A method and apparatus for encapsulating post-quantum identifier keys

Abstract

This application provides a post-quantum identifier key encapsulation method and apparatus. The method includes the following steps: acquiring a preset standardized parameter set and a target identity identifier, and generating public parameters, a master public key, and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; generating an identity decapsulation key through hybrid sampling based on the public parameters, the master public key, the master private key, and the target identity identifier; generating an identity polynomial corresponding to the target identity identifier based on the public parameters, the master public key, and the identity polynomial; and generating a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key, and the identity polynomial. By constructing a cryptographic mechanism based on the NIST standardized post-quantum cryptographic modulus q=8380417, compatibility with the identity basic operations of mainstream post-quantum cryptographic standards is achieved, possessing good interoperability and a solid foundation for industrial application.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a post-quantum identifier key encapsulation method. Background Technology

[0002] With the rapid development of quantum computing technology, traditional public-key cryptosystems based on mathematically difficult problems such as large number factorization and discrete logarithms face severe security threats. Post-quantum cryptography has become a core technical approach to ensure the long-term security of information systems. The National Institute of Standards and Technology (NIST) has officially released standardized post-quantum lattice cryptographic algorithms, including a key encapsulation mechanism (ML-KEM) and a digital signature algorithm (ML-DSA). ML-KEM uses a modulus q=3329, and ML-DSA uses a modulus q=8380417. It also includes standardized arithmetic components such as modulo reduction, NTT fast number theory transformation, and Montgomery multiplication. This arithmetic system has been widely deployed, optimized, verified, and hardened with side-channel security in software libraries, embedded devices, FPGAs, and ASICs, possessing a mature engineering foundation.

[0003] Identifier-based cryptography allows user identifiers (such as email addresses and phone numbers) to be used directly as public keys, with key generation centers centrally issuing and managing user private keys. This simplifies the complexity of public key infrastructure and offers significant advantages in centralized control scenarios such as the Internet of Things (IoT) and e-government communications. To meet post-quantum security requirements, lattice-based identifier key encapsulation mechanisms have become a research hotspot. However, existing mainstream lattice-based identifier cryptography schemes still suffer from a series of interconnected technical shortcomings that have not yet been collaboratively addressed in their progress towards practical application and integration with standardized systems. Weak or missing security proofs: Existing compact schemes (such as DLP-IBE and its subsequent instantiation) lack satisfactory provable security reductions; while schemes with proof frameworks (such as LATTE) often require higher algebraic rank in single-level identity scenarios, leading to decreased efficiency.

[0004] High decryption failure rate: When attempting to migrate existing compact solutions to NIST standard modulo (such as ML-DSA q=8380417), direct migration leads to a sharp deterioration in the decapsulation failure rate, which cannot meet the high reliability threshold required for practical applications.

[0005] Low efficiency of identity key extraction: Existing solutions typically rely on complex recursive sampling frameworks such as KL-GPV or Falcon-style ffSampling for identity key extraction, resulting in low computational throughput and high complexity in implementing side-channel protection.

[0006] Large ciphertext and key sizes: Some provable schemes, in order to maintain correctness and security, result in large ciphertext sizes, which are poorly suited for embedded environments with limited bandwidth and storage.

[0007] Incompatibility with standardized quantum cryptography arithmetic stacks: Most current mainstream schemes use moduli different from the NIST standard (especially ML-DSA), requiring core arithmetic operations such as polynomial multiplication, NTT transformation, and modulo reduction to be implemented independently. In practical deployments, the system needs to maintain two completely separate cryptographic algorithm stacks, significantly increasing code size, memory usage, testing and verification costs, and the repetitive workload of side-channel protection. It is difficult to reuse the widely deployed and deeply optimized ML-DSA algorithm backend.

[0008] The aforementioned issues collectively limit the practicality and deployability of post-quantum identifier cryptography in standardized, large-scale, and high-performance application scenarios. Therefore, there is an urgent need for a novel identifier key encapsulation method that can fundamentally and collaboratively address security proof, decryption reliability, extraction efficiency, and data compactness, while achieving seamless compatibility and reuse with the ML-DSA standard arithmetic system. Summary of the Invention

[0009] In view of the aforementioned problems, this application is proposed to provide a post-quantum identifier key encapsulation method and apparatus that overcomes or at least partially solves the aforementioned problems, comprising: A post-quantum identification key encapsulation method, based on the NIST-standardized post-quantum cryptography ML-DSA modulus q=8380417, employs a ring NTRU trapdoor to construct the cryptographic system, and utilizes hybrid sampling for identity key extraction, including the following steps: Obtain a preset standardized parameter set and a target identity identifier, and generate public parameters, a master public key, and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; Based on the public parameters, the master public key, the master private key, and the target identity identifier, an identity decapsulation key is generated through the hybrid sampling. Based on the public parameters and the master public key, the target identity identifier generates an identity polynomial corresponding to the target identity identifier; Based on the public parameters, the master public key, and the identity polynomial, a shared key and ciphertext corresponding to the identity decapsulation key are generated.

[0010] Further, the step of obtaining a preset standardized parameter set and a target identity identifier, and generating public parameters, a master public key, and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set, includes: By using the circular NTRU trapdoor generation method, short polynomial pairs are sampled in the complex embedding domain, and circular constraints are applied to each complex embedding result of the short polynomial pairs to generate NTRU trapdoor bases and public key polynomials. A master public key is generated based on the public key polynomial, and a master private key is generated based on the NTRU trapdoor base. Based on the preset standardized parameter set, a common parameter set is generated, including ring dimension, modulus, hash function, key derivation function, message encoding parameter and ciphertext compression parameter.

[0011] Further, the step of generating an identity decapsulation key based on the public parameters, the master public key, the master private key, and the target identity identifier includes: Based on the hash rules preset by the public parameters, the target identity identifier is hash-mapped to generate an identity syndrome polynomial; Based on the key derivation rules preset by the public parameters, an extraction seed is generated using the master private key and the target identity identifier; Based on the master public key, the identity complex polynomial, and the extraction seed, a short polynomial witness that satisfies the preset congruence condition is sampled, and a specified component in the short polynomial is output as the identity decapsulation key uniquely bound to the target identity identifier.

[0012] Further, the step of generating an identity polynomial corresponding to the target identity identifier based on the public parameters, the master public key, and the target identity identifier includes: Based on the hash rules preset in the public parameters, the master public key and the target identity identifier are hashed to generate an identity polynomial corresponding to the target identity identifier; wherein, the identity polynomial is the same as the identity complex polynomial used when generating the identity decapsulation key.

[0013] Further, the step of generating a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key, and the identity polynomial includes: Sample random messages of a preset fixed length; Based on the key derivation rules preset by the public parameters, an encapsulation seed and a shared key are generated through the random message and the target identity identifier; Based on the encapsulation seed, a multi-channel noise sampling seed is generated, and three sets of noise polynomials with fixed noise widths are obtained through deterministic sampling. The first ciphertext polynomial and the second ciphertext polynomial are then generated using the master public key, the identity polynomial, and the noise polynomial. The compression rules preset by the common parameters are applied to the first ciphertext polynomial and the second ciphertext polynomial to generate ciphertext.

