message authentication codes using adjustable block ciphers. It possesses advantages such as small storage requirements and high quantum security strength. When the output size of the message authentication code is n, the classical security strength of this method is close to n, and the quantum security strength can reach n / 2. That is, under the same key, the complexity of this method against quantum attacks is greater than 2. n / 2 . Background Technology

[0002] Message authentication code (MAC) algorithms, under key control, map messages into fixed-length bit strings (called message authentication codes, or MACs) that satisfy the following two properties:

[0003] —The algorithm can perform calculations quickly and efficiently for any key and any message;

[0004] —For any fixed key, an attacker, without obtaining key information, even if they obtain some messages and corresponding MAC values, cannot (computationally) predict the MAC value of any new message.

[0005] Message authentication codes (MACs) can be used for data integrity checks, verifying whether data has been altered without authorization; they can also be used for message authentication, ensuring the legitimacy of the message source. MACs are commonly used in data verification and authentication protocols, and are widely applied in finance, telecommunications, and other fields.

[0006] The strength of data integrity and message authentication depends on the key length and its confidentiality, the strength and parameter size of the underlying algorithm, the length of the message authentication code, and the specific message authentication code algorithm. The security of the message authentication code is typically assessed by the algorithm's ability to resist forgery attacks. Treating the underlying modules as pseudo-random permutations, provable security theory can be used to analyze and demonstrate the algorithm's unforgeability. Due to limitations imposed by birthday forgery attacks, the security bound of the algorithm is typically approximately 2. n / 2 , where n is a parameter of the underlying module, such as the group length.

[0007] With the research on quantum computers, quantum algorithms (algorithms running on quantum computers) have gradually come to be recognized. Quantum algorithms have significantly greater computational power than classical algorithms. Furthermore, when attackers are allowed to perform quantum superposition state queries, a single query can complete the query of all elements in the domain in parallel. Using the quantum periodicity discovery algorithm Simon, the attack complexity, which includes many message authentication algorithms, can be reduced from O(2^3) to O(2^3). n / 2 This reduces the time complexity to polynomial O(n). The following introduces existing message authentication code algorithms:

[0008] I. CBC-MAC and its seven different variants (EMAC, ANSI retail MAC, MacDES, CMAC, LMAC, CBCR, TrCBC) employ standard message authentication code algorithms constructed using block ciphers, and have an overall chain structure.

[0009] 2. PMAC uses a message authentication code algorithm constructed from block ciphers and Gray codes, and can call block ciphers in parallel except for the last call;

[0010] III. Poly1305-AES and GMAC are standard message authentication code algorithms constructed using a generalized hash function, where the generalized hash function is implemented based on multiplication over a finite field.

[0011] IV. LightMAC is a standard lightweight message authentication code algorithm constructed using block ciphers and counters; Chaskey-12 is a standard lightweight message authentication code algorithm designed specifically for 32-bit microcontrollers, with its underlying round function constructed using ARX (Add-Rotate-Xor, a modulo-addition-shift-exclusive operation over a finite field) technique.

[0012] All of the above message authentication algorithms are known to be susceptible to theoretical attacks with quantum computation complexity on the polynomial level. In contrast, the following message authentication algorithms are known to be quantum-resistant:

[0013] I. HMAC, a standard message authentication code algorithm using a dedicated hash function, is based on the NMAC framework. It serially calls the round function, requiring a minimum storage of 640 bits. It has been proven that when the round function is a quantum pseudo-random function, the algorithm's complexity in distinguishing it from a quantum random function is Ω(2). n / 3 ), where n is the bit length of the round function output.

[0014] II. KMAC, a standard message authentication code algorithm designed specifically for the SHA-3 series of dedicated hash functions, employs Keccak permutations and a sponge structure. The sponge structure serially calls the round function Keccak permutation, which has been proven to be quantum collision-resistant when the underlying layer is a quantum pseudo-random permutation. SHA-3 has a storage capacity of 1600 bits and a security strength of c / 3 (c = 256, 384, 512).

[0015] Therefore, it is evident that the two quantum-resistant message authentication code schemes mentioned above have significant storage requirements, which limits their applicability, especially in resource-constrained scenarios such as the Internet of Things (IoT). Consequently, there is currently no lightweight message authentication code algorithm with quantum resistance capabilities, making the development of such a scheme both promising and of great importance. Summary of the Invention

[0016] The purpose of this invention is to construct a lightweight message authentication code construction method and system resistant to quantum computing attacks.

