Key rotation: lightweight precaution against physical attacks against FALCON

Abstract

The invention provides a method for improving the resistance of signature generation to physical attacks. The method comprises the following steps: obtaining a message to be signed; obtaining a key transformation parameter; obtaining a secret key, wherein the secret key is orthogonal to the public key; transforming the secret key based on the key transformation parameter to generate a transformed secret key, wherein the transformation maintains orthogonality of the secret key and the public key; the cryptographic signature of the obtained message is generated based on the transformed secret key.

Description

Technical Field

[0001] This invention relates to a method and a system. Specifically (but not exclusively), this invention relates to a computer-implemented method for generating cryptographic signatures for messages. Background Technology

[0002] Digital signatures are an increasingly popular method for providing a secure association between the signer and the data. Several digital signature schemes have been proposed in this field, and some vulnerabilities associated with these schemes are physical attacks, such as side-channel attacks and activity failure attacks.

[0003] Mitigation methods for these attacks typically introduce significant performance overhead, particularly in schemes such as FALCON (Fast Fourier Base Compact Signature on NTRU)[1]. These performance overheads can be problematic in computing devices, especially embedded or mobile computing devices with limited computing resources.

[0004] The foregoing content is taken into account in conceiving the various aspects and implementation methods. Summary of the Invention

[0005] Various aspects are involved in the generation of digital signatures, such as cryptographic signatures used to provide security around data content. These aspects can be used as part of the FALCON signature generation method.

[0006] From a first perspective, a computer-implemented method for generating a cryptographic signature of a message can be provided. The cryptographic signature may include data that can be used to verify the content of the message. The message may include content and a request for a signature to be generated for the content. The content may include an alphanumeric sequence. The method may be implemented by a processing resource. The processing resource may be hardware or software implemented. The processing resource may include one or more processing components providing processing capabilities. The processing resource may be a secure computing resource. The processing resource may be contained within a trusted execution environment. The trusted execution environment may be contained within an embedded computing device. The processing resource may be an embedded computing device. The method may include obtaining the message to be signed. The message may be provided as part of a request for a signature to be generated and may include content as the object of the signature. The method may include obtaining key transformation parameters. The key transformation parameters may be generated deterministically or randomly. In the deterministic case, the key transformation parameters may be any odd positive integer. In the random case, the key transformation parameters may be any positive integer. The method may include obtaining a secret key, wherein the secret key is orthogonal to the public key. The secret key may be defined in the real domain or the Fourier domain. The secret key may be described as a private key. The secret key can be obtained from storage devices local to the computing resource or from storage devices remote from the computing resource. The secret key can also be obtained from computing devices external to the processing resource. Obtaining the secret key can include using the processing resource to generate the secret key. The processing resource can include secure computing elements configured to generate the secret key. Orthogonality can be defined by the product of the secret key and the public key modulo q being equal to zero, where q is an integer to be selected by the user or fixed by a selected signature generation scheme. The method can include transforming the secret key based on key transformation parameters to generate a transformed secret key, wherein the transformation maintains the orthogonality of the secret key and the public key. That is, the transformation must maintain the orthogonality of the secret key relative to the public key. An example transformation is applying a variable raised to a certain exponent, wherein the exponent is equal to the key transformation parameters. The method may further include generating a cryptographic signature of the obtained message based on the transformed secret key.

[0007] One approach based on the first aspect improves the robustness of the signature generation process against side-channel and fault attacks because it makes it difficult to guess the secret key used to generate the signature based solely on physical measurements.

[0008] Cryptographic signatures can be transmitted to the entity requesting the signature. The cryptographic signature can be transmitted to the entity requesting the signature by processing resources. The transmission may include a signature dataset, which includes a salt, a message, and the generated cryptographic signature.

[0009] Optionally, the secret key can be defined by polynomials f, g, G, and F, where f, g, G, and F satisfy the NTRU equation. The NTRU equation is defined in the FALCON standard as follows: Let f, g, G, and F be polynomials, and f is... If f, g, G, and F are invertible elements, then f, g, G, and F must satisfy the following relationship.

[0010] .

[0011] Where q is a prime number (it can be an integer defined within a signature generation scheme such as FALCON), and .

[0012] A prime number q can be user-defined according to the method in the first aspect. The power n = 2. κ , where κ is an integer.

[0013] Alternatively, It can be any cyclotomic polynomial, i.e. A polynomial of the form , where Let m be the set of primitive roots of unity of integer m.

