Method for key encapsulation

Abstract

The application provides a key encapsulation method, which is applied to a key encapsulation party and comprises the following steps: a block error matrix satisfying a preset block rank weight condition is randomly generated; a ciphertext vector is generated by performing calculation according to a block error matrix and a public key matrix sent by a key decapsulation party, and a session key is generated according to support information of the block error matrix; the block error matrix is a matrix divided into multiple sub-matrices according to columns, the number of columns of each sub-matrix corresponds to the number of block columns of the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are disjoint. The application allows smaller parameter scales under the premise of ensuring equivalent security strength, and effectively reduces the sizes of the public key and the ciphertext.

Description

Technical Field

[0001] This invention relates to the field of quantum-resistant cryptography, and in particular to a key encapsulation method. Background Technology

[0002] With the rapid development of quantum computing technology, Shor's algorithm can solve large integer factorization and discrete logarithm problems in polynomial time, posing a fundamental threat to widely used public-key cryptosystems such as Rivest-Shamir-Adleman (RSA) and Elliptic Curve Cryptography (ECC). Of particular concern is the practical feasibility of "store-and-decrypt" attacks. Attackers can currently store large amounts of encrypted communication data and then decrypt it once quantum computers are more advanced. At that time, the previously stored ciphertext will be deciphered in bulk, with incalculable consequences. Therefore, accelerating the development of quantum-resistant public-key cryptosystems is a crucial means to address this threat.

[0003] Encoding-based cryptosystems have garnered significant attention due to their robust security assumptions. Among them, public-key algorithms based on rank-distance codes offer unique advantages in communication bandwidth and storage efficiency by employing smaller parameter sizes compared to Hamming metric schemes while maintaining equivalent security. However, the security of most rank-distance code-based public-key cryptosystems relies on the Rank Syndrome Decoding Problem (RSD). Some researchers have proposed effective algebraic attacks against rank-distance code public-key schemes. By leveraging the linearity of finite fields and employing matrix techniques such as the maximum cofactor model, they reduce the problem of solving a system of multivariate equations derived from the RSD problem to solving a system of linear equations, significantly reducing the computational complexity of solving the RSD problem. This attack results in cryptographic schemes constructed under rank distance being significantly lower than their claimed security level. To maintain the claimed security strength, the parameter sizes of the public key and ciphertext need to be doubled, leading to excessive communication overhead.

[0004] Therefore, how to effectively reduce the size of public keys and ciphertext while ensuring security strength has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a key encapsulation method that allows for a smaller parameter size while maintaining the same level of security. This significantly reduces the size of the public key and ciphertext, overcoming the technical drawback of existing technologies that force the parameter size to be doubled to resist algebraic attacks, resulting in excessive communication overhead.

[0006] In a first aspect, the present invention provides a key encapsulation method, the method being applied to a key encapsulation party, comprising the following steps: Randomly generate a block error matrix that satisfies the preset block rank weight condition; The ciphertext vector is generated by calculating the block error matrix and the public key matrix sent by the key decapsulation party, and a session key is generated based on the support information of the block error matrix. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns. The number of columns of each sub-matrix corresponds to the number of columns of a block in the public key matrix. Each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive.

[0007] According to a key encapsulation method provided by the present invention, the block error matrix is ​​a binary block error matrix, which includes a first submatrix and a second submatrix; the number of columns of the first submatrix corresponds to the number of columns of the first block of the public key matrix, and the number of columns of the second submatrix corresponds to the number of columns of the second block of the public key matrix; the support of the block error matrix is ​​composed of the support of the first submatrix and the support of the second submatrix, and the support of the first submatrix and the support of the second submatrix are mutually disjoint; the column weight of each block in the block error matrix is ​​equal to a preset block error weight; the sum of the error weights of the first submatrix and the error weights of the second submatrix is ​​less than or equal to the error correction capacity of the rank-distance linear error-correcting code.

[0008] According to a key encapsulation method provided by the present invention, the step of generating a ciphertext vector based on the block error matrix and the public key matrix includes: The ciphertext vector is obtained by multiplying the block error matrix by the transpose of the public key matrix.

[0009] According to a key encapsulation method provided by the present invention, the step of generating a session key based on the supporting information of the block error matrix includes: The supporting information is input into a preset hash function to obtain the session key.

[0010] According to a key encapsulation method provided by the present invention, before generating the session key based on the supporting information of the block error matrix, the method further includes: Determine the linear space spanned over a finite field for each non-zero column vector in the block error matrix; The linear space is determined as the supporting information for the block error matrix.

