Key encapsulation method, apparatus and storage medium based on module lattice key exchange

Abstract

The application discloses a key encapsulation method and device based on a module lattice key exchange and a storage medium, and comprises the following steps: an initiator generates a random number seed and a random number, obtains a temporary public key, and sends a responder; the responder generates a first random number, derives four random numbers, calculates a temporary key, obtains a shared key of both parties through segmented signal functions and coordination processing, obtains random number ciphertext, and further derives a final key; the initiator recovers data from the compressed public key of the received responder and calculates a temporary key, obtains a shared key of both parties through coordination processing, checks through generated responder data, and if the checking is passed, the final key is obtained; if the checking fails, the initiator inputs the random number, the received random number ciphertext and the temporary public key of the initiator into a key derivation function to obtain the final key. The application has ciphertext security, has the same security level as the lattice-based KEM standard, and directly derives the final generated key based on the shared secret, and has higher fairness.

Description

Technical Field

[0001] This invention belongs to the field of cryptography technology and relates to a key encapsulation method, apparatus and storage medium based on modular lattice key exchange, specifically a key encapsulation method, apparatus and storage medium based on Ding's key exchange. Background Technology

[0002] Modern information security systems heavily rely on public-key cryptography primitives to implement core functions such as key negotiation, authentication, and data encryption. Among these, the Key Encapsulation Mechanism (KEM), as a cryptographic primitive for securely transmitting symmetric keys to a receiver, has been widely used in hybrid encryption architectures (such as TLS 1.3 and IPsec). The basic operating mode of the KEM is as follows: the initiator first uses a public-key encryption algorithm to generate its own public-private key pair, sends its public key to the recipient, and then the recipient also generates its own public-private key pair, generates a key, encrypts and encapsulates this key, and sends ciphertext to the initiator. Upon receiving the ciphertext, the initiator decrypts it using its own private key, thus ensuring that both parties possess the same key.

[0003] However, the security of current mainstream KEM schemes (such as those based on RSA-OAEP or elliptic curve integrated encryption schemes ECIES and PSEC-KEM) is based on classical computational problems such as integer factorization or discrete logarithms. With the continuous breakthroughs in quantum computing theory and hardware, Shor's algorithm can solve the above mathematical problems in polynomial time, making existing KEM completely insecure against attackers with practically large-scale quantum computers.

[0004] To address this "quantum threat," academia and industry have been vigorously promoting the development of post-quantum cryptography (PQC) in recent years. The National Institute of Standards and Technology (NIST) launched the PQC standardization project in 2016, aiming to select public-key cryptography and KEM standards that can withstand both classical and quantum attacks. In this process, lattice-based cryptographic schemes have become the most popular technical approach due to their robust security reductions (such as reduction to Learning With Errors, LWE, or its ring variant Ring-LWE problem), good performance, and support for forward secrecy. For example, NIST standardized the lattice-based KEM standard FIPS 203 ML-KEM in 2024. Summary of the Invention

[0005] To address the aforementioned issues, this invention provides a key encapsulation method based on modular lattice key exchange. This method offers selected ciphertext security, achieving the same level of security as lattice-based KEM standards such as ML-KEM. Furthermore, it directly derives the final generated key from a shared secret, resulting in higher fairness.

[0006] A second objective of this invention is to provide a key encapsulation device based on modular key exchange.

[0007] A third objective of this invention is to provide a computer storage medium.

[0008] The technical solution adopted in this invention is a key encapsulation method based on modular key exchange, comprising the following steps:

[0009] S1, the initiator generates a random number seed and a random number rej, obtains a temporary public key based on the random number seed, and sends the temporary public key and seed to the responder;

[0010] S2, the responder generates a first random number and derives four random numbers, obtaining a compressed public key based on the received random number seed; a temporary key is calculated based on the received initiator's temporary public key; the temporary key and the derived random numbers are processed by a segmented signal function to obtain a signal value, and the temporary key is coordinated to obtain a shared key between the two parties; the ciphertext of the random number is obtained based on the shared key, and then the final key is derived; the compressed public key, the signal value, and the ciphertext of the random number are sent to the initiator.