[0014] Furthermore, the method also includes key decapsulation, comprising the steps of: The ciphertext is decompressed to obtain a first ciphertext polynomial and a second ciphertext polynomial; The recovery polynomial is obtained based on the first ciphertext polynomial, the second ciphertext polynomial, and the identity decapsulation key; The recovery polynomial is subjected to error correction and decoding processing to obtain candidate messages and decoding success flags; Obtain the rollback key bound to the target identity, and generate a rollback message and a rollback shared key based on the rollback key and the ciphertext; Based on the candidate message, the decoding success flag, the rollback message, the target identity identifier, and the master public key, a verification encapsulation seed and a verification shared key are generated; A verification ciphertext is generated based on the verification encapsulation seed, and the verification ciphertext is compared with the ciphertext to determine the decapsulation result.

[0015] Further, the step of performing error correction decoding processing on the recovery polynomial to obtain candidate messages and decoding success flags includes: The coefficients of the recovery polynomial are grouped according to a preset number, and the average value of each group of coefficients is subjected to a threshold decision to obtain the encoded bit string; The encoded bit string is reassembled into an encoded byte string, and the corresponding error correction code is decoded according to the message layer parameters preset by the common parameters to obtain the candidate message and the decoding success flag.

[0016] A post-quantum identifier key encapsulation device, the device being implemented based on the NIST-standardized post-quantum cryptography ML-DSA modulus q=8380417, employing a ring NTRU trapdoor to construct the cryptographic system, and utilizing hybrid sampling for identity key extraction, the device implementing the steps of the post-quantum identifier key encapsulation method as described in any one of claims 1-7, including: include: The acquisition module is used to acquire a preset standardized parameter set and a target identity identifier, and generate public parameters, a master public key and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; The decapsulation key module is used to generate an identity decapsulation key through the hybrid sampling based on the public parameters, the master public key, the master private key, and the target identity identifier; An identity polynomial module is used to generate an identity polynomial corresponding to the target identity based on the public parameters, the master public key, and the target identity identifier; The encapsulation module is used to generate a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key, and the identity polynomial.

[0017] A computer electronic device includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method described in any of the preceding descriptions.

[0018] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any of the preceding claims.

[0019] This application has the following advantages: In the embodiments of this application, in contrast to the problems of existing technologies such as reliance on non-standardized moduli, incompatibility of arithmetic stacks, low efficiency of identity key extraction, insufficient decapsulation correctness, excessively large ciphertext size, and inability to adapt to large-scale deployment, this application provides a post-quantum identifier key encapsulation method and apparatus. The method includes the following steps: obtaining a preset standardized parameter set and a target identity identifier, and generating public parameters, a master public key, and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; generating an identity decapsulation key through hybrid sampling based on the public parameters, the master public key, the master private key, and the target identity identifier; generating an identity polynomial corresponding to the target identity identifier based on the public parameters, the master public key, and the identity polynomial; and generating a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key, and the identity polynomial. Through a collaborative design involving a ring NTRU trapdoor, hybrid sampling extraction, standardized modular multiplexing, and ciphertext compression, a significant breakthrough in the engineering level of post-quantum identifier cryptography is achieved: Deep arithmetic compatibility with the ML-DSA standard is realized: the core arithmetic of this scheme is entirely based on the NIST ML-DSA standard modular number q=8380417. Therefore, all its underlying operations, such as modular reduction, NTT transformation, and Montgomery multiplication, can directly reuse the highly optimized and side-channel hardened arithmetic implementations in existing ML-DSA algorithms. This eliminates the need to deploy a separate algorithm stack, greatly reducing code size, memory usage, integration verification costs, and repetitive workload for side-channel protection, providing a direct path for seamlessly embedding identifier cryptography functions into existing ML-DSA-based post-quantum systems. It combines provable security with high decryption reliability: the collaborative design of the ring NTRU trapdoor and hybrid sampling provides a theoretical foundation for the scheme's security. Meanwhile, the dedicated error-correcting coding message layer effectively compensates for the noise margin under the standard modulus, reducing the decryption failure rate to a negligible level (e.g., for 128-bit security level, DFR < 2). -180This solution meets stringent application security and reliability thresholds. It significantly improves identity key extraction efficiency: the hybrid sampler operates directly on a compact rank-2 NTRU trapdoor basis, resulting in a simple and efficient algorithm that significantly increases the private key issuance throughput of the key generation center, supporting the key management needs of a massive number of users. It maintains excellent compactness: inheriting the compact identity relationships of the DLP style, and through optimized compression parameters, this scheme produces smaller ciphertext than many existing schemes at the same security level, balancing efficient transmission and storage. In summary, this application's scheme, for the first time, systematically solves the compatibility problem with the ML-DSA standard arithmetic system in compact lattice-based identity key encapsulation, and simultaneously overcomes key bottlenecks such as decryption failure rate, extraction efficiency, and provable security. It ensures long-term quantum-resistant security and has a solid foundation for large-scale engineering deployment, allowing direct integration with the widely deployed ML-DSA ecosystem, suitable for various scenarios from cloud servers to resource-constrained embedded devices. Attached Figure Description

[0020] To more clearly illustrate the technical solution of this application, the drawings used in the description of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the steps of a post-quantum identifier key encapsulation method according to an embodiment of this application; Figure 2 This is a system architecture diagram of a post-quantum identifier key encapsulation method provided in one embodiment of this application; Figure 3 This is a flowchart illustrating the identity key extraction process of a post-quantum identifier key encapsulation method according to an embodiment of this application. Figure 4 This is a structural block diagram of a standardized quantum identifier key generation device provided in one embodiment of this application; Figure 5 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention; 1. Computer equipment; 2. External devices; 3. Processing unit; 4. Bus; 5. Network adapter; 6. I / O interface; 7. Display; 8. Memory; 9. Random access memory; 10. Cache memory; 11. Storage system; 12. Program / utility; 13. Program module. Detailed Implementation

[0022] To make the objectives, features, and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0023] The inventors, through analysis of existing technologies, discovered several insurmountable technical drawbacks in migrating existing lattice-based identifier cryptography to the NIST-standardized modular system. First, direct migration leads to a sharp deterioration in decapsulation failure rate, failing to meet security threshold requirements. Second, identity key extraction relies on complex recursive sampling frameworks such as KL-GPV and ffSampling, resulting in low PKG-end issuance throughput, making it difficult to support large-scale user scenarios. Third, the average quality index optimized by traditional trapdoor generation methods does not match the worst-case embedding imbalance required by efficient hybrid samplers, leading to excessively large sampling widths and key norm exceeding limits. Fourth, the ciphertext and identity key sizes are too large, resulting in poor applicability in bandwidth- and storage-constrained embedded environments. These issues collectively limit the practicality and deployability of post-quantum identifier cryptography in standardized environments.

