Multi-party secure communication method and device based on key negotiation, equipment and medium
By combining SRAM PUF and SIKE algorithms with the Montgomery ladder algorithm using bitmasking technology, a shared key is generated, which solves the problem that the key encapsulation mechanism is vulnerable to side-channel attacks and achieves high security and efficient key negotiation.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CCORE TECH CO LTD
- Filing Date
- 2026-03-31
- Publication Date
- 2026-05-15
AI Technical Summary
Existing key encapsulation mechanisms are vulnerable to side-channel attacks, such as differential power analysis, timing analysis, and fault injection attacks, which can lead to shared key leakage. Furthermore, they are computationally inefficient and cannot meet the requirements of real-time communication and resource-constrained environments.
The root key is generated using SRAM PUF. The Montgomery ladder algorithm, which combines the SIKE algorithm and bitmasking techniques, is used to perform source computation and key negotiation to generate a shared key. The masking technique is then used to resist side-channel attacks.
It effectively resists side-channel attacks, avoids key leakage, improves communication security and quantum computing resistance, and enhances the security and efficiency of key negotiation.
Smart Images
Figure CN122053058A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security communication technology, and in particular to multi-party secure communication methods, devices, equipment and media based on key negotiation. Background Technology
[0002] In the field of network security communication, a shared secret key (a secret information agreed upon and used in advance between two communicating parties) is usually negotiated securely over an insecure channel through a key encapsulation mechanism (KEM). This shared secret key is then used to perform communication tasks such as authentication, data encryption, and integrity verification when the two parties communicate, thereby ensuring the security of the communication.
[0003] However, with the increasing complexity of network environments, current key encapsulation mechanisms, such as SIKE (Supersingular Isogeny Key Encapsulation, a post-quantum cryptographic key encapsulation mechanism based on the supersingular elliptic curve homology problem) and Kyber's algorithm (ML-KEM, a public-key encryption and key encapsulation mechanism based on lattice cryptography), are vulnerable to side-channel attacks during the key encapsulation process, including Differential Power Analysis (DPA), timing analysis attacks, and Fault Injection Attacks (FIA). For example, timing information leakage occurs because conditional branches in homology computations cause execution time to depend on the key value; power consumption correlation occurs because the power consumption trajectory of core operations such as Montgomery multiplication is highly correlated with intermediate data; and fault injection vulnerability arises from the lack of hardware-level fault detection mechanisms, making them susceptible to fault injection attacks such as laser attacks and voltage spikes. After being subjected to these side-channel attacks, risks such as shared key leakage or loss may occur, thereby reducing communication security.
[0004] Furthermore, the SIKE algorithm is computationally intensive in the key encapsulation process due to the homogeneous mapping operation (involving a large number of modular multiplication and addition operations over a large prime number field), which reduces the speed of key encapsulation and consequently reduces the efficiency of the conversation and data transmission between the two parties. It cannot meet the requirements of scenarios with high real-time communication requirements (such as voice calls or mobile data transmission between base stations and user equipment through negotiated session keys, and pairing and data transmission between IoT devices (such as smart door locks, cameras and user mobile apps)). In addition, the algorithm has high operating overhead, which makes its application in resource-constrained scenarios such as embedded systems, IoT environments and mobile terminals face many challenges. Summary of the Invention
[0005] In view of this, the purpose of this application is to provide a multi-party secure communication method, apparatus, device, and medium based on key negotiation, which can resist various types of side-channel attacks, thereby avoiding the risk of key leakage and ensuring the security of multi-party communication. The specific solution is as follows: In a first aspect, this application discloses a multi-party secure communication method based on key negotiation, applied to a transmitting end equipped with a secure encryption chip, comprising: A root key for the security encryption chip is generated using SRAM PUF, and the sender's private key is reconstructed based on the root key to obtain the reconstructed private key. The SIKE algorithm is used to generate a first hypersingular elliptic curve and a second hypersingular elliptic curve, and target points are obtained from the first hypersingular elliptic curve and the second hypersingular elliptic curve respectively to obtain the first target point and the second target point. The first target kernel is obtained by using the Montgomery ladder algorithm with bitmasking technology and performing homogeneous calculation based on the first target point and the reconstructed private key; Using the reconstructed private key and based on the first target kernel, a first homologous mapping from the starting point to the first hypersingular elliptic curve is generated; A first generation point is generated based on the first homologous mapping, starting from the second target point, and a public key is generated based on the first generation point and the first hypersingular elliptic curve. The public key is sent to the receiving end to generate a second generation point starting from the first target point based on the second target point and the receiving party's private key, and a shared key is generated based on the public key and the receiving party's private key. Then, the encapsulated ciphertext containing the second supersingular elliptic curve and the second generation point is sent to the receiving end. The receiver receives and decapsulates the encapsulated ciphertext of the generation point sent by the receiving end to obtain the second hypersingular elliptic curve and the second generation point. Based on the second hypersingular elliptic curve and the second generation point, the shared key is recovered, and the shared key is used to conduct encrypted communication with the receiving end.
[0006] Optionally, generating the root key for the security encryption chip using the SRAM PUF includes: The initial value of the preset SRAM array when it is powered on is obtained to obtain the binary entropy value, and the binary entropy value is corrected by the BCH algorithm to obtain the error-corrected entropy value. The privacy amplification algorithm is used to convert the error-corrected entropy value into a root key of a preset number of bits.
