Encryption and decryption method, device, computer equipment and program product

Abstract

This application discloses an encryption / decryption method, apparatus, computer device, and program product, belonging to the field of computer technology. In this application embodiment, when the ring modulus of a polynomial ring does not meet the parameter requirements of NTT (Network Tolerance), the allowable out-of-bounds probability is obtained, and then the ring modulus is increased based on the allowable out-of-bounds probability. The allowable out-of-bounds probability can be understood as the tolerable out-of-bounds probability. Compared to directly setting the increased ring modulus based on the ring modulus and ring dimension of the polynomial ring, because this application embodiment considers the tolerable out-of-bounds probability when increasing the ring modulus, the increased ring modulus is not too large. This avoids the problem that the optimization effect of accelerating polynomial multiplication through NTT is not significant after increasing the ring modulus. Therefore, the solution provided by this application embodiment can improve the data encryption or decryption efficiency in cryptographic algorithms.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an encryption / decryption method, apparatus, computer equipment, and program product. Background Technology

[0002] Polynomial multiplication is used in many data processing stages of cryptographic algorithms, such as data encryption and decryption. Polynomial multiplication involves multiplying two polynomials within a polynomial ring. Currently, number theoretic transform (NTT) techniques are frequently used to optimize the efficiency of polynomial multiplication. However, NTT techniques have requirements regarding the parameters of the polynomial ring to which the two polynomials being multiplied belong; for example, the ring modulus must be 2. k The form is p'+1, where p' is a prime number. If the ring modulus of the polynomial ring does not meet the parameter requirements of NTT, the ring modulus can be increased using ring modulus boosting techniques.

[0003] In related technologies, it is considered that the absolute value of the coefficients of the polynomial resulting from the product of any two polynomials in a polynomial ring is usually greater than nq. 2 / 4, where n is the ring dimension of the polynomial ring and q is the ring modulus of the polynomial ring. Therefore, the boosted ring modulus can be directly set to: the boosted modulus is greater than nq. 2 / 2 and the improved modulus can be written as 2 k The form is p'+1, where p' is a prime number. However, the ring modulus improved by this ring modulus enhancement technique is sometimes too large, making the effect of optimizing polynomial multiplication efficiency through NTT not obvious. Summary of the Invention

[0004] This application provides an encryption / decryption method, apparatus, computer device, and program product, which can improve the efficiency of encrypting or decrypting data in cryptographic algorithms. The technical solution is as follows:

[0005] Firstly, an encryption method is provided, in which a public key and a random number are obtained, the public key is converted into a first polynomial, and the random number is converted into a second polynomial. The first and second polynomials are polynomials in a first polynomial ring, and the first polynomial ring corresponds to a first ring modulus. If the first ring modulus does not satisfy the parameter requirements of the number-theoretic transformation NTT, a first allowed out-of-bounds probability is obtained. The first allowed out-of-bounds probability refers to the probability that the coefficients of a third polynomial are allowed to exceed the boundary. The third polynomial is the polynomial obtained by multiplying the first and second polynomials. Based on the first allowed out-of-bounds probability, the first ring modulus is increased to a second ring modulus, and the second ring modulus satisfies the parameter requirements of NTT. Based on the second ring modulus, the public key and the random number are multiplied by NTT to obtain a mask, and the plaintext is encrypted into ciphertext based on the mask.

[0006] In the encryption scheme provided in this application embodiment, when the first ring modulus of the first polynomial ring corresponding to the public key and the random number does not meet the parameter requirements of NTT, a first allowed out-of-bounds probability is obtained. Then, based on the first allowed out-of-bounds probability, the first ring modulus is increased to a second ring modulus to generate a mask. The allowed out-of-bounds probability can be understood as the tolerable out-of-bounds probability. Compared to directly setting the increased second ring modulus based on the ring modulus and ring dimension of the polynomial ring, since this application embodiment considers the tolerable out-of-bounds probability when increasing the ring modulus, the increased ring modulus is not too large. This avoids the problem that the optimization effect of accelerating polynomial multiplication through NTT is not significant after increasing the ring modulus. Therefore, the scheme provided in this application embodiment can improve the efficiency of mask generation in the encryption process, thereby improving data encryption efficiency. Furthermore, since the increased modulus obtained through the scheme provided in this application embodiment is not too large, the scheme provided in this application embodiment can also be called a compact ring modulus increase technique.

[0007] Based on the method provided in the first aspect, in one possible implementation, the method of increasing the first ring modulus to the second ring modulus based on the first allowed out-of-bounds probability can be as follows: determine the predicted standard deviation of the coefficient distribution of the third polynomial; based on the predicted standard deviation of the coefficient distribution of the third polynomial, the first allowed out-of-bounds probability, and the target mapping relationship, solve for the first boundary that satisfies the predicted standard deviation of the coefficient distribution of the third polynomial and the first allowed out-of-bounds probability, wherein the target mapping relationship is used to indicate the correspondence between the coefficient distribution standard deviation, the out-of-bounds probability, and the boundary; and determine the second ring modulus based on the first boundary.

[0008] In this embodiment, the allowed out-of-bounds probability can refer to the probability of allowing any single coefficient to go out of bounds, or it can refer to the probability of allowing one or more coefficients among all coefficients of the polynomial to go out of bounds. For ease of explanation later, the former is referred to as the allowed out-of-bounds probability of a single coefficient, and the latter as the allowed out-of-bounds probability of all coefficients. Correspondingly, there can be two types of target mapping relationships: one is the target mapping relationship corresponding to the probability of any single coefficient going out of bounds (i.e., the allowed out-of-bounds probability of a single coefficient), and the other is the target mapping relationship corresponding to the probability of one or more coefficients among all coefficients of the polynomial going out of bounds (i.e., the allowed out-of-bounds probability of all coefficients). For ease of explanation later, the former is referred to as the first target mapping relationship, and the latter as the second target mapping relationship. Therefore, in this embodiment, the target mapping relationship can be flexibly selected to determine the first boundary.

[0009] Based on the method provided in the first aspect, in one possible implementation, the number of second ring modules is 1, and the number of second ring modules is greater than or equal to the first boundary.

[0010] In this embodiment of the application, if the first ring modulus is increased to a second ring modulus, the second ring modulus must be greater than or equal to the first boundary in order to meet the requirement of the allowed out-of-bounds probability.

[0011] Based on the method provided in the first aspect, in one possible implementation, the number of second ring modules is multiple, and the total product of the multiple second ring modules is greater than or equal to the first boundary.

[0012] In this embodiment of the application, in order to avoid the second ring modulus being too large when the first ring modulus is increased to a second ring modulus, it is also possible to choose to increase the first ring modulus to multiple smaller second ring modulus. In this scenario, the total product of multiple second ring modulus must be greater than or equal to the first boundary in order to meet the requirement of the allowed out-of-bounds probability.

[0013] Based on the method provided in the first aspect, in one possible implementation, the method of increasing the first ring modulus to the second ring modulus based on the first allowed out-of-bounds probability can be as follows: decompose the first polynomial into multiple sub-first polynomials, and process each of the multiple sub-first polynomials according to the following processing method for the target sub-first polynomial, to obtain multiple second ring moduli corresponding one-to-one with the multiple sub-first polynomials, and multiply each sub-first polynomial and the second polynomial by NTT based on the second ring modulus corresponding to each sub-first polynomial, wherein the target sub-first polynomial is any one of the multiple sub-first polynomials:

[0014] Determine the predicted standard deviation of the coefficient distribution of the target sub-third polynomial, which is the polynomial obtained by multiplying the target sub-first polynomial and the second polynomial; based on the predicted standard deviation of the coefficient distribution of the target sub-third polynomial, the first allowable out-of-bounds probability, and the target mapping relationship, solve for the second boundary that satisfies the predicted standard deviation of the coefficient distribution and the first allowable out-of-bounds probability of the target sub-third polynomial. The target mapping relationship is used to indicate the correspondence between the coefficient distribution standard deviation, the out-of-bounds probability, and the boundary; based on the second boundary, determine the second ring modulus corresponding to the target sub-first polynomial.

[0015] In this embodiment, before increasing the first ring modulus to the second ring modulus, if the coefficients of the first polynomial are large, the first polynomial can be decomposed into multiple sub-first polynomials, and then the ring modulus can be increased for each sub-first polynomial and the second polynomial respectively. Here, "large coefficients of the first polynomial" can be understood as: the expected value or mean of multiple coefficients of the first polynomial exceeds a certain threshold.

[0016] Based on the method provided in the first aspect, in one possible implementation, the number of second ring moduli corresponding to the first polynomial of the target sub-polynomial is 1, and the second ring moduli are greater than or equal to the second boundary.

[0017] For the first polynomial of the target sub-sub ...

[0018] Based on the method provided in the first aspect, in one possible implementation, the second ring modulus satisfies the parameter requirements of NTT, including: the result of taking the second ring modulus modulo the first target value is 1, and the first target value is the product of the first target ring dimension and the expected improvement of the ring modulus; wherein, the first polynomial ring corresponds to the first ring dimension, the first target ring dimension is related to the first dimension, and the first target ring dimension is a power of 2, and the expected improvement of the ring modulus is any value in the reference value list, which includes 1 / 2, 1, and 2.

[0019] In this embodiment, the expected increase in ring module can be specified in advance so that the increased second ring module not only meets the parameter requirements of NTT, but also meets the user's expected increase in ring module. Since the second ring module also needs to meet the parameter requirements of NTT, the expected increase in ring module, i.e., 1 / t, can be any one of 1 / 2, 1, and 2.

[0020] Based on the method provided in the first aspect, in one possible implementation, the method can also obtain the value of the expected improvement of the ring modulus in response to the user's configuration command for the expected improvement of the ring modulus.

[0021] In this embodiment of the application, the value of the expected increase in the ring modulus can be configured by the user.

[0022] Based on the method provided in the first aspect, in one possible implementation, the method can also obtain the value of the first allowed out-of-bounds probability in response to the user's configuration instruction for the first allowed out-of-bounds probability.

[0023] The allowed out-of-bounds probability can be understood as the tolerable out-of-bounds probability. The first allowed out-of-bounds probability can be configured by the user.

[0024] Based on the method provided in the first aspect, in one possible implementation, the method for determining the estimated standard deviation of the coefficient distribution of the third polynomial can be: determining the standard deviation of the coefficient distribution of the first polynomial; determining the standard deviation of the coefficient distribution of the second polynomial; and determining the estimated standard deviation of the coefficient distribution of the third polynomial based on the standard deviation of the coefficient distribution of the first polynomial and the standard deviation of the coefficient distribution of the second polynomial.

