Encryption method and system based on computer-aided proof security

Abstract

The invention relates to the technical field of cryptography, and provides an encryption method and system based on computer-aided proof security, and the method comprises the steps: carrying out the parametric modeling of an EGFN structure, constructing a constraint condition based on a differential cryptographic analysis framework, and carrying out the optimization of the constraint condition through an SMT constraint solver; calculating the minimum number of rounds of complete diffusion of all rounds of functions of a certain round of the EGFN structure during encryption inquiry and the minimum number of rounds of complete diffusion of all rounds of functions of a certain round of the EGFN structure during decryption inquiry; constructing a coefficient matrix of the ciphertext output by the EGFN structure about a round function, and calculating the minimum round number when the coefficient matrix of the ciphertext output by the EGFN structure about the round function reaches a full rank during encryption inquiry through a linear algebraic calculation tool; and when the EGFN structure meets the security, encrypting the plaintext through the EGFN structure to obtain a ciphertext. And the encryption speed and security are improved.

Description

Technical Field

[0001] This invention belongs to the field of cryptography, and in particular relates to an encryption method and system based on computer-aided proof of security. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Generalized Feistel Networks (GFNs), as the core structure of block cipher design, can build high-performance encryption schemes through small nonlinear components and have been widely used in the design of internationally renowned block cipher algorithms such as CAST-256, CLEFIA, and LEA. To unify and extend existing GFN structures, Berger et al. proposed Extended GFN based on matrix representation, which decomposes each round structure into round function layers, linear layers, and permutation layers, providing a unified framework for the design of multi-branch generalized Feistel structures.

[0004] However, security analysis of EGFN structures faces significant challenges: for any EGFN structure, manual analysis struggles to quickly determine the minimum number of rounds required to achieve pseudo-random permutation (PRP) and strong pseudo-random permutation (SPRP) security; as the number of branches increases, the complexity of collision event analysis in traditional security proofs grows exponentially, making manual proofs not only inefficient but also highly prone to logical errors. Current technologies can only complete security proofs for 8-branch and 16-branch BMT-type EGFNs, and a universal security analysis tool supporting multiple types and numbers of branches for EGFN structures has not yet been developed, failing to meet the need for efficient security verification in symmetric cryptographic algorithm design.

[0005] Meanwhile, traditional computer-aided proof tools are limited to specific cryptographic algorithm structures, lack the ability to adapt to EGFN structures and their variants, and cannot automate key tasks such as determining the number of secure rounds. Summary of the Invention

[0006] To address the technical problems mentioned above, this invention provides an encryption method and system based on computer-aided proof of security. By using an SMT constraint solver and linear algebra calculation tools, it achieves automated search for the number of secure rounds and automated proof of security, making the design and analysis of EGFN structures more convenient and improving the speed and security of encryption.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides an encryption method based on computer-aided proof of security, comprising: Obtain EGFN structure parameters, perform parameterized modeling of EGFN structure, construct constraints based on differential cryptanalysis framework, and use SMT constraint solver to calculate the minimum number of rounds required for complete diffusion of all round functions of EGFN structure in a certain round during encryption query and the minimum number of rounds required for complete diffusion of all round functions of EGFN structure in a certain round during decryption query. Construct the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function, and use linear algebra calculation tools to calculate the minimum number of rounds required for the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function to reach full rank when encrypting the query. The security of the EGFN structure is determined by the minimum number of rounds required for complete diffusion of all round functions in a given round during an encrypted query, the minimum number of rounds required for complete diffusion of all round functions in a given round during a decrypted query, and the minimum number of rounds required for the coefficient matrix of the ciphertext output by the EGFN structure to reach full rank with respect to the round functions during an encrypted query. When the security is satisfied, the plaintext is encrypted using the EGFN structure to obtain the ciphertext.

[0008] Furthermore, when The wheel EGFN structure meets PRP safety requirements, and When the EGFN structure satisfies SPRP security, the plaintext is encrypted using the EGFN structure to obtain the ciphertext; where, The minimum number of rounds required for all round functions of a given round in the EGFN structure to achieve complete diffusion during encrypted queries. To determine the minimum number of rounds required for complete diffusion of all round functions in a given round of the EGFN structure during decryption queries, The minimum number of rounds required for the coefficient matrix of the round function in the ciphertext output by the EGFN structure to reach full rank during encrypted queries.

