Domestic post-quantum key packaging method based on lattice

Abstract

The invention discloses a lattice-based domestic post-quantum key packaging method, which comprises an initial step, a key generation step, an encryption step and a decryption step, and is characterized in that S1, the initial step is as follows: a terminal and a server presets packaging parameters corresponding to a post-quantum password security level, appoints compression and decompression rules of ciphertext data, and sends the packaging parameters to the server; the compression rule adopts a mode based on bit shift operation, and the decompression rule corresponds to reverse operation of the compression rule; the terminal generates a public key element and a private key through the seed and sampling, the public key is uploaded to the server side, the public key comprises a first public key element and a second seed, and the private key comprises a private key vector. And a traditional SHA3 series hash function is replaced by a CBC expansion mode based on SM4, so that the parallel performance of the algorithm is improved.

Description

Technical Field

[0001] This invention relates to the field of cryptography, and more particularly to a domestically developed post-quantum key encapsulation method based on lattice. Background Technology

[0002] With the rapid development of quantum computing technology, traditional public-key cryptosystems are facing unprecedented challenges. Quantum computers, utilizing properties such as quantum superposition and entanglement, can achieve exponential computational speedups for specific problems. In particular, the emergence of Shor's algorithm enables quantum computers to factor large integers and compute discrete logarithms in polynomial time, directly threatening the security of widely used public-key cryptosystems such as RSA and elliptic curve cryptography. Although large-scale general-purpose quantum computers have not yet been realized, their potential threats have attracted significant attention from the cryptographic community. To address the potential "quantum catastrophe" of the future, cryptographers have begun researching new cryptographic algorithms resistant to quantum computing attacks.

[0003] Post-quantum cryptography (PQC) refers to cryptographic algorithms that maintain security even after the advent of quantum computers. These algorithms are typically based on mathematical problems considered difficult to solve even under quantum computing models. Currently, the main PQC schemes include: lattice-based cryptography, code-based cryptography, multivariate public-key cryptography, hash-based signatures, and homology-based cryptography. Among these, lattice-based cryptography schemes have become one of the key research directions in PQC due to their relatively good security, efficiency, and functionality.

[0004] Key encapsulation mechanism (KEM) is a cryptographic primitive used to securely transmit symmetric keys. In the post-quantum era, designing secure and efficient key encapsulation mechanisms is particularly important because it can provide key exchange functionality for hybrid cryptographic systems while resisting quantum computing attacks.

[0005] Post-quantum key encapsulation mechanisms typically comprise three main algorithms: a key generation algorithm to generate public and private key pairs, an encapsulation algorithm to generate session keys and ciphertext using the public key, and a decapsulation algorithm to recover the session keys using the private key and ciphertext. Designing efficient and secure post-quantum key encapsulation mechanisms presents numerous challenges, including: achieving sufficient security strength with finite key and ciphertext sizes; maintaining high performance across various hardware platforms; resisting known side-channel attacks; and ensuring compatibility and a smooth transition with existing cryptographic infrastructures.

[0006] To address these challenges, researchers have continuously optimized algorithm design and proposed new construction methods and secure conversion techniques. The lattice-based domestic post-quantum key encapsulation mechanism algorithm introduced in this paper was proposed against this backdrop, aiming to provide strong protection for the long-term security of my country's critical information infrastructure. Summary of the Invention

[0007] The purpose of this invention is to provide a domestically developed post-quantum key encapsulation method based on lattice to solve the problem of poor security mentioned in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a domestically developed post-quantum key encapsulation method based on lattice, comprising an initialization step, a key generation step, an encryption step, and a decryption step, characterized in that: S1. Initial steps: The terminal and the server preset the encapsulation parameters corresponding to the quantum cryptography security level, and agree on the compression and decompression rules of the ciphertext data. The compression rule adopts a bit shift operation method, and the decompression rule is the reverse operation of the compression rule. S2. Key generation steps: The terminal generates a public key element and a private key through sampling using a seed, and uploads the public key to the server. The public key includes public key element one and seed two, and the private key includes a private key vector. S3. Encryption steps: The server first decompresses the public key using a public key decompression algorithm, then processes the decompressed result using a public key compression algorithm to generate ciphertext elements. Subsequently, the server calculates temporary variable one, and generates ciphertext using an encryption method based on the temporary variable, and then sends the ciphertext to the terminal. S4. Decryption steps: The terminal calculates temporary variable two and combines it with the ciphertext decryption algorithm to decapsulate the key and output the decryption message.