[0014] Generating the secret key may involve randomly generating f and g, and then solving the NTRU equation to determine F and G that provide the solution to the NTRU equation.

[0015] Polynomials f, g, F, and G can be stored by processing resources or by resources that can be accessed by processing resources.

[0016] In practice, The root can be hardcoded into processing resources for use by any processor that is computing the signature.

[0017] Optionally, the transformation of the secret key may include:

[0018] Rotation is applied to both the secret key and the public key, where the rotation is based on key transformation parameters;

[0019] Obtain the binary tree and its root;

[0020] Apply rotations to the root of the binary tree to generate a rotated binary tree, and

[0021] Provide a rotated binary tree and a rotated secret key as a transformed secret key.

[0022] A Falcon tree can be defined as follows:

[0023] A Falcon tree is a binary tree of height m, where the root node contains Q[x] / (x). n The polynomial in +1), where n=2 κThe left and right children of the root are Falcon trees of height m-1.

[0024] Optionally, the application of rotation may include multiplying the secret key and public key by a factor raised to a certain exponent, where the exponent is equal to the key transformation parameter.

[0025] Optionally, the secret key and / or public key can be in the Fourier domain.

[0026] Alternatively, the message may be received by processing resources or obtained from a storage device.

[0027] Optionally, the public key and secret key are defined by polynomials. Alternatively, the public key and secret key can be defined by a vector of polynomial coefficients.

[0028] Alternatively, at least one of the polynomials is a ring. The elements, among which It is an integer ring modulo q.

[0029] Alternatively, the secret key can be defined by a matrix:

[0030]

[0031] Where g, f, F, and G are fields. The set of real-valued polynomials in the set of polynomials, where Z is an integer ring and satisfies the NTRU equation described above. .

[0032] Alternatively, the public key can be defined by a matrix:

[0033]

[0034] Where h is The polynomial in the text.

[0035] Optionally, the cryptographic signature of the message generated based on the transformed secret key includes one or more of the following:

[0036] Obtain the transformed secret key;

[0037] Generate random seed parameters;

[0038] Generate hash parameters, wherein the hash parameters are generated based on a random seed parameter and the message.

[0039] Generate a pre-image of the hash parameters;

[0040] Pre-image generation bit string based on hash parameters; or

[0041] Provide the cryptographic signature as a bit string and a random seed parameter.

[0042] It may also provide a non-transitory computer-readable storage medium, system, and processing resources configured to provide the method according to the first aspect. Attached Figure Description

[0043] The embodiments will now be described by way of example only and with reference to the following figures, in which:

[0044] Figure 1 The document illustrates a series of steps for generating an implementation signature according to an embodiment;

[0045] Figure 2 This illustrates processing resources that can be used to implement signature generation according to an embodiment; and

[0046] Figure 3 A series of steps, according to an embodiment, can be used to generate a signature. Detailed Implementation

[0047] We now refer to Figure 1 , 2 Sections 2 and 3 describe how processing resource 200 can be used to generate cryptographic signatures. The FALCON signature generation scheme is used as an example of a signature generation method that can be enhanced by using the described processing resource 200, but this should be considered merely as an illustrative example and not as limiting.

[0048] Processing resource 200 can be implemented using any appropriately configured processing element (e.g., processor, registers, etc.) and can be implemented in hardware or software. Processing resource 200 can be implemented in the cloud. Processing resource 200 includes message interface 202, signature generation module 204, and signature transmission interface 206. Message interface 202, signature generation module 204, and signature transmission interface 206 can be located in the same location or can be remotely distributed relative to each other.

[0049] Data can be transmitted between the corresponding message interface 202, signature generation module 204 and signature transmission interface 206 using any suitable data transmission protocol or medium.

[0050] Processing resource 200 may be implemented within or as part of a Trusted Execution Environment (TEE) and / or within an embedded device. Each of message interface 202, signature generation module 204, and signature transmission interface 208 may be configured to access any desired data or files from local storage or from storage located in the cloud or on hardware remotely positioned relative to processing resource 200. Alternatively, or optionally, signature generation module 204 may be a separate component as part of processing resource 200 and configured to communicate with remotely positioned message interface 202 and remotely positioned signature transmission interface 206.

[0051] In step S100, message interface 202 receives a message from an entity outside processing resource 200 and a request for a cryptographic signature associated with the message to be generated. The request may originate from a computing device hosting processing resource 200 or communicating with processing resource 200. The message may include an alphanumeric sequence requiring a cryptographic signature. The message may include a file containing content to be verified based on the cryptographic signature.