[0024] Reference Figure 1 This application illustrates a post-quantum identifier key encapsulation method according to an embodiment of the present application. The method is based on the NIST standardized post-quantum cryptographic modulus q=8380417 and employs a ring NTRU trapdoor to construct the cryptographic system. The method is used to perform identifier key encapsulation and secure key exchange in a standardized post-quantum cryptographic environment, and includes the following steps: S110. Obtain a preset standardized parameter set and a target identity identifier, and generate public parameters, a master public key, and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; S120. Based on the public parameters, the master public key, the master private key, and the target identity identifier, generate an identity decapsulation key through the hybrid sampling. S130. Based on the public parameters and the master public key, the target identity identifier generates an identity polynomial corresponding to the target identity identifier; S140. Generate a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key and the identity polynomial.

[0025] In the embodiments of this application, in contrast to the problems of existing technologies such as reliance on non-standardized moduli, incompatibility of arithmetic stacks, low efficiency of identity key extraction, insufficient decapsulation correctness, excessively large ciphertext size, and inability to adapt to large-scale deployment, this application provides a post-quantum identifier key encapsulation method and apparatus. The method includes the following steps: obtaining a preset standardized parameter set and a target identity identifier, and generating public parameters, a master public key, and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; generating an identity decapsulation key based on the public parameters, the master public key, the master private key, and the target identity identifier; generating an identity polynomial corresponding to the target identity identifier based on the public parameters, the master public key, and the identity polynomial; and generating a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key, and the identity polynomial. Through a collaborative design involving a ring NTRU trapdoor, hybrid sampling extraction, standardized modular multiplexing, and ciphertext compression, a significant breakthrough in the engineering level of post-quantum identifier cryptography is achieved: Deep arithmetic compatibility with the ML-DSA standard is realized: the core arithmetic of this scheme is entirely based on the NIST ML-DSA standard modular number q=8380417. Therefore, all its underlying operations, such as modular reduction, NTT transformation, and Montgomery multiplication, can directly reuse the highly optimized and side-channel hardened arithmetic implementations in existing ML-DSA algorithms. This eliminates the need to deploy a separate algorithm stack, greatly reducing code size, memory usage, integration verification costs, and repetitive workload for side-channel protection, providing a direct path for seamlessly embedding identifier cryptography functions into existing ML-DSA-based post-quantum systems. It combines provable security with high decryption reliability: the collaborative design of the ring NTRU trapdoor and hybrid sampling provides a theoretical foundation for the scheme's security. Meanwhile, the dedicated error-correcting coding message layer effectively compensates for the noise margin under the standard modulus, reducing the decryption failure rate to a negligible level (e.g., for 128-bit security level, DFR < 2). -180This solution meets stringent application security and reliability thresholds. It significantly improves identity key extraction efficiency: the hybrid sampler operates directly on a compact rank-2 NTRU trapdoor basis, resulting in a simple and efficient algorithm that significantly increases the private key issuance throughput of the key generation center, supporting the key management needs of a massive number of users. It maintains excellent compactness: inheriting the compact identity relationships of the DLP style, and through optimized compression parameters, this scheme produces smaller ciphertext than many existing schemes at the same security level, balancing efficient transmission and storage. In summary, this application's scheme, for the first time, systematically solves the compatibility problem with the ML-DSA standard arithmetic system in compact lattice-based identity key encapsulation, and simultaneously overcomes key bottlenecks such as decryption failure rate and extraction efficiency. It ensures long-term quantum-resistant security and provides a solid foundation for large-scale engineering deployment, allowing direct integration with the widely deployed ML-DSA ecosystem, suitable for various scenarios from cloud servers to resource-constrained embedded devices.

[0026] It should be noted that, referring to Figure 2 The method proposed in this application consists of four core algorithms: system setup, identity key extraction, key encapsulation, and key decapsulation. Its technical approach is called the AHD (Annular-Hybrid-DLP) approach, which integrates ring trapdoor generation, hybrid sampling extraction, and DLP-style identity interface.

[0027] As described in step S110, a preset standardized parameter set and a target identity identifier are obtained, and public parameters, a master public key, and a master private key that satisfy the ring constraint of the complex embedded domain are generated through the preset standardized parameter set.

[0028] It should be noted that the preset standardized parameter set includes the NIST-standardized quantum cryptography modulus q=8380417, ring dimension parameters, hash function, key derivation function, message encoding parameters, and ciphertext compression parameters. By generating a ring NTRU trapdoor, a uniform constraint is applied to the polynomial embedding in the complex embedding domain, so that the generated trapdoor basis meets the worst-case embedding quality requirements of mixed sampling, thereby ensuring the feasibility, efficiency, and decapsulation correctness of subsequent identity key extraction.

[0029] As an example, the system building algorithm generates annular NTRUTrapdoor gates based on the Antrag (Annular NTRUTrapdoor Generation) method, replacing the classic DLP / Falcon style coefficient domain Gaussian trapdoor generation.

[0030] Input: Selected parameter set .

[0031] Output: Common parameters public key Master private key .

[0032] step: (1) Generate a ring-shaped NTRU trapdoor using the Antrag method This method samples short polynomial pairs in complex embedding domains. Ensure that each embedding satisfies the cyclic constraint condition:

[0033] in For the ring mass parameter, by Export: ; Solving the NTRU equation yields the auxiliary polynomial pair (F,G), forming a rank-2 trapdoor basis matrix B, and the public-key polynomial h=g×f is calculated. - ¹modq.

[0034] (2) Settings , (Trapdoor basis matrix), common parameters It includes ring parameters, hash function, message layer parameters, and compression parameters.

[0035] Key features: The annular trapdoor ensures that the Gram-Schmidt norm of all embedded elements is uniformly controlled, and the worst-case trapdoor quality meets the requirements. This provides a fundamental guarantee for subsequent Hybrid-Sampling extraction.

[0036] In one embodiment of the present invention, the specific process of step S110, "obtaining a preset standardized parameter set and a target identity identifier, and generating public parameters, a master public key and a master private key that satisfy the ring constraint of the complex embedded domain through the preset standardized parameter set", can be further described in conjunction with the following description.

[0037] As described in the following steps, the NTRU trapdoor generation method is used to sample short polynomial pairs in the complex embedding domain and apply a circular constraint condition to each complex embedding result of the short polynomial pairs to generate the NTRU trapdoor basis and public key polynomial. It should be noted that the Antrag circular NTRU trapdoor generation method applies a narrow circular constraint to each embedding result in the complex embedding domain:

[0038] in For the ring mass parameter, by Export: This constraint ensures that the Gram-Schmidt norm of all embeddings is uniformly controlled, so that the generated trapdoor basis satisfies the worst-case quality requirements. This provides the necessary prerequisite for the efficient and correct operation of the subsequent hybrid sampler.