[0007] Optionally, the step of reconstructing the sender's private key based on the root key to obtain the reconstructed private key includes: Obtain the order of the first hypersingular elliptic curve; Perform a dot product operation on the order and the root key to obtain a first operation result, and use the sum of the first operation result and the sender's private key as the reconstructed private key; the reconstructed private key is located in a register.
[0008] Optionally, before performing homogeneous computation based on the first target point and the reconstructed private key using the Montgomery ladder algorithm with bitmasking, the method further includes: A random mask is generated by a random number generator, and the random mask is distributed in parallel to multiple multipliers via a shift register; each multiplier integrates an AND gate. A random mask in each of the multipliers is XORed with a preset operand so that the multiplication operation of the multiplier is performed in the mask field.
[0009] Optionally, the step of using the Montgomery ladder algorithm with bitmasking technology and performing homogeneous computation based on the first target point and the reconstructed private key to obtain the first target kernel includes: In the mask field, a multiplier is used to perform a dot multiplication operation on the first target point and the reconstructed private key based on the mask transformation rule, to obtain the second operation result; the multiplier is located in the Montgomery ladder algorithm based on bit masking technology, and the mask transformation rule is to perform the same dot addition and dot multiplication operations on all key bits, and adjust the order of preset operands through a constant-time conditional exchange operation; The sum of the second operation result and the second target point is calculated by an adder to obtain the kernel point that is homologous to the first hypersingular elliptic curve, thus obtaining the first target kernel.
[0010] Optionally, the process of generating the first homologous mapping from the starting point to the first hypersingular elliptic curve further includes: The number of iterations of the same source mapping is counted by multiple counters to obtain multiple iteration count results, and it is determined whether the values of the multiple iteration count results are consistent. If the values of multiple iteration counts are inconsistent, the generation of the first homologous mapping is interrupted and an abnormal alarm is triggered.
[0011] Secondly, this application discloses a multi-party secure communication device based on key negotiation, applied at the receiving end, comprising: The public key sent by the sender is received, and the second target kernel is obtained by using the Montgomery ladder algorithm with bit masking technology and performing homogeneous calculation based on the second target point and the receiver's private key. Using the recipient's private key and based on the second target kernel, a second homologous mapping from the starting point to the second hypersingular elliptic curve is generated, and a second generation point from the first target point is generated based on the second homologous mapping; A third homologous mapping from the second hypersingular elliptic curve to the first hypersingular elliptic curve is generated based on the public key and the private key of the receiver, and a shared secret value is derived based on the third homologous mapping. The shared secret value is hashed to obtain the shared key, and the second hypersingular elliptic curve and the second generation point are encapsulated to obtain the encapsulated ciphertext. The encapsulated ciphertext is sent to the receiving end so that the receiving end can recover the shared key based on the second supersingular elliptic curve and the second generation point obtained after decapsulating the encapsulated ciphertext, and use the shared key to perform encrypted communication with the sending end.
[0012] Thirdly, this application discloses a multi-party secure communication device based on key negotiation, applied to a transmitting end equipped with a secure encryption chip, comprising: The key generation and reconstruction module is used to generate a root key for the security encryption chip using SRAM PUF, and to reconstruct the sender's private key based on the root key to obtain the reconstructed private key. The first generation module is used to generate the first and second hypersingular elliptic curves using the SIKE algorithm. The acquisition module is used to acquire target points from the first hypersingular elliptic curve and the second hypersingular elliptic curve respectively, to obtain the first target point and the second target point; The same-source calculation module is used to perform same-source calculation based on the first target point and the reconstructed private key using the Montgomery ladder algorithm with bit masking technology to obtain the first target kernel; The second generation module is used to generate a first homologous mapping from the starting point to the first hypersingular elliptic curve using the reconstructed private key and based on the first target kernel. The third generation module is used to generate a first generation point starting from the second target point based on the first homologous mapping, and to generate a public key based on the first generation point and the first hypersingular elliptic curve. The sending module is used to send the public key to the receiving end to generate a second generation point starting from the first target point based on the second target point and the receiving party's private key, and to generate a shared key based on the public key and the receiving party's private key, and then send the encapsulated ciphertext containing the second supersingular elliptic curve and the second generation point to the receiving end. An encrypted communication module is used to receive and decapsulate the encapsulated ciphertext of the generation point sent by the receiving end to obtain the second hypersingular elliptic curve and the second generation point, recover the shared key based on the second hypersingular elliptic curve and the second generation point, and use the shared key to perform encrypted communication with the receiving end.
[0013] Fourthly, this application discloses an electronic device, including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the aforementioned multi-party secure communication method based on key negotiation.
[0014] Fifthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned multi-party secure communication method based on key negotiation.