[0011] S3, the initiator recovers data from the received responder's compressed public key and calculates a temporary key. The temporary key is then coordinated using the received signal value to obtain a shared key between the two parties. The initiator verifies the data generated by the responder. If the verification passes, the same final key is obtained through the same key derivation function. If the verification fails, the initiator inputs the random number rej, the received random number ciphertext, and its own temporary public key into the key derivation function to calculate the final key.

[0012] Furthermore, in step S1, the method for obtaining the temporary public key is as follows: a public parameter matrix is ​​generated based on the random number seed, a temporary private key vector and an error vector are generated through random sampling, and then the temporary public key is calculated. The temporary public key is equal to the product of the public parameter matrix and the temporary private key vector plus the error vector.

[0013] The common parameter matrix is ​​a polynomial ring. The elements of the temporary private key vector and the error vector are all in the multidimensional matrix on the surface. Small polynomials in.

[0014] Furthermore, in step S2, the method for obtaining the compression public key is as follows:

[0015] Using the received random number seed, a public parameter matrix identical to that of the initiator is generated. A temporary private key vector and an error vector are generated using two of the derived random numbers. Then, a temporary public key is calculated, which is equal to the product of the public parameter matrix and the transpose of the temporary private key vector, plus the transpose of the error vector. Finally, a compression function is used to obtain the compressed public key.

[0016] The elements in the temporary private key vector and the error vector are all Small polynomials in.

[0017] Furthermore, the method for calculating the temporary key:

[0018] The responder generates an error using a third derived random number. The product of the transpose of the temporary private key vector and the received initiator's temporary public key, plus the error... Then multiply the sum by 2 to obtain the responder's temporary key.

[0019] Furthermore, in step S2, the signal value is obtained:

[0020] mold Integer ring Divided into Sub-intervals, Integers greater than zero;

[0021] Construct the segmented signal function :right elements in First from Random sampling was obtained ,if In the In each subinterval, then define The signal value is ; Calculate the signal value using the fourth derived random number;

[0022] The coordination process involves: first, calculating the responder's temporary key minus the offset, where the offset is the product of the width of each sub-interval and the signal value; then, moduloing the difference... The calculation is performed, and finally the modulus is... The result of the operation is modulo-2 to obtain the reconciled bit value.

[0023] Furthermore, in step S2, the method for deriving the final key is as follows:

[0024] The shared key between the two parties after coordination is XORed with the first random number to generate a random number ciphertext. The final key is then calculated using a key derivation function. The input data of the key derivation function includes the shared key between the two parties after coordination, the random number ciphertext, and the received temporary public key of the initiator.

[0025] Furthermore, in step S3, the method for calculating the temporary key is as follows:

[0026] The initiator decompresses the received compressed public key to obtain the decompressed temporary public key of the responder, with random sampling error. The product of the decompressed responder's temporary public key and the initiator's temporary private key vector, plus the random sampling error. Then multiply the sum by 2 to get the temporary key.

[0027] Furthermore, the temporary public key mentioned in step S1 is sent directly without compression, or it is compressed using a compression function before being sent; when the temporary public key is compressed, the responder decompresses it before calculating the temporary key;

[0028] The compression function is: to convert the modulus... Integer ring elements in Compressed into integer modulo Remaining ring elements in The decompression is the inverse operation of the compression function.

[0029] A key encapsulation device includes an initiator device and a responder device, both of which are equipped with a processor and a memory. The memory stores a computer program, and when the processor executes the computer program, it implements the aforementioned key encapsulation method based on modular key exchange.

[0030] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the aforementioned key encapsulation method based on modular key exchange.

[0031] The beneficial effects of this invention are:

[0032] 1. This invention designs a compression / decompression mechanism that does not require parity checking, combined with... and increase This design ensures that the coefficient of the error is even, allowing the error to be eliminated through modulo-2 operations. Compared to the original Ding's key exchange protocol's compression and decompression mechanism that maintains parity, this design effectively reduces the probability of failure.