[0039] As described in the following steps, a master public key is generated based on the public key polynomial, and a master private key is generated based on the NTRU trapdoor base; It should be noted that the master public key is composed of a public key polynomial. The system is directly constructed, with the master private key being a complete NTRU trapdoor basis matrix B. The master public key is publicly distributed to all system participants, while the master private key is secretly stored by the Key Generation Center (PKG) and used only for extracting the identity decapsulation key.

[0040] As described in the following steps, a common set of parameters is generated based on the preset standardized parameter set, including ring dimension, modulus, hash function, key derivation function, message encoding parameters, and ciphertext compression parameters.

[0041] It should be noted that the generated public parameters are global parameters shared by all system participants. Among them, the ring parameters are constructed based on the NIST standardized modulus q=8380417. The public parameter system is fully compatible with the ML-DSA standardized arithmetic components and can directly reuse the deployed modulo reduction, NTT transformation and Montgomery multiplication operators without the need to develop an additional independent arithmetic stack.

[0042] As described in step S120, an identity decapsulation key is generated through the hybrid sampling based on the public parameters, the master public key, the master private key, and the target identity identifier.

[0043] It should be noted that the technical approach of using a ring NTRU trapdoor and a hybrid sampler in tandem, replacing the traditional DLP / LATTE scheme's KL-GPV or ffSampling recursive sampling framework, fundamentally solves the bottleneck problem of low throughput in identity key extraction under standardized modulus. The generated identity decapsulation key is uniquely bound to the target identity identifier and is held only by the user, for use in subsequent key decapsulation operations.

[0044] As an example, refer to Figure 3 The identity key extraction algorithm is as follows: Input: Common parameters Master private key public key Identity string .

[0045] Output: Decapsulation key .

[0046] step: (1) Calculate the identity syndrome polynomial: .

[0047] (2) Derivation of deterministic seed extraction: .

[0048] (3) Invoke the hybrid sampler: This sampler outputs a pair of short polynomial witnesses (s0, s1) that satisfy the congruence equation. .

[0049] (4) Output Used as the identity decapsulation key.

[0050] In actual deployment, the complete decryption state obtained by the user is (t, bk) id ), where bk id It is a randomized and securely distributed key that is independent of the master private key. Bit rollback seed, or derived from t using a key derivation method.

[0051] In one embodiment of the present invention, the specific process of "generating an identity decapsulation key through the hybrid sampling based on the public parameters, the master public key, the master private key and the target identity identifier" in step S120 can be further described in conjunction with the following description.

[0052] As described in the following steps, the target identity identifier is hash-mapped according to the hash rules preset by the public parameters to generate an identity syndrome polynomial; It should be noted that the hash mapping uses the standardized HashToRq function to deterministically map identity strings of arbitrary length to a cyclic polynomial space modulo q. This process is publicly computable; the sender, receiver, and PKG can all independently compute a consistent identity syndrome polynomial based on the same master public key and identity string, without additional interaction. The generated identity syndrome polynomial is the target input for subsequent trapdoor sampling, and its uniqueness ensures that different identities correspond to different key extraction tasks.

[0053] As described in the following steps, an extraction seed is generated using the master private key and the target identity identifier, based on the key derivation rules preset by the public parameters. It should be noted that the extraction seed is deterministically derived from the master private key and the target identity identifier, ensuring that the same master private key always generates the same extraction seed for the same identity, thus achieving reusable extraction of the identity key. The master private key is hashed before participating in the derivation process, avoiding direct leakage of the master private key during the derivation process. The use of the key derivation function guarantees the generated extraction seed has cryptographically secure randomness, providing a secure random source for the subsequent hybrid sampling process, and simultaneously providing a deterministic basis for the re-encryption verification mechanism in the decapsulation stage.

[0054] As described in the following steps, based on the master public key, the identity complex polynomial and the extraction seed, a short polynomial witness that satisfies the preset congruence condition is sampled, and a specified component in the short polynomial is output as the identity decapsulation key uniquely bound to the target identity identifier.

[0055] It should be noted that using the Hybrid-Sampling sampler to perform sampling operations on the rank-2 NTRU trapdoor basis requires only two steps of random nearest-plane process and a fixed one-dimensional Gaussian sampling routine, eliminating the need for the complex recursive Gram-Schmidt orthogonalization and tree traversal required by traditional KL-GPV or ffSampling, thus significantly improving sampling efficiency.

[0056] As described in step S130, based on the public parameters and the master public key, the target identity identifier generates an identity polynomial corresponding to the target identity identifier.

[0057] It should be noted that the generated identity polynomial and the identity complex polynomial generated in the identity key extraction stage are the same mathematical object, ensuring the consistency of identity mapping in the three stages of encapsulation, extraction, and decapsulation. This is the core foundation of the identity binding relationship in the entire identifier cryptosystem. This process is publicly computable and requires no interaction with the key generation center (PKG).

[0058] As an example, the identity mapping process uses the exact same hash mapping rules as the identity key extraction process: Input: public parameter pp, master public key h, identity string id.

[0059] Output: The public identity polynomial 'a' corresponding to this identity.

[0060] Steps: Calculate a=H id (h,id)=HashToRq(Hash(h||'H')||id||'E') The mapping process is deterministic and unique. The same master public key and target identity will always generate the exact same identity polynomial, which can be calculated independently by all system participants without the need for third-party participation.

[0061] In one embodiment of the present invention, the specific process of "generating an identity polynomial corresponding to the target identity based on the public parameters and the master public key" in step S130 can be further described in conjunction with the following description.

[0062] As described in the following steps, based on the hash rules preset by the public parameters, the master public key and the target identity identifier are hashed to generate an identity polynomial corresponding to the target identity identifier; wherein, the identity polynomial is the same as the identity complex polynomial used when generating the identity decapsulation key; It should be noted that the fixed identifier in the identity mapping stage is a globally constant string preset in the standardized parameter set, independent of the fixed identifiers in the extraction and derivation stages, used to achieve strict domain separation of cryptographic primitives. By configuring a dedicated fixed identifier for the identity mapping stage, it is ensured that the input space for identity polynomial generation is completely isolated from the input space of other cryptographic operations, fundamentally avoiding cross-stage hash collision attacks and input confusion attacks, and guaranteeing the security and uniqueness of identity mapping. The hash mapping is performed using the same standardized HashToRq function as in the identity key extraction stage, and the generated identity polynomial is completely consistent with the identity polynomial generated by the PKG end. This mapping process is deterministic and unique: the same master public key and target identity always generate the same identity polynomial, and different master public keys or target identity will generate different identity polynomials. All system participants can independently calculate the consistent identity polynomial based on the public master public key and target identity without any third-party involvement, providing a unified identity input for subsequent key encapsulation and decapsulation operations.

[0063] As described in step S140, a shared key and ciphertext corresponding to the identity decapsulation key are generated based on the public parameters, the master public key and the identity polynomial.