[0015] As can be seen, this application is applied to a transmitter equipped with a secure encryption chip, comprising: generating a root key for the secure encryption chip using SRAM PUF, and reconstructing the transmitter's private key based on the root key to obtain a reconstructed private key; generating a first hypersingular elliptic curve and a second hypersingular elliptic curve using the SIKE algorithm, and obtaining target points from the first hypersingular elliptic curve and the second hypersingular elliptic curve respectively to obtain a first target point and a second target point; performing homologous calculation using the Montgomery step algorithm with bitmasking technology based on the first target point and the reconstructed private key to obtain a first target kernel; generating a first homologous mapping from the starting point to the first hypersingular elliptic curve using the reconstructed private key and based on the first target kernel; and generating a first homologous mapping from the second target kernel to the first target kernel based on the first homologous mapping. A first generation point is generated starting from the punctuation mark, and a public key is generated based on the first generation point and the first hypersingular elliptic curve. The public key is sent to the receiving end to generate a second generation point starting from the first target point based on the second target point and the receiving party's private key. A shared key is generated based on the public key and the receiving party's private key. The encapsulated ciphertext containing the second hypersingular elliptic curve and the second generation point is then sent to the receiving end. The receiving end receives and decapsulates the encapsulated ciphertext of the generation point sent by the receiving end to obtain the second hypersingular elliptic curve and the second generation point. The shared key is recovered based on the second hypersingular elliptic curve and the second generation point, and encrypted communication with the receiving end is performed using the shared key. This application is applied to a transmitter equipped with a secure encryption chip. During the generation of a shared key, a root key for the secure encryption chip is first generated using SRAM PUF, and the sender's private key is reconstructed based on the root key to obtain the reconstructed private key. This method avoids the power consumption analysis threat that may occur when inputting the private key. Furthermore, this application utilizes the SIKE algorithm combined with the Montgomery ladder algorithm using bitmasking technology, which can effectively overcome side-channel attacks vulnerable to homologous computation, such as timing analysis attacks and fault injection attacks, thereby avoiding the risk of key leakage and ensuring the security of multi-party communication based on key negotiation. At the same time, it improves the anti-side-channel attack capability of the secure encryption chip and can effectively resist future quantum computing attacks. Attached Figure Description
[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0017] Figure 1This application discloses a flowchart of a multi-party secure communication method based on key negotiation. Figure 2 This application discloses a specific flowchart of a multi-party secure communication method based on key negotiation; Figure 3 This is a schematic diagram of a multi-party secure communication device based on key negotiation disclosed in this application; Figure 4 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation
[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0019] This application discloses a multi-party secure communication method based on key negotiation, applied to a transmitting end equipped with a secure encryption chip. See [link to relevant documentation]. Figure 1 As shown, the method includes: Step S11: Generate a root key for the security encryption chip using SRAM PUF, and reconstruct the sender's private key based on the root key to obtain the reconstructed private key.
[0020] It should be noted that the multi-party secure communication method based on key negotiation proposed in this application is specifically applied to a transmitter (which can be a third-party trusted execution agency) equipped with a secure encryption chip. The secure encryption chip (such as a smart card) is a dedicated secure chip that integrates symmetric and asymmetric algorithms, such as a dedicated microchip embedded in a computer motherboard. It can provide secure authentication and data protection services by storing encryption keys in hardware. It has anti-tampering and anti-cloning characteristics to ensure the security of keys and data. Its core functions include key generation, encapsulation and decapsulation, ensuring that encryption operations are completed inside the chip to prevent key leakage.
[0021] The sending end is used to communicate securely with the receiving end. The sending end and the receiving end can be two communication nodes used in fields such as IoT devices, financial payment terminals, smart home devices, vehicle networking devices, and medical devices. For example, in application scenarios based on network security communication protocols (such as Secure Shell (SSH), Transport Layer Security (TLS), and Hypertext Transfer Protocol Secure), when a user visits a website, the browser and server use KEM (Key Encapsulation Mechanism) to negotiate a session key (i.e., a shared key) to prevent man-in-the-middle attacks and decryption threats from future quantum computers. Other examples include secure sessions / communications between IoT devices and embedded systems, between electricity meters and smart grid control centers, between vehicles, and between vehicles and infrastructure; instruction transmission between factory robots and programmable logic controllers (PLCs) to prevent malicious control leading to production accidents; pairing and data transmission between smart locks, cameras, and mobile apps; data uploads from users to the cloud, or data migration between different data centers by cloud service providers (using KEM-negotiated keys for encryption); key negotiation between base stations (gNBs) and user equipment (UEs) to protect voice calls and mobile data; and key negotiation in CPU enclaves (such as Intel SGX, AMD...). When running code in a SEV, KEM is used to securely inject keys into protected memory areas; quantum computers (i.e., the sender) use KEM to encrypt and store or transmit confidential files; dedicated communication lines between exchanges and brokerages; and when creating independent logical networks for different industries (such as telemedicine, autonomous driving, etc.), KEM can be used to ensure key isolation between network slices.
[0022] In this embodiment, the transmitting end equipped with the security encryption chip first uses SRAM PUF (Physical Unclonable Function, which uses the inherent microscopic physical differences in the chip manufacturing process (such as transistor threshold voltage deviation) to generate a unique and uncopyable hardware digital fingerprint) to generate a root key for the security encryption chip. Then, based on the root key, the transmitting end's private key is reconstructed to obtain the corresponding reconstructed private key.
[0023] In one specific implementation, generating the root key for the security encryption chip using the SRAM PUF may include: obtaining the initial value of a preset SRAM array upon power-up to obtain a binary entropy value; correcting the binary entropy value using the BCH algorithm to obtain a corrected entropy value; and converting the corrected entropy value into a root key of a preset number of bits using a privacy amplification algorithm. In this embodiment, to address the vulnerability of the private key input to power consumption analysis, a 2KB dedicated SRAM array integrated into the SRAM PUF can be used as the entropy source. Upon power-up, the initial value (a random sequence) of the SRAM array is read to obtain a binary entropy value. Then, the binary entropy value is corrected using the BCH algorithm (Bose-Chaudhuri-Hocquenghem, an error correction coding algorithm) to obtain a corrected entropy value. Finally, a privacy amplification algorithm (such as a hash algorithm) is used to convert the corrected entropy value into a root key of a preset number of bits (such as 256 bits) (ensuring uniqueness). After privacy amplification, the randomness of the random sequence can be further enhanced, thereby improving the security of the root key.