[0052] In step S102, message interface 202 processes the message to extract the content that will form the basis of the cryptographic signature. We list this content as m for later use in this specification.

[0053] In step S104, message interface 202 transmits content m along with a request for the cryptographic signature to be generated to signature generation module 204.

[0054] In step S106, the content m, together with the request provided in step S104, is received by the signature generation module 204.

[0055] In step S108, the key transformation parameter k is obtained by the signature generation module 204. The key transformation parameter can be obtained from a local or remote storage device. The signature generation module 204 can be configured to generate the key transformation parameter using a deterministic or random (also referred to as random) process. The signature generation module 204 can be configured to use both modes interchangeably, namely deterministic and random key transformation parameter generation, as it can switch between the two modes in response to instructions from the user or even without instructions from the user.

[0056] In a deterministic scenario, the key transformation parameter is selected sequentially from the set of odd-positive integers. That is, the first time, the key transformation parameter is 1, the second time it is 3, and so on. A flag in the storage device can be used to determine the position in the sequence of odd-positive integers, the flag indicating that the previous odd-positive integer was 3 (therefore the next should be 5), and so on. When applying the key transformation parameter to both the secret and public keys, as described below, this means traversing the entire space of odd-positive integers without requiring a source of randomness.

[0057] In the case of randomness, key transformation parameters are randomly selected from a set of positive integers. Random generation can be based on a random integer generator that identifies which odd positive integer to use. Flags can store previous key transformation parameters and are used to ensure that the same odd positive integer is not used in successive instances.

[0058] In step S110, the signature generation module 204 obtains the secret key from the storage device. Using FALCON as an example, the secret key is a matrix (T). And the FALCON tree definition.

[0059] matrix The definition is as follows:

[0060]

[0061] in and It is the Fourier transform of polynomials g, f, G, and F. It is meaningful to consider the generation of the transformed secret key in the Fourier domain because many of the computations surrounding the generation of the Falcon signature are performed in the Fourier domain.

[0062] Alternatively, or additionally, the signature generation module 204 can generate g, f, G, and F. If a completely new secret key (and corresponding public key) needs to be generated before the transformation operation applied by the signature generation module 204, then the signature generation module 204 can generate g, f, G, and F.

[0063] In this case, the routine NTRUSolve (described in the FALCON specification) can be deployed. Polynomials f and g can be generated by generating a set of random coefficients, and polynomials F and G can be obtained recursively. Alternatively, It is also stated in the FALCON specification that it can be used to generate f, g, F, and G, among which It is a univariate polynomial (e.g., (as described below), and q is the modulus.

[0064] Then the Fourier transforms of f, g, G, and F can be obtained, and the Fourier transforms can be applied to produce the Fourier transforms of the corresponding polynomials. This will give... That is, the Fourier transform of matrix B.

[0065] We can define the Fourier transform (FFT) of a polynomial p using the following equation:

[0066] ,in ,

[0067] In addition, the polynomial f, as an element of a ring, must be invertible:

[0068]

[0069] in It is a polynomial ring with coefficients modulo q (where q is a prime number, for example, equal to 12289).

[0070] matrix Then it can be determined by the signature generation module 204 as follows:

[0071]

[0072] Where k is the key transformation parameter. Matrix That is, corresponding to the transformed secret key (where the transformation is, for example, using a key derived from...). The application of rotation to the defined factor (where k is the key transformation parameter) is the Fourier transform of the matrix:

[0073]

[0074] Since f is a polynomial, the Fourier transform provides the following representation:

[0075] .

[0076] In other words, a k-based transform can be applied in the Fourier or real domain to create a transformed secret key B' (or its Fourier equivalent).

[0077] More generally, f, G, g, and F also satisfy the equation

[0078]

[0079] Where q is a prime number, and ,in .

[0080] In summary, matrix B can be obtained from a storage device (in real-domain or Fourier representation), and then a transformation can be applied by signature generation module 204 to provide a transformed matrix (in real-domain or Fourier domain).

[0081] Alternatively, or otherwise, the Fourier transforms of the corresponding polynomials f, g, F, and G are computed, and the key transformation parameters are used as Fourier variables as described above. The index to achieve the matrix (or equivalently, as the exponent of x in the real field).

[0082] In other words, the signature generation module 204 uses the key transformation parameter k to determine the transformed secret key matrix.