[0025] In this embodiment of the application, the standard deviation of the coefficient distribution of the third polynomial can be estimated based on the standard deviation of the coefficient distribution of the first polynomial and the standard deviation of the coefficient distribution of the second polynomial.

[0026] Secondly, a decryption method is provided. In this method, a private key and ciphertext are obtained. The private key is converted into a fourth polynomial, and the ciphertext into a fifth polynomial. The fourth and fifth polynomials are polynomials within a second polynomial ring, which corresponds to a third-ring modulus. If the third-ring modulus does not satisfy the parameter requirements of the number-theoretic transformation (NTT), a second out-of-bounds probability is obtained. This second out-of-bounds probability refers to the probability that the coefficients of a sixth polynomial are allowed to exceed the boundary. The sixth polynomial is the polynomial obtained by multiplying the fourth and fifth polynomials. Based on the second out-of-bounds probability, the third-ring modulus is increased to a fourth-ring modulus, which satisfies the parameter requirements of the NTT. Based on the fourth-ring modulus, the private key and ciphertext are multiplied using the NTT to obtain the decrypted plaintext.

[0027] In the decryption scheme provided in this application embodiment, when the third ring modulus of the second polynomial ring corresponding to the private key and ciphertext does not meet the parameter requirements of NTT, a second allowed out-of-bounds probability is obtained, and then the third ring modulus is increased to the fourth ring modulus based on the second allowed out-of-bounds probability. The allowed out-of-bounds probability can be understood as the tolerable out-of-bounds probability. Compared to directly setting the increased fourth ring modulus based on the ring modulus and ring dimension of the polynomial ring, since this application embodiment considers the tolerable out-of-bounds probability when increasing the ring modulus, the increased ring modulus will not be too large, thereby avoiding the problem that the optimization effect of accelerating polynomial multiplication by NTT after increasing the ring modulus is not obvious. Therefore, the scheme provided in this application embodiment can improve the efficiency of calculating the product of the private key and ciphertext during the decryption process, thereby improving the efficiency of decrypting data.

[0028] Based on the method provided in the second aspect, in one possible implementation, the method of increasing the third ring modulus to the fourth ring modulus based on the second allowed out-of-bounds probability can be as follows: determine the predicted standard deviation of the coefficient distribution of the sixth polynomial; based on the predicted standard deviation of the coefficient distribution of the sixth polynomial, the second allowed out-of-bounds probability, and the target mapping relationship, solve for the third boundary that satisfies the predicted standard deviation of the coefficient distribution of the sixth polynomial and the second allowed out-of-bounds probability, the target mapping relationship being used to indicate the correspondence between the coefficient distribution standard deviation, the out-of-bounds probability, and the boundary; and determine the fourth ring modulus based on the third boundary.

[0029] Based on the method provided in the second aspect, in one possible implementation, the number of fourth ring modules is 1, and the fourth ring module is greater than or equal to the third boundary.

[0030] Based on the method provided in the second aspect, in one possible implementation, there are multiple fourth ring modules, and the total product of the multiple fourth ring modules is greater than or equal to the third boundary.

[0031] Based on the method provided in the second aspect, in one possible implementation, the method of increasing the third ring modulus to the fourth ring modulus based on the second allowed out-of-bounds probability can be as follows: decompose the fourth polynomial into multiple sub-fourth polynomials, and process each of the multiple sub-fourth polynomials according to the following processing method for the target sub-fourth polynomial, to obtain multiple fourth ring moduli corresponding one-to-one with the multiple sub-fourth polynomials, and multiply each sub-fourth polynomial and the fifth polynomial by NTT based on the fourth ring modulus corresponding to each sub-fourth polynomial, wherein the target sub-fourth polynomial is any one of the multiple sub-fourth polynomials:

[0032] Determine the predicted standard deviation of the coefficient distribution of the sixth polynomial of the target sub-polynomial, which is the polynomial obtained by multiplying the fourth and fifth polynomials of the target sub-polynomials; based on the predicted standard deviation of the coefficient distribution of the sixth polynomial of the target sub-polynomial, the second allowable out-of-bounds probability, and the target mapping relationship, solve for the fourth boundary that satisfies the predicted standard deviation of the coefficient distribution and the second allowable out-of-bounds probability of the sixth polynomial of the target sub-polynomial. The target mapping relationship is used to indicate the correspondence between the standard deviation of the coefficient distribution, the out-of-bounds probability, and the boundary; based on the fourth boundary, determine the fourth ring modulus corresponding to the fourth polynomial of the target sub-polynomial.

[0033] Based on the method provided in the second aspect, in one possible implementation, the number of fourth ring moduli corresponding to the fourth polynomial of the target sub-polynomial is 1, and the fourth ring moduli is greater than or equal to the fourth boundary.

[0034] Based on the method provided in the second aspect, in one possible implementation, the fourth ring modulus satisfies the parameter requirements of NTT, including: the result of taking the fourth ring modulus modulo the second target value is 1, and the second target value is the product of the second target ring dimension and the expected improvement of the ring modulus; wherein, the second polynomial ring corresponds to the third ring dimension, the second target ring dimension is related to the third dimension, and the second target ring dimension is a power of 2, and the expected improvement of the ring modulus is any value in the reference value list, which includes 1 / 2, 1, and 2.

[0035] Based on the method provided in the second aspect, in one possible implementation, the value of the expected improvement of the ring modulus can also be obtained in response to the user's configuration command for the expected improvement of the ring modulus.

[0036] Based on the method provided in the second aspect, in one possible implementation, the value of the second allowed out-of-bounds probability can also be obtained in response to the user's configuration instruction for the second allowed out-of-bounds probability.

[0037] The technical effects of the decryption method provided in the second aspect can be referenced from the technical effects of the encryption method provided in the first aspect, and will not be elaborated here.

[0038] Thirdly, an encryption device is provided, which has the function of implementing the encryption method described in the first aspect. The encryption device includes at least one module for implementing the encryption method provided in the first aspect.

[0039] Fourthly, a decryption apparatus is provided, which has the function of implementing the decryption method described in the second aspect above. The decryption apparatus includes at least one module for implementing the decryption method provided in the second aspect above.

[0040] Fifthly, a computer device is provided, the computer device comprising a processor and a memory, the memory being used to store programs supporting the computer device in executing the encryption method provided in the first aspect, and to store data related to implementing the encryption method provided in the first aspect. The processor is configured to execute the programs stored in the memory.

[0041] Sixthly, a computer device is provided, the computer device comprising a processor and a memory, the memory being used to store a program supporting the computer device in executing the decryption method provided in the second aspect, and to store data related to implementing the decryption method provided in the second aspect. The processor is configured to execute the program stored in the memory.

[0042] In a seventh aspect, a computer-readable storage medium is provided, wherein instructions are stored therein, which, when executed on a computer device, cause the computer device to perform the encryption method described in the first aspect or the decryption method described in the second aspect.

[0043] Eighthly, a computer program product containing instructions is provided, which, when run on a computer device, causes the computer device to perform the encryption method described in the first aspect or the decryption method described in the second aspect.

[0044] The technical effects achieved by the corresponding technical means in aspects three through eight above are similar, and will not be repeated here. Attached Figure Description

[0045] Figure 1 This is a schematic diagram of the architecture of an encryption / decryption system provided in an embodiment of this application;

[0046] Figure 2 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application;

[0047] Figure 3 This is a flowchart of an encryption method provided in an embodiment of this application;

[0048] Figure 4 This is a schematic diagram of an encryption process provided in an embodiment of this application;

[0049] Figure 5 This is a schematic diagram of another encryption process provided in an embodiment of this application;

[0050] Figure 6 This is a schematic diagram of another encryption process provided in an embodiment of this application;

[0051] Figure 7This is a flowchart of a decryption method provided in an embodiment of this application;

[0052] Figure 8 This is a schematic diagram of the structure of an encryption device provided in an embodiment of this application;

[0053] Figure 9 This is a schematic diagram of the structure of a decryption device provided in an embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0055] In cryptographic algorithms such as lattice ciphers, polynomial multiplication is used. For example, in the process of encrypting and decrypting data using lattice ciphers, information such as the public key, private key, random number, and ciphertext are all expressed in polynomial form. The encryption and decryption process involves operations such as multiplying the public key by the random number and multiplying the ciphertext by the private key, all of which require the use of polynomial multiplication.

[0056] The data processing scheme provided in this application embodiment is applied to the aforementioned lattice cipher and other cryptographic algorithms. Optionally, the data processing scheme provided in this application embodiment can also be applied to other scenarios that require polynomial multiplication. In other words, any algorithm that requires polynomial multiplication can apply the scheme provided in this application embodiment, and will not be illustrated in detail here.

[0057] Number theoretic transform (NTT) is frequently used to optimize the efficiency of polynomial multiplication. The principle of NTT is to substitute the powers of the primitive roots into the polynomial, transforming the polynomial from coefficient representation to point-value representation, thus converting polynomial convolution multiplication into point multiplication. In this transformation process, the point values ​​of the polynomial are determined using a bisection recursive decomposition, which reduces the complexity of polynomial multiplication from O(m...) to O(m...). 2 The multiplication time is reduced to O(mlog(m)), achieving a significant speedup for polynomial multiplication. Here, m is the vector dimension of the polynomial coefficient vector, which can be understood as a vector composed of multiple coefficients of the polynomial.

[0058] Furthermore, the two polynomials to be multiplied are polynomials in a polynomial ring, which can be represented as Z. q [x] / (x n+1), where q is the ring modulus of the polynomial ring, and n is the ring dimension of the polynomial ring. The ring modulus q can be understood as: the range of values ​​for the coefficients of each polynomial in the polynomial ring. For example, the coefficient of any polynomial in the polynomial ring is a value in the interval [-q / 2, q / 2], or the coefficient of any polynomial in the polynomial ring is a value in the interval [0, q]. Z q It can be understood as a domain with an interval of [-q / 2, q / 2] or [0, q]. The ring dimension n can be understood as: after representing each polynomial in the polynomial ring as a coefficient vector, each coefficient vector corresponds to a vector dimension, and the ring dimension n is the largest vector dimension among the vector dimensions corresponding to multiple coefficient vectors.