[0024] Specifically, the step of reconstructing the sender's private key based on the root key to obtain the reconstructed private key may include: obtaining the order of the first hypersingular elliptic curve; performing a dot product operation on the order and the root key to obtain a first operation result; and using the sum of the first operation result and the sender's private key as the reconstructed private key. In this embodiment, the order n of the first hypersingular elliptic curve EA generated using the SIKE algorithm can be obtained first, then the order n and the aforementioned root key d can be multiplied to obtain the first operation result, and then the sum of the first operation result and the sender's private key skA can be calculated, and the sum can be used as the reconstructed private key skA'. The specific reconstruction formula is as follows: ,in, (G is the base point of the first hypersingular elliptic curve EA). Additionally, the reconstructed private key skA' can be saved to a register.
[0025] Step S12: Use the SIKE algorithm to generate a first hypersingular elliptic curve and a second hypersingular elliptic curve, and obtain target points from the first hypersingular elliptic curve and the second hypersingular elliptic curve respectively to obtain the first target point and the second target point.
[0026] In this embodiment, after reconstructing the sender's private key based on the root key, the SIKE algorithm can be used to generate a first hypersingular elliptic curve EA and a second hypersingular elliptic curve EB. Then, target points are obtained from the first hypersingular elliptic curve EA and the second hypersingular elliptic curve EB, respectively. For example, two points PA and QA are obtained from the first hypersingular elliptic curve EA to obtain the first target point, and two points PB and QB are obtained from the second hypersingular elliptic curve EB to obtain the second target point.
[0027] Step S13: Using the Montgomery ladder algorithm with bitmasking technology and performing homogeneous calculation based on the first target point and the reconstructed private key, the first target kernel is obtained.
[0028] In this embodiment, after obtaining the target points from the first hypersingular elliptic curve EA and the second hypersingular elliptic curve EB, the Montgomery Ladder Algorithm, which employs bitmasking technology, can be used to perform homologous computation based on the aforementioned first target points (i.e., PA and QA) and the reconstructed private key skA', in order to calculate the homologous kernel points ( The plus sign indicates a dot addition operation. (For the Montgomery ladder dot product operation / multiplication operation), the first target kernel is obtained.
[0029] It should be noted that before the Montgomery ladder algorithm using bitmasking technology and performing homogeneous computation based on the first target point and the reconstructed private key, the method further includes: generating a random mask using a random number generator, and distributing the random mask in parallel to multiple multipliers using a shift register; each multiplier integrates an AND gate; and performing an XOR operation between the random mask in each multiplier and a preset operand, so that the multiplication operation of the multiplier is performed in the mask domain. In this embodiment, to address the vulnerability of multiplication operations to power analysis attacks, multiple multipliers can be instantiated according to the highest security level of the SIKE algorithm to implement the multiplication operation. For example, when the highest security level of the SIKE algorithm is SIKE751 and the maximum width of the multiplier is 384, nine 128-bit multipliers can be instantiated to implement a 384-bit multiplication operation. Specifically, before each round of Montgomery ladder multiplication, a 1152-bit random mask can be generated using a random number generator (such as a True Random Number Generator, TRNG). This random mask is then distributed in parallel to nine multipliers via a shift register. Each multiplier integrates mask conversion logic, which performs an XOR operation between the random mask and a preset operand, ensuring that the multiplication operation is performed within the mask domain. It's worth noting that AND gates can also be integrated into the multipliers to prevent information leakage caused by glitch in combinational logic. Furthermore, a mask update operation is automatically triggered after each round of same-source computation, eliminating the risk of mask accumulation and leakage during long-term computation. Moreover, the full coverage by the random mask decouples power consumption, electromagnetic properties, and other physical characteristics from sensitive data, increasing the difficulty for attackers to extract keys or intermediate states via side channels and reducing the risk of information leakage, thus improving information security.
[0030] Specifically, the step of using the Montgomery's step algorithm with bitmasking technology and performing homologous computation based on the first target point and the reconstructed private key to obtain the first target kernel may include: performing a dot product operation on the first target point and the reconstructed private key in the mask domain using a multiplier and based on mask transformation rules to obtain a second operation result; and calculating the sum of the second operation result and the second target point using an adder to obtain kernel points homologous to the first hypersingular elliptic curve, thus obtaining the first target kernel. In this embodiment, multiple multipliers (such as nine 128-bit multipliers) located in the Montgomery's step algorithm can be used in the mask domain to perform a dot product operation (including dot addition and dot multiplication operations) on the first target point and the reconstructed private key based on mask transformation rules to obtain a second operation result. Then, the sum of the second operation result and the second target point (such as PB and QB) can be calculated using an adder to calculate kernel points homologous to the first hypersingular elliptic curve EA, thus obtaining the first target kernel.
[0031] The masking transformation rule involves performing the same dot-add and dot-multiply operations on all key bits, and adjusting the order of the pre-defined operands using a constant-time conditional swap (cswap). That is, regardless of whether the key bit is 0 or 1, the same sequence of dot-double and dot-add operations is performed, and the operand order is adjusted using a constant-time conditional swap. This allows for conditional swapping of two values without affecting the overall execution time, effectively preventing time-side-channel attacks that could leak sensitive information during execution time analysis.