[0064] It should be noted that by integrating general layered error correction coding and ciphertext compression technology, while ensuring quantum security strength after 128 / 192 / 256 bits, the correctness of decapsulation is significantly improved and the ciphertext size is reduced. The generated shared key can only be decrypted and obtained by the recipient holding the corresponding identity decapsulation key.

[0065] As an example, the key encapsulation algorithm is as follows: Input: Common parameters public key Identity string .

[0066] Output: Shared key and ciphertext .

[0067] step: Randomly select one Bit message m (1) Randomly select a bit of message m.

[0068] (2) Derivation of encapsulated random numbers and shared keys: . For the front Bits, K is the last 256 bits.

[0069] (3) Unpack the seed: ; Deterministic sampling small-noise polynomial: ,in ; Error correction encoded message: This Encode function performs the following operations: right Bit message m is zero-padded to form k B Bit data field m bar =m||0{k B - }

[0070] Use error correction codes such as BCH(511,k) B ,d B ) code pair m bar Encode the code to obtain a 511-bit codeword, then append one padding bit to pack it into a 512-bit (64-byte) string "ec".

[0071] Each bit b of ec t (t=0,…,511), repeatedly embedded in u=N / 512 ring coefficients. Specifically, for each t and p=0,…,u-1, set (e m ){ut+p}=b t (q-1) / 2.

[0072] Compute the ciphertext polynomial: , ; Compressed ciphertext: Apply a precision of d to the coefficients of C0 and C1 respectively. u and d v The compression function is used to concatenate the results to obtain the final ciphertext ct. .

[0073] (4) Output the shared key and ciphertext .

[0074] In one embodiment of the present invention, the specific process of "generating a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key and the identity polynomial" in step S140 can be further described in conjunction with the following description.

[0075] Sample random messages of a preset fixed length as described in the following steps; It should be noted that the fixed identifier in the encapsulation stage is an optional global constant string preset in the standardized parameter set, which is independent of the fixed identifiers in the extraction, derivation, and identity mapping stages, and is used to achieve global separation of cryptographic primitives. The length of the random message is determined by the selected error correction code and is the entropy source of the entire key encapsulation process; its randomness directly determines the security of the generated shared key.

[0076] As described in the following steps, based on the key derivation rules preset by the public parameters, and in combination with the random message and the target identity identifier, an encapsulation seed and a shared key are generated through the key derivation function preset by the public parameters; It should be noted that a deterministic key derivation mechanism is employed, ensuring that identical random messages and target identities always generate the same encapsulation seed and shared key. This mechanism provides the mathematical basis for re-encryption verification during the subsequent decapsulation stage, ensuring that the receiver can recalculate the consistent ciphertext for verification using the recovered message. The generated shared key is 32 bytes long and can be directly used for subsequent secure communication processes such as symmetric encryption and message authentication.

[0077] As described in the following steps, a multi-channel noise sampling seed is generated based on the encapsulation seed, and three sets of noise polynomials with fixed noise widths are deterministically sampled. The first ciphertext polynomial and the second ciphertext polynomial are generated by the identity polynomial and the noise polynomial. It should be noted that the sampling width of the three sets of noise polynomials is fixed at [value missing]. To ensure security while minimizing the impact of noise on decapsulation correctness, this step also encodes the random message into a message polynomial using BCH error-correcting codes and embeds it into the second ciphertext polynomial. This dual mechanism of code-level redundancy and coefficient-level redundancy improves decapsulation correctness. The generated first ciphertext polynomial is... The second ciphertext polynomial is ,in , , It is a noise polynomial. For message polynomials.

[0078] As described in the following steps, the compression rules preset by the common parameters are applied to the first ciphertext polynomial and the second ciphertext polynomial, and then concatenated to generate ciphertext.

[0079] It should be noted that a unified approach is adopted. Compression accuracy d u =21, and adjusts according to security level. Compression accuracy d vThe compression parameters are 3 for ANSA-IBKEM1, 4 for ANSA-1536, and 5 for ANSA-IBKEM2. This achieves an optimal balance between correctness and compactness. The compression operation is performed only at the beginning and end of the ciphertext generation and decapsulation stages, without affecting the reuse of intermediate core arithmetic operations and standardized components.

[0080] In one embodiment of the present invention, the method further includes key decapsulation, comprising the following steps: The ciphertext is decompressed to obtain a first ciphertext polynomial and a second ciphertext polynomial; It should be noted that the reverse process of ciphertext compression uses the exact same parameters as the compression stage to perform dequantization. The decompression process only recovers the numerical values ​​of the ciphertext coefficients and does not involve any core cryptographic operations. Its output first ciphertext polynomial C0 and second ciphertext polynomial C1 are consistent with the uncompressed ciphertext polynomial generated in the encapsulation stage within the allowable error range, providing accurate input for subsequent message recovery.

[0081] A recovery polynomial is obtained based on the first ciphertext polynomial, the second ciphertext polynomial, and the identity decapsulation key. Error correction and decoding processing is then performed on the recovery polynomial to obtain a candidate message and a decoding success flag. It should be noted that, firstly, the recovery polynomial V=C1-C0t is calculated based on the NTRU congruence relation. This calculation process can directly reuse the standardized polynomial multiplication and subtraction operators. Subsequently, BCH error-correcting codes are used to decode the recovery polynomial. Through a dual error-correction mechanism of BCH code-level redundancy and coefficient-level redundancy, the effects of noise and compression quantization errors are effectively offset. Taking the parameter example of this application, this mechanism reduces the decapsulation failure rate from 2 in direct encoding. -88 The magnitude has increased to 2 -180 (ANSA-IBKEM1) and 2 -286 (ANSA-IBKEM2) meets the correctness requirements for actual deployment.

[0082] Obtain the rollback key bound to the target identity, and generate a rollback message and a rollback shared key based on the rollback key and the ciphertext; It should be noted that the fallback key is a fixed key pre-generated and secretly stored for each identity. The fallback process uses a key derivation function to deterministically map the fallback key and ciphertext into a fallback message and a fallback shared key. When decoding fails or ciphertext verification fails, the system will output the fallback shared key instead of an error message, preventing attackers from obtaining the system's secret information through error feedback and ensuring the system's security under malicious attacks.

[0083] Based on the decoding success flag, the rollback message, the target identity identifier, and the master public key in the candidate message, a verification encapsulation seed and a verification shared key are generated; A verification ciphertext is generated based on the verification encapsulation seed, and the verification ciphertext is compared with the ciphertext to determine the decapsulation result.

[0084] It should be noted that the verification process involves re-entering the candidate message and the target identity into the encapsulation process to generate verification ciphertext, which is then compared with the original ciphertext. Only when decoding is successful and the ciphertexts are completely identical is the verification shared key output as the final result. This mechanism ensures that only legally generated ciphertext can be correctly decapsulated. Furthermore, the entire decapsulation process employs constant time, effectively resisting side-channel attacks such as timing attacks, further enhancing system security.