[0009] Furthermore, the EGFN structure parameters include the number of branches, branch length, round function layer matrix, linear layer matrix, and permutation layer matrix of the EGFN structure.

[0010] Furthermore, the SMT constraint solver uses... Bit encoding represents the differential state of each branch, and constraints are constructed by combining the differential propagation rules of round functions, copying, and XOR operations.

[0011] Furthermore, the difference states include: zero difference, known non-zero difference, and unknown difference.

[0012] Furthermore, the constraints include: the first... The first round or decryption direction The inputs to any round function cannot maintain zero difference; the connection result of the initial input difference is not zero. A string consisting entirely of zeros; the initial input difference has no unknown differences.

[0013] Furthermore, the coefficient matrix is ​​constructed based on the linear relationship between the ciphertext output by EGFN and the round function instance.

[0014] A second aspect of the present invention provides an encryption system based on computer-aided proof security, comprising: The first round number calculation module is configured to: obtain EGFN structure parameters, perform parameterized modeling of the EGFN structure, construct constraints based on the differential cryptography framework, and calculate the minimum number of rounds required for complete diffusion of all round functions of a certain round of the EGFN structure during encryption query and the minimum number of rounds required for complete diffusion of all round functions of a certain round of the EGFN structure during decryption query using the SMT constraint solver. The second round number calculation module is configured to: construct the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function, and calculate the minimum number of rounds when the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function reaches full rank using a linear algebra calculation tool; The security encryption module is configured to: determine the security of the EGFN structure based on the minimum number of rounds required for complete diffusion of all round functions in a certain round of the EGFN structure during encryption query, the minimum number of rounds required for complete diffusion of all round functions in a certain round of the EGFN structure during decryption query, and the minimum number of rounds required for the coefficient matrix of the ciphertext output by the EGFN structure during encryption query to reach full rank with respect to the round functions; and when the security is satisfied, encrypt the plaintext using the EGFN structure to obtain the ciphertext.

[0015] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the encryption method for computer-aided proof security as described above.

[0016] A fourth aspect of the present invention provides a computer device including a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, wherein the processor executes the program to implement the steps of the encryption method for computer-aided proof security as described above.

[0017] Compared with the prior art, the beneficial effects of the present invention are: This invention uses an SMT constraint solver and linear algebra calculation tools to achieve automated search for the number of secure rounds and automated proof of security, making the design and analysis of EGFN structures more convenient and improving the speed and security of encryption. Attached Figure Description

[0018] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0019] Figure 1 These are the parameters of Embodiment 1 of the present invention. and Search algorithm flowchart; Figure 2 These are the parameters of Embodiment 1 of the present invention. Search algorithm flowchart; Figure 3 This is Embodiment 1 of the present invention. Branched EGFN structure diagram; Figure 4 This is a schematic diagram of the structure of a computer device according to Embodiment 4 of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0021] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0022] Terminology Explanation: EGFN (Extended Generalized Feistel Network): Proposed by Berger et al., this network decomposes each round into round function layers, linear layers, and permutation layers using matrix representation, unifying and extending existing Feistel-like structures. The matrix expression is as follows: .

[0023] PRP (Pseudorandom Permutation): A pseudo-random permutation that satisfies the fact that, under a chosen-plaintext attack, the attacker's advantage in distinguishing this permutation from a random permutation is negligible.

[0024] SPRP (Strong Pseudorandom Permutation): This permutation satisfies the condition that, under chosen-plaintext / ciphertext attacks, the attacker's advantage in distinguishing this permutation from a random permutation is negligible.

[0025] SMT Solver: A tool for solving Satisfiability Modulo Theories, used to verify the satisfiability of logical constraints. Common SMT solvers include STP, Z3, CVC5, Bitwuzla, etc.

[0026] SageMath: An open-source mathematical computing software that provides efficient computing modules in the fields of linear algebra, calculus, number theory, etc., and can be used to calculate parameters .