[0032] Specifically, the constant-time conditional swap (cswap) operation can be implemented using bitmasking techniques to achieve branchless swapping. The specific operation steps are as follows: mask = -bit (if bit=1, mask is all 1s; if bit=0, mask is all 0s). (temp is an intermediate variable,) For XOR operation, (for operation). ; .
[0033] The above operations only use bitwise XOR and AND operations, with no conditional branches, thus ensuring constant execution time and preventing attackers from analyzing intermediate data from externally observed power consumption changes.
[0034] Step S14: Using the reconstructed private key and based on the first target kernel, generate a first homologous mapping from the starting point to the first hypersingular elliptic curve.
[0035] In this embodiment, the reconstructed private key can be used to calculate a homologous mapping from the starting point E0 (which is the starting point of homologous cryptography and can be a curve) to the first hypersingular elliptic curve EA (referring to the homologous mapping from the first hypersingular elliptic curve EA to the second hypersingular elliptic curve EB) based on the first target kernel, thus obtaining the first homologous mapping. ).
[0036] It should be noted that the process of generating the first homologous mapping from the starting point to the first hypersingular elliptic curve specifically includes: counting the number of iterations of the homologous mapping using multiple counters to obtain multiple iteration count results, and determining whether the values of the multiple iteration count results are consistent; if the values of the multiple iteration count results are inconsistent, the generation of the first homologous mapping is interrupted and an abnormal alarm is triggered. In this embodiment, during the calculation of the homologous mapping, three independent counters can be used to monitor the number of iterations during the calculation of the homologous mapping. If the count values of the three counters are inconsistent, an alarm is immediately triggered, and after detecting a fault, the homologous mapping calculation is immediately interrupted, all intermediate registers (such as mask registers) are cleared, and a fixed error code is output.
[0037] Furthermore, after completing the calculation of the homology mapping, the curve coefficient E' of the first hypersingular elliptic curve EA can be recalculated using the Weierstrass equations. The specific calculation formula is as follows: Then, it checks whether the curve coefficients E' (such as A' / C', B' / C'²) are correct (it can be compared with the coefficients of the first hypersingular elliptic curve EA to determine whether the two coefficients are consistent). If it is incorrect, a fault alarm is triggered immediately.
[0038] To address the vulnerability of homologous mappings to timing analysis attacks due to execution branches, a dedicated state machine can be pre-defined to ensure that both 2^eA (second-order) and 3^eB (third-order) homologous mappings are completed within a predefined fixed clock cycle. The number of cycles can be determined by the maximum security level parameter, such as SIKEp751 (i.e., the highest parameter set of SIKE is 751). For smaller parameter sets (such as sike503, sike434, etc.), dummy cycles can be inserted to fill the gaps to a uniform length (e.g., uniformly to a parameter set of 751). The dummy cycles can automatically calculate the number of calculations required for the dummy homologous mappings based on the Hamming weight of the key. Specifically, this can be precisely controlled by a hardware counter (CNT) to balance the power consumption of different key paths.
[0039] Furthermore, to address the vulnerability of same-source mapping computation to fault injection attacks, multiple paths can be used to avoid this attack. For example, the same same-source mapping can be executed simultaneously on the main computation path and redundant computation paths. The calculation uses independent Montgomery multipliers and adders for the two paths, and performs real-time bitwise XOR comparisons on the calculation results. If a single bit comparison result is different, a fault alarm is triggered immediately.
[0040] Step S15: Generate a first generation point starting from the second target point based on the first homologous mapping, and generate a public key based on the first generation point and the first hypersingular elliptic curve.
[0041] In this embodiment, after performing the homology mapping calculation, further calculations can be made based on the first homology mapping. Calculate the first generation point from the starting point of the second target point (PB and QB). and ), and then based on the first generation point ( and A public key pkA for communication between the two parties is generated by the first hypersingular elliptic curve EA and the first hypersingular elliptic curve EA. In one specific implementation, the public key pkA can be generated by the first hypersingular elliptic curve EA, ... and the first hypersingular elliptic curve EA. and The string is 564 bytes long. This represents a mapping originating from point PB. The generated points, This represents a mapping originating from point QB. The generated points.
[0042] Step S16: Send the public key to the receiving end to generate a second generation point starting from the first target point based on the second target point and the receiving party's private key, and generate a shared key based on the public key and the receiving party's private key, and then send the encapsulated ciphertext containing the second supersingular elliptic curve and the second generation point to the receiving end.
[0043] In this embodiment, the public key pkA is sent to the receiving end; after receiving the public key pkA, the receiving end parses it to obtain the first hypersingular elliptic curve EA and the first generating point ( and Then, based on the second target points (PB and QB) and the receiver's private key m, a homology calculation is performed to obtain the second target kernel. Then, based on the second target kernel and the receiver's private key m, the homology from the starting point E0 to the second hypersingular elliptic curve EB is calculated to obtain the second homology mapping. Then based on the second homology mapping Generate points starting from the first target point (PA and QA) to obtain the second generated point ( and ), and calculate another homologous mapping (referring to the homologous relationship between the second hypersingular elliptic curve EB and the first hypersingular elliptic curve EA) based on the public key pkA and the receiver's private key m. Finally, derive the shared secret value j based on the other homologous mapping, and perform a hash operation (such as SHAKE-256 operation) on the shared secret value j to obtain the shared key K. Then, calculate the shared secret value K based on the second hypersingular elliptic curve EB and the second generation point ( and The encrypted text c is compressed and then sent to the receiving end.