[0059] The application of the NTT technique requires specific parameters of the polynomial ring to ensure the existence of primitive roots. In other words, the NTT technique has corresponding parameter requirements. For example, for the polynomial ring Z... q [x] / (x n +1), typically requires the ring dimension n to be a power of 2, and the ring modulus q ≡ 1 mod 2n, meaning the ring modulus q modulo 2n leaves a remainder of 1. If the modulus q ≡ 1 mod n, or q ≡ 1 mod n / 2, incomplete NTT can also be applied to accelerate polynomial multiplication. However, if q ≡ 1 mod n / t and t > 2, the effect of NTT on accelerating polynomial multiplication is no longer significant.

[0060] In some scenarios, for polynomial ring Z q [x] / (x n +1), if q is a non-NTT-friendly parameter, that is, q cannot be written as 2. k The form p'+1, where p' is a prime number, can be used to boost the polynomial ring Z using ring modulus boosting techniques. q [x] / (x n +1) ring modulus and ring dimension, to accelerate polynomial multiplication by applying NTT or incomplete NTT in polynomial rings after increasing ring modulus.

[0061] For ease of explanation, the enhanced ring modulus will be denoted as Q. The principle of one ring modulus enhancement technique is as follows: For a polynomial ring Z... q [x] / (x n The polynomial in +1), considering that the absolute value of the coefficients of the polynomial resulting from the product of any two polynomials in the polynomial ring is usually greater than nq. 2 / 4, therefore, the improved ring modulus Q can be directly set as: Q is greater than nq 2 / 2 and Q satisfies the parameter requirements of NTT.

[0062] The problem with the above-mentioned ring modulus enhancement technique is that sometimes the enhanced ring modulus Q is too large, which means that it is still necessary to decompose the enhanced ring modulus Q into multiple smaller ring moduli for polynomial multiplication. This requires more NTTs, which affects the optimization effect of accelerating polynomial multiplication through NTTs, and thus leads to low data processing efficiency in cryptographic algorithms.

[0063] Based on this, embodiments of this application provide an encryption scheme and a decryption scheme. In the encryption scheme provided by embodiments of this application, when the first ring modulus of the first polynomial ring corresponding to the public key and the random number does not meet the parameter requirements of NTT, a first allowed out-of-bounds probability can be obtained, and then the first ring modulus can be increased to a second ring modulus based on the first allowed out-of-bounds probability. The allowed out-of-bounds probability can be understood as the tolerable out-of-bounds probability. Compared to directly setting the increased second ring modulus based on the ring modulus and ring dimension of the polynomial ring, since embodiments of this application consider the tolerable out-of-bounds probability when increasing the ring modulus, the increased ring modulus will not be too large, thereby avoiding the problem that the optimization effect of accelerating polynomial multiplication by NTT after increasing the ring modulus is not obvious. Therefore, the scheme provided by embodiments of this application can improve the efficiency of generating the mask during the encryption process, thereby improving the data encryption efficiency.

[0064] In the decryption scheme provided in this application embodiment, when the third ring modulus of the second polynomial ring corresponding to the private key and ciphertext does not meet the parameter requirements of NTT, a second allowed out-of-bounds probability can be obtained, and then the third ring modulus can be increased to the fourth ring modulus based on the second allowed out-of-bounds probability. The allowed out-of-bounds probability can be understood as the tolerable out-of-bounds probability. Compared with directly setting the increased second ring modulus based on the ring modulus and ring dimension of the polynomial ring, since this application embodiment considers the tolerable out-of-bounds probability when increasing the ring modulus, the increased ring modulus will not be too large, thereby avoiding the problem that the optimization effect of accelerating polynomial multiplication by NTT after increasing the ring modulus is not obvious. Therefore, the scheme provided in this application embodiment can improve the efficiency of calculating the product of the private key and ciphertext during the decryption process, thereby improving the efficiency of decrypting data.

[0065] Furthermore, since the module improved by the solution provided in this application embodiment is not too large, the solution provided in this application embodiment can also be called a compact improvement technique for ring module.

[0066] The encryption / decryption system, encryption / decryption method, and related products provided in the embodiments of this application will be described in detail below.

[0067] Figure 1 This is a schematic diagram of the architecture of an encryption / decryption system provided in an embodiment of this application. Figure 1 As shown, the encryption / decryption system includes a modulus selection component, a polynomial multiplication component, and a cryptographic algorithm implementation component.

[0068] The modulus selection component is used to increase the ring modulus of the polynomial ring using the compact ring modulus technique provided in this application embodiment. The polynomial multiplication component is used to perform polynomial multiplication on the polynomial ring based on the increased ring modulus using NTT. The cryptographic algorithm implementation component is used to complete the data encryption or decryption stage based on the output of the polynomial multiplication component.

[0069] It should be noted that any of the components among the modulus selection component, polynomial multiplication component, and cryptographic algorithm implementation component can be implemented in software, hardware, or a combination of both. This application does not limit this approach. For example, if the modulus selection component, polynomial multiplication component, and cryptographic algorithm implementation component are all implemented in software, then in this scenario, they can be understood as three software packages.

[0070] Furthermore, the modulus selection component, the polynomial multiplication component, and the cryptographic algorithm implementation component can be integrated into a single computer device. Alternatively, different components of the modulus selection component, polynomial multiplication component, and cryptographic algorithm implementation component can be distributed in different computer devices, and this application embodiment does not limit this.

[0071] Figure 2 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 2 As shown, the computer device includes at least one processor 201, a communication bus 202, a memory 203, and at least one communication interface 204.

[0072] The processor 201 is a general-purpose central processing unit (CPU), a neural processing unit (NPU), a microprocessor, or one or more integrated circuits for implementing the solutions of this application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. Optionally, the PLD is a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0073] The communication bus 202 is used to transmit information between the aforementioned components. Optionally, the communication bus 202 may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used to represent it in the figure, but this does not mean that there is only one bus or one type of bus.

[0074] The memory 203 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile optical discs, Blu-ray discs, etc.), magnetic disks or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 203 may exist independently and be connected to the processor 201 via the communication bus 202. The memory 203 may also be integrated with the processor 201.

[0075] The memory 203 stores program code for executing the scheme of this application, and its execution is controlled by the processor 201. The processor 201 executes the program code stored in the memory 203. The program code may include one or more software modules, such as... Figure 1 The illustrated components include a modulus selection unit, a polynomial multiplication unit, and a cryptographic algorithm implementation unit. The aforementioned embodiments can determine the data used for application development through one or more software modules in the program code within the processor 201 and memory 203.

[0076] Communication interface 204 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0077] In a specific implementation, as one example, a computer device may include multiple processors, for example... Figure 2The processors 201 and 205 are shown. Each of these processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0078] In a specific implementation, as one embodiment, the computer device may further include an output device 206 and an input device 207. The output device 206 communicates with the processor 201 and can display information in various ways. For example, the output device 206 may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device 207 communicates with the processor 201 and can receive user input in various ways. For example, the input device 207 may be a mouse, keyboard, touchscreen device, or sensing device, etc.

[0079] The aforementioned computer device can be a general-purpose computer device or a special-purpose computer device. In specific implementations, the computer device can be a desktop computer, a portable computer, a network server, a handheld digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. Optionally, the computer device can also be a computing node in a cloud platform that provides computing power. This application does not limit the type of computer device.

[0080] The system architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0081] As can be seen from the foregoing, polynomial multiplication may be used in both the data encryption and data decryption stages of cryptographic algorithms. Therefore, the embodiments of this application will be described in detail below for these two scenarios.

[0082] Figure 3 This is a flowchart of an encryption method provided in an embodiment of this application. Figure 3 As shown, the method includes the following steps.

[0083] Step 301: Obtain the public key and random number, convert the public key into a first polynomial, and convert the random number into a second polynomial. The first and second polynomials are polynomials in the first polynomial ring, and the first polynomial ring corresponds to the first ring modulus.

[0084] The embodiments of this application do not limit how the public key and random number are converted into a polynomial.

[0085] In some embodiments, during the data encryption phase of a cryptographic algorithm, the first polynomial and the second polynomial can be two polynomials to be multiplied in the encryption operation. For example, the first polynomial is used to indicate the public key in the encryption operation, and the second polynomial is used to indicate the random number in the encryption operation.

[0086] Furthermore, in scenarios where the scheme provided in this application is applied to non-cryptographic algorithms, the first polynomial and the second polynomial are also any two polynomials that need to be multiplied.

[0087] In this embodiment, to optimize the efficiency of polynomial multiplication, NTT is used to implement polynomial multiplication. As mentioned above, NTT has requirements on the parameters of the polynomial ring to which the polynomials to be multiplied belong; that is, NTT has parameter requirement conditions. Therefore, when multiplying the first polynomial and the second polynomial, it is first determined whether the parameters of the first polynomial ring to which the first and second polynomials belong satisfy the parameter requirement conditions of NTT.

[0088] The parameters of the polynomial ring include the ring modulus and the ring dimension. In this embodiment, the ring modulus of the first polynomial ring to which the first and second polynomials belong is called the first ring modulus, and the ring dimension of the first polynomial ring to which the first and second polynomials belong is called the first ring dimension. For ease of explanation later, the first ring modulus is denoted as q, and the first ring dimension is denoted as n.

[0089] Furthermore, if the first ring dimension n does not satisfy the parameter requirements of the NTT, the first ring dimension n is promoted to the second ring dimension so that the first polynomial and the second polynomial can be multiplied using the NTT based on the second ring dimension. For ease of explanation, the second ring dimension is denoted as N. Correspondingly, if the first ring dimension n satisfies the parameter requirements of the NTT, the first polynomial and the second polynomial can be multiplied directly based on the first ring dimension n using the NTT.

[0090] The statement that the first ring dimension n does not meet the parameter requirements of NTT can be understood as: the first ring dimension n is not a power of 2. This can also be referred to as: the first ring dimension n is an NTT-unfriendly parameter.

[0091] In some embodiments, the method for increasing the first ring dimension n to the second ring dimension N can be: increasing n to N, where N satisfies the following formula:

[0092]

[0093] For example, in greater than or equal to Within the interval, k can take the smallest integer in that interval.

[0094] Optionally, in the embodiments of this application, the first ring dimension can also be upgraded to the second ring dimension in other ways, and the embodiments of this application do not limit this.

[0095] If the first-ring module q does not meet the parameter requirements of NTT, the first-ring module q is upgraded to the second-ring module through steps 302 and 303 below. For ease of explanation, the second-ring module is denoted as Q. Correspondingly, if the first-ring module q meets the parameter requirements of NTT, the first polynomial and the second polynomial are multiplied directly based on the first-ring module q using NTT.