[0033] 2. During encapsulation, this invention performs an XOR operation on the responder's random number and the shared secret between the two parties to encrypt the responder's random number. During decapsulation, the initiator can perform an XOR operation on its calculated shared secret and the ciphertext of the random number to decrypt the random number. This random number is then used to recover the responder's public key, signal, and shared secret. Consistency is then checked to ensure data randomness and to detect tampering with the encapsulated data, thus achieving selected ciphertext security. Furthermore, when the secret data shared by both parties... and Inconsistencies will also cause verification to fail, thus making it detectable. This method of encryption and decryption, which uses an XOR operation between a random number and a shared secret, does not involve complex calculations or large amounts of data, making it simple to implement and highly efficient.

[0034] 3. This invention uses the secret shared by both parties generated by Ding's key exchange to directly derive the final key, thereby ensuring the fairness and temporariness of the final key generation and thus guaranteeing its security.

[0035] This invention has significant industrial applicability. Addressing the industrial pain point of existing public-key cryptosystems (such as RSA-OAEP) being vulnerable to quantum computing cracking, it provides a modular lattice-based key exchange protocol. By multiplying the temporary key by 2 to make the error even, and then using modulo-2 operations to eliminate the error, the probability of failure is reduced. Encryption and decryption are achieved by XORing a random number and a shared secret, avoiding complex calculations or large amounts of data computation. The implementation is simple and highly efficient, thereby improving the efficiency of key encapsulation and decapsulation. The final key is directly derived from the shared secret generated by the key exchange to ensure its security, demonstrating significant industrial application value. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is the logic flow of the encapsulation method in the embodiments of the present invention.

[0038] Figure 2 This is a flowchart of the encapsulation method according to an embodiment of the present invention. Detailed Implementation

[0039] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0040] Auxiliary functions used in the embodiments of this invention:

[0041] Divide the signal into intervals: Let are integers greater than zero and satisfying , making and All are integers. The signal interval... Divided into A small subset , , The width of each sub-interval is approximately .

[0042] Segmented signal function :right elements in First from Random sampling was obtained (Right now There is a 50% probability that it will be 0 or 1), if In the interval In the middle, then define The signal is The purpose of random sampling here is to eliminate statistical bias in the signal function. The signal function can be naturally extended to... Above, that is, applying a signal function to each coefficient of the polynomial.

[0043] The coordination function after splitting According to the signal Bundle elements in The following formula maps the signal to 0 or 1. If the signal is 0, it indicates that the signal is within the interval [0, 1]. Then directly Modulo 2 results in 0 or 1 (if) If it is even, then it is 0; otherwise, it is 1. This indicates the interval. ,but minus After (its function is from the interval) Rotate to interval Modulo 2 again. Expressed as a formula: The coordination function can be naturally extended to Above, that is, applying a coordination function to each coefficient of the polynomial.

[0044] Compression function :Bundle elements in Compressed into The elements in the code are used to reduce the amount of data transmitted. Specifically, they are defined as follows: first, the elements in the code are... After scaling down proportionally, round down to the nearest whole number. . Represents the modulus of an integer The remaining class ring.

[0045] decompression function The inverse operation of the compression function, that is, to compress... elements in Restore to The element in the text is specifically defined as follows: first, put... Scaled up proportionally and then rounded down to the nearest whole number. .

[0046] An embodiment of the key encapsulation method based on modular key exchange, which, based on Ding Key Exchange, employs several optimization methods to directly construct a new key encapsulation mechanism, called the Ding Key Encapsulation Mechanism (DKEM), as follows: Figures 1-2 As shown, it includes the following steps:

[0047] S1, the initiator generates a public-private key pair (Ding-KEM-KeyGen).

[0048] The initiator generates a A random number seed is used to generate a polynomial ring. On matrix As a common parameter, it is then generated through random sampling. dimensional vector As a temporary private key and As for the error, the elements of both are The small polynomial in the formula is then used to calculate the temporary public key. ,Bundle The seed is sent to the responder. Compression is not performed by default. However, compression can be selected. Additionally, the initiator randomly generates one. The random number rej is used in case of subsequent decapsulation errors.