[0009] Preferably, the key generation step includes the following sub-steps: S21. Select at least two bit strings as seed one and seed two; S22. Based on the seed, a random source is generated using a cryptographic expansion function, wherein the random source is processed through a polynomial ring. Uniformly distributed sampling in dimensional space generates a polynomial matrix. S23. Based on the seed two, a random source is generated using a cryptographic expansion function, wherein the random source is processed using a discrete Gaussian distribution. Uniform sampling is performed to generate polynomial vector one and polynomial vector two. S24. Perform multiplication and addition calculations based on the polynomial matrix one, polynomial vector one, and polynomial vector two to obtain temporary variable one; S25. Perform a compression operation on the temporary variable to obtain public key element one; S26. Generate output public and private keys, wherein the public key includes public key element one and seed two, and the private key includes polynomial vector one.

[0010] Preferably, the encryption step includes the following sub-steps: S31. Input the public key, the message to be encrypted, and the random number; S32. Perform a decompression operation on the public key element in the public key to obtain public key element two; S33. Based on seed 2 in the public key, a random source is generated using a cryptographic expansion function. The random source is then processed through a polynomial ring. Uniform sampling in dimensionality generates a polynomial matrix of two. S34. Based on the random number, a random source is generated using a cryptographic expansion function, and the random source is processed using a discrete Gaussian distribution. Uniform sampling in dimensional space generates polynomial vectors three, four, and five. S35. Calculate using the transpose of polynomial matrix two, polynomial vector three, and polynomial vector four. Perform a compression operation on the calculation result to obtain ciphertext element one. S36. Calculate using the transpose of the public key element two, polynomial vector three, and polynomial vector five to obtain temporary variable two; S37. Perform an encryption algorithm on the temporary variable two to obtain the encrypted element; S38. Output ciphertext, which includes ciphertext element one and encryption element.

[0011] Preferably, the decryption step includes the following sub-steps: S41. Input the private key and the ciphertext; S42. By transposing the private key and combining it with ciphertext element one, decompression is performed to obtain temporary variable three; S43. Decrypt the encrypted element and the temporary variable three to obtain the message.

[0012] A lattice-based domestic post-quantum key encapsulation device includes a memory and one or more processors. The memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the lattice-based domestic post-quantum key encapsulation method.

[0013] A computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the aforementioned lattice-based domestic post-quantum key encapsulation method.

[0014] The beneficial effects of this invention are: 1. The present invention employs the compression and decompression method described above, which improves efficiency through bit shifting operations and uses the CBC extended mode based on the national cryptographic standard SM4 to replace the traditional SHA3 series hash functions, thereby improving the parallel performance of the algorithm.

[0015] 2. This invention improves the performance of key generation and encryption functions while ensuring security through key generation, encryption, and decryption steps, and provides flexible parameter settings for different post-quantum cryptography security levels, including a 512-bit key extension parameter suitable for high-security scenarios. Attached Figure Description

[0016] Figure 1 This is a pseudocode diagram of the public key encryption algorithm according to an embodiment of the present invention; Figure 2 This is a pseudocode diagram illustrating the key encapsulation mechanism in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figures 1-2 This invention provides a domestically developed post-quantum key encapsulation method based on lattice, comprising an initialization step, a key generation step, an encryption step, and a decryption step, characterized in that: S1. Initial steps: The terminal and the server preset the encapsulation parameters corresponding to the quantum cryptography security level, and agree on the compression and decompression rules of the ciphertext data. The compression rule adopts a bit shift operation method, and the decompression rule is the reverse operation of the compression rule. S2. Key generation steps: The terminal generates a public key element and a private key through sampling using a seed, and uploads the public key to the server. The public key includes public key element one and seed two, and the private key includes a private key vector. S3. Encryption steps: The server first decompresses the public key using a public key decompression algorithm, then processes the decompressed result using a public key compression algorithm to generate ciphertext elements. Subsequently, the server calculates temporary variable one, and generates ciphertext using an encryption method based on the temporary variable, and then sends the ciphertext to the terminal. S4. Decryption steps: The terminal calculates temporary variable two and combines it with the ciphertext decryption algorithm to decapsulate the key and output the decryption message.