[0027] Example 1 This example provides an encryption method for computer-aided proof of security.

[0028] As Figure 3 shown, it is the branched EGFN structure. Use EGFN r,dn to represent the EGFN structure of r rounds and d branches (where r > 0 and d ≥ 2). This structure divides the input message into d n-bit groups. The input groups are denoted as (x0,…,x d-1 ), and the corresponding output groups are denoted as (y0,…,y d-1 ). EGFN can be decomposed into three different layers: the round function layer, the linear layer, and the permutation layer.

[0029] If the input branch x i appears effectively in the expression of the output branch y j (0 ≤ i, j < d), then it is said that the input branch x i affects the output branch y j . The EGFN structure contains the following three layers: Round function layer: Composed of a non-linear round function related to the key F . Each F receives the value of a specific branch as input, and its output is XORed with those of other branches; Linear layer: Composed of a series of linear operations, such as COPY and XOR; Permutation layer: Performs a permutation operation on d branches to achieve fast diffusion.

[0030] The characteristics of different EGFN variant structures lie in the instantiation of the round function in the round function layer. This example focuses on the EGFN structure with quasi-involution characteristics (the encryption and decryption processes are almost the same). Such EGFN structures satisfy the following definition: If the coefficients are taken from {0, 1, F, I} and the matrix in Z[F, I] can be represented as = (where, is a permutation matrix, ), and satisfies the following conditions, then is an EGFN matrix: The elements on the main diagonal are all 1; The non - diagonal coefficients are 0, F or I; For each index i, the i - th row and the i - th column (except the diagonal) cannot both contain non - zero coefficients; For each index i, if the i - th row contains I, then it must also contain F .

[0031] This definition covers most of the known GFNs, but does not include the well - known Type - 3 GFN structure - its round function must be executed sequentially, so the Type - 3 GFN structure is not considered in this embodiment. The matrix corresponding to the round function layer is defined by the elements 1 and the symbol F , and its main diagonal elements are all 1. The element at position (i, j) F indicates the existence of a round function: this round function obtains input from the j - th branch, and its output affects the i - th branch (0 ≤ i, j < d), where F is an abstract parameter representing the existence of the round function, and the same F is used for different rounds of the structure.

[0032] The matrix representing the linear layer is defined by the elements 0 and I, and its structure is similar to , but the non - diagonal non - zero elements are the coefficient I instead of F .

[0033] Finally, the matrix corresponding to the permutation layer represents the permutation operation of the branches.

[0034] Therefore, the EGFN can be represented by the matrix = × × , where is a d×d matrix over Z F ,I]. For indices 0 ≤ i, j < d: If the element at position (i, j) in i is 1, then the output y j is directly determined by the input x F and is not affected by the round function ; F If this element is j , then x F needs to be processed by the round functioni ; If the element is 0, then x j For y i No direct impact.

[0035] matrix A complete specification for EGFN is not provided, but it is sufficient to analyze each output branch y. i How (directly or indirectly through the round function F) is affected by all input values ​​(x0, ..., x) d-1 The impact of EGFN on decrypting the corresponding inverse matrix is ​​due to the fact that EGFN is based on invertible permutations constructed from non-invertible round functions. 1 Must not contain F The inverse of, this requirement means det( ) must be independent of F And I, specifically, det( )=±1.

[0036] This embodiment provides an encryption method based on computer-aided proof of security. Using the SMT constraint solver and the SageMath tool, it realizes the automated search for the number of secure rounds of PRP / SPRP in a 4-branch Type-2 GFN structure and the automated proof of PRP / SPRP security.

[0037] This embodiment provides an encryption method based on computer-aided proof of security, the core objective of which is to automate parameter calculation. , , This method determines the minimum number of rounds required for a 4-branch Type-2 GFN to satisfy PRP and SPRP security requirements, addressing the issues of low efficiency and error-proneness in traditional manual proofs. The parameters are as follows. , , Definition: parameter (correspondingly) For the r-wheel EGFN structure, the parameters are... (correspondingly) ) is the minimum number of rounds that satisfies the following condition: the number of rounds in the encryption direction. Wheel (correspondingly decryption direction) In each round (round), each input to the round function is influenced by each input group from the first round, where... .