[0011] According to a key encapsulation method provided by the present invention, the public key matrix is ​​generated by the key decapsulation party through the following steps: Obtain a preset rank-distance linear error correction code, and generate a corresponding parity check matrix based on the rank-distance linear error correction code; A block permutation matrix and a confusion invertible matrix are randomly generated. The column permutation matrix is ​​used to perform column permutation on the verification matrix, and the row confusion matrix is ​​used to perform row confusion on the verification matrix to obtain the system-type public key matrix. The block permutation matrix, the confusion invertible matrix, and the verification matrix are stored as private keys.

[0012] Secondly, the present invention also provides a key encapsulation method, the method being applied to a key decapsulation method, comprising: The key encapsulation party receives a ciphertext vector sent by the key encapsulation party, and performs an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input. The ciphertext vector is generated by the key encapsulation party through a block error matrix that randomly satisfies a preset block rank weight condition, and is calculated based on the block error matrix and the public key matrix sent by the key decapsulation party. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns in a block of the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. The preset decoding algorithm is invoked to decode the decoding input and recover the initial error matrix; The initial error matrix is ​​inversely permuted using the block permutation matrix in the private key to obtain the block error matrix; Extract the supporting information of the block error matrix, and recover the session key based on the supporting information of the block error matrix.

[0013] According to a key encapsulation method provided by the present invention, the step of performing an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input includes: The ciphertext vector is multiplied by the inverse of the confusion invertible matrix to obtain the decoding input.

[0014] According to a key encapsulation method provided by the present invention, the step of calling a preset decoding algorithm to decode the decoding input and recover the initial error matrix includes: The decoding input is decoded using the decoding algorithm of Interleaved Gabidulin code to obtain the error matrix after column permutation; The error matrix after column permutation is used as the initial error matrix.

[0015] According to a key encapsulation method provided by the present invention, before performing an inverse permutation on the initial error matrix based on the block permutation matrix in the private key to obtain the block error matrix, the method further includes: Obtain a preset rank-distance linear error correction code, and generate a corresponding parity check matrix based on the rank-distance linear error correction code; A block permutation matrix and a confusion invertible matrix are randomly generated. The column permutation matrix is ​​used to perform column permutation on the check matrix, and the row confusion matrix is ​​used to perform row confusion on the check matrix to obtain a system-type public key matrix. The block permutation matrix, the confusion invertible matrix, and the check matrix are stored as a private key. The public key matrix is ​​sent to the key encapsulation party.

[0016] Thirdly, the present invention also provides a key encapsulation device, which is applied to a key encapsulation device and includes the following modules: The encapsulation module is used to randomly generate a block error matrix that satisfies a preset block rank weight condition; calculate and generate a ciphertext vector based on the block error matrix and the public key matrix sent by the key decapsulation party; and generate a session key based on the support information of the block error matrix; the block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns of a block in the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive.

[0017] Fourthly, the present invention also provides a key encapsulation device, which is applied to a key decapsulation device and includes the following modules: The decapsulation module receives a ciphertext vector sent by the key encapsulation party, performs an inverse transformation on the ciphertext vector using a confusion invertible matrix, and obtains the decoding input. The ciphertext vector is generated by the key encapsulation party through a randomly generated block error matrix that satisfies a preset block rank weight condition, and is calculated based on the block error matrix and the public key matrix sent by the key decapsulation party. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns, where the number of columns in each sub-matrix corresponds to the number of columns in a block of the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. A preset decoding algorithm is invoked to decode the decoding input and recover the initial error matrix. The initial error matrix is ​​then inversely permuted using the block permutation matrix in the private key to obtain the block error matrix. The support information of the block error matrix is ​​extracted, and the session key is recovered based on the support information of the block error matrix.

[0018] Fifthly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the key encapsulation method as described above.

[0019] In a sixth aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the key encapsulation method as described above.

[0020] In a seventh aspect, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the key encapsulation method as described above.