[0096] The fact that the first-ring modulus q does not meet the parameter requirements of NTT can be understood as: the first-ring modulus cannot be written as 2. k The form is p'+1, where p' is a prime number. The first-ring modulus q does not satisfy the parameter requirements of NTT, and can also be referred to as: the first-ring modulus q is an NTT unfriendly parameter.

[0097] Step 302: If the first ring modulus does not meet the parameter requirements of NTT, obtain the first allowed out-of-bounds probability. The first allowed out-of-bounds probability refers to the probability that the coefficients of the third polynomial are allowed to exceed the boundary. The third polynomial is the polynomial obtained by multiplying the first polynomial and the second polynomial.

[0098] Here, the allowed out-of-bounds probability can be understood as the out-of-bounds probability that the user can tolerate. The first allowed out-of-bounds probability can be configured by the user. Based on this, in some embodiments, in response to the user's configuration instruction for the first allowed out-of-bounds probability, the value of the first allowed out-of-bounds probability is obtained.

[0099] The above-described configuration of the first allowed out-of-bounds probability can be performed before data is processed by the cryptographic algorithm. For example, when the cryptographic algorithm is started in a computer device, the value of the first allowed out-of-bounds probability can be configured in the above manner.

[0100] The user can configure the first allowed out-of-bounds probability via command line. For example, assuming the device implementing the cryptographic algorithm is device A, the user terminal is connected to the console interface of device A via a console cable. Then, the user opens the command line interface of device A on the user terminal. The user enters the allowed out-of-bounds probability configuration command in the command line interface, and the command line interface pops up an input window for the allowed out-of-bounds probability. The user enters the value of the first allowed out-of-bounds probability in the input window, so that device A receives the configuration command for the first allowed out-of-bounds probability, and this configuration command carries the value of the first allowed out-of-bounds probability.

[0101] Optionally, the user's configuration command for the first allowed out-of-bounds probability can also be implemented through configuration options displayed on the computer device. For example, suppose the device implementing the cryptographic algorithm is device A, and device A provides a management interface that includes an allowed out-of-bounds probability configuration option. When the user clicks on this allowed out-of-bounds probability configuration option, an input window for the allowed out-of-bounds probability is displayed in the management interface. The user enters the value of the first allowed out-of-bounds probability in this input window, so that device A receives a configuration command for the first allowed out-of-bounds probability, which carries the value of the first allowed out-of-bounds probability.

[0102] Additionally, when configuring the first allowed out-of-bounds probability, users can combine the bit error rate corresponding to the error correction technique in the cryptographic algorithm to set the value of the first allowed out-of-bounds probability. In this scenario, the value of the first allowed out-of-bounds probability is usually different for different cryptographic algorithms.

[0103] Alternatively, the first allowed out-of-bounds probability can be determined in other ways, which are not limited in the embodiments of this application. For example, the probability of a polynomial going out of bounds can be estimated based on the historical cases of polynomial coefficients going out of bounds after polynomial multiplication, which will not be elaborated here.

[0104] Step 303: Based on the first allowed out-of-bounds probability, increase the first ring modulus to the second ring modulus, and the second ring modulus satisfies the parameter requirements of NTT.

[0105] Step 304: Based on the second ring modulus, multiply the public key and the random number using NTT to obtain a mask, and encrypt the plaintext into ciphertext based on the mask.

[0106] Among them, the parameter requirement for the second ring module to be full NTT is that the second ring module Q≡1mod 2N, or the second ring module Q≡1mod N, or the second ring module Q≡1mod N / 2.

[0107] In some embodiments, the improved second ring modulus Q can satisfy any of the above parameter requirements.

[0108] Optionally, in other embodiments, the expected increase in ring module can be specified in advance so that the increased second ring module not only meets NTT's parameter requirements, but also meets the user's expected increase in ring module.

[0109] For example, the result of taking the second ring modulus modulo the first target value is 1. The first target value is the product of the first target ring dimension and the expected improvement of the ring modulus. The first target ring dimension is related to the first ring dimension of the first polynomial ring, and the first target ring dimension is a power of 2.

[0110] In this context, the ring dimension of the first polynomial ring, i.e., the first ring dimension n mentioned above, is a power of 2. The first target ring dimension is then the first ring dimension n. Optionally, in scenarios where the first ring dimension n is not a power of 2, the first target ring dimension is the second ring dimension N, which is the increased value of the first ring dimension n.

[0111] For example, if the expected increase in the ring modulus is marked as 1 / t, then the first target value can be expressed as N / t, and the corresponding improved second ring modulus Q≡1mod N / t.

[0112] Considering that the second ring module must also meet the parameter requirements of NTT, the expected improvement in the ring module, i.e., 1 / t, can be any one of 1 / 2, 1, and 2. That is, the expected improvement in the ring module can be any value from the reference value list, which includes 1 / 2, 1, and 2.

[0113] Optionally, in scenarios where the NTT parameter requirements can be extended to other conditions, the reference value list may also include other possible values, which will not be illustrated here.

[0114] In addition, the value of the expected improvement of the ring modulus can be configured by the user. Based on this, in some embodiments, the value of the expected improvement of the ring modulus is obtained in response to the user's configuration instruction for the expected improvement of the ring modulus.

[0115] The above-described configuration of the desired increase in the ring modulus can be performed before data is processed by the cryptographic algorithm. For example, when the cryptographic algorithm is started in a computer device, the desired increase in the ring modulus can be configured in the manner described above.

[0116] The user can configure the desired increase in the ring modulus through command line. Optionally, the user can also configure the allowed desired increase in the ring modulus through configuration options displayed on the computer device; this embodiment does not limit this. The implementation method can refer to the aforementioned configuration process for allowing out-of-bounds probabilities, and will not be repeated here.

[0117] The following section explains how to increase the first-ring module to a second-ring module that meets the above conditions.

[0118] Before increasing the first-ring modulus to the second-ring modulus, if the coefficients of the first polynomial are large, the first polynomial can be decomposed into multiple sub-first polynomials, and then the ring modulus can be increased for each sub-first polynomial and the second polynomial respectively. A large coefficient of the first polynomial can be understood as the expected value or mean of its coefficients exceeding a certain threshold. Conversely, if the coefficients of the first polynomial are small, i.e., the expected value or mean of its coefficients is below this threshold, the ring modulus can be increased directly based on the first and second polynomials. Therefore, the implementation methods for increasing the first-ring modulus to the second-ring modulus that meets the above conditions will be explained in two scenarios below.

[0119] Scenario 1: Without factoring the first polynomial.

[0120] In Scenario 1, in some embodiments, the implementation of increasing the first ring modulus to the second ring modulus based on the first allowed out-of-bounds probability can be as follows: determine the predicted standard deviation of the coefficient distribution of the third polynomial; based on the predicted standard deviation of the coefficient distribution of the third polynomial, the first allowed out-of-bounds probability, and the target mapping relationship, solve for the first boundary that satisfies the predicted standard deviation of the coefficient distribution of the third polynomial and the first allowed out-of-bounds probability, the target mapping relationship being used to indicate the correspondence between the coefficient distribution standard deviation, the out-of-bounds probability, and the boundary; determine the second ring modulus based on the first boundary.

[0121] For example, the estimated standard deviation of the coefficient distribution of the third polynomial can be determined as follows: determine the standard deviation of the coefficient distribution of the first polynomial; determine the standard deviation of the coefficient distribution of the second polynomial; and determine the estimated standard deviation of the coefficient distribution of the third polynomial based on the standard deviations of the coefficient distributions of the first and second polynomials.

[0122] In this embodiment of the application, the standard deviation of the coefficient distribution of the third polynomial can be estimated based on the standard deviation of the coefficient distribution of the first polynomial and the standard deviation of the coefficient distribution of the second polynomial.

[0123] For example, assuming the first polynomial is labeled a(x), the second polynomial is labeled s(x), and the third polynomial is labeled b(x), then the predicted standard deviation of the coefficient distribution of the third polynomial can be determined, for example, by the following formula:

[0124]

[0125] Where, σ b Estimate the standard deviation σ of the coefficient distribution of the third polynomial.a Let σ be the standard deviation of the coefficient distribution of the first polynomial. s Let be the standard deviation of the coefficient distribution of the second polynomial.

[0126] For example, the coefficients of the first polynomial are in Z. q Uniformly distributed in the middle, and Z q When the domain represents an interval of [0, q], the standard deviation of the coefficient distribution of the first polynomial can be determined by the following formula:

[0127]

[0128] Among them, the coefficients of the first polynomial are in Z q A uniform distribution in the middle can be understood as: each coefficient in the first polynomial is in the Z region. q Randomly select values ​​from Z, and each Z value is selected with equal probability. q Different elements in.

[0129] Accordingly, the predicted standard deviation of the coefficient distribution of the third polynomial can be determined by the following formula:

[0130]

[0131] It should be noted that the above formula is used as an example to illustrate how to determine the estimated standard deviation of the coefficient distribution of the third polynomial. Optionally, in the embodiments of this application, the standard deviation of the coefficient distribution of the third polynomial can also be estimated by other means, such as by a technician setting the estimated standard deviation of the coefficient distribution of the third polynomial based on experience, which will not be illustrated here.

[0132] Furthermore, in this embodiment, the allowed out-of-bounds probability can refer to the probability of allowing any single coefficient to go out of bounds, or it can refer to the probability of allowing one or more coefficients among all coefficients of the polynomial to go out of bounds. For ease of explanation later, the former is referred to as the allowed out-of-bounds probability of a single coefficient, and the latter as the allowed out-of-bounds probability of all coefficients. Correspondingly, there can be two types of target mapping relationships: one is the target mapping relationship corresponding to the probability of any single coefficient going out of bounds (i.e., the allowed out-of-bounds probability of a single coefficient), and the other is the target mapping relationship corresponding to the probability of one or more coefficients among all coefficients of the polynomial going out of bounds (i.e., the allowed out-of-bounds probability of all coefficients). For ease of explanation later, the former is referred to as the first target mapping relationship, and the latter as the second target mapping relationship.

[0133] In some embodiments, the first target mapping relationship can be represented by the following formula:

[0134]

[0135] Where Pr[|bi|≥x] represents the probability that any single coefficient in the third polynomial is allowed to go out of bounds. x represents the boundary, σ b This is the estimated standard deviation of the coefficient distribution of the aforementioned third polynomial.

[0136] Based on the first mapping relationship, given the known probability of a single coefficient going out of bounds and the estimated standard deviation of the coefficient distribution of the third polynomial, a first boundary that satisfies the first probability of going out of bounds and the estimated standard deviation of the coefficient distribution of the third polynomial can be solved through the first mapping relationship, that is, the value of x in the first target mapping relationship can be solved.