[0038] parameter Assumption Output It is a linear function of all applied round functions, and can be expressed as: ,in It is by All instances of the round function applied in the round. The vector formed (superscript) Indicates the round number, subscript (Indicates the branch position). Then the parameter... Defined as a matrix The minimum number of rounds required to reach full rank, where It is less than Positive integers.

[0039] This embodiment is based on the round function. The differential propagation rules for operations such as copy (COPY), XOR, etc., are used to construct constraints. (Round function F) Since each round function is instantiated as an independent uniformly random function (URF), it can be modeled as an S-box with the following difference properties: Let and Let these represent the input and output differences, respectively. If and only if ;otherwise .

[0040] (Copy operation) Let The input difference is represented as and the output difference is denoted as . and Then the relationship between them is: .

[0041] (XOR operation) Let and For input difference, To output the difference. The XOR operation produces... The rules are as follows: (1) If an input difference is divided into ,but It equals the other input difference; (2) If the difference between the two inputs is both ,but for or ; (3) For all other cases, .

[0042] This embodiment constructs constraints based on the characteristics of the input difference and the output difference: (Complete diffusion constraint) for All inputs to the round-of-rounds function (Right now The result of its bitwise AND operation must be equal to... ; (Non-zero input difference) Concatenated input difference Must not equal (Depend on (a string consisting of zeros) (Attacker-controllable constraints) For each Input difference Must not equal .

[0043] This embodiment provides an encryption method based on computer-aided proof of security, the core of which is to calculate parameters using an SMT constraint solver. and Calculated using linear algebra tools such as SageMath .

[0044] In this embodiment, the parameters of the EGFN structure are as follows, and all parameters conform to the classic definition of Type-2 GFN and the representation specification of EGFN matrix: Structure type: Type-2 GFN; Branching parameters: number of branches ; Round function layer: Each round contains There are 3 independent round functions, and each round function is instantiated using a uniformly random function (URF), denoted as . and (superscript) Representing the wheel), The input is the first The branch whose output value is the same as the first branch. Perform an XOR operation on the branch; The input is the first The branch whose output value is the same as the first branch. Perform an XOR operation on the branch; Linear layer: Contains linear operations such as COPY and XOR; Permutation layer: Employs a 4-branch cyclic shift permutation, its matrix representation is as follows: ; that is, the input branch Replacement Later became ; EGFN matrix: linear layer matrix identity matrix The round function layer matrix is: ; Therefore, according to The matrix corresponding to Type-2 GFN is: .

[0045] Security objective: Calculate the number of PRP / SPRP security rounds for Type-2 GFN.

[0046] This embodiment provides an encryption method based on computer-aided proof of security, comprising the following steps: Step 1: Receive EGFN structure parameters.

[0047] Among them, the structural parameters include the number of branches. Branch length The round function layer matrix, linear layer matrix, and permutation layer matrix of the EGFN structure.

[0048] Step 2: Perform parametric modeling of the EGFN structure, construct constraints based on the differential cryptanalysis framework, and calculate parameters using the SMT constraint solver. and .

[0049] In step 2, the SMT constraint solver can be tools such as STP, Z3, CVC5, and Bitwuzla. Bit encoding represents the differential state of each branch ( For zero difference, For known non-zero differences, (For unknown differences), construct constraints by combining the difference propagation rules of round functions, copying, XOR and other operations.

[0050] (1) Specifically, for parameters calculate: (101) Defined as: the first direction of encryption The minimum number of rounds in which all round functions are affected by all initial input values ​​is calculated based on a differential cryptanalysis framework and implemented using SMT solvers such as STP or Z3.

[0051] (102) Differential state encoding: The differential state of each branch is represented by a 2-bit binary code: : Zero difference (the input groups for the two queries are exactly the same); : Known non-zero difference (the difference is known and can be controlled by an attacker); : Unknown difference (the difference is unknown and cannot be controlled by the attacker).