[0021] This invention provides a key encapsulation method applied to the key encapsulation party. It randomly generates a block error matrix that satisfies a preset block rank weight condition. Then, based on the block error matrix and the public key matrix sent by the key decapsulation party, it calculates and generates a ciphertext vector, and generates a session key based on the support information of the block error matrix. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns. The number of columns in each sub-matrix corresponds to the number of columns in a block of the public key matrix. Each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. This invention, by using a block error matrix with mutually exclusive supports instead of a traditional single support error matrix, increases the difficulty for attackers to solve the error matrix using algebraic methods. Therefore, it allows for a smaller parameter scale while maintaining the same security strength, effectively reducing the size of the public key and ciphertext. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is one of the flowcharts of the key encapsulation method provided by the present invention.

[0024] Figure 2 This is the second flowchart of the key encapsulation method provided by the present invention.

[0025] Figure 3 This is one of the structural schematic diagrams of the key encapsulation device provided by the present invention.

[0026] Figure 4 This is the second schematic diagram of the key encapsulation device provided by the present invention.

[0027] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0029] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, a first node can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0030] To better understand the various embodiments provided by the present invention, the technical content involved in the present invention will first be described as follows: To resist algebraic attacks in existing technologies and reduce public key size, new approaches such as multi-checker techniques (e.g., Interleaved Gabidulin codes) and block noise construction have been proposed in recent years. However, the error matrix construction methods used by the encapsulation side in existing schemes still have security bottlenecks. The supporting structure of their error matrices is relatively simple, which allows attackers to exploit vulnerabilities when solving them using algebraic methods, thus limiting further compression of public key and ciphertext sizes.

[0031] Therefore, there is an urgent need for a technical solution that can enhance the complexity of the error matrix structure and improve resistance to algebraic attacks during the key encapsulation process, so as to effectively reduce the size of public keys and ciphertext while ensuring security strength.

[0032] The technical problem this invention aims to solve is as follows: Encoding-based public-key cryptography algorithms are an important component of quantum-resistant public-key cryptosystems, but their development has been consistently hampered by the excessively large public-key and ciphertext sizes. Therefore, constructing secure and reliable encoding-based public-key cryptography algorithms with smaller public-key sizes is a crucial issue that urgently needs to be addressed by both academia and industry. Given the excellent properties of the rank distance decoding problem, this invention focuses on key encapsulation algorithms based on the rank distance decoding problem. By studying variants of novel difficult problems, analyzing provably secure algorithmic frameworks, selecting appropriate rank-distance linear error-correcting codes, evaluating the ability to resist typical attacks, and balancing the relationship between security and parameter size, a secure, reliable, and high-performance encoding-based key encapsulation algorithm is designed. Specific parameters are provided for classic 129, 192, and 256-bit security levels, effectively reducing the public-key / ciphertext size compared to similar public algorithms.

[0033] Furthermore, the symbols and definitions used in the various embodiments of the present invention are described below: 1. Symbol Description Bold uppercase letters (e.g.) ) represents a matrix, with bold lowercase letters (e.g.) ) represents a vector, with unbold lowercase letters (e.g., ...). ) represents an integer. Indicates by A finite field consisting of n elements, where It is a prime number. express The size of the top is The set of all matrices, and Representing vectors respectively sum matrix The rank weight of two matrices and Cascading writing , Representation matrix transpose, Representation matrix The reverse, Represents a hash function. This represents the decoding algorithm for Interleaved Gabidulin codes. Represents the block error matrix dimensionality Represents taking a set The minimum value in, Represents taking a set The maximum value in.

[0034] 2. Basic Definition Definition 1 (Rank Distance): Seen as superior A vector space of dimension, and let ,in, for On Given a vector with elements. , for Given the set of all matrices of length n, then each coordinate... It can be written as ,at this time It can be transformed into a matrix ,in, For the transformation matrix, These are matrix elements.

[0035] Therefore, vector rank weight Defined as a deformation matrix The rank of the vector. Given two vectors... Then its rank distance is .

[0036] Definition 2 (Support): Given a vector Then its support is represented as It is composed of vectors A coordinate generated - Linear space (i.e.) (linear space on), i.e. but The dimension of the support is equal to its rank weight, that is... Definition 3 (Gabidulin code): Let And each component in If linearly independent, then The upper length is Dimension is Gabidulin code Defined as yes The first irreducible polynomial on, for The first An irreducible polynomial, For polynomials The highest number of times, It is a positive integer.

[0037] Definition 4 (Interleaved Gabidulin code): Let For one The upper length is Dimension is The Gabidulin code has the following parameters: The Interleaved Gabidulin code is defined as in, For parameters Interleaved Gabidulin code, This is the first Gabidulin code. For the first A Gabidulin code.