[0044] Specifically, the derivation of the shared secret value j is as follows: If the shared elliptic curve is... Then the secret value is shared. .
[0045] Step S17: Receive and decapsulate the encapsulated ciphertext of the generation point sent by the receiving end to obtain the second hypersingular elliptic curve and the second generation point, recover the shared key based on the second hypersingular elliptic curve and the second generation point, and use the shared key to perform encrypted communication with the receiving end.
[0046] In this embodiment, after receiving the encapsulated ciphertext c sent by the receiving end, it is decapsulated to obtain the second hypersingular elliptic curve EB and the second generation point ( and ), and then based on the second hypersingular elliptic curve EB and the second generation point ( and Using the same method of generating homology maps as described above, calculate the homology map from the first hypersingular elliptic curve EA to the second hypersingular elliptic curve EB. Then based on The shared secret value j is derived, and then the same hash operation (such as SHAKE-256 operation) is performed on the shared secret value j as in the encapsulation step to recover the shared key K. The shared key K is then used to achieve encrypted communication with the receiving end, such as the drone control center sending control commands for drones in a certain area in an encrypted manner.
[0047] It should be noted that the decapsulation operation can also be implemented through two independent paths, and the decapsulation results of the two paths are compared. If they match, the shared key K is released after a masked XOR operation; if the comparison results do not match, a fault alarm is triggered immediately. This method further avoids the risk of key attacks and effectively resists various side-channel attacks.
[0048] As can be seen, the embodiments of this application are applied to a transmitter equipped with a security encryption chip. In the process of generating a shared key, a root key for the security encryption chip is first generated using SRAM PUF, and the sender's private key is reconstructed based on the root key to obtain the reconstructed private key. The above method can avoid the power consumption analysis threat that may be encountered when inputting the private key. Furthermore, the embodiments of this application utilize the SIKE algorithm combined with the Montgomery ladder algorithm using bitmasking technology, which can effectively overcome the side-channel attacks that are vulnerable to in the same-source computation process, such as timing analysis attacks and fault injection attacks, thereby avoiding the risk of key leakage and ensuring the security of multi-party communication based on key negotiation. At the same time, it improves the anti-side-channel attack capability of the security encryption chip and can effectively resist future quantum computing attacks.
[0049] This application discloses a specific multi-party secure communication method based on key negotiation, applied at the receiving end. See [link to relevant documentation]. Figure 2 As shown, the method includes: Step S21: Receive the public key sent by the sender, and use the Montgomery ladder algorithm with bitmasking technology to perform homogeneous calculation based on the second target point and the receiver's private key to obtain the second target kernel.
[0050] In this embodiment, after the receiving end receives the public key pkA sent by the sending end, it parses it to obtain the first hypersingular elliptic curve EA and the first generating point ( Then, the Montgomery ladder algorithm with bit masking technology is used to calculate the same core point based on the second target point (PB and QB) and the receiver's private key m to obtain the second target core. The calculation formula of the second target core is PB+[m]QB.
[0051] Step S22: Using the receiver's private key and based on the second target kernel, generate a second homologous mapping from the starting point to the second hypersingular elliptic curve, and generate a second generation point from the first target point based on the second homologous mapping.
[0052] In this embodiment, the second homology mapping is obtained by using the aforementioned receiver's private key m and calculating the homology from the starting point E0 to the second hypersingular elliptic curve EB based on the second target kernel. E0→EB, then calculate the second hypersingular elliptic curve EB based on the second homologous mapping, and generate points starting from the first target point (PA and QA) to obtain the second generated point ( and ).
[0053] Step S23: Generate a third homologous mapping from the second hypersingular elliptic curve to the first hypersingular elliptic curve based on the public key and the private key of the receiver, and derive the shared secret value based on the third homologous mapping.
[0054] In this embodiment, the first hypersingular elliptic curve EA and the first generation point (in the public key pkA) are first used as the basis. and The second hypersingular elliptic curve EB is generated from the first hypersingular elliptic curve EA using the receiver's private key m, and a third homologous mapping is obtained. Then, the shared secret value j is derived based on the third homologous mapping.
[0055] Step S24: Perform a hash operation on the shared secret value to obtain the shared key, and encapsulate the second hypersingular elliptic curve and the second generation point to obtain the encapsulated ciphertext.
[0056] In this embodiment, after deriving the shared secret value j, a hash operation (such as SHAKE-256 operation) is performed on the shared secret value j to obtain the shared key K. Then, the second hypersingular elliptic curve EB and the second generation point ( and Encapsulate the encrypted text c.
[0057] Step S25: Send the encapsulated ciphertext to the receiving end so that the receiving end can recover the shared key based on the second supersingular elliptic curve and the second generation point obtained after decapsulating the encapsulated ciphertext, and use the shared key to perform encrypted communication with the sending end.
[0058] In this embodiment, after obtaining the encapsulated ciphertext c, it is sent to the receiving end; when the receiving end receives the encapsulated ciphertext c, it first decapsulates the encapsulated ciphertext c to obtain the second hypersingular elliptic curve EB and the second generation point ( and The same source mapping is calculated to derive the same shared secret value j. Then, the same hash operation (such as SHAKE-256 operation) is used to operate on the shared secret value j to recover the shared key K. The shared key K is then used to realize encrypted communication with the sender.