[0083] The Falcon tree T can be obtained using the ffLDL* routines stated in the Falcon standard. This is shown in Algorithm 1 below. The Falcon tree T computed using Algorithm 1 below is an example of a binary tree. Although we are discussing based on the Falcon tree T, it should be understood that this is merely an example, and the transformation can be applied to other binary trees. The root node of the Falcon tree contains Q[x] / from the FFT representation. polynomial

[0084]

[0085] The computation of the Falcon tree T performed by the signature generation module 204 using Algorithm 1 requires matrix G as input, where G is defined as follows:

[0086] ,

[0087] matrix yes The complex conjugate matrix of the components.

[0088] The output provides a Falcon tree T, which can be used as part of the secret key. The signature generation module 204 then applies the key transformation parameter k to the root node of the Falcon tree T (only) to provide T', i.e., the transformed Falcon tree. This is lines 6 and 7 of the routine described below, as part of the KeyRandomizer routine (which provides guiding pseudocode for generating the transformed secret key).

[0089]

[0090] matrix The transformed Falcon tree T' is then provided as output as the transformed secret key (sk'). This is step S112. Multiply by a factor It is described as applying a rotation of the tree root node in the Fourier domain using a key transformation factor k. In the real domain, it would simply correspond to p multiplied by k.

[0091] In step S114, the signature generation module 104 can use the transformed secret key to generate a signature for the content m, which we will now refer to. Figure 3 This is described in detail. The signature generation module is also summarized by the image of Algorithm 3 below.

[0092] In step S300, content m is retrieved from the memory or storage device, and the transformed secret key provided in step S112 is also retrieved from the memory or storage device (which may be a local storage device or a remote storage device). A finite constant β is also retrieved from the memory or storage device.

[0093] In step S302, a random salt r is obtained using a sample size (n=320) and a uniform distribution between 0 and 1.

[0094] In step S304, the hash value is calculated using the concatenation of a random salt and content m (i.e., the content to be signed) using the following equation:

[0095]

[0096] in And n is a positive non-zero natural number. This routine (i.e., HashtoPoint) is defined in the Falcon standard. Depending on the security level, the positive non-zero natural number n can be equal to 512 or 1024.

[0097] In step S306, the preimage t (of c) is computed using the Fast Fourier Transforms of c and q, the Fast Fourier Transform of polynomial F' (i.e., the rotated version of F), and the Fast Fourier Transform of polynomial f' (i.e., the rotated version of f) defined in the first and third rows of Algorithm 2 above, respectively.

[0098] In step S308, the preimage t, together with the transformed Falcon tree T', is used as input to the Fast Fourier Transform Sampling Algorithm (assigned to the value z) to return the Fourier Transform s (based on the preimage t, the result of the Fast Fourier Transform Sampling Algorithm (i.e., z), and the matrix). When the absolute square of s is greater than When the base value is reached, this sampling is repeated. The output s is then used as input to the inverse fast Fourier transform (invFFT) to return two polynomials s1 and s2, which are... The polynomial in the text.

[0099] In step S310, s2 is compressed into a bit string s.

[0100] Repeat steps S308 and S310 until s is not empty. That is, it is possible... Not suitable for compression. This means that the compression in step S310 will produce a null value, and s will not be assigned a value; that is, it will be empty. In other words, repeat steps S308 and S310 until a suitable value for s2 is provided to the compression operation in step S310. If the coefficients are too large, the polynomial s2 may not be suitable for compression. This will cause the compressed representation to become longer than the maximum length specified for encoding and return an empty output.

[0101] After completing the iterations of steps S308 and S310, the signature of the content m is returned as a vector of components r and s. This is step S312.

[0102] Then, the signature generation module 204 provides a signature for the content m as output. That is, the signature is generated using the transformed secret key generated in step S112.

[0103] In step S314, the signature (as vectors r and s) can be provided to the entity that requested the signature in step S100. The content (or more broadly, the message) can also be provided along with the signature. This may mean that the signature transmission interface 206 obtains the signature output by the signature generation module 204 and sends it to the entity that requested it using any suitable transmission protocol or medium. This entity can be another component in the computing device hosting the processing resource 200.

[0104]

[0105] We can use the following numerical example to illustrate the impact of using steps S300 to S314. If we consider the original versions of f, g, F, and G below (as quartic polynomials):

[0106] ,

[0107] ,

[0108] ,

[0109] .

[0110] If we set the key transformation parameter k=1, then we can obtain the following rotated versions of f, g, F, and G using the rotation operations described below:

[0111] ,

[0112] ,

[0113] ,

[0114] .