[0019] In the algorithm designed in this invention, the encapsulation parameters corresponding to the preset post-quantum cryptography security level are as follows: Security Level 1: Multinomial Dimension Polynomial vector dimension Modulus Key and noise distribution Compression parameters Encapsulation key 32 bytes long, public key 800 bytes long, ciphertext Length 608 bytes; Security Level 3: Multinomial Dimension Polynomial vector dimension Modulus Key and noise distribution Compression parameters Encapsulation key 32 bytes long, public key 1184 bytes in length, ciphertext 960 bytes in length; For post-quantum cryptography security level 5, this invention provides an extended parameter for a 512-bit key, suitable for scenarios with higher security. The parameter setting is as follows: polynomial dimension. Polynomial vector dimension Modulus Key and noise distribution Compression parameters Encapsulation key 64 bytes long, public key 1568 bytes long, ciphertext Length 1632 bytes.

[0020] Specifically, the key generation step includes the following sub-steps: S21. Select at least two bit strings as seed one and seed two; S22. Based on the seed, a random source is generated using a cryptographic expansion function, wherein the random source is processed through a polynomial ring. Uniformly distributed sampling in dimensional space generates a polynomial matrix. S23. Based on the seed two, a random source is generated using a cryptographic expansion function, wherein the random source is processed using a discrete Gaussian distribution. Uniform sampling is performed to generate polynomial vector one and polynomial vector two. S24. Perform multiplication and addition calculations based on the polynomial matrix one, polynomial vector one, and polynomial vector two to obtain temporary variable one; S25. Perform a compression operation on the temporary variable to obtain public key element one; S26. Generate output public and private keys, wherein the public key includes public key element one and seed two, and the private key includes polynomial vector one.

[0021] Specifically, the encryption step includes the following sub-steps: S31. Input the public key, the message to be encrypted, and the random number; S32. Perform a decompression operation on the public key element in the public key to obtain public key element two; S33. Based on seed 2 in the public key, a random source is generated using a cryptographic expansion function. The random source is then processed through a polynomial ring. Uniform sampling in dimensionality generates a polynomial matrix of two. S34. Based on the random number, a random source is generated using a cryptographic expansion function, and the random source is processed using a discrete Gaussian distribution. Uniform sampling in dimensional space generates polynomial vectors three, four, and five. S35. Calculate using the transpose of polynomial matrix two, polynomial vector three, and polynomial vector four. Perform a compression operation on the calculation result to obtain ciphertext element one. S36. Calculate using the transpose of the public key element two, polynomial vector three, and polynomial vector five to obtain temporary variable two; S37. Perform an encryption algorithm on the temporary variable two to obtain the encrypted element; S38. Output ciphertext, which includes ciphertext element one and encryption element.

[0022] Specifically, the decryption step includes the following sub-steps: S41. Input the private key and the ciphertext; S42. By transposing the private key and combining it with ciphertext element one, decompression is performed to obtain temporary variable three; S43. Decrypt the encrypted element and the temporary variable three to obtain the message.

[0023] The compression and decompression methods are as follows: Unlike the affine transformation-based compression methods commonly used in lattice ciphers, this invention employs a more efficient compression method: This method only requires bit shifting operations in its implementation, making it more efficient than compression methods based on affine transformations.

[0024] Based on this method, the present invention proposes a message... Encryption methods for Correspondingly, the method for decrypting ciphertext v for .

[0025] A lattice-based domestic post-quantum key encapsulation device includes a memory and one or more processors. The memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the lattice-based domestic post-quantum key encapsulation method.

[0026] A computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements a lattice-based domestic post-quantum key encapsulation method.