[0059] As can be seen, this embodiment of the application is applied to the receiving end. When the public key sent by the sending end is received, the Montgomery step algorithm with bitmasking technology is first used to perform homologous calculation based on the second target point and the receiver's private key to obtain the second target kernel. Then, using the receiver's private key and based on the second target kernel, a second homologous mapping from the starting point to the second hypersingular elliptic curve is generated, and a second generation point from the first target point is generated based on the second homologous mapping. Next, a third homologous mapping from the second hypersingular elliptic curve to the first hypersingular elliptic curve is generated based on the public key and the receiver's private key, and a shared secret value is derived based on the third homologous mapping. Then, a hash operation is performed on the shared secret value to obtain the shared key, and the second hypersingular elliptic curve and the second generation point are encapsulated to obtain encapsulated ciphertext. Finally, the encapsulated ciphertext is sent to the receiving end so that the receiving end can recover the shared key based on the second hypersingular elliptic curve and the second generation point obtained after decapsulating the encapsulated ciphertext, and use the shared key to perform encrypted communication with the sending end. This application's embodiments utilize the SIKE algorithm combined with the Montgomery ladder algorithm employing bitmasking technology, which can effectively overcome various side-channel attacks that may occur during the same-source computation process, thereby avoiding the risk of key leakage and ensuring the security of multi-party communication based on key negotiation.
[0060] Accordingly, embodiments of this application also disclose a multi-party secure communication device based on key negotiation, applied to a transmitter equipped with a secure encryption chip, see [link to relevant documentation]. Figure 3 As shown, the device includes: The key generation and reconstruction module 11 is used to generate a root key for the security encryption chip using SRAM PUF, and reconstruct the sender's private key based on the root key to obtain the reconstructed private key. The first generation module 12 is used to generate a first hypersingular elliptic curve and a second hypersingular elliptic curve using the SIKE algorithm. The acquisition module 13 is used to acquire target points from the first hypersingular elliptic curve and the second hypersingular elliptic curve respectively, to obtain the first target point and the second target point; The same-source calculation module 14 is used to perform same-source calculation based on the first target point and the reconstructed private key using the Montgomery ladder algorithm with bit masking technology to obtain the first target kernel; The second generation module 15 is used to generate a first homologous mapping from the starting point to the first hypersingular elliptic curve using the reconstructed private key and based on the first target kernel. The third generation module 16 is used to generate a first generation point starting from the second target point based on the first homologous mapping, and to generate a public key based on the first generation point and the first hypersingular elliptic curve. The sending module 17 is used to send the public key to the receiving end, generate a second generation point starting from the first target point based on the second target point and the receiving party's private key, generate a shared key based on the public key and the receiving party's private key, and then send the encapsulated ciphertext containing the second supersingular elliptic curve and the second generation point to the receiving end. The encrypted communication module 18 is used to receive and decapsulate the encapsulated ciphertext of the generation point sent by the receiving end to obtain the second hypersingular elliptic curve and the second generation point, recover the shared key based on the second hypersingular elliptic curve and the second generation point, and use the shared key to perform encrypted communication with the receiving end.
[0061] The specific workflow of each of the above modules can be found in the relevant content disclosed in the foregoing embodiments, and will not be repeated here.
[0062] Furthermore, embodiments of this application also disclose an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.
[0063] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the key-negotiation-based multi-party secure communication method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.
[0064] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.
[0065] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.
[0066] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the key-negotiation-based multi-party secure communication method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.
[0067] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed multi-party secure communication method based on key negotiation. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.
[0068] Furthermore, embodiments of this application also disclose a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the multi-party secure communication method based on key negotiation as disclosed above.
[0069] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.
[0070] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0071] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.
[0072] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0073] The foregoing has provided a detailed description of the multi-party secure communication method, apparatus, device, and medium based on key negotiation provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and its core ideas. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.
Claims
1. A multi-party secure communication method based on key negotiation, characterized in that, Applied to transmitters equipped with security encryption chips, including: A root key for the security encryption chip is generated using SRAM PUF, and the sender's private key is reconstructed based on the root key to obtain the reconstructed private key. The SIKE algorithm is used to generate a first hypersingular elliptic curve and a second hypersingular elliptic curve, and target points are obtained from the first hypersingular elliptic curve and the second hypersingular elliptic curve respectively to obtain the first target point and the second target point. The first target kernel is obtained by using the Montgomery ladder algorithm with bitmasking technology and performing homogeneous calculation based on the first target point and the reconstructed private key; Using the reconstructed private key and based on the first target kernel, a first homologous mapping from the starting point to the first hypersingular elliptic curve is generated; A first generation point is generated based on the first homologous mapping, starting from the second target point, and a public key is generated based on the first generation point and the first hypersingular elliptic curve. The public key is sent to the receiving end to generate a second generation point starting from the first target point based on the second target point and the receiving party's private key, and a shared key is generated based on the public key and the receiving party's private key. Then, the encapsulated ciphertext containing the second supersingular elliptic curve and the second generation point is sent to the receiving end. The receiver receives and decapsulates the encapsulated ciphertext of the generation point sent by the receiving end to obtain the second hypersingular elliptic curve and the second generation point. Based on the second hypersingular elliptic curve and the second generation point, the shared key is recovered, and the shared key is used to conduct encrypted communication with the receiving end.