[0137] In addition, in some embodiments, the second target mapping relationship can be represented by the following formula:

[0138]

[0139] in, This represents the probability that one or more coefficients in the third polynomial are allowed to be out of bounds.

[0140] Based on the second mapping relationship, given the known overall coefficient out-of-bounds probability and the predicted standard deviation of the coefficient distribution of the third polynomial, a first boundary satisfying the first allowed out-of-bounds probability and the predicted standard deviation of the coefficient distribution of the third polynomial can be solved through the second mapping relationship and the first mapping relationship. That is, the value of x in the second target mapping relationship can be solved.

[0141] It should be noted that the two target mapping relationships mentioned above are used to illustrate the relationship between the probability of a polynomial coefficients going out of bounds and the standard deviation of the polynomial coefficient distribution. Optionally, when there are other types of mapping relationships between the probability of a polynomial coefficients going out of bounds and the standard deviation of the polynomial coefficient distribution, these other types of mapping relationships can also be referred to to solve for the first boundary that satisfies the conditions. These will not be illustrated in detail here.

[0142] After solving for the first boundary, the improved second ring module is determined based on the first boundary.

[0143] In some embodiments, if the first ring modulus is increased to a second ring modulus, the second ring modulus must be greater than or equal to the first boundary to meet the requirement of allowing out-of-bounds probability. In other words, the number of second ring moduli is one, and the second ring modulus is greater than or equal to the first boundary.

[0144] That is, the improved second ring modulus Q ≥ x.

[0145] Optionally, in other embodiments, to avoid the second ring module being too large when the first ring module is increased to a certain level, the first ring module can be increased to multiple smaller second ring modules. In this scenario, the total product of the multiple second ring modules must be greater than or equal to the first boundary to meet the requirement of the allowed out-of-bounds probability. In other words, there are multiple second ring modules, and the total product of the multiple second ring modules is greater than or equal to the second boundary.

[0146] For example, the improved second-ring modules are labeled as Q1, ..., Q. i Q w Where i∈{1、…、w}, then multiple second-ring moduli must satisfy the following formula:

[0147]

[0148] It should be noted that the conditions for the two second-ring moduli mentioned above apply to Z in the polynomial ring. q The domain represented corresponds to the interval [0, q]. Optionally, in Z... q When the domain represented corresponds to other intervals, the relationship between the improved second ring modulus Q and the first boundary can also be determined by referring to the above method. Examples will not be provided here.

[0149] Scenario 2: Factorize the first polynomial.

[0150] In Scenario 2, the implementation method of increasing the first ring modulus to the second ring modulus based on the first allowed out-of-bounds probability can be as follows: decompose the first polynomial into multiple sub-first polynomials, and process each of the multiple sub-first polynomials according to the following processing method for the target sub-first polynomial to obtain multiple second ring moduli corresponding one-to-one with the multiple sub-first polynomials. Multiply each sub-first polynomial and the second polynomial by NTT based on the second ring modulus corresponding to each sub-first polynomial. The target sub-first polynomial is any one of the multiple sub-first polynomials. Determine the predicted standard deviation of the coefficient distribution of the target sub-third polynomial. The target sub-third polynomial is the polynomial obtained by multiplying the target sub-first polynomial and the second polynomial. Based on the predicted standard deviation of the coefficient distribution of the target sub-third polynomial, the first allowed out-of-bounds probability, and the target mapping relationship, solve for the second boundary that satisfies the predicted standard deviation of the coefficient distribution and the first allowed out-of-bounds probability of the target sub-third polynomial. The target mapping relationship is used to indicate the correspondence between the coefficient distribution standard deviation, the out-of-bounds probability, and the boundary. Determine the second ring modulus corresponding to the target sub-first polynomial based on the second boundary.

[0151] The implementation method for determining the second ring modulus corresponding one-to-one with any sub-first polynomial is basically the same as the implementation method in Scenario 1, and will not be repeated here.

[0152] The decomposition of the first polynomial into multiple sub-first polynomials can be achieved through the following steps:

[0153] Step 1: Select the following decomposition basis vectors:

[0154] g=(B 0 B 1 ,…,B d-1 )

[0155] Step 2: Execute the following decomposition function g -1 Decompose the first polynomial into d sub-first polynomials:

[0156]

[0157] Where a0(x),…,a d-1 (x) represents the d sub-first polynomials obtained by decomposing the first polynomial a(x).

[0158] The above examples illustrate how to factor the first polynomial. Optionally, in the embodiments of this application, the first polynomial can also be factored by other means, which will not be illustrated here.

[0159] In this scenario, for any sub-first polynomial, such as the target sub-first polynomial, the number of second ring moduli corresponding to the target sub-first polynomial is usually 1. In this scenario, the improved second ring moduli is greater than or equal to the second boundary.

[0160] Optionally, there may be multiple second ring moduli corresponding to the first polynomial of the target sub-sub ...

[0161] After obtaining the enhanced second ring modulus, the multiplication of the first and second polynomials can be implemented in the enhanced second ring modulus using NTT. After multiplying the first and second polynomials, the result of the multiplication is further restored to the first polynomial ring corresponding to the first ring modulus and the first ring dimension. Then, the restored polynomial is converted into a mask, and the plaintext is encrypted into ciphertext based on the mask.

[0162] To further understand the embodiments of this application, different embodiments are described below. Figure 3 The illustrated examples are provided.

[0163] Example 1: Directly upgrade the first ring module to a second ring module.

[0164] Example 1 can be implemented through the following steps.

[0165] Step 1.1: Estimate the standard deviation of the coefficient distribution of the third polynomial. That is, determine the predicted standard deviation σ of the coefficient distribution of the third polynomial b(x) resulting from the product of the first polynomial a(x) and the second polynomial s(x). b .

[0166] Step 1.2: Calculate the boundary x that satisfies the first allowed out-of-bounds probability and the relevant target mapping relationship. The target mapping relationship can be, for example, the one described above. or

[0167] Step 1.3: Based on the calculated x, select an appropriate second ring modulus Q after the upgrade.

[0168] Wherein, the second ring modulus Q≥x, and the second ring modulus ≡1mod N / t, 1 / t is the expected improvement of the ring modulus, that is, the value of 1 / t is set in advance based on the expected improvement of the ring modulus, and 1 / t can be any of 1 / 2, 1 and 2.

[0169] Additionally, before step 1.1, if the first ring dimension n of the first polynomial ring does not meet the parameter requirements of NTT, the first ring dimension n can be promoted to the second ring dimension N.

[0170] Furthermore, after step 1.3, the NTT algorithm is executed based on the improved second-ring modulus to complete the multiplication of the first and second polynomials. After executing the NTT algorithm, the third polynomial is then recovered from the NTT algorithm output to ensure that the coefficients of the third polynomial satisfy the first-ring modulus and that the vector dimension of the coefficient vector of the third polynomial satisfies the first-ring dimension.

[0171] The process of the above embodiment 1 can be achieved through Figure 4 The process shown is illustrated, regarding Figure 4 The implementation details of the process shown will not be elaborated here.

[0172] For example, the first polynomial a(x) and the second polynomial s(x) ∈ the polynomial ring Z q [x] / (x n +1), where the first ring dimension n = 512 and the first ring modulus q = 251. The coefficients of the first polynomial a(x) are taken from Z. q The coefficients of the second polynomial s(x) are derived from a central binomial distribution on {-1, 0, 1}, and the standard deviation of the coefficient distribution of the second polynomial is given. Assume the first allowed out-of-bounds probability is 2. (-24) Therefore, the compact lifting ring module selected in Example 1, that is, the second ring module Q = 12289.

[0173] However, if we directly set the improved second modulus Q to be: Q > nq 2 If Q satisfies the parameter requirements of NTT, then the improved second-ring modulus Q = 133121. Therefore, the improved second-ring modulus provided by the embodiments of this application will not be too large, thereby improving the execution efficiency of NTT, improving the efficiency of generating the mask of the cryptographic algorithm, and thus improving the data encryption efficiency.

[0174] For example, for the first polynomial ring Z q [x] / (x n +1), where the first ring dimension n = 1024 and the first ring modulus q = 251. The coefficients of the first polynomial a(x) are taken from Z. q The coefficients of the second polynomial s(x) are derived from a central binomial distribution on {-1, 0, 1}. Assume the first allowed out-of-bounds probability is 2. (-26) Therefore, the compact lifting ring module selected in Example 1, that is, the second ring module Q = 18433.

[0175] Example 2: Combine the remainder number system (RNS) to increase the first ring modulus to multiple second ring moduli.

[0176] Example 2 can be implemented through the following steps.

[0177] Step 2.1: Estimate the standard deviation of the coefficient distribution of the third polynomial, that is, determine the predicted standard deviation σ of the coefficient distribution of the third polynomial b(x) after multiplying the first polynomial a(x) and the second polynomial s(x). b .

[0178] Step 2.2: Calculate the boundary x that satisfies the first allowed out-of-bounds probability and the relevant target mapping relationship. The target mapping relationship can be, for example, the one described above. or

[0179] Step 2.3: Based on the calculated x, select appropriate second ring moduli after the upgrade.

[0180] Among them, multiple second ring modules are labeled Q1, ..., Q i Q w , And any second ring modulus Q i ≡1mod N / t, where 1 / t is pre-set based on the desired increase in ring modulus, and 1 / t can be any of 1 / 2, 1, and 2.

[0181] Additionally, before step 2.1, if the first ring dimension n of the first polynomial ring does not meet the parameter requirements of NTT, the first ring dimension n can be promoted to the second ring dimension N.

[0182] Furthermore, after step 2.3, the NTT algorithm is executed based on each improved second-ring modulus, yielding w outputs. Finally, the third polynomial is recovered from these w outputs, ensuring that the coefficients of the third polynomial satisfy the first-ring modulus and that the vector dimension of the coefficient vector of the third polynomial satisfies the first-ring dimension. The recovery of the third polynomial from the w outputs can be exemplified by using the Chinese Remainder Theorem (CRT) technique from the remainder number system (RNS), which will not be elaborated upon here.

[0183] The process of the above embodiment 2 can be achieved through Figure 5 The process shown is illustrated, regarding Figure 5 The implementation details of the process shown will not be elaborated here.