[0049] S2, Responder Encapsulation Key (Ding-KEM-Encaps);

[0050] The responder generates a random number of bits and derived This will be used to generate the data needed in the following steps. Derived function for key. Indicates based on random numbers Four random numbers are derived from this.

[0051] The responder uses a seed to generate the same matrix as the initiator. Then use respectively generate dimensional vector As a temporary private key and As an error vector, the elements of both are The small polynomial in the formula is then used to calculate the temporary public key. , This is the transpose of the temporary private key vector. This is the transpose of the error vector; then it is compressed using a compression function. get .

[0052] Response side generate As an error, calculate the temporary key. and signal value ,in Random sampling is used in signal computation, and then the signal is used to calculate the shared key between the two parties. This is confidential data shared by both parties. The above-described coordination function after segmentation signal value in .

[0053] The responder calculates random numbers ciphertext The final key is derived. Then, compress the public key. ,Signal and random number ciphertext Send to the initiator.

[0054] S3, Ding-KEM-Decapsulation;

[0055] The initiator uses a decompression function to extract from... get Random sampling As an error, then calculate Then use a signal calculate As shared secret data; This is the coordination function after partitioning.

[0056] The initiator performs verification by generating response data, first recovering a random number. Derived from Then use respectively generate dimensional vector and ,calculate Then compress using a compression function. get ,use Generation error Then calculate and calculate signals Then use the signal to calculate .examine Is it equal to the received compressed public key? , Is it equal to the received signal? , Is it equal to If all are equal, it means the initiator received the data. It is correct, it has not been tampered with, and and They are consistent and can output the final key. If one of the discrepancies is not equal, it indicates that the received data has a very high probability of being tampered with, or that it has not been tampered with but has only occurred with a very low probability. Then calculate To defend against side-channel attacks.

[0057] The key encapsulation method for encrypted security designed in this embodiment of the invention recommends using specific parameter settings similar to the NIST standard ML-KEM, and the same central binomial distribution to generate the private key and noise vector, because it has undergone rigorous efficiency and security verification. Under this setting, compared to the original Ding Key Exchange protocol (standard proposal: DingKey Exchange, NIST submission 2017), the communication data size, performance, security level, and failure probability of this embodiment of the invention are significantly improved, reaching a level similar to the NIST standard ML-KEM. Unlike ML-KEM, where the final key is mainly determined by the responder, the final key in this embodiment of the invention is directly derived from the shared secret of the Ding Key Exchange protocol and generated through mutual negotiation, resulting in higher fairness.

[0058] parameter The size of the compressed public key is Bytes, Seed (32 bytes), Signal The total data for communication includes 32 bytes of public key and seed from party A, and 32 bytes of compressed public key, signal, and random number ciphertext from party B. Table 1 shows the specific recommended parameters and the corresponding public key and other data sizes and failure probabilities for this embodiment of the invention. The public key in Table 1 is the uncompressed public key size of the initiator. For comparison, the relevant data for the NIST standard ML-KEM is shown in Table 2, where the data size is in bytes.

[0059] Table 1. Relevant data of the embodiments of the present invention.

[0060]

[0061] Table 2. Relevant data for NIST standard ML-KEM

[0062]

[0063] The key encapsulation method based on modular key exchange described in this invention, when implemented as a software functional module and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the key encapsulation method based on modular key exchange described in this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, external hard drives, ROM, RAM, magnetic disks, or optical disks.