[0085] As an example, the decapsulation employs a re-encryption verification mechanism, returning a pseudo-random backoff key when decoding or ciphertext verification fails, implemented using a constant-time ML-DSA style. The key decapsulation algorithm is as follows: Input: Common parameters public key ,identity User decapsulation state (t, bk) id ), encrypted ct.

[0086] Output: Shared key .

[0087] step: Decompression and Decompression: Decompress ct to recover polynomials C0 and C1.

[0088] Calculate the recovery polynomial V=C1-C0t Decode(V) on V to obtain the candidate message and the decoding flag. The Decode function performs the following operations: For each bit position t, calculate the block fraction S of its corresponding u coefficients. t =Σ{p=0} u-1 min([V ut+p ] q ,q-[V ut+p ] q ).

[0089] Judgment bit b' t =1 if and only if S t ≥floor(uq / 4).

[0090] The 512 bits determined are reassembled into a byte string ec', the trailing padding bits are removed, and the first 511 bits are BCH decoded.

[0091] If decoding is successful and the decoded data is in its first... If all bits after the first bit are 0, then output the first bit. Bit is taken as m', and b is set. dec =1; otherwise, output m'=0. , and place b dec =0.

[0092] Prepare the rollback key: Calculate (m'', K) bad )=J fail (bk id ,ct)=KDF(bk id ||ct||'J').

[0093] Re-encryption verification: Determine candidate messages: m tilde =m' (if b dec =1) or m tilde =m'' (if b dec =0).

[0094] Use m tilde Re-execute the encapsulation step (using the same h and id) to generate the verification ciphertext ct' and the candidate shared key K. good .

[0095] Perform a consistency check: if b dec If = 1 and ct' == ct, then output K. good Otherwise, output K. bad .

[0096] In one embodiment of the present invention, the encoding and decoding process of the message encoding layer with preset public parameters includes: The coefficients of the recovery polynomial are grouped according to a preset number, and the average value of each group of coefficients is subjected to a threshold decision to obtain the encoded bit string; It should be noted that the coefficients of the recovered polynomial are divided into blocks of u. A threshold decision is made on the average value of the coefficients in each block. If the average value is greater than q / 2, the value is determined to be 1; otherwise, it is determined to be 0, thus recovering the encoded bit string. This threshold decision process can effectively offset the noise introduced during polynomial operations and the quantization error introduced during ciphertext compression, providing accurate input for subsequent error correction and decoding.

[0097] The encoded bit string is reassembled into an encoded byte string, and the corresponding error correction code is decoded according to the message layer parameters preset by the common parameters to obtain the candidate message and the decoding success flag.

[0098] It should be noted that the encoded byte string is decoded using the corresponding error-correcting code decoder, outputting candidate messages and a decoding success flag. When the number of errors detected during decoding is within the error-correcting capability of the error-correcting code, the decoding success flag is 1; otherwise, it is 0. Through a dual mechanism of code-level redundancy and coefficient-level redundancy, this invention reduces the decapsulation failure rate from 2% in direct encoding to 1%. -88 The magnitude has been significantly increased to 2 -180 (ANSA-IBKEM1) and 2 -286 (ANSA-IBKEM2) fully meets the correctness requirements for actual deployment.

[0099] As an example, this solution provides a BCH code implementation: The encoding process is as follows: (1) Encode the 48-byte message Encode using BCH(511,384,29) code: .

[0100] (2) Embed each encoded bit into u ring polynomial coefficients ( hour , hour , hour ), embedding value .

[0101] The decoding process is as follows: (1) The polynomial is recovered. coefficients according to The code is divided into blocks, and a threshold decision is made for each block to recover the encoded bit string.

[0102] (2) Reassemble the encoded byte string and call the BCH decoder to recover the message. .

[0103] The BCH(511,384,29) code provides 127 bits of redundancy (correcting up to 14 bits of error), and each coded bit is redundantly embedded. Among the coefficients, this dual redundancy mechanism (BCH code-level redundancy + coefficient-level redundancy) effectively restores the correctness margin under the normalized modulus, reducing the decapsulation failure rate from that of direct encoding. The magnitude has been improved to 2 -180 (ANSA-IBKEM1) and 2 -286 (ANSA-IBKEM2).

[0104] In one embodiment of this application, the scheme employs the following compression rules to reduce the ciphertext size:

[0105]

[0106] The compression parameters are: ANSA-IBKEM1: , The compressed ciphertext length is 3072; ANSA-1536: The compressed ciphertext length is 4800; ANSA-IBKEM2: The compressed ciphertext length is 6656.

[0107] Specific parameter set:

[0108] The security of this scheme is based on the assumption of difficulty in the cyclic NTRU problem and the RLWE problem. In the stochastic oracle machine model, the IND-ID-CCA security of this scheme can be reduced to these standard lattice-hard problems.

[0109] The Ring NTRU hypothesis states that, given a public key h generated by the ring trapdoor generation algorithm, it is difficult to distinguish it from a uniform random polynomial in the ring R_q.

[0110] RLWE hypothesis: It is difficult to distinguish a sample of the form (h,s+e) from a uniformly random pair, where s and e follow a specific distribution.

[0111] Security Reduction: In short, the attacker's advantage in adaptively choosing ciphertexts for the key encapsulation scheme can be translated into a distinguishing advantage over the underlying problems mentioned above. The reduction process embeds the challenging identity by programming a random oracle machine H_id and utilizes the properties of a hybrid sampler to answer adversary queries for private key extraction from the non-challenging identity in a simulator.

[0112] Specific attack cost estimation: For the above parameter set, an estimation is made based on the best current lattice attack algorithm (such as BKZ2.0 + sieve method): For ANSA-IBKEM1 (N=1024), the classical / quantum security strength required to recover the master private key is estimated to be no less than 146 / 134 bits, respectively.

[0113] For ANSA-IBKEM2 (N=2048), the classical / quantum security strength required to recover the master private key is estimated to be no less than 327 / 298 bits, respectively.

[0114] Decryption failure rate: Through the BCH-D2 / D4 message layer described in the above embodiments, this scheme greatly improves correctness. For selected parameters and compression levels, the decryption failure rate can be strictly limited to an extremely low level. ANSA-IBKEM1: DFR<2- ¹ 80 ANSA-IBKEM2: DFR<2 - ² 86 This indicator is far higher than the usual requirement of 2. - ¹² 8 or 2 - ² 56 This provides sufficient security margin for the solution when encountering decryption noise or side-channel attacks.

[0115] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0116] Reference Figure 4 This illustration shows a standardized post-quantum identifier key generation device according to an embodiment of this application. The device is based on the NIST standardized post-quantum cryptography ML-DSA modulus q=8380417, uses a ring NTRU trapdoor to construct the cryptographic system, and utilizes hybrid sampling for identity key extraction. The device implements the steps of the post-quantum identifier key encapsulation method described in any of the above claims: include: The acquisition module 410 is used to acquire a preset standardized parameter set and a target identity identifier, and generate public parameters, a master public key and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; The decapsulation key module 420 is used to generate an identity decapsulation key based on the public parameters, the master public key, the master private key, and the target identity identifier; The identity polynomial module 430 is used to generate an identity polynomial corresponding to the target identity based on the public parameters, the master public key, and the target identity identifier. The encapsulation module 440 is used to generate a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key and the identity polynomial.