[0184] For example, the first polynomial a(x) and the second polynomial s(x) ∈ the polynomial ring Z q [x] / (x n +1), where the first ring dimension n = 256 and the first ring modulus q = 8192. The coefficients of the first polynomial a(x) are taken from Z. q The coefficients of the second polynomial s(x) are derived from a central binomial distribution on [-5, 5]. Assume the first allowed out-of-bounds probability is 2. (-170) The multiple compact lifting ring modules selected through Example 2, that is, the multiple second ring modules, are: Q1 = 769, Q2 = 3329.

[0185] Example 3: Combine polynomial decomposition to increase the first ring modulus to the second ring modulus corresponding to each decomposed subpolynomial.

[0186] Example 3 can be implemented through the following steps.

[0187] Step 3.1: Decompose the first polynomial into multiple sub-first polynomials.

[0188] Step 3.2: Determine the improved second ring modulus corresponding to each sub-first polynomial. The implementation can be found in steps 1.1 to 1.3 of Example 1.

[0189] Additionally, before step 3.1, if the first ring dimension n of the first polynomial ring does not meet the parameter requirements of NTT, the first ring dimension n can be promoted to the second ring dimension N.

[0190] In addition, after step 3.2, for each sub-first polynomial, the NTT algorithm is executed based on the improved second ring modulus to complete the multiplication of a sub-first polynomial and the second polynomial.

[0191] For example, b i (x)=a i (x)*s(x), where i∈{0,…,d-1}.

[0192] Then, based on the decomposition of basis vectors and b i (x) recovers the final b(x).

[0193] The process of the above embodiment 3 can be achieved through Figure 6 The process shown is illustrated, regarding Figure 6 The implementation details of the process shown will not be elaborated here.

[0194] For example, the first polynomial a(x) and the second polynomial s(x) ∈ the first polynomial ring Z q [x] / (x n +1), where the first ring dimension n = 512 and the first ring modulus q = 251. The coefficients of the first polynomial a(x) are taken from Z. q The coefficients of the second polynomial s(x) are derived from a central binomial distribution on {-1, 0, 1}. Assume the first allowed out-of-bounds probability is 2. (-371) Then, in Example 3, the first polynomial a(x) is first decomposed using the basis B = 2. 4 It is decomposed into d = 2 sub-first polynomials. For each sub-first polynomial, the compact lifting ring module, which is also the second ring module, is Q = 3329.

[0195] In summary, in the encryption scheme provided in this application embodiment, when the first ring modulus of the first polynomial ring corresponding to the public key and the random number does not meet the parameter requirements of NTT, a first allowed out-of-bounds probability can be obtained, and then the first ring modulus can be increased to a second ring modulus based on the first allowed out-of-bounds probability. The allowed out-of-bounds probability can be understood as the tolerable out-of-bounds probability. Compared to directly setting the increased second ring modulus based on the ring modulus and ring dimension of the polynomial ring, since this application embodiment considers the tolerable out-of-bounds probability when increasing the ring modulus, the increased ring modulus will not be too large, thereby avoiding the problem that the optimization effect of accelerating polynomial multiplication through NTT after increasing the ring modulus is not obvious. Therefore, the scheme provided in this application embodiment can improve the efficiency of generating the mask in the encryption process, thereby improving the data encryption efficiency.

[0196] Figure 7 This is a flowchart of a decryption method provided in an embodiment of this application. Figure 7 As shown, the method includes the following steps.

[0197] Step 701: Obtain the private key and ciphertext, convert the private key into the fourth polynomial, and convert the ciphertext into the fifth polynomial. The fourth and fifth polynomials are polynomials in the second polynomial ring, and the second polynomial ring corresponds to the third ring modulus.

[0198] In this embodiment of the application, the polynomial ring to which the fourth and fifth polynomials belong is referred to as the second polynomial ring, and the second polynomial ring has a third transformation modulus and a third ring dimension.

[0199] For an explanation of the parameters corresponding to the second polynomial ring, such as the modulus of the third ring, please refer to [reference needed]. Figure 3 The details of the first polynomial ring in the embodiment will not be repeated here.

[0200] Step 702: If the modulus of the third ring does not meet the parameter requirements of the number-theoretic transformation NTT, obtain the second allowed out-of-bounds probability. The second allowed out-of-bounds probability refers to the probability that the coefficients of the sixth polynomial are allowed to exceed the boundary. The sixth polynomial is the polynomial obtained by multiplying the fourth and fifth polynomials.

[0201] In some embodiments, in response to a user's configuration instruction for a second allowed out-of-bounds probability, the value of the second allowed out-of-bounds probability is obtained.

[0202] For an explanation of the second allowed out-of-bounds probability, please refer to [link / reference]. Figure 3 The details regarding the first allowed out-of-bounds probability in the embodiment will not be repeated here.

[0203] Furthermore, considering that the encryption and decryption sides typically use the same cryptographic algorithm, the value of the second allowed out-of-bounds probability can be set to the same value as the value of the first allowed out-of-bounds probability. Optionally, the value of the second allowed out-of-bounds probability can also be set to different values, and this application embodiment does not limit this.

[0204] Step 703: Based on the second allowed out-of-bounds probability, increase the third ring modulus to the fourth ring modulus. The fourth ring modulus satisfies the parameter requirements of NTT.

[0205] The implementation method of step 703 Figure 3 The implementation of step 303 in the embodiments is basically the same, and will not be described in detail below.

[0206] For example, in some embodiments, the method of increasing the third ring modulus to the fourth ring modulus based on the second allowed out-of-bounds probability can be as follows: determine the predicted standard deviation of the coefficient distribution of the sixth polynomial; based on the predicted standard deviation of the coefficient distribution of the sixth polynomial, the second allowed out-of-bounds probability, and the target mapping relationship, solve for the third boundary that satisfies the predicted standard deviation of the coefficient distribution of the sixth polynomial and the second allowed out-of-bounds probability, whereby the target mapping relationship is used to indicate the correspondence between the coefficient distribution standard deviation, the out-of-bounds probability, and the boundary; and determine the fourth ring modulus based on the third boundary.

[0207] For example, the number of fourth ring modules is 1, and the fourth ring module is greater than or equal to the third boundary.

[0208] For example, there are multiple fourth ring modules, and the total product of the multiple fourth ring modules is greater than or equal to the third boundary.

[0209] Optionally, in other embodiments, the implementation of increasing the third ring modulus to the fourth ring modulus based on the second allowed out-of-bounds probability can be as follows: decompose the fourth polynomial into multiple sub-fourth polynomials, and process each of the multiple sub-fourth polynomials according to the following processing method for the target sub-fourth polynomial, to obtain multiple fourth ring moduli corresponding one-to-one with the multiple sub-fourth polynomials, and multiply each sub-fourth polynomial and the fifth polynomial by NTT based on the fourth ring modulus corresponding to each sub-fourth polynomial, wherein the target sub-fourth polynomial is any one of the multiple sub-fourth polynomials:

[0210] Determine the predicted standard deviation of the coefficient distribution of the sixth polynomial of the target sub-polynomial, which is the polynomial obtained by multiplying the fourth and fifth polynomials of the target sub-polynomials; based on the predicted standard deviation of the coefficient distribution of the sixth polynomial of the target sub-polynomial, the second allowable out-of-bounds probability, and the target mapping relationship, solve for the fourth boundary that satisfies the predicted standard deviation of the coefficient distribution and the second allowable out-of-bounds probability of the sixth polynomial of the target sub-polynomial. The target mapping relationship is used to indicate the correspondence between the standard deviation of the coefficient distribution, the out-of-bounds probability, and the boundary; based on the fourth boundary, determine the fourth ring modulus corresponding to the fourth polynomial of the target sub-polynomial.

[0211] For example, the number of fourth ring moduli corresponding to the fourth polynomial of the target sub-sub ...

[0212] In addition, in some embodiments, the fourth ring modulus satisfies the parameter requirements of NTT, including: the result of the fourth ring modulus modulo the second target value is 1, and the second target value is the product of the second target ring dimension and the expected improvement of the ring modulus;

[0213] The second polynomial ring corresponds to the third ring dimension. The second target ring dimension is related to the third dimension, and the second target ring dimension is a power of 2. The expected improvement of the ring modulus can be any value from the reference value list, which includes 1 / 2, 1, and 2.

[0214] In addition, in some embodiments, the value of the expected increase in the ring modulus is obtained in response to a user's configuration command for the expected increase in the ring modulus.

[0215] Step 704: Based on the fourth ring modulus, multiply the private key and the ciphertext using NTT to obtain the decrypted plaintext.

[0216] After obtaining the enhanced fourth-ring modulus, the multiplication of the fourth and fifth polynomials can be performed using NTT within the enhanced fourth-ring modulus. After multiplying the fourth and fifth polynomials, the result is further restored to the second polynomial ring, which corresponds to the third-ring modulus and the third-ring dimension. Then, the restored polynomial is converted into plaintext.

[0217] In summary, in the decryption scheme provided in this application embodiment, when the third ring modulus of the second polynomial ring corresponding to the private key and ciphertext does not meet the parameter requirements of NTT, a second allowed out-of-bounds probability can be obtained, and then the third ring modulus can be increased to the fourth ring modulus based on the second allowed out-of-bounds probability. The allowed out-of-bounds probability can be understood as the tolerable out-of-bounds probability. Compared to directly setting the increased fourth ring modulus based on the ring modulus and ring dimension of the polynomial ring, since this application embodiment considers the tolerable out-of-bounds probability when increasing the ring modulus, the increased ring modulus will not be too large, thereby avoiding the problem that the optimization effect of accelerating polynomial multiplication by NTT after increasing the ring modulus is not obvious. Therefore, the scheme provided in this application embodiment can improve the efficiency of calculating the product of the private key and ciphertext during the decryption process, thereby improving the efficiency of decrypting data.

[0218] Figure 8 This is a schematic diagram of the structure of an encryption device provided in an embodiment of this application. Figure 8 As shown, the device 800 includes the following modules.

[0219] The first acquisition module 801 is used to acquire the public key and random number, convert the public key into a first polynomial, and the random number into a second polynomial. The first and second polynomials are polynomials in the first polynomial ring, and the first polynomial ring corresponds to the first ring modulus. For detailed implementation, please refer to [reference needed]. Figure 3 Step 301 in the embodiment.

[0220] The second acquisition module 802 is used to acquire the first allowed out-of-bounds probability when the first ring modulus does not meet the parameter requirements of the number-theoretic transformation NTT. The first allowed out-of-bounds probability refers to the probability that the coefficients of the third polynomial are allowed to exceed the boundary. The third polynomial is the polynomial obtained by multiplying the first polynomial and the second polynomial. For detailed implementation, please refer to [reference needed]. Figure 3 Step 302 in the embodiment.