[0038] Definition 5 (Block Error Matrix): Let , For two lengths A positive integer vector, It is a positive integer and satisfies If for a matrix There are: (1) And for all satisfy (2) For all and satisfy Then the matrix is ​​called a matrix. yes - Blocked, represented as .

[0039] The following is combined with Figures 1 to 5 The key encapsulation method of the present invention is described.

[0040] Figure 1 This is one of the flowcharts illustrating the key encapsulation method provided by the present invention. This method is applied to the key encapsulation party, such as... Figure 1 As shown, the method includes the following: Step 101: Randomly generate a block error matrix that satisfies the preset block rank weight condition; Step 102: Calculate the ciphertext vector based on the block error matrix and the public key matrix sent by the key decapsulator, and generate the session key based on the support information of the block error matrix. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns. The number of columns in each sub-matrix corresponds to the number of columns in a block of the public key matrix. Each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive.

[0041] The execution subject of the key encapsulation method provided by the present invention is the key encapsulation party. Specifically, it can be an electronic device, or any other key encapsulation system or other subject that can implement the key encapsulation method.

[0042] In this invention, the key encapsulation party performs the key encapsulation operation, using the public key generated by the key decapsulation party to encapsulate the session key, generating a ciphertext vector and outputting it. The key encapsulation party does not hold a private key; it only uses the public key to complete the encapsulation operation.

[0043] The key decapsulating party is the party that performs key generation and decapsulation operations. It generates a public key and a private key, publishes the public key or sends it to the key encapsulating party, and uses the private key to recover the session key from the ciphertext.

[0044] A block error matrix refers to a matrix divided into multiple submatrices by columns. Each submatrix has a predetermined number of columns and a predetermined rank weight, and the supports (i.e., the linear space spanned by all column vectors of that submatrix over a finite field) of any two different submatrices are disjoint. In this invention, the block error matrix satisfies the predetermined block rank weight condition, where "rank weight" refers to the rank of the matrix, and "block rank weight" means that each submatrix has a predetermined rank weight value.

[0045] The public key matrix is ​​a system-type matrix generated by the key decapsulating party and sent to the key encapsulating party. Its form is as follows: ,in For code length, For information dimension, Features of a finite field denoted by the expansion number. This public key matrix is ​​a verification matrix obtained by column permutation of a block permutation matrix and row obfuscation of an invertible obfuscation matrix, and has a standard Systematic Form.

[0046] The ciphertext vector is a vector calculated by the key encapsulator based on the block error matrix and the public key matrix. ,in For the block error matrix, This is the transpose of the public key matrix. The ciphertext vector will be sent to the key decryptor.

[0047] Support information: The support of a matrix is ​​the linear space spanned by all its column vectors over a finite field, and its dimension is equal to the rank weight of the matrix. For a block error matrix, its support information is the direct sum of the supports of its submatrices.

[0048] The session key is a key generated by the key encapsulating party based on the supporting information of the block error matrix, and is used for subsequent symmetric encrypted communication. Both the key encapsulating party and the key decapsulating party obtain the same session key after successfully completing encapsulation / decapsulation.

[0049] In practical applications, the key encapsulation method of this embodiment includes the following steps: First, a block error matrix is ​​randomly generated.

[0050] Specifically, after obtaining the public key matrix sent by the key decapsulating party, the key encapsulating party randomly generates a block error matrix that satisfies the preset block rank weight condition based on preset parameters (including the number of blocks, the number of columns in each block, and the rank weight of each block). .

[0051] The block error matrix is ​​a matrix divided into multiple sub-matrices by columns, i.e. ,in This represents the number of blocks. Each submatrix... The number of columns corresponds to the number of columns in a block of the public key matrix. ,satisfy Each submatrix has a preset rank weight. (Right now Furthermore, the supports of any two distinct submatrices are mutually exclusive. (i≠j).

[0052] Furthermore, a ciphertext vector and a session key are generated based on the block error matrix.

[0053] The key encapsulator uses the block error matrix. and public key matrix Perform calculations to generate ciphertext vectors. Specifically, the block error matrix Multiply by the transpose of the public key matrix ,Right now .

[0054] Meanwhile, the key encapsulation party extracts the block error matrix. Supporting information A session key is generated based on this supporting information. Specifically, it is calculated using a preset hash function. .

[0055] Finally, the key encapsulator outputs the ciphertext vector. and session key , ciphertext vector Send it to the key decryptor.