2. The multi-party secure communication method based on key negotiation according to claim 1, characterized in that, The step of generating the root key for the security encryption chip using SRAM PUF includes: The initial value of the preset SRAM array when it is powered on is obtained to obtain the binary entropy value, and the binary entropy value is corrected by the BCH algorithm to obtain the error-corrected entropy value. The privacy amplification algorithm is used to convert the error-corrected entropy value into a root key of a preset number of bits.
3. The multi-party secure communication method based on key negotiation according to claim 2, characterized in that, The process of reconstructing the sender's private key based on the root key to obtain the reconstructed private key includes: Obtain the order of the first hypersingular elliptic curve; Perform a dot product operation on the order and the root key to obtain a first operation result, and use the sum of the first operation result and the sender's private key as the reconstructed private key; the reconstructed private key is located in a register.
4. The multi-party secure communication method based on key negotiation according to claim 1, characterized in that, Before performing homogeneous computation based on the first target point and the reconstructed private key using the Montgomery ladder algorithm with bitmasking technology, the method further includes: A random mask is generated by a random number generator, and the random mask is distributed in parallel to multiple multipliers via a shift register; each multiplier integrates an AND gate. A random mask in each of the multipliers is XORed with a preset operand so that the multiplication operation of the multiplier is performed in the mask field.
5. The multi-party secure communication method based on key negotiation according to claim 4, characterized in that, The method of using the Montgomery ladder algorithm with bitmasking technology and performing homogeneous computation based on the first target point and the reconstructed private key to obtain the first target kernel includes: In the mask field, a multiplier is used to perform a dot multiplication operation on the first target point and the reconstructed private key based on the mask transformation rule, to obtain the second operation result; the multiplier is located in the Montgomery ladder algorithm based on bit masking technology, and the mask transformation rule is to perform the same dot addition and dot multiplication operations on all key bits, and adjust the order of preset operands through a constant-time conditional exchange operation; The sum of the second operation result and the second target point is calculated by an adder to obtain the kernel point that is homologous to the first hypersingular elliptic curve, thus obtaining the first target kernel.
6. The multi-party secure communication method based on key negotiation according to any one of claims 1 to 5, characterized in that, The process of generating the first homologous mapping from the starting point to the first hypersingular elliptic curve also includes: The number of iterations of the same source mapping is counted by multiple counters to obtain multiple iteration count results, and it is determined whether the values of the multiple iteration count results are consistent. If the values of multiple iteration counts are inconsistent, the generation of the first homologous mapping is interrupted and an abnormal alarm is triggered.
7. A multi-party secure communication method based on key negotiation, characterized in that, Applied to the receiving end, including: The public key sent by the sender is received, and the second target kernel is obtained by using the Montgomery ladder algorithm with bit masking technology and performing homogeneous calculation based on the second target point and the receiver's private key. Using the recipient's private key and based on the second target kernel, a second homologous mapping from the starting point to the second hypersingular elliptic curve is generated, and a second generation point from the first target point is generated based on the second homologous mapping; A third homologous mapping from the second hypersingular elliptic curve to the first hypersingular elliptic curve is generated based on the public key and the private key of the receiver, and a shared secret value is derived based on the third homologous mapping. The shared secret value is hashed to obtain the shared key, and the second hypersingular elliptic curve and the second generation point are encapsulated to obtain the encapsulated ciphertext. The encapsulated ciphertext is sent to the receiving end so that the receiving end can recover the shared key based on the second supersingular elliptic curve and the second generation point obtained after decapsulating the encapsulated ciphertext, and use the shared key to perform encrypted communication with the sending end.
8. A multi-party secure communication device based on key negotiation, characterized in that, Applied to transmitters equipped with security encryption chips, including: The key generation and reconstruction module is used to generate a root key for the security encryption chip using SRAM PUF, and to reconstruct the sender's private key based on the root key to obtain the reconstructed private key. The first generation module is used to generate the first and second hypersingular elliptic curves using the SIKE algorithm. The acquisition module is used to acquire target points from the first hypersingular elliptic curve and the second hypersingular elliptic curve respectively, to obtain the first target point and the second target point; The same-source calculation module is used to perform same-source calculation based on the first target point and the reconstructed private key using the Montgomery ladder algorithm with bit masking technology to obtain the first target kernel; The second generation module is used to generate a first homologous mapping from the starting point to the first hypersingular elliptic curve using the reconstructed private key and based on the first target kernel. The third generation module is used to generate a first generation point starting from the second target point based on the first homologous mapping, and to generate a public key based on the first generation point and the first hypersingular elliptic curve. The sending module is used to send the public key to the receiving end to generate a second generation point starting from the first target point based on the second target point and the receiving party's private key, and to generate a shared key based on the public key and the receiving party's private key, and then send the encapsulated ciphertext containing the second supersingular elliptic curve and the second generation point to the receiving end. An encrypted communication module is used to receive and decapsulate the encapsulated ciphertext of the generation point sent by the receiving end to obtain the second hypersingular elliptic curve and the second generation point, recover the shared key based on the second hypersingular elliptic curve and the second generation point, and use the shared key to perform encrypted communication with the receiving end.
9. An electronic device, characterized in that, It includes a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the multi-party secure communication method based on key negotiation as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the multi-party secure communication method based on key negotiation as described in any one of claims 1 to 7.