[0221] The enhancement module 803 is used to enhance the first ring modulus to a second ring modulus based on a first allowed out-of-bounds probability. The second ring modulus satisfies the parameter requirements of NTT. For detailed implementation details, please refer to [reference needed]. Figure 3 Step 303 in the embodiment.

[0222] Encryption block 804 is used to multiply the public key and a random number using NTT based on the second ring modulus to obtain a mask, which is then used to encrypt the plaintext into ciphertext. For detailed implementation instructions, please refer to [reference needed]. Figure 3 Step 304 in the embodiment.

[0223] In some embodiments, the boosting module is used for:

[0224] Determine the predicted standard deviation of the coefficient distribution of the third polynomial;

[0225] Based on the predicted standard deviation of the coefficient distribution of the third polynomial, the first allowable out-of-bounds probability, and the target mapping relationship, the first boundary satisfying the predicted standard deviation of the coefficient distribution of the third polynomial and the first allowable out-of-bounds probability is solved. The target mapping relationship is used to indicate the correspondence between the standard deviation of the coefficient distribution, the out-of-bounds probability, and the boundary.

[0226] The second ring module is determined based on the first boundary.

[0227] In some embodiments, the number of second ring modules is 1, and the second ring module is greater than or equal to the first boundary.

[0228] In some embodiments, there are multiple second ring modules, and the total product of the multiple second ring modules is greater than or equal to the first boundary.

[0229] In some embodiments, the boosting module is used for:

[0230] The first polynomial is decomposed into multiple sub-first polynomials, and each sub-first polynomial is processed according to the following method for processing the target sub-first polynomial, resulting in multiple second ring moduli corresponding one-to-one with the multiple sub-first polynomials. Each sub-first polynomial and the second polynomial are then multiplied by NTT based on the second ring moduli corresponding to each sub-first polynomial. The target sub-first polynomial is any one of the multiple sub-first polynomials.

[0231] Determine the predicted standard deviation of the coefficient distribution of the third polynomial of the target sub-sub ...

[0232] Based on the predicted standard deviation of the coefficient distribution of the third polynomial of the objective sub-sub ...

[0233] The second ring modulus corresponding to the first polynomial of the target sub-sub ...

[0234] In some embodiments, the number of second ring moduli corresponding to the target sub-first polynomial is 1, and the second ring moduli are greater than or equal to the second boundary.

[0235] In some embodiments, the second ring modulus satisfies the parameter requirements of NTT, including: the result of taking the second ring modulus modulo the first target value is 1, and the first target value is the product of the first target ring dimension and the expected improvement of the ring modulus;

[0236] Among them, the first polynomial ring corresponds to the first ring dimension, the first target ring dimension is related to the first dimension, and the first target ring dimension is a power of 2. The expected improvement of the ring modulus is any value in the reference value list, which includes 1 / 2, 1, and 2.

[0237] In some embodiments, the device further includes a first configuration module for:

[0238] In response to the user's configuration command for the expected increase in the ring modulus, obtain the value of the expected increase in the ring modulus.

[0239] In some embodiments, the device further includes a second configuration module for:

[0240] In response to the user's configuration command for the first allowed out-of-bounds probability, the value of the first allowed out-of-bounds probability is obtained.

[0241] In some embodiments, the boosting module is used for:

[0242] Determine the standard deviation of the coefficient distribution of the first polynomial;

[0243] Determine the standard deviation of the coefficient distribution of the second polynomial;

[0244] Based on the standard deviation of the coefficient distribution of the first polynomial and the standard deviation of the coefficient distribution of the second polynomial, the estimated standard deviation of the coefficient distribution of the third polynomial is determined.

[0245] In summary, in the encryption scheme provided in this application embodiment, when the first ring modulus of the first polynomial ring corresponding to the public key and the random number does not meet the parameter requirements of NTT, a first allowed out-of-bounds probability can be obtained, and then the first ring modulus can be increased to a second ring modulus based on the first allowed out-of-bounds probability. The allowed out-of-bounds probability can be understood as the tolerable out-of-bounds probability. Compared to directly setting the increased second ring modulus based on the ring modulus and ring dimension of the polynomial ring, since this application embodiment considers the tolerable out-of-bounds probability when increasing the ring modulus, the increased ring modulus will not be too large, thereby avoiding the problem that the optimization effect of accelerating polynomial multiplication through NTT after increasing the ring modulus is not obvious. Therefore, the scheme provided in this application embodiment can improve the data encryption efficiency in cryptographic algorithms.

[0246] It should be noted that the encryption device provided in the above embodiments is only illustrated by the division of the above functional modules when implementing the cryptographic algorithm. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the encryption device and encryption method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0247] Figure 9 This is a schematic diagram of the structure of a decryption device provided in an embodiment of this application. Figure 9 As shown, the device 900 includes the following modules.

[0248] The first acquisition module 901 is used to acquire a private key and ciphertext, convert the private key into a fourth polynomial, and convert the ciphertext into a fifth polynomial. The fourth and fifth polynomials are polynomials in a second polynomial ring, and the second polynomial ring corresponds to a third ring modulus. For detailed implementation, please refer to [reference needed]. Figure 7 Step 701 in the embodiment.

[0249] The second acquisition module 902 is used to acquire the second allowed out-of-bounds probability when the modulus of the third ring does not meet the parameter requirements of the number-theoretic transformation NTT. The second allowed out-of-bounds probability refers to the probability that the coefficients of the sixth polynomial are allowed to exceed the boundary. The sixth polynomial is the polynomial obtained by multiplying the fourth and fifth polynomials. For detailed implementation, please refer to [reference needed]. Figure 7 Step 702 in the embodiment.

[0250] Module 903 is used to increase the modulus of the third ring to the modulus of the fourth ring based on the second allowed out-of-bounds probability. The modulus of the fourth ring satisfies the parameter requirements of NTT. For detailed implementation, please refer to [link / reference]. Figure 7 Step 703 in the embodiment.

[0251] Decryption module 904 is used to multiply the private key and ciphertext using NTT based on the fourth ring modulus to obtain the decrypted plaintext. For detailed implementation instructions, please refer to [reference needed]. Figure 7 Step 704 in the embodiment.

[0252] In some embodiments, the boosting module is used for:

[0253] Determine the predicted standard deviation of the coefficient distribution of the sixth polynomial;

[0254] Based on the predicted standard deviation of the coefficient distribution of the sixth polynomial, the second allowable out-of-bounds probability, and the target mapping relationship, the third boundary that satisfies the predicted standard deviation of the coefficient distribution and the second allowable out-of-bounds probability of the sixth polynomial is solved. The target mapping relationship is used to indicate the correspondence between the standard deviation of the coefficient distribution, the out-of-bounds probability, and the boundary.

[0255] The fourth ring module is determined based on the third boundary.

[0256] In some embodiments, the number of fourth ring modules is 1, and the fourth ring module is greater than or equal to the third boundary.

[0257] In some embodiments, there are multiple fourth ring modules, and the total product of the multiple fourth ring modules is greater than or equal to the third boundary.

[0258] In some embodiments, the lifting module is configured to: decompose the fourth polynomial into multiple sub-fourth polynomials, and process each of the multiple sub-fourth polynomials according to the following processing method for the target sub-fourth polynomial, to obtain multiple fourth ring moduli corresponding one-to-one with the multiple sub-fourth polynomials, and multiply each sub-fourth polynomial and the fifth polynomial by NTT based on the fourth ring moduli corresponding to each sub-fourth polynomial, wherein the target sub-fourth polynomial is any one of the multiple sub-fourth polynomials:

[0259] Determine the predicted standard deviation of the coefficient distribution of the sixth polynomial of the target sub-polynomial, which is the polynomial obtained by multiplying the fourth and fifth polynomials of the target sub-polynomials; based on the predicted standard deviation of the coefficient distribution of the sixth polynomial of the target sub-polynomial, the second allowable out-of-bounds probability, and the target mapping relationship, solve for the fourth boundary that satisfies the predicted standard deviation of the coefficient distribution and the second allowable out-of-bounds probability of the sixth polynomial of the target sub-polynomial. The target mapping relationship is used to indicate the correspondence between the standard deviation of the coefficient distribution, the out-of-bounds probability, and the boundary; based on the fourth boundary, determine the fourth ring modulus corresponding to the fourth polynomial of the target sub-polynomial.

[0260] In some embodiments, the number of fourth ring moduli corresponding to the target sub-fourth polynomial is 1, and the fourth ring moduli is greater than or equal to the fourth boundary.

[0261] In some embodiments, the fourth ring modulus satisfies the parameter requirements of NTT, including: the result of the fourth ring modulus modulo the second target value is 1, and the second target value is the product of the second target ring dimension and the expected improvement of the ring modulus;

[0262] The second polynomial ring corresponds to the third ring dimension. The second target ring dimension is related to the third dimension, and the second target ring dimension is a power of 2. The expected improvement of the ring modulus can be any value from the reference value list, which includes 1 / 2, 1, and 2.

[0263] In some embodiments, the device further includes a first configuration module, configured to: obtain the value of the expected improvement in the ring modulus in response to a user's configuration instruction for the expected improvement in the ring modulus.

[0264] In some embodiments, the device further includes a second configuration module, configured to: obtain the value of the second allowed out-of-bounds probability in response to a user's configuration instruction for the second allowed out-of-bounds probability.

[0265] In summary, in the decryption scheme provided in this application embodiment, when the third ring modulus of the second polynomial ring corresponding to the private key and ciphertext does not meet the parameter requirements of NTT, a second allowed out-of-bounds probability can be obtained, and then the third ring modulus can be increased to the fourth ring modulus based on the second allowed out-of-bounds probability. The allowed out-of-bounds probability can be understood as the tolerable out-of-bounds probability. Compared to directly setting the increased fourth ring modulus based on the ring modulus and ring dimension of the polynomial ring, since this application embodiment considers the tolerable out-of-bounds probability when increasing the ring modulus, the increased ring modulus will not be too large, thereby avoiding the problem that the optimization effect of accelerating polynomial multiplication through NTT after increasing the ring modulus is not obvious. Therefore, the scheme provided in this application embodiment can improve the data decryption efficiency in cryptographic algorithms.

[0266] It should be noted that the decryption device provided in the above embodiments is only illustrated by the division of the above functional modules when implementing the cryptographic algorithm. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the decryption device and decryption method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0267] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital versatile discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0268] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0269] The above content is not intended to limit the embodiments of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of the embodiments of this application.