[0056] The following is a detailed example 1: Taking the classic 128-bit security level as an example, the following parameters are used: , , , , L=5 , =7, .

[0057] The key encapsulation party obtains the public key matrix sent by the key decapsulation party. Based on preset block parameters, a binary block error matrix is ​​randomly generated. ,in The supporting dimension is 8. The supporting dimension is 7, and That is, the overall support dimension of E is 15.

[0058] The key encapsulator calculates the ciphertext vector. .extract Supporting information Calculate the session key Finally, the ciphertext vector is output. and session key , ciphertext vector Send to the key decryptor.

[0059] The method provided in this invention is applied to the key encapsulation party, which randomly generates a block error matrix that satisfies a preset block rank weight condition. Then, based on the block error matrix and the public key matrix sent by the key decapsulation party, a ciphertext vector is generated, and a session key is generated based on the support information of the block error matrix. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns, where the number of columns in each sub-matrix corresponds to the number of columns in a block of the public key matrix. Each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. This invention increases the difficulty for attackers to solve the error matrix algebraically by using a block error matrix with mutually exclusive supports instead of a traditional single support error matrix, thereby allowing for a smaller parameter size while maintaining the same security strength, effectively reducing the size of the public key and ciphertext.

[0060] It should be noted that each implementation method of this application can be freely combined, rearranged, or executed individually, and does not need to rely on or depend on a fixed execution order.

[0061] According to a key encapsulation method provided by the present invention, the block error matrix is ​​a binary block error matrix, which includes a first submatrix and a second submatrix; the number of columns of the first submatrix corresponds to the number of columns of the first block of the public key matrix, and the number of columns of the second submatrix corresponds to the number of columns of the second block of the public key matrix; the support of the block error matrix is ​​composed of the support of the first submatrix and the support of the second submatrix, and the support of the first submatrix and the support of the second submatrix do not intersect; the column weight of each block in the block error matrix is ​​equal to a preset block error weight; the sum of the error weights of the first submatrix and the error weights of the second submatrix is ​​less than or equal to the error correction capacity of the rank-distance linear error-correcting code.

[0062] Wherein, the bipartite error matrix refers to the error matrix Divide into two sub-matrices according to columns. ,in The number of columns is , The number of columns is , respectively, correspond to the number of columns in the first block and the number of columns in the second block of the public key matrix, satisfying .

[0063] Rank-distance linear error-correcting codes refer to linear error-correcting codes defined under a rank metric. Unlike the traditional Hamming metric, the rank metric treats a vector over a finite field as a matrix, and its weight is defined as the rank of that matrix. Gabidulin codes are maximally distance-separable codes in the rank-distance sense, similar to Reed-Solomon codes under the Hamming metric. When constructing cryptographic schemes using rank-distance linear error-correcting codes, the computational complexity of the decoding problem increases sharply with the number of parameters. However, at the same security level, a smaller parameter size can be used compared to Hamming metric schemes.

[0064] Error correction capacity refers to the maximum error weight that a linear error-correcting code can correct. For interleaved Gaboduin codes, the error correction capacity is... ,in The interleaving multiplicity. The weighted sum of the weights (i.e., rank weights) of two block error components in the block error matrix. The error correction capacity must not exceed this limit to ensure that the decoding algorithm can successfully decode with a sufficiently high probability.

[0065] In this embodiment, the block error matrix is ​​specifically a binary block error matrix. ,in , .

[0066] The block error matrix satisfies the following structural conditions: (1) The number of columns is , which corresponds to the column number of the first block of the public key matrix; The number of columns is , corresponding to the number of the second block column in the public key matrix, and .

[0067] (2) The support is , The support is The two do not intersect, that is The overall support of the block error matrix is ​​provided by support and The supporting structure, namely (Straight and straight).

[0068] (3) The column weight (rank weight) is , The column weight (rank weight) is All of these are preset block error weights.

[0069] (4) The sum of the error weights of the two blocks (in and Error correction capacity of linear error-correcting codes whose block permutation parameters are less than or equal to the rank distance. .

[0070] The following is an example 2: Following Example 1, at a 128-bit security level, , L=5 , , , =7, .

[0071] Key encapsulation party randomly generates ,in dim(Supp(E1))=8; , , ,and .

[0072] Verify the error correction capacity constraint: , = Given a 128-bit security level, this set of parameters satisfies the corresponding security constraints, ensuring that the decoding algorithm can successfully decode.