[0064] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A key encapsulation method based on modular key exchange, characterized in that, Includes the following steps: S1, the initiator generates a random number seed and a random number rej, obtains a temporary public key based on the random number seed, and sends the temporary public key and the random number seed to the responder; S2, the responder generates the first random number and derives four random numbers, and obtains the compressed public key based on the received random number seed; A temporary key is calculated based on the received temporary public key from the initiator. The temporary key and the derived random number are processed by a segmented signal function to obtain a signal value. The temporary key is then coordinated to obtain a shared key between the two parties. Based on the shared key, a random number ciphertext is obtained, and the final key is derived. The compressed public key, the signal value, and the random number ciphertext are then sent to the initiator. S3, the initiator recovers data from the received responder's compressed public key and calculates a temporary key. The temporary key is then coordinated using the received signal value to obtain a shared key between the two parties. The initiator verifies the data generated by the responder. If the verification passes, the same final key is obtained through the same key derivation function. If the verification fails, the initiator inputs the random number rej, the received random number ciphertext, and its own temporary public key into the key derivation function to calculate the final key.

2. The key encapsulation method based on modular key exchange according to claim 1, characterized in that, In step S1, the method for obtaining the temporary public key is as follows: a public parameter matrix is ​​generated based on the random number seed, a temporary private key vector and an error vector are generated through random sampling, and then the temporary public key is calculated. The temporary public key is equal to the product of the public parameter matrix and the temporary private key vector plus the error vector. The common parameter matrix is ​​a polynomial ring. The elements of the temporary private key vector and the error vector are all in the multidimensional matrix on the surface. Small polynomials in.

3. The key encapsulation method based on modular key exchange according to claim 2, characterized in that, In step S2, the method for obtaining the compression public key is as follows: Using the received random number seed, a public parameter matrix identical to that of the initiator is generated. A temporary private key vector and an error vector are generated using two of the derived random numbers. Then, a temporary public key is calculated, which is equal to the product of the public parameter matrix and the transpose of the temporary private key vector, plus the transpose of the error vector. Finally, a compression function is used to obtain the compressed public key. The elements in the temporary private key vector and the error vector are all Small polynomials in.

4. The key encapsulation method based on modular key exchange according to claim 3, characterized in that, In step S2, the method for calculating the temporary key is as follows: The responder generates an error using a third derived random number. The product of the transpose of the temporary private key vector and the received initiator's temporary public key, plus the error... Then multiply the sum by 2 to obtain the responder's temporary key.

5. The key encapsulation method based on modular key exchange according to claim 4, characterized in that, In step S2, the signal value is obtained: mold Integer ring Divided into Sub-intervals, Integers greater than zero; Construct the segmented signal function :right elements in First from Random sampling was obtained ,if In the In each subinterval, then define The signal value is ; Calculate the signal value using the fourth derived random number; The coordination process involves: first, calculating the responder's temporary key minus the offset, where the offset is the product of the width of each sub-interval and the signal value; then, moduloing the difference... The calculation is performed, and finally the modulus is... The result of the operation is modulo-2 to obtain the reconciled bit value.

6. The key encapsulation method based on modular key exchange according to claim 1, characterized in that, In step S2, the method for deriving the final key is as follows: The shared key between the two parties after coordination is XORed with the first random number to generate a random number ciphertext. The final key is then calculated using a key derivation function. The input data of the key derivation function includes the shared key between the two parties after coordination, the random number ciphertext, and the received temporary public key of the initiator.

7. The key encapsulation method based on modular key exchange according to claim 1, characterized in that, In step S3, the method for calculating the temporary key is as follows: The initiator decompresses the received compressed public key to obtain the decompressed temporary public key of the responder, with random sampling error. The product of the decompressed responder's temporary public key and the initiator's temporary private key vector, plus the random sampling error. Then multiply the sum by 2 to get the temporary key.

8. The key encapsulation method based on modular key exchange according to claim 3, characterized in that, The temporary public key mentioned in step S1 can be sent directly without compression, or compressed using a compression function before being sent; when the temporary public key is compressed, the responder should decompress it before calculating the temporary key. The compression function is: to convert the modulus... Integer ring elements in Compressed into integer modulo Remaining ring elements in The decompression is the inverse operation of the compression function.

9. A key encapsulation device, characterized in that, It includes an initiating device and a responding device, both of which are equipped with a processor and a memory. The memory stores a computer program, and when the processor executes the computer program, it implements a key encapsulation method based on modular key exchange as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements a key encapsulation method based on modular key exchange as described in any one of claims 1 to 8.

Images