[0117] In one embodiment of this application, a decapsulation module is further included, which is used to decrypt the ciphertext and restore the shared key based on the public parameters, the master public key, the identity polynomial, and the identity decapsulation key.

[0118] In one embodiment of the present invention, the acquisition module 410 includes: The public-key polynomial submodule is used to sample short polynomial pairs in the complex embedding domain through the circular NTRU trapdoor generation method, and apply circular constraints to each complex embedding result of the short polynomial pairs to generate NTRU trapdoor bases and public-key polynomials. The master private key submodule is used to generate a master public key based on the public key polynomial and to generate a master private key based on the NTRU trapdoor base. The common parameter submodule is used to generate common parameters including ring dimension, modulus, hash function, key derivation function, message encoding parameters and ciphertext compression parameters based on the preset standardized parameter set.

[0119] In one embodiment of the present invention, the decapsulation key module 420 includes: The fixed identifier submodule is used to obtain the fixed identifiers for the extraction and derivation stages that are associated with the preset standardized parameter set. The identity syndrome polynomial submodule is used to perform hash mapping on the target identity identifier to generate an identity syndrome polynomial according to the hash rules preset by the public parameters; The seed extraction submodule is used to generate an extraction seed based on the key derivation rules preset by the public parameters, using the master private key and the target identity identifier; The identity decapsulation key submodule is used to sample a short polynomial witness that satisfies a preset congruence condition based on the master public key, the identity complex polynomial and the extraction seed, and output a specified component of the short polynomial as the identity decapsulation key uniquely bound to the target identity identifier.

[0120] In one embodiment of the present invention, the identity polynomial module 430 includes: The identity polynomial generation submodule is used to perform a hash mapping on the master public key and the target identity identifier according to the hash rules preset by the public parameters to generate an identity polynomial corresponding to the target identity identifier; wherein, the identity polynomial is the same as the identity complex polynomial used when generating the identity decapsulation key.

[0121] In one embodiment of the present invention, the encapsulation module 440 includes: The random message submodule is used to sample random messages of a preset fixed length; The encapsulation seed and shared key generation submodule is used to generate an encapsulation seed and shared key based on the key derivation rules preset by the public parameters, through the random message and the target identity identifier; The ciphertext polynomial submodule is used to generate a multi-channel noise sampling seed based on the encapsulation seed, and deterministically sample to obtain three sets of noise polynomials with fixed noise widths, and generate a first ciphertext polynomial and a second ciphertext polynomial through the master public key, the identity polynomial and the noise polynomial; The ciphertext generation submodule is used to apply the preset compression rules of the common parameters to the first ciphertext polynomial and the second ciphertext polynomial and generate ciphertext.

[0122] In one embodiment of the present invention, a decapsulation module is further included, comprising: The decompression submodule is used to decompress the ciphertext to obtain a first ciphertext polynomial and a second ciphertext polynomial. The decoding processing submodule is used to obtain the recovery polynomial based on the first ciphertext polynomial, the second ciphertext polynomial, and the identity decapsulation key; The error correction and decoding submodule is used to perform error correction and decoding processing on the recovery polynomial to obtain candidate messages and decoding success flags. The rollback shared key submodule is used to obtain the rollback key bound to the target identity identifier, and generate a rollback message and a rollback shared key based on the rollback key and the ciphertext; The verification submodule is used to generate a verification encapsulation seed and a verification shared key based on the decoding success flag, the rollback message, the target identity identifier, and the master public key in the candidate message; The unsealing result submodule is used to generate verification ciphertext based on the verification encapsulation seed, and to perform a consistency comparison between the verification ciphertext and the ciphertext to determine the unsealing result.

[0123] In one embodiment of the present invention, the error correction decoding submodule includes: The encoded bit string unit is used to group the coefficients of the recovery polynomial into a preset number and perform a threshold decision on the average value of each group of coefficients to obtain the encoded bit string. The decoding unit is used to reassemble the encoded bit string into an encoded byte string, decode the corresponding error correction code according to the message layer parameters preset by the common parameters, and obtain the candidate message and the decoding success flag.

[0124] Reference Figure 5 The diagram illustrates a computer device for implementing a post-quantum identifier key encapsulation method of the present invention, which may specifically include the following: The aforementioned computer device 1 is in the form of a general-purpose computing device. The components of the computer device 1 may include, but are not limited to: one or more processors or processing units 3, memory 8, and a bus 4 connecting different system components (including memory 8 and processing unit 3).

[0125] Bus 4 represents one or more of several bus architectures, including memory buses or memory controllers, peripheral buses, graphics acceleration ports, processors, or local buses using any of the various bus architectures. For example, these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Audio / Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0126] Computer device 1 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by computer device 1, including volatile and non-volatile media, removable and non-removable media.

[0127] Memory 8 may include computer system readable media in the form of volatile memory, such as random access memory 9 and / or cache memory 10. Computer device 1 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 11 may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as a "hard disk drive"). Although Figure 5 As not shown, a disk drive for reading and writing to a removable non-volatile disk (such as a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (such as a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 4 via one or more data media interfaces. The memory may include at least one program product having a set (e.g., at least one) of program modules 13 configured to perform the functions of the embodiments of this application.

[0128] A program / utility 12 having a set (at least one) of program modules 13 may be stored, for example, in memory. Such program modules 13 include—but are not limited to—an operating system, one or more application programs, other program modules 13, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 13 typically perform the functions and / or methods described in the embodiments of this application.

[0129] Computer device 1 can also communicate with one or more external devices 2 (e.g., keyboard, pointing device, monitor 7, camera, etc.), and with one or more devices that enable an operator to interact with computer device 1, and / or with any device that enables computer device 1 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed through I / O interface 6. Furthermore, computer device 1 can communicate with one or more networks (e.g., local area network (LAN)), wide area network (WAN), and / or public networks (e.g., the Internet) through network adapter 5, and can also exchange data via medical data network protocols such as ICD protocol, DICOM protocol, and HL7 protocol. Figure 5 As shown, network adapter 5 communicates with other modules of computer device 1 via bus 4. It should be understood that, although... Figure 5Not shown, it can be combined with computer device 1 to use other hardware and / or software modules, including but not limited to: microcode, device drivers, redundant processing unit 3, external disk drive array, RAID system, tape drive and data backup storage system 11, etc.

[0130] The processing unit 3 executes various functional applications and data processing by running programs stored in memory 8, such as implementing a post-quantum identifier key encapsulation method provided in the embodiments of this application.