[0073] The method provided in this invention employs a bipartite error matrix with mutually disjoint supports, increasing the difficulty for attackers to solve the error matrix algebraically. This means the attacker needs to simultaneously determine two independent support spaces and their intersection properties. Furthermore, by precisely controlling the total error weight to not exceed the error correction capacity, it ensures that the legitimate receiver can recover the error matrix with a very high probability of error-free operation.

[0074] According to a key encapsulation method provided by the present invention, a ciphertext vector is generated by calculating based on a block error matrix and a public key matrix, including: Multiplying the block error matrix by the transpose of the public key matrix yields the ciphertext vector.

[0075] In some embodiments, the specific methods for generating the ciphertext vector based on the block error matrix and the public key matrix include the following: In this embodiment, the specific calculation method for the key encapsulation party to generate the ciphertext vector is as follows: the randomly generated block error matrix is ​​used... Multiply by the transpose of the public key matrix H′, which is the ciphertext vector. Calculated Output as a ciphertext vector.

[0076] The method provided in this embodiment of the invention adopts the standard checksum calculation method under the Niederreiter framework, which is simple and efficient. The ciphertext size depends only on the number of rows (nk) of the checksum matrix and the interleaving multiplication factor L, and does not depend on the code length n, which is beneficial for compressing the ciphertext size.

[0077] According to a key encapsulation method provided by the present invention, a session key is generated based on supporting information of a block error matrix, comprising: Input the supporting information into a preset hash function to obtain the session key.

[0078] In some embodiments, the specific methods for generating session keys based on the supporting information of the block error matrix include the following: Here, a hash function is a function that maps an input of arbitrary length to an output of fixed length; in this invention, it is denoted as... Hash functions are one-way and collision-resistant, and can evenly distribute supporting information throughout the session key space.

[0079] In this embodiment, the key encapsulation party generates a session key based on the supporting information, specifically by extracting the block error matrix. Supporting information Input the preset hash function ,calculate Obtain the session key .

[0080] The method provided in this invention uses a hash function to generate a session key. This not only evenly distributes high-dimensional supporting information across the key space but also prevents attackers from reverse-engineering the supporting information from publicly available data, enhancing the security of the solution in practical applications. Furthermore, the determinism of the hash function ensures that the encapsulation and decapsulation ends obtain the same session key when inputting the same supporting information.

[0081] According to a key encapsulation method provided by the present invention, before generating a session key based on the supporting information of a block error matrix, the method further includes: Determine the linear space spanned over a finite field for each non-zero column vector in the block error matrix; The linear space is determined as the supporting information for the block error matrix.

[0082] In some embodiments, before generating the session key based on the supporting information of the block error matrix, a supporting information extraction method is further included, including the following: In this invention, a finite field refers to... That is, by A finite field consisting of elements. A non-zero column vector of a matrix is ​​a column in the matrix that contains at least one non-zero element. The linear space spanned by these non-zero column vectors over the finite field is the support of the matrix.

[0083] In this embodiment, before generating the session key based on the supporting information of the block error matrix, the key encapsulation party needs to extract the supporting information first. This specifically includes the following sub-steps: (1) Determine the block error matrix In a finite field, each non-zero column vector... The linear space formed by the above.

[0084] (2) Determine the supporting information of the block error matrix in this linear space. .

[0085] For the binary block error matrix Its support (Direct sum), that is, the linear space spanned by all non-zero column vectors.

[0086] The following is a detailed embodiment: Following the aforementioned embodiments, the key encapsulation party generates... After that, extract All non-zero column vectors in The linear space V1 formed by the above tension, and If V2 is the linear space spanned by all non-zero column vectors in the vector matrix, then... Since V1∩V2={0}, the dimension of this straight space is equal to... .

[0087] The method provided in this invention clarifies the extraction method of supporting information, making the subsequent generation of session keys deterministic and unique, ensuring that both communicating parties can generate the same session key after correct decoding. Simultaneously, the supporting information corresponds one-to-one with the error matrix; any modification to the error matrix will result in a different session key, providing message integrity protection.

[0088] According to a key encapsulation method provided by the present invention, the public key matrix is ​​generated by the key decapsulation party through the following steps, including: Obtain the preset rank-distance linear error correction code, and generate the corresponding parity check matrix based on the rank-distance linear error correction code; Randomly generate a block permutation matrix and a confusion invertible matrix. Use the block permutation matrix to perform column permutation on the check matrix, and use the confusion invertible matrix to perform row confusion on the check matrix to obtain a system-type public key matrix. Store the block permutation matrix, the confusion invertible matrix, and the check matrix as a private key.