Claims

1. An encryption method, characterized in that, The method includes: Obtain a public key and a random number, and convert the public key into a first polynomial and the random number into a second polynomial. The first polynomial and the second polynomial are polynomials in a first polynomial ring, and the first polynomial ring corresponds to a first ring modulus. If the first ring modulus does not meet the parameter requirements of the number theory transformation NTT, the first allowed out-of-bounds probability is obtained. The first allowed out-of-bounds probability refers to the probability that the coefficients of the third polynomial are allowed to exceed the boundary. The third polynomial is the polynomial obtained by multiplying the first polynomial and the second polynomial. Based on the first allowed out-of-bounds probability, the first ring modulus is increased to the second ring modulus, and the second ring modulus satisfies the parameter requirements of the NTT; Based on the second ring modulus, the public key and the random number are multiplied by NTT to obtain a mask, and the plaintext is encrypted into ciphertext based on the mask.

2. The method as described in claim 1, characterized in that, The step of increasing the first ring modulus to the second ring modulus based on the first allowed out-of-bounds probability includes: Determine the predicted standard deviation of the coefficient distribution of the third polynomial; Based on the predicted standard deviation of the coefficient distribution of the third polynomial, the first allowed out-of-bounds probability and the target mapping relationship, the first boundary satisfying the predicted standard deviation of the coefficient distribution of the third polynomial and the first allowed out-of-bounds probability is solved. The target mapping relationship is used to indicate the correspondence between the standard deviation of the coefficient distribution, the out-of-bounds probability and the boundary. The second ring modulus is determined based on the first boundary.

3. The method as described in claim 2, characterized in that, The second ring module has one number, and the second ring module is greater than or equal to the first boundary.

4. The method as described in claim 2, characterized in that, The number of the second ring modules is multiple, and the total product of the multiple second ring modules is greater than or equal to the first boundary.

5. The method as described in claim 1, characterized in that, The step of increasing the first ring modulus to the second ring modulus based on the first allowed out-of-bounds probability includes: The first polynomial is decomposed into multiple sub-first polynomials, and each of the multiple sub-first polynomials is processed according to the following target sub-first polynomial processing method to obtain multiple second ring moduli corresponding one-to-one with the multiple sub-first polynomials. Each sub-first polynomial and the second polynomial are then multiplied by NTT based on the second ring moduli corresponding to each sub-first polynomial. The target sub-first polynomial is any one of the multiple sub-first polynomials. Determine the predicted standard deviation of the coefficient distribution of the third polynomial of the target sub-sub ... Based on the predicted standard deviation of the coefficient distribution of the target sub-third polynomial, the first allowed out-of-bounds probability, and the target mapping relationship, the second boundary satisfying the predicted standard deviation of the coefficient distribution of the target sub-third polynomial and the first allowed out-of-bounds probability is solved. The target mapping relationship is used to indicate the correspondence between the standard deviation of the coefficient distribution, the out-of-bounds probability, and the boundary. The second ring modulus corresponding to the first polynomial of the target sub-polynomial is determined based on the second boundary.

6. The method as described in claim 5, characterized in that, The number of second ring moduli corresponding to the first polynomial of the target sub-polynomial is 1, and the second ring moduli is greater than or equal to the second boundary.

7. The method according to any one of claims 1-6, characterized in that, The second ring modulus satisfies the parameter requirements of the NTT, including: the result of the second ring modulus modulo the first target value is 1, and the first target value is the product of the first target ring dimension and the expected improvement of the ring modulus; Wherein, the first polynomial ring corresponds to a first ring dimension, the first target ring dimension is related to the first dimension, and the first target ring dimension is a power of 2. The expected improvement of the ring modulus is any value in the reference value list, which includes 1 / 2, 1, and 2.

8. The method as described in claim 7, characterized in that, The method further includes: In response to the user's configuration command for the expected increase in the ring modulus, the value of the expected increase in the ring modulus is obtained.

9. The method according to any one of claims 1-8, characterized in that, The method further includes: In response to the user's configuration command for the first allowed out-of-bounds probability, the value of the first allowed out-of-bounds probability is obtained.

10. A decryption method, characterized in that, The method includes: Obtain a private key and ciphertext, and convert the private key into a fourth polynomial and the ciphertext into a fifth polynomial. The fourth and fifth polynomials are polynomials in a second polynomial ring, and the second polynomial ring corresponds to a third ring modulus. If the modulus of the third ring does not meet the parameter requirements of the number theory transformation NTT, a second allowed out-of-bounds probability is obtained. The second allowed out-of-bounds probability refers to the probability that the coefficients of the sixth polynomial are allowed to exceed the boundary. The sixth polynomial is the polynomial obtained by multiplying the fourth polynomial and the fifth polynomial. Based on the second allowed out-of-bounds probability, the third ring modulus is increased to the fourth ring modulus, and the fourth ring modulus satisfies the parameter requirements of the NTT. Based on the fourth ring modulus, the private key and the ciphertext are multiplied by NTT to obtain the decrypted plaintext.

11. The method as described in claim 10, characterized in that, The step of increasing the modulus of the third ring to the modulus of the fourth ring based on the second allowed out-of-bounds probability includes: Determine the predicted standard deviation of the coefficient distribution of the sixth polynomial; Based on the predicted standard deviation of the coefficient distribution of the sixth polynomial, the second allowable out-of-bounds probability, and the target mapping relationship, the third boundary satisfying the predicted standard deviation of the coefficient distribution of the sixth polynomial and the second allowable out-of-bounds probability is solved. The target mapping relationship is used to indicate the correspondence between the standard deviation of the coefficient distribution, the out-of-bounds probability, and the boundary. The fourth ring module is determined based on the third boundary.

12. The method as described in claim 11, characterized in that, The fourth ring module has one value, and the fourth ring module is greater than or equal to the third boundary.

13. The method as described in claim 11, characterized in that, There are multiple fourth ring modules, and the total product of the multiple fourth ring modules is greater than or equal to the third boundary.

14. The method as described in claim 10, characterized in that, The step of increasing the modulus of the third ring to the modulus of the fourth ring based on the second allowed out-of-bounds probability includes: The fourth polynomial is decomposed into multiple sub-fourth polynomials, and each of the multiple sub-fourth polynomials is processed according to the following target sub-fourth polynomial processing method to obtain multiple fourth ring moduli corresponding one-to-one with the multiple sub-fourth polynomials. Based on the fourth ring moduli corresponding to each sub-fourth polynomial, each sub-fourth polynomial is multiplied by the fifth polynomial using NTT. The target sub-fourth polynomial is any one of the multiple sub-fourth polynomials: Determine the predicted standard deviation of the coefficient distribution of the sixth polynomial of the target sub-sub ... Based on the predicted standard deviation of the coefficient distribution of the target sub-sixth polynomial, the second allowable out-of-bounds probability, and the target mapping relationship, the fourth boundary satisfying the predicted standard deviation of the coefficient distribution of the target sub-sixth polynomial and the second allowable out-of-bounds probability is solved. The target mapping relationship is used to indicate the correspondence between the standard deviation of the coefficient distribution, the out-of-bounds probability, and the boundary. The fourth ring modulus corresponding to the target sub-fourth polynomial is determined based on the fourth boundary.

15. The method as described in claim 14, characterized in that, The number of fourth ring moduli corresponding to the target sub-fourth polynomial is 1, and the fourth ring moduli is greater than or equal to the fourth boundary.

16. The method according to any one of claims 10-15, characterized in that, The fourth ring modulus satisfies the parameter requirements of NTT, including: the result of the fourth ring modulus modulo the second target value is 1, and the second target value is the product of the second target ring dimension and the expected improvement of the ring modulus; Wherein, the second polynomial ring corresponds to the third ring dimension, the second target ring dimension is related to the third dimension, and the second target ring dimension is a power of 2. The expected improvement of the ring modulus is any value in the reference value list, which includes 1 / 2, 1, and 2.

17. The method as described in claim 16, characterized in that, The method further includes: In response to the user's configuration command for the expected increase in the ring modulus, the value of the expected increase in the ring modulus is obtained.

18. The method according to any one of claims 10-17, characterized in that, The method further includes: In response to the user's configuration command for the second allowed out-of-bounds probability, the value of the second allowed out-of-bounds probability is obtained.

19. An encryption device, characterized in that, The device includes: The first acquisition module is used to acquire a public key and a random number, and convert the public key into a first polynomial and the random number into a second polynomial. The first polynomial and the second polynomial are polynomials in a first polynomial ring, and the first polynomial ring corresponds to a first ring modulus. The second acquisition module is used to acquire the first allowed out-of-bounds probability when the first ring modulus does not meet the parameter requirements of the number theory transformation NTT. The first allowed out-of-bounds probability refers to the probability that the coefficients of the third polynomial are allowed to exceed the boundary. The third polynomial is the polynomial obtained by multiplying the first polynomial and the second polynomial. An enhancement module is used to enhance the first ring modulus to a second ring modulus based on the first allowed out-of-bounds probability, wherein the second ring modulus satisfies the parameter requirements of the NTT. An encryption block is used to multiply the public key and the random number using NTT based on the second ring modulus to obtain a mask, and then encrypt the plaintext into ciphertext based on the mask.

20. A decryption device, characterized in that, The device includes: The first acquisition module is used to acquire a private key and ciphertext, and convert the private key into a fourth polynomial and the ciphertext into a fifth polynomial. The fourth polynomial and the fifth polynomial are polynomials in a second polynomial ring, and the second polynomial ring corresponds to a third ring modulus. The second acquisition module is used to acquire a second allowed out-of-bounds probability when the third ring modulus does not meet the parameter requirements of the number theory transformation NTT. The second allowed out-of-bounds probability refers to the probability that the coefficients of the sixth polynomial are allowed to exceed the boundary. The sixth polynomial is the polynomial obtained by multiplying the fourth polynomial and the fifth polynomial. An enhancement module is used to enhance the third ring modulus to a fourth ring modulus based on the second allowed out-of-bounds probability, wherein the fourth ring modulus satisfies the parameter requirements of the NTT. The decryption module is used to multiply the private key and the ciphertext using NTT based on the fourth ring modulus to obtain the decrypted plaintext.

21. A computer device, characterized in that, The computer device includes a processor and memory; The processor is configured to execute instructions stored in the memory to cause the computer device to perform the method as described in any one of claims 1-9, or to perform the method as described in any one of claims 10-18.

22. A computer program product containing instructions, characterized in that, When the instructions are executed by a computer device, the computer device performs the method as described in any one of claims 1-9, or the method as described in any one of claims 10-18.

Images