[0115] We can generate the salt r by using the message m=b'HelloWorld!':

[0116] ,

[0117] We can generate random seeds ( Then the message is hashed to a point to provide:

[0118]

[0119] Then, the signature based on the original value and the rotated value is:

[0120] ,

[0121]

[0122] In other words, the signatures are different from each other; that is, even when k=1, the application of the key transformation operation generates different signatures.

[0123] This signature can be verified using a public key:

[0124] ,

[0125] More generally, the transformation of the secret key needs to maintain the relationship between the secret key and the public key. The application of the above transformation using the key transformation parameter k does indeed maintain the relationship between the secret key and the public key. We will now explain why this relationship is maintained between the transformed secret key and the public key.

[0126] First, we remind ourselves to use matrix B to define the secret key:

[0127]

[0128] Polynomials f, g, F, G ∈ R, among other properties, satisfy the following:

[0129] ●f as R q The elements are reversible.

[0130] ● All four polynomials satisfy the NTRU equation: .

[0131] The public key is a single polynomial h ∈ R q It is calculated as Since f needs to be invertible, h is always well-defined. Depending on the context, the public key can also be written as a matrix:

[0132]

[0133] Where 1 represents a constant polynomial, and where:

[0134]

[0135] in [x] is a polynomial ring (with integer coefficients) modulo q (where q is a prime number), and:

[0136]

[0137] Consideration factors In this application, where k is the key transformation parameter, for the secret key B, we obtain the rotated secret key B':

[0138]

[0139] factor The application can be described as applying a rotation with an exponent k (i.e., the key transformation parameter), and this is an example of a key transformation that can be applied to a secret key using the key transformation parameter k.

[0140] B' is The real-domain version of A (i.e., the inverse Fourier transform) and therefore the verifiability of B' can be shown without considering the Fourier transform of A.

[0141] According to the Falcon standard, signature verification relies on the fact that the secret key and the public key are orthogonal in the sense that the product of B and A modulo q is zero. We can check that, in fact, B′ satisfies the same relation:

[0142] .

[0143] The upper entry can be easily parsed as Since the NTRU equation, the lower entry is equal to q. In any case, the final result is (0,0) modulo q. Therefore, the signature generated with the rotated secret key can be verified using the original public key. Even if the Fourier transform of B' is provided, the inverse fast Fourier transform can be used to return B' (i.e., in the real domain), and the above equation can be verified due to the uniqueness of the Fourier transform.

[0144] Verification of the signature generated in step S312 can be performed using the content of the signature generation (which we more generally describe as the message above), the signature generated in step S312 (i.e., components r and s), the public key A corresponding to the transformed secret key B', and the boundary constant β. The parameter β needs to be equal to the parameter β used in signature generation. That is, the entity generating the signature and the verifier need to agree on the value of β. The value of β is set in the FALCON specification, but different values ​​can be used.

[0145] First, the value c is recalculated based on the concatenation of r with the message (i.e., the content that generates the signature), the value q, and the polynomial degree n (calculated in step S304).

[0146] Secondly, s is decoded (decompressed) into a polynomial. As defined in the Falcon standard.

[0147] Third, determine the value .

[0148] if If the signature is valid, it is accepted and verified. Otherwise, it is rejected.

[0149] In summary, a transformable secret key is used to generate a verifiable signature. The example above illustrates that, assuming the transformation maintains the orthogonality between the transformed secret key and the original public key (i.e., the public key corresponding to the original secret key), the transformed secret key can still be used to generate a signature that can be verified using the same public key A. This applies regardless of whether the secret key is provided in the real domain or the Fourier domain.

[0150] In the example described for FALCON signature generation, an alternative secret key is generated by applying a transformation (e.g., rotation) to the secret key using key transformation parameters to generate a transformed secret key. This transformed secret key is then used to generate a signature for the provided content. The transformation is chosen such that the algebraic relationship (e.g., orthogonality) between the transformed secret key and the public key is maintained. This means that transformations applied to the secret key do not alter its relationship to the public key. In other words, each transformed secret key retains the same public key. This increases FALCON's resistance to physical attacks while introducing negligible overhead only in terms of runtime, randomness, and memory.

[0151] Generating cryptographic signatures in the manner described offers benefits in resisting side-channel and fault-based attacks.