[0027] In a specific embodiment, the specific encapsulation scheme is as follows: (I) Calculation process of the key encapsulation mechanism: 1. Key encapsulation mechanism and key generation function (1) Generate key pairs using public-key encryption algorithms: (2) Select Long bit string random numbers: (3) Set the private key: (3) Return the public / private key pair: 2. Key Encapsulation Mechanism and Key Encapsulation Function (1) From message space Selected message : (2) Transfer the public key and messages As input, the encapsulation key is obtained through expansion. and random numbers : (3) Send the message and random numbers Input, then encrypt using a public key to obtain ciphertext. (4) Output key encapsulation result: 3. Key Encapsulation Mechanism and Key Decapsulation Function (1) Obtain the message using the decryption function : (2) Using functions Expand to obtain the encapsulation key and random numbers : (3) Identify the public key random numbers and ciphertext The decapsulation result is obtained by expanding the input. : (4) If or Output Otherwise output Among them, the This represents the public key identifier, which can be selected as the first 33 bytes of the public key.

[0028] Among them, the The function uses the CBC extension mode of the SM4 encryption algorithm, which is based on China's national cryptographic standard. Compared with traditional extension methods based on the SHA3 series of hash functions, this method is entirely based on domestic cryptographic algorithms, making it more hardware-friendly in terms of parallelism and enabling faster computation using platforms such as GPUs.

[0029] (II) Calculation process of the CPA-secure encryption algorithm: 1. Public-key encryption algorithm key generation function (1) Select Long bit strings and : (2) Sampling loop superior Uniformly distributed polynomial matrix : (3) Sampling follows Distribution 3D polynomial vector key and obedience Distribution dimensional polynomial vector noise : (4) Perform relevant calculations and compress to obtain the public key element. : (5) Return the public / private key pair : 2. Public-key encryption algorithm encryption function Input: Public key Message to be encrypted random numbers Output: Ciphertext (1) Perform relevant calculations and decompress to obtain the public key element. : (2) Sampling loop superior Uniformly distributed polynomial matrix : (3) Sampling respectively Distribution 3D polynomial vector ,obey Distribution 3D polynomial vector and obedience Distributed polynomial : (4) Perform relevant calculations and compress to obtain ciphertext elements. : (5) Calculate temporary variables: (6) Perform relevant calculations and encrypt to obtain ciphertext elements: (7) Return the ciphertext: 3. Public-key encryption algorithm decryption function Input: Private key ciphertext Output: Decrypted message (1) Calculate temporary variables : (2) Perform relevant calculations to recover the key. : Wherein, the uniform distribution sampling The method is: using The function expands the input random number into a bit stream of sufficient length, and then uses a general rejection sampling method to obtain elements that follow a uniform distribution.

[0030] Among them, the The function uses the CBC extension mode of the SM4 encryption algorithm, which is based on China's national cryptographic standard. Compared with traditional extension methods based on the SHA3 series of hash functions, this method is entirely based on domestic cryptographic algorithms, making it more hardware-friendly in terms of parallelism and enabling faster computation using platforms such as GPUs.

[0031] Wherein, the obedience Sampling of distribution The method is: using The function expands the input random numbers into a sufficiently long bitstream, and then uses a general central binomial distribution sampling method to obtain a sequence that follows... The elements of the distribution.

[0032] The compression and decompression methods are as follows: Unlike the affine transformation-based compression methods commonly used in lattice ciphers, this invention employs a more efficient compression method: This method only requires bit shifting operations in its implementation, making it more efficient than compression methods based on affine transformations.

[0033] Based on this method, the present invention proposes a message... Encryption methods for Correspondingly, the method for decrypting ciphertext v for (III) Parameter Setting In the algorithm designed in this invention, the parameters for post-quantum cryptography security levels 1 and 3 are set as follows: Security Level 1: Multinomial Dimension Polynomial vector dimension Modulus Key and noise distribution Compression parameters Encapsulation key 32 bytes long, public key 800 bytes long, ciphertext Length 608 bytes; Security Level 3: Multinomial Dimension Polynomial vector dimension Modulus Key and noise distribution Compression parameters Encapsulation key 32 bytes long, public key 1184 bytes in length, ciphertext 960 bytes in length; For post-quantum cryptography security level 5, this invention provides an extended parameter for a 512-bit key, suitable for scenarios with higher security. The parameter setting is as follows: polynomial dimension. Polynomial vector dimension Modulus Key and noise distribution Compression parameters Encapsulation key 64 bytes long, public key 1568 bytes long, ciphertext Length 1632 bytes.