[0052] (103) Definition of differential propagation rules for each component of the Type-2 GFN structure: Round function When the input difference is #b00, the output difference is #b00; when the input difference is #b01 or #b11, the output difference is #b11. COPY operation: The output difference is exactly the same as the input difference, that is... ; XOR operation: If one input difference is #b00, the output difference is equal to the other input difference; if both input differences are #b01, the output difference is #b00 or #b01; otherwise, the output difference is #b11.

[0053] (104) Constraint Construction: Constraint 1 (Complete Diffusion Constraint): The first The bitwise AND of the differences of all round function inputs is #b00, meaning that no round function inputs maintain zero difference; Constraint 2 (Non-zero input difference): Connection result of initial input difference ||…|| Not #b00000000 (an 8-bit string of all zeros); Constraint 3 (Attacker-Controllable Constraint): Initial input score is zero (#b11), i.e. ∈{#b00,#b01}(0≤i<4).

[0054] (105) Search algorithm: Specific search algorithms, such as Figure 1 As shown.

[0055] when When the solver outputs "unsat" (unsatisfiable), it indicates that there is no difference propagation path that satisfies the constraints, i.e., the two round functions of the fourth round. and The inputs are all affected by the initial four input groups, and the final result is determined. .

[0056] (2) Specifically, for parameters calculate: Definition and Symmetry, the minimum number of rounds required for complete diffusion of all round functions in a given round in the decryption direction: Search algorithm: Specific search algorithms, such as Figure 1 As shown.

[0057] Solution results: The Z3 solver in Output "unsat" to confirm. .

[0058] (3) such as Figure 1 As shown, parameters and The search algorithms include: Input: number of branches d, query direction u, index set τ; Output: The parameter r' that satisfies the constraint; when the query direction u=+1, the output value r'= ; When the query direction u = -1, the output value r' = ; (301) Initialization: Set r to 0 and flag to 1; (302) If flag = 1, then perform the following operations: Increment the value of r by 1; For each i (0 ≤ i < d), declare 2-bit input differential variables and output differential variables , with the value range restricted to {#b00, #b01, #b11}; Model the EGFN structure. When the input difference is ([[]] , …, ), calculate the output difference ([[]] , …, ) after the input difference passes through r rounds of the EGFN structure, that is, ([[]] , …, ) = ( , …, ); Declare a 2-bit variable x and initialize it to #b11; For each i in the index set τ, perform a bitwise AND operation, that is, x = x & ;​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​

[0061] Defined as: the EGFN output vector ( is the coefficient matrix of the round function instance vector) M The minimum number of rounds for which the rank is full.

[0062] Can be determined by tools such as SageMath = 2: When r = 2, the matrix has full rank and meets the definition requirements. The specific search algorithm is as Figure 2 shown.

[0063] As Figure 2 shown,[[]] the search algorithm of Input: branch number d; Output: parameters that meet the conditions , which is ; (1) Initialization: Set r to 0 and rk to 0; (2) If rk ≠ d, then perform the following operations: Let the value of r increase by 1, the value of Φ ; Use SageMath to declare variables( ,…, ); For each i (0 ≤ i < r), use SageMath to declare variables( ,…, ), and add( ,…, ) to the set ; Use SageMath to model the EGFN structure. When the input is( ,…, ), calculate the output( ,…, ) after the input passes through the r-round EGFN structure, that is,( ,…, ) = ( ,…, );<0​​​​​​​​​​​​​rank(rk=rank( M ); (3) Output the result. When rk=d (full rank of the matrix), return the current r.

[0064] Step 4: Based on parameters , , Determining the safety of EGFN structures: The wheel EGFN structure meets PRP safety requirements. The wheel EGFN structure satisfies SPRP security, and the proof results are output.

[0065] According to the determination rules of this embodiment: PRP safety rounds: The five-wheel, four-branch Type-2 GFN meets PRP security requirements. SPRP safety rounds: The 8-wheel, 4-branch Type-2 GFN satisfies SPRP security.

[0066] Step 5: Based on the number of rounds that satisfy both PRP and SPRP security, encrypt the plaintext using the EGFN structure to obtain the ciphertext.