[0152] Resistance to side-channel attacks is enhanced as the variation provided by changing the key through the key transformation parameter increases during the signature generation process, because the variation results in generating entirely different sample values ​​(see the numerical example above). If the key transformation parameter k is randomly generated, the randomness increases as the signature generation process continues. Specifically, regarding side-channel attacks, an adversary performs physical measurements depending on the secret key. They can then apply statistical analysis to retrieve the secret key. Since we do not fix the secret key, each measurement provides different information about different secret keys. An attacker does not know which measurement was generated from which of 2n equivalent secret keys (equivalent because each secret key generates a signature that can be verified using the same public key), thus making it more difficult to analyze the data generated using the signature generation process in terms of measurements.

[0153] Similarly, regarding failure attacks, they typically rely on the assumption that all collected data is generated from a fixed secret key. Our transformed secret key will make retrieving the secret key more difficult because this assumption no longer applies.

[0154] The described embodiments can be combined with other countermeasures to create an optimal cost-performance tradeoff, for example, by reducing the masking order by 1. Regarding masking implementations, the embodiments can also be applied to these implementations. It is sufficient to apply the signature generation module 204 individually to each share of the masking key, but with the same k. This also applies to general fault-tolerant countermeasures. For example, when recalculating the signature operation used for fault protection, it is only necessary to ensure that the same rotated key is used in both iterations.

[0155] In summary, the described embodiments provide a signature generation method that offers increased resistance to the effects of physical attacks such as side-channel attacks and activity failure attacks. These attacks can be used to recover information about the secret key used in signature generation.

[0156] It should be noted that the aspects and embodiments mentioned above illustrate this disclosure but do not limit it, and those skilled in the art will be able to devise many alternative embodiments without departing from the scope of this disclosure as defined by the appended claims. Any reference numerals placed in parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps other than those listed in any claim or throughout the specification. In this specification, "comprising" means "including... or consisting of...". A singular reference to an element does not exclude a plural reference to such an element, and vice versa. This disclosure can be implemented by means of hardware comprising several disparate elements and by means of a suitably programmed computer. In a device claim listing several components, several of these components may be embodied by the same piece of hardware. The fact that certain measures are stated in mutually different dependent claims does not in itself imply that a combination of these measures cannot be used advantageously.

[0157] refer to

[0158] [1] Thomas Prest; Pierre-Alain Fouque; Jeffrey Hoffstein; PaulKirchner; Vadim Lyubashevsky; Thomas Pornin; Thomas Ricosset; Gregor Seiler; William Whyte; Zhenfei Zhang, https: / / falcon-sign.info / falcon.pdf.

Claims

1. A computer-implemented method for generating a cryptographic signature of a message, the method being implemented by processing resources, characterized in that, The method includes: Receive the message to be signed; Obtain the key transformation parameters; Obtain the secret key, which is orthogonal to the public key; The secret key is transformed based on the key transformation parameters to generate a transformed secret key, wherein the transformation maintains the orthogonality between the secret key and the public key; The cryptographic signature of the message is generated based on the transformed secret key.

2. The method according to claim 1, characterized in that, The cryptographic signature is transmitted to the entity that requested the signature.

3. The method according to claim 1, characterized in that, The key transformation parameters are obtained deterministically or using a random process.

4. The method according to claim 2 or claim 3, characterized in that, The key transformation parameters are obtained from a set of integers.

5. The method according to any one of the preceding claims, characterized in that, The transformation of the secret key includes: A rotation is applied to the secret key and the public key, wherein the rotation is based on the key transformation parameters; Obtain the binary tree and its root; Apply the rotation to the root of the binary tree to generate a rotated binary tree; and The rotated binary tree and the rotated secret key are provided as the transformed secret key.

6. The method according to any one of the preceding claims, characterized in that, At least one of the polynomials is a ring. The elements, among which It is an integer ring modulo q.

7. The method according to any one of the preceding claims, characterized in that, The secret key is defined by the following matrix: Where g, f, F, and G are fields. The set of real-valued polynomials in the set of polynomials, where Z is an integer ring and satisfies the NTRU equation described above. And among them And Z[x] is a ring of polynomials with integer coefficients.

8. A non-transitory computer-readable storage medium having executable instructions stored thereon, characterized in that, The executable instructions, due to execution by the processor of the computer system, cause the computer system to perform at least the method according to any one of claims 1 to 7.

9. A system, characterized in that, Configured to implement the method according to claims 1 to 7.

10. A method for processing resources, characterized in that, It includes a processor and a memory, the memory including executable instructions that, when executed by the processor, cause a reader to perform the method according to claims 1 to 7.

Images