[0017] The technical solution adopted in this invention is as follows:

[0018] A method for constructing a message authentication code based on an adjustable block cipher, comprising a MAC generation method and a MAC verification method, the specific steps of which are as follows:

[0019] The two communicating parties share a key value K generated by a key generation algorithm and agree on a tag length τ = |Tag|, where Tag represents the authentication code, τ is limited to n, and n represents the block length, which is usually chosen to be τ = n / 2.

[0020] I. MAC Generation Method: Using the key K, message M, and unique value N as input, generate a τ-bit authentication code Tag, denoted as Tag←MAC. K,N (M). The process is as follows:

[0021] (1) Calculate the length of the input message Where |M| represents the bit length of M, This indicates rounding up.

[0022] (2) Fill in the unique value N, N = Pad n (N). Among them, Pad n (N) indicates that N is padded by adding bits so that the length of the bit string is an integer multiple of n. Here, 10 bits are used for padding by default, forming a bit string consisting of one 1 and several 0s.

[0023] (3) Use the encryption result of N to generate the initial handle value. Take its lower n-3 bits And connect it with the domain partition constant d0 to form As the control value, the initial state value is generated. Where E represents the encryption algorithm, E K (N) represents the result of encrypting data of length n bits using a block cipher algorithm and key K; E is the encryption algorithm of the adjustable block cipher, which satisfies that for any key K and handle value t, E(K,t,·) is {0,1}. n The permutation on the above is abbreviated as EK,t(·); Con0 and Con1 are two n-bit public constants, which are determined during the specific implementation of the scheme; || represents bit concatenation; lsb a (X) represents the rightmost bit a of the bit string X.

[0024] (4) Fill and split the message M to generate (M1,...,M) m )← nPad n (M). Where, ← n This means dividing the input into groups of length n bits, where m represents the number of groups.

[0025] (5) For i = 1 to m - 1, calculate the adjustment value t in the i-th step. i =h(t) i-1 ) and state value Where h is an n-bit function with a large period, and d1 is the domain partitioning constant.

[0026] (6) Calculate and output the authentication code Tag. First, calculate t. m =h(t) m-1 Then, based on |M|, there are two cases: if |M|modn=0, then If |M|modn≠0, then Output Tag = lsb τ (S m ). Where d2 and d3 are domain partitioning constants.

[0027] II. MAC Verification Method: Taking the key K, message M, unique value N, and authentication code Tag as input, the output is a 1-bit value, denoted as d←Ver. K,N (M). The process is as follows:

[0028] (1) The receiver calculates the corresponding authentication code for the received message M using the key K, Tag′ = MAC. K,N (M).

[0029] (2) If Tag = Tag′, return 1 to indicate that the message is correct and accept the message; otherwise, return 0 to indicate that the message is incorrect and discard it.

[0030] Based on the same inventive concept, this invention also provides a quantum-resistant message authentication code construction system using an adjustable block cipher, comprising:

[0031] The MAC generation module is used to generate a message authentication code using the MAC generation method described above.

[0032] The MAC verification module is used to verify the generated message authentication code using the MAC verification method described above, and to determine whether the message is correct and whether to accept the message.

[0033] This message authentication code algorithm is a cryptographic scheme based on unique values, which cannot be reused during use. The randomness of the initial handle value is achieved by leveraging the randomness inherent in the unique value; the initial handle value is the result of encrypting the unique value with the key, and its confidentiality depends on the key. Furthermore, during message processing, the handle value is independently updated using the h function (e.g., plaintext message processing does not participate). Combined with the properties of h, the handle value is collision-resistant. Without considering the correlation of the handle value, the adjustable block ciphers invoked in the message authentication code scheme are independent and random.

[0034] Furthermore, the method of this invention can flexibly handle messages of different lengths, and the underlying encryption algorithm can be easily replaced. It utilizes the characteristics of adjustable block ciphers to resist various attacks, such as time-series attacks. Frequent key changes are a method to prevent time-series attacks; here, based on the uniqueness and non-repeatability of the value, the change of the handle value is obtained, thereby achieving the effect of frequent key changes.

[0035] Compared with existing message authentication code algorithms, the present invention has the following properties and advantages:

[0036] (1) Lightweight. The storage required by this scheme is approximately twice the size of the block size of a block cipher.