[0067] It should be noted that, in conjunction with the following properties, the parameters and The search algorithm sets the direction flags u=+1 (in the encrypted scenario, to obtain r1) and u= 1. (Decrypt the scenario and obtain r3) to calculate r1 and r3.

[0068] (A) Correctness verification.

[0069] Compare the results of this embodiment with existing manual verification results: Existing research (Zheng et al., CRYPTO 1989) has demonstrated that the PRP safety rounds for a 4-branch Type-2 GFN are 5 rounds, which is consistent with the present embodiment. Consistent; Existing research (Moriai et al., ASIACRYPT 2000) demonstrates that the SPRP safety rounds for a 4-branch Type-2 GFN are 8 rounds, which is consistent with this embodiment. Consistent; The safety boundary is consistent with theoretical expectations, verifying the correctness of the method.

[0070] (B) Efficiency analysis.

[0071] The time taken for parameter calculation and security verification in this embodiment under the hardware environment (Intel Core i7-12700 CPU, 16GB DDR4 memory) is as follows: Calculation: Z3 solver took 0.35 seconds; Calculation: SageMath tool took 0.12 seconds; Calculation: Z3 solver took 0.33 seconds; Total time: approximately 0.85 seconds, a significant improvement in efficiency compared to manual verification (which takes several days to weeks for similar structures).

[0072] This embodiment completes the PRP / SPRP security proof of a 4-branch Type-2 GFN using a computer-aided proof method that extends the generalized Feistel network structure. The 5-wheel, 4-branch Type-2 GFN meets PRP security requirements, and the 8-wheel type meets SPRP security requirements. The security bound of PRP / SPRP is dominated by the number of queries q by the attacker and the bit degree n of each branch of the structure, and the security strength is sufficient in practical applications; The method is highly automated, with computational efficiency far exceeding that of manual verification, and the results have been verified by classical studies, ensuring their correctness.

[0073] This embodiment fully demonstrates the adaptability of the present invention to EGFN and its variant structures. Its core process can be directly migrated to other branch numbers and other types of EGFN structures (such as Type-1 GFN, BMT's EGFN, etc.), providing an efficient and reliable solution for security analysis of block ciphers.

[0074] Example 2 This embodiment provides an encryption system based on computer-aided proof security, comprising: The first round number calculation module is configured to: obtain EGFN structure parameters, perform parameterized modeling of the EGFN structure, construct constraints based on the differential cryptography framework, and calculate the minimum number of rounds required for complete diffusion of all round functions of a certain round of the EGFN structure during encryption query and the minimum number of rounds required for complete diffusion of all round functions of a certain round of the EGFN structure during decryption query using the SMT constraint solver. The second round number calculation module is configured to: construct the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function, and calculate the minimum number of rounds when the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function reaches full rank using a linear algebra calculation tool; The security encryption module is configured to: determine the security of the EGFN structure based on the minimum number of rounds required for complete diffusion of all round functions in a certain round of the EGFN structure during encryption query, the minimum number of rounds required for complete diffusion of all round functions in a certain round of the EGFN structure during decryption query, and the minimum number of rounds required for the coefficient matrix of the ciphertext output by the EGFN structure during encryption query to reach full rank with respect to the round functions; and when the security is satisfied, encrypt the plaintext using the EGFN structure to obtain the ciphertext.

[0075] It should be noted that each module in this embodiment corresponds one-to-one with each step in Embodiment 1, and their specific implementation processes are the same, so they will not be repeated here.

[0076] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of an encryption method based on computer-aided proof security as described in Embodiment 1 above.

[0077] Example 4 This embodiment provides a computer device, such as... Figure 4 As shown, the system includes a computer-readable storage medium 1003, a processor 1001, a communication interface 1002, and a computer program stored on the computer-readable storage medium 1003 and executable on the processor 1001. The processor 1001, communication interface 1002, and computer-readable storage medium 1003 can be connected via a bus or other means. The communication interface 1002 is used to receive and send data. When the processor 1001 executes the program, it implements the steps of the encryption method based on computer-aided proof security as described in Embodiment 1 above.