[0034] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A domestically developed post-quantum key encapsulation method based on lattice, comprising an initialization step, a key generation step, an encryption step, and a decryption step, characterized in that: S1. Initial steps: The terminal and the server preset the encapsulation parameters corresponding to the quantum cryptography security level, and agree on the compression and decompression rules of the ciphertext data. The compression rule adopts a bit shift operation method, and the decompression rule is the reverse operation of the compression rule. S2. Key generation steps: The terminal generates a public key element and a private key through sampling using a seed, and uploads the public key to the server. The public key includes public key element one and seed two, and the private key includes a private key vector. S3. Encryption steps: The server first decompresses the public key using a public key decompression algorithm, then processes the decompressed result using a public key compression algorithm to generate ciphertext elements. Subsequently, the server calculates temporary variable one, and generates ciphertext using an encryption method based on the temporary variable, and then sends the ciphertext to the terminal. S4. Decryption steps: The terminal calculates temporary variable two and combines it with the ciphertext decryption algorithm to decapsulate the key and output the decryption message.

2. The efficient key encapsulation method based on the modular fault-tolerant rounding problem as described in claim 1, characterized in that: The key generation step includes the following sub-steps: S21. Select at least two bit strings as seed one and seed two; S22. Based on the seed, a random source is generated using a cryptographic expansion function, wherein the random source is processed through a polynomial ring. Uniformly distributed sampling in dimensional space generates a polynomial matrix. S23. Based on the seed two, a random source is generated using a cryptographic expansion function, wherein the random source is processed using a discrete Gaussian distribution. Uniform sampling is performed to generate polynomial vector one and polynomial vector two. S24. Perform multiplication and addition calculations based on the polynomial matrix one, polynomial vector one, and polynomial vector two to obtain temporary variable one; S25. Perform a compression operation on the temporary variable to obtain public key element one; S26. Generate output public and private keys, wherein the public key includes public key element one and seed two, and the private key includes polynomial vector one.

3. The efficient key encapsulation method based on the modular fault-tolerant rounding problem as described in claim 1, characterized in that: The encryption step includes the following sub-steps: S31. Input the public key, the message to be encrypted, and the random number; S32. Perform a decompression operation on the public key element in the public key to obtain public key element two; S33. Based on seed 2 in the public key, a random source is generated using a cryptographic expansion function. The random source is then processed through a polynomial ring. Uniform sampling in dimensionality generates a polynomial matrix of two. S34. Based on the random number, a random source is generated using a cryptographic expansion function, and the random source is processed using a discrete Gaussian distribution. Uniform sampling in dimensional space generates polynomial vectors three, four, and five. S35. Calculate using the transpose of polynomial matrix two, polynomial vector three, and polynomial vector four. Perform a compression operation on the calculation result to obtain ciphertext element one. S36. Calculate using the transpose of the public key element two, polynomial vector three, and polynomial vector five to obtain temporary variable two; S37. Perform an encryption algorithm on the temporary variable two to obtain the encrypted element; S38. Output ciphertext, which includes ciphertext element one and encryption element.

4. The domestically developed post-quantum key encapsulation method based on lattice as described in claim 1, characterized in that: The decryption step includes the following sub-steps: S41. Input the private key and the ciphertext; S42. By transposing the private key and combining it with ciphertext element one, decompression is performed to obtain temporary variable three; S43. Decrypt the encrypted element and the temporary variable three to obtain the decryption message.

5. A domestically produced post-quantum key packaging device based on a lattice, characterized in that: The device includes a memory and one or more processors, wherein the memory stores executable code, and the one or more processors execute the executable code to implement the lattice-based domestic post-quantum key encapsulation method according to any one of claims 1-4.

6. A computer-readable storage medium, characterized in that: It stores a program that, when executed by a processor, implements a lattice-based domestic post-quantum key encapsulation method as described in any one of claims 1-5.

Images