[0037] (2) Quantum security. This scheme is resistant to quantum attacks; and compared with the currently known MAC schemes that are resistant to quantum attacks, it requires less storage while providing the same level of quantum security. Attached Figure Description

[0038] Figure 1 This is a schematic diagram illustrating the process of generating a message authentication code. Detailed Implementation

[0039] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below through specific examples.

[0040] In one embodiment of the present invention, h adopts GF(2) over a finite field. 128 For the multiplication on E, the Deoxys-TBC family of adjustable block ciphers, as specified in ISO / IEC 18033-7:2022, is adopted. The message authentication code is 128 bits in size. Taking this as an example, the scheme is explained.

[0041] h(X): For input X, if the most significant bit of X is 0, shift X left by 1 bit one by one; if the most significant bit is 0, shift X left by 1 bit and then merge with 0. 120 Perform an XOR operation on 10000111.

[0042] Deoxys-BC-256 Algorithm: Deoxys-BC-256 uses a round function similar to the AES-128 algorithm. The main difference from AES-128 is that the round key plus AddRoundKey operation is replaced with the round handle key plus AddRoundTweakey. After 14 rounds of iteration, the encrypted result is produced.

[0043] The replacement round handle key is added using AddRoundTweakey: For a key K and a handle T, let TK = T||K. The handle key arrangement algorithm divides the input TK into n = 128 bits. And generate the Tweakey value required for each step in sequence.

[0044] For i ← 1, ..., r,

[0045]

[0046]

[0047] The byte substitution P is defined as follows:

[0048]

[0049] The function definition of the linear feedback shift register LFSR2 is as follows.

[0050]

[0051] Based on the handle key arrangement, the wheel handle key is defined as follows.

[0052]

[0053] Among them, RC i Let be the round constant, defined in matrix form as follows:

[0054]

[0055] RCON[i] represents the (i+15)th key arrangement constant of AES, specifically in hexadecimal as shown in Table 1.

[0056] Table 1. Constant values ​​used in Deoxys-TBC-256

[0057] Number of rounds RCON[i] is a constant value. i = 0 to i = 14 2F,5E,BC,63,C6,97,35,6A,D4,B3,7D,FA,EF,C5,91

[0058] The MAC generation method in this embodiment takes a 128-bit key K, a unique value N, and a message M as input to generate a τ = 128-bit authentication code Tag. The process is as follows:

[0059] (1) Calculate the length of the input message

[0060] (2) Fill in the unique value N: N = Pad n (N).

[0061] (3) Using the Deoxys-BC-256 algorithm as E, calculate the initial control value. Again The initial state value is generated as the adjustment value.

[0062] (4) Fill and segment the loading message M to generate (M1,...,M) a )← n Pad n (M).

[0063] (5) For i = 1 to a - 1, calculate the adjustment value t in the i-th step. i =h(t) i-1 ) and state value h is the GF(2) over the finite field given above. 128 Multiplication on ).

[0064] (6) Calculate and output the authentication code Tag. First, calculate t. a =h(t) a-1 Then, based on |M|, there are two cases: if |M|modn=0, then If |M|modn≠0, then Output Tag = S a .

[0065] The scheme reserves 3 bits of domain segmentation constant, which users can assign values ​​to according to their actual needs. In the example above, d0, d1, d2, and d3 are set to 000, 001, 010, and 011 respectively. The other four values ​​can be assigned additional values ​​according to the scenario.

[0066] The MAC verification method in this embodiment takes a 128-bit key K, a unique value N, a message M, and an authentication code Tag as input, and outputs a 1-bit value. The process is as follows:

[0067] (1) For a unique value N and a message M, calculate the authentication code Tag′ = MAC. K,N (M).

[0068] (2) If Tag = Tag′, return 1; otherwise, return 0.

[0069] Security Strength and Storage Requirements Comparison: This scheme is compared with the security strength of MAC algorithms that currently claim to be quantum-safe. Specifically, with an output tag size of 256 as a prerequisite, the security strength and storage requirements provided by each algorithm are compared:

[0070] For the existing HMAC algorithm, the underlying function uses SHA-256, which requires approximately 512 bits of storage and provides a quantum security strength of 256 / 3≈85.3 bits.