[0078] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An encryption method based on computer-aided proof of security, characterized in that, include: Obtain EGFN structure parameters, perform parameterized modeling of EGFN structure, construct constraints based on differential cryptanalysis framework, and use SMT constraint solver to calculate the minimum number of rounds required for complete diffusion of all round functions of EGFN structure in a certain round during encryption query and the minimum number of rounds required for complete diffusion of all round functions of EGFN structure in a certain round during decryption query. Construct the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function, and use linear algebra calculation tools to calculate the minimum number of rounds required for the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function to reach full rank when encrypting the query. The security of the EGFN structure is determined by the minimum number of rounds required for complete diffusion of all round functions in a given round during an encrypted query, the minimum number of rounds required for complete diffusion of all round functions in a given round during a decrypted query, and the minimum number of rounds required for the coefficient matrix of the ciphertext output by the EGFN structure to reach full rank with respect to the round functions during an encrypted query. When the security is satisfied, the plaintext is encrypted using the EGFN structure to obtain the ciphertext.

2. The encryption method based on computer-aided proof security as described in claim 1, characterized in that, when The wheel EGFN structure meets PRP safety requirements, and When the EGFN structure satisfies SPRP security, the plaintext is encrypted using the EGFN structure to obtain the ciphertext; where, The minimum number of rounds required for all round functions of a given round in the EGFN structure to achieve complete diffusion during encrypted queries. To determine the minimum number of rounds required for complete diffusion of all round functions in a given round of the EGFN structure during decryption queries, The minimum number of rounds required for the coefficient matrix of the round function in the ciphertext output by the EGFN structure to reach full rank during encrypted queries.

3. The encryption method based on computer-aided proof security as described in claim 1, characterized in that, The EGFN structure parameters include the number of branches, branch length, round function layer matrix, linear layer matrix, and permutation layer matrix of the EGFN structure.

4. The encryption method based on computer-aided proof security as described in claim 1, characterized in that, The SMT constraint solver, through Bit encoding represents the differential state of each branch, and constraints are constructed by combining the differential propagation rules of round functions, copying, and XOR operations.

5. The encryption method based on computer-aided proof security as described in claim 1, characterized in that, The difference states include: zero difference, known non-zero difference, and unknown difference.

6. The encryption method based on computer-aided proof security as described in claim 1, characterized in that, The constraints include: the first [unclear] direction of EGFN structure encryption. The first round or decryption direction The inputs to any round function cannot maintain zero difference; the connection result of the initial input difference is not zero. A string consisting entirely of zeros; the initial input difference has no unknown differences.

7. The encryption method based on computer-aided proof security as described in claim 1, characterized in that, The coefficient matrix is ​​constructed based on the linear relationship between the ciphertext output by EGFN and the round function instance.

8. An encryption system based on computer-aided proof security, characterized in that, include: The first round number calculation module is configured to: obtain EGFN structure parameters, perform parameterized modeling of the EGFN structure, construct constraints based on the differential cryptography framework, and calculate the minimum number of rounds required for complete diffusion of all round functions of a certain round of the EGFN structure during encryption query and the minimum number of rounds required for complete diffusion of all round functions of a certain round of the EGFN structure during decryption query using the SMT constraint solver. The second round number calculation module is configured to: construct the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function, and calculate the minimum number of rounds when the coefficient matrix of the ciphertext output by the EGFN structure with respect to the round function reaches full rank using a linear algebra calculation tool; The security encryption module is configured to: determine the security of the EGFN structure based on the minimum number of rounds required for complete diffusion of all round functions in a certain round of the EGFN structure during encryption query, the minimum number of rounds required for complete diffusion of all round functions in a certain round of the EGFN structure during decryption query, and the minimum number of rounds required for the coefficient matrix of the ciphertext output by the EGFN structure during encryption query to reach full rank with respect to the round functions; and when the security is satisfied, encrypt the plaintext using the EGFN structure to obtain the ciphertext.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the encryption method based on computer-aided proof security as described in any one of claims 1-7.

10. A computer device comprising a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the encryption method based on computer-aided proof of security as described in any one of claims 1-7.

Images