[0131] That is, when the above processing unit 3 executes the above program, it achieves the following: obtaining a preset standardized parameter set and a target identity identifier, and generating public parameters, a master public key and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; Generate an identity decapsulation key based on the public parameters, the master public key, the master private key, and the target identity identifier; Based on the public parameters, the master public key, and the target identity identifier, an identity polynomial corresponding to the target identity identifier is generated through the hybrid sampling. Based on the public parameters, the master public key, and the identity polynomial, a shared key and ciphertext corresponding to the identity decapsulation key are generated.

[0132] In this application embodiment, the application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a post-quantum identifier key encapsulation method as provided in all embodiments of the application.

[0133] That is, when the program is executed by the processor, it implements the following: obtaining a preset standardized parameter set and the target identity identifier, and generating public parameters, a master public key and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; Generate an identity decapsulation key based on the public parameters, the master public key, the master private key, and the target identity identifier; Based on the public parameters, the master public key, and the target identity identifier, an identity polynomial corresponding to the target identity identifier is generated through the hybrid sampling. Based on the public parameters, the master public key, and the identity polynomial, a shared key and ciphertext corresponding to the identity decapsulation key are generated.

[0134] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0135] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0136] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the operator's computer, partially on the operator's computer, as a standalone software package, partially on the operator's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the operator's computer via any type of network—including a local area network (LAN) or wide area network (WAN) that is compatible with medical network standards such as HL7 for HIS, RIS, and LIS systems—or it can be connected to an external computer (e.g., via the Internet using an Internet service provider). The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably.

[0137] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0138] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0139] The above provides a detailed description of the post-quantum identifier key encapsulation method and apparatus provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A post-quantum identifier key encapsulation method, characterized in that, The method is based on the NIST-standardized quantum cryptography ML-DSA modulus q=8380417, employs a ring NTRU trapdoor to construct the cryptographic system, and utilizes hybrid sampling for identity key extraction, including the following steps: Obtain a preset standardized parameter set and a target identity identifier, and generate public parameters, a master public key, and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; Based on the public parameters, the master public key, the master private key, and the target identity identifier, an identity decapsulation key is generated through the hybrid sampling. Based on the public parameters and the master public key, the target identity identifier generates an identity polynomial corresponding to the target identity identifier; Based on the public parameters, the master public key, and the identity polynomial, a shared key and ciphertext corresponding to the identity decapsulation key are generated; It also includes a key decapsulation step, including: The ciphertext is decompressed to obtain a first ciphertext polynomial and a second ciphertext polynomial; The recovery polynomial is obtained based on the first ciphertext polynomial, the second ciphertext polynomial, and the identity decapsulation key; The recovery polynomial is subjected to error correction and decoding processing to obtain candidate messages and decoding success flags; Obtain the rollback key bound to the target identity, and generate a rollback message and a rollback shared key based on the rollback key and the ciphertext; Based on the candidate message, the decoding success flag, the rollback message, the target identity identifier, and the master public key, a verification encapsulation seed and a verification shared key are generated; A verification ciphertext is generated based on the verification encapsulation seed, and the verification ciphertext is compared with the ciphertext to determine the decapsulation result.

2. The method according to claim 1, characterized in that, The steps of obtaining a preset standardized parameter set and a target identity identifier, and generating public parameters, a master public key, and a master private key that satisfy the ring constraint of the multiple embedded domain using the preset standardized parameter set, include: By using the circular NTRU trapdoor generation method, short polynomial pairs are sampled in the complex embedding domain, and circular constraints are applied to each complex embedding result of the short polynomial pairs to generate NTRU trapdoor bases and public key polynomials. A master public key is generated based on the public key polynomial, and a master private key is generated based on the NTRU trapdoor base. Based on the preset standardized parameter set, a common parameter set is generated, including ring dimension, modulus, hash function, key derivation function, message encoding parameter and ciphertext compression parameter.

3. The method according to claim 1, characterized in that, The step of generating an identity decapsulation key based on the public parameters, the master public key, the master private key, and the target identity identifier includes: Based on the hash rules preset by the public parameters, the target identity identifier is hash-mapped to generate an identity syndrome polynomial; Based on the key derivation rules preset by the public parameters, an extraction seed is generated using the master private key and the target identity identifier; Based on the master public key, the identity complex polynomial, and the extraction seed, a short polynomial witness that satisfies the preset congruence condition is sampled, and a specified component in the short polynomial is output as the identity decapsulation key uniquely bound to the target identity identifier.

4. The method according to claim 1, characterized in that, The step of generating an identity polynomial corresponding to the target identity based on the public parameters, the master public key, and the target identity includes: Based on the hash rules preset in the public parameters, the master public key and the target identity identifier are hashed to generate an identity polynomial corresponding to the target identity identifier; wherein, the identity polynomial is the same as the identity complex polynomial used when generating the identity decapsulation key.

5. The method according to claim 1, characterized in that, The step of generating a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key, and the identity polynomial includes: Sample random messages of a preset fixed length; Based on the key derivation rules preset by the public parameters, a sealing seed and a shared key are generated using the random message, the target identity identifier, and the master public key; Based on the encapsulation seed, a multi-channel noise sampling seed is generated, and three sets of noise polynomials with fixed noise widths are obtained through deterministic sampling. The first ciphertext polynomial and the second ciphertext polynomial are then generated using the master public key, the identity polynomial, and the noise polynomial. The compression rules preset by the common parameters are applied to the first ciphertext polynomial and the second ciphertext polynomial to generate ciphertext.

6. The method according to claim 5, characterized in that, The step of performing error correction decoding on the recovery polynomial to obtain candidate messages and decoding success flags includes: The coefficients of the recovery polynomial are grouped according to a preset number, and the average value of each group of coefficients is subjected to a threshold decision to obtain the encoded bit string; The encoded bit string is reassembled into an encoded byte string, and the corresponding error correction code is decoded according to the message layer parameters preset by the common parameters to obtain the candidate message and the decoding success flag.

7. A post-quantum identifier key encapsulation generation device, characterized in that, The device is based on the NIST-standardized post-quantum cryptography ML-DSA modulus q=8380417, employs a ring NTRU trapdoor to construct the cryptographic system, and utilizes hybrid sampling for identity key extraction. The device implements the steps of the post-quantum identifier key encapsulation method as described in any one of claims 1-6: include: The acquisition module is used to acquire a preset standardized parameter set and a target identity identifier, and generate public parameters, a master public key and a master private key that satisfy the ring constraint of the complex embedding domain through the preset standardized parameter set; The decapsulation key module is used to generate an identity decapsulation key through the hybrid sampling based on the public parameters, the master public key, the master private key, and the target identity identifier; An identity polynomial module is used to generate an identity polynomial corresponding to the target identity based on the public parameters, the master public key, and the target identity identifier; The encapsulation module is used to generate a shared key and ciphertext corresponding to the identity decapsulation key based on the public parameters, the master public key, and the identity polynomial.

8. A computer electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the method as described in any one of claims 1 to 6.

Images