[0071] The existing KMAC algorithm uses SHA3-256 at the bottom layer, with a storage capacity of approximately 1600 bits, providing a quantum security strength of 256 / 3≈85.3 bits.

[0072] This scheme uses a block cipher with a block size of 256 bits, requiring approximately 512 bits for storage and providing a quantum security strength of 256 / 2 = 128 bits.

[0073] This invention is widely applicable in fields such as communications and finance, used to protect data integrity or to authenticate the entities accessing the data. Examples include collaborative signature gateways, smart cryptographic key application interfaces, and PKI security middleware.

[0074] The function h in this invention can be implemented in different ways, but it should satisfy the characteristic of having a large period. For example, using a linear operation: for input X, it satisfies (X1,...,X4)← n / 4 X, definition

[0075] Another embodiment of the present invention provides a quantum-resistant message authentication code construction system using an adjustable block cipher, comprising:

[0076] MAC generation module, used to generate message authentication code using the MAC generation method of the present invention;

[0077] The MAC verification module is used to verify the generated message authentication code using the MAC verification method of this invention, and to determine whether the message is correct and whether to accept the message.

[0078] Another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0079] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) storing a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0080] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.

Claims

1. A method for constructing a quantum-resistant message authentication code using an adjustable block cipher, characterized in that, This includes a MAC generation method, which comprises the following steps: The two communicating parties share a key value K generated by a key generation algorithm, agree on a tag length τ = |Tag|, where Tag represents the message authentication code, and τ is limited to n, where n represents the block length; Using the key K, message M, and unique value N as input, generate a τ-bit message authentication code Tag.

2. The method according to claim 1, characterized in that, The process of generating a τ-bit authentication code Tag, using key K, message M, and unique value N as input, includes: Calculate the length of the input message Where |M| represents the bit length of M, Indicates rounding up; Fill in the unique value N, where N = Pad n (N), where Pad n (N) means that N is padded by adding bits so that the length of the bit string is an integer multiple of n; The initial handle value is generated using the encryption result of N. Take its lower n-3 bits And connect it with the domain partition constant d0 to form As the control value, the initial state value is generated. Where E represents the encryption algorithm, E K (N) represents the result of encrypting data of length n bits using a block cipher algorithm and key K; E is the encryption algorithm of the adjustable block cipher, which satisfies that for any key K and handle value t, E(K,t,·) is {0,1}. n Permutation on; Con0, Con1 are two n-bit public constants; || denotes bit concatenation; lsb a (X) represents the rightmost a bits of bit string X; The message M is padded and split to generate (M1,...,M) m )← n Pad n (M), where ← n This means dividing the input into groups of length n bits, where m represents the number of groups; For i = 1 to m-1, calculate the adjustment value t for the i-th step. i =h(t) i-1 ) and state value Where h is a function of size n bits with a large period; Calculate t m =h(t) m-1 Then, based on |M|, there are two cases: if |M| mod n = 0, then... If |M| mod n ≠ 0, then Output message authentication code Tag = lsb τ (S m ).

3. The method according to claim 2, characterized in that, Choose τ = n / 2.

4. The method according to claim 2, characterized in that, d0, d1, d2, and d3 are 3-bit field partitioning constants, and values ​​are assigned to them according to actual needs.

5. The method according to claim 2, characterized in that, h adopts GF(2) over a finite field. 128 For multiplication on E, the Deoxys-TBC family of adjustable block ciphers, as specified in ISO / IEC 18033-7:2022, is used.

6. The method according to claim 1, characterized in that, It also includes a MAC verification method, which takes a key K, a message M, a unique value N, and a message authentication code Tag as input, and outputs a 1-bit value, denoted as d←Ver. K (M), the MAC verification method includes the following steps: The receiver calculates the corresponding authentication code for the received message M using the key K, where Tag′ = MAC. K (M); If Tag = Tag', return 1 to indicate that the message is correct and accept it; otherwise, return 0 to indicate that the message is incorrect and discard it.

7. The method according to any one of claims 1 to 6, characterized in that, The generated message authentication code is used to protect data integrity or to verify the authenticity of the accessed entity.

8. A quantum-resistant message authentication code construction system using an adjustable block cipher, characterized in that, include: MAC generation module, used to generate message authentication code using the method described in any one of claims 1 to 5; The MAC verification module is used to verify the generated message authentication code to determine whether the message is correct and whether to accept it.

9. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 7.

Images