[0089] In some embodiments, the public key matrix is ​​generated in the following ways: First, it should be noted that the entity responsible for generating the public key matrix is ​​the key decapsulation party.

[0090] Among them, the parity-check matrix of the linear error-correcting code It is A parity check matrix is ​​used for checksum calculations during encoding and decoding. In the Niederreiter cryptographic framework, the parity check matrix is ​​used as a public key after random transformation.

[0091] Block permutation matrices differ from ordinary permutation matrices. A block permutation matrix divides the column vector into several sub-blocks according to a predefined block structure, and performs column permutation operations independently within each sub-block. In this invention, a biblock permutation matrix is ​​used, dividing the columns of the parity matrix into two sub-blocks, each of which is then permuted.

[0092] A confused invertible matrix is ​​a randomly generated invertible square matrix. The confusion matrix is ​​used to perform row operations on the parity check matrix to hide its structure. The randomness and invertibility of the confusion matrix ensure that the public key is indistinguishable from the original parity check matrix, which is an important component of the scheme's security.

[0093] Systematic public key matrix: The verification matrix obtained after block permutation matrix column permutation and confusion invertible matrix row transformation. It has a systematic standard form, that is, it contains identity matrix blocks, which facilitates the rapid calculation of ciphertext in the encapsulation step.

[0094] In this embodiment, the public key matrix is ​​generated by the key decapsulation party through the following steps: Step 1: Obtain the rank-distance linear error-correcting code and generate the parity-check matrix.

[0095] The key decapsulator obtains a preset rank-distance linear error-correcting code (such as a Gabodulin code) and generates a corresponding parity-check matrix based on the error-correcting code. ,in For code length, Dimensionality of information.

[0096] Step 2: Randomly generate the block permutation matrix and the confusion invertible matrix.

[0097] The key decapsulator randomly generates a block permutation matrix. and a confused invertible matrix Block permutation matrix Used to permutate the columns of the parity check matrix, obfuscating the invertible matrix. Used to transform the rows of the parity check matrix, where, , .

[0098] Step 3: Generate a system-wide public key matrix.

[0099] Using block permutation matrix For the verification matrix Perform column permutation ( ), using confusion invertible matrices Row obfuscation of the parity check matrix ( ), to obtain the system-type public key matrix .

[0100] Step 4: Store the private key and send the public key.

[0101] Block permutation matrix Confusion invertible matrix and the original parity check matrix Store as private key , system type public key matrix The public key (pk) is sent to the key encapsulator.

[0102] The following is a detailed embodiment: Taking 128-bit security level as an example, the key decapsulation party should choose... Gabodulin codes with a length of 52 and a dimension of 26 are used to generate a parity-check matrix. Randomly generate a bipartite permutation matrix. (Dividing the 52 columns into two 26-column sub-blocks, with independent permutations within each sub-block) and confusing invertible matrices .calculate This yields a system-type public key matrix. .Will Send the public key to the key encapsulator, Stored as a private key.

[0103] The method provided in this invention performs a double random transformation on the parity check matrix using a block permutation matrix and a confusion invertible matrix, hiding the structure of the underlying error-correcting code. This makes the public key indistinguishable from the random matrix, providing a security foundation for the scheme. The standard form of the system-type public key matrix facilitates rapid computation of the ciphertext by the encapsulating party.

[0104] Figure 2 This is the second flowchart of the key encapsulation method provided by the present invention. The method is applied to the key decapsulation side, such as... Figure 2 As shown, the method includes: Step 201: Receive the ciphertext vector sent by the key encapsulation party, and perform an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input; the ciphertext vector is generated by the key encapsulation party after randomly generating a block error matrix that satisfies the preset block rank weight condition, and then calculating the ciphertext vector based on the block error matrix and the public key matrix sent by the key decapsulation party; the block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns of a block in the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive; Step 202: Call the preset decoding algorithm to decode the decoding input and recover the initial error matrix; Step 203: Perform an inverse permutation on the initial error matrix based on the block permutation matrix in the private key to obtain the block error matrix; Step 204: Extract the supporting information of the block error matrix and recover the session key based on the supporting information of the block error matrix.

[0105] In this embodiment of the invention, the executing entity is the key decapsulation party, which is the party that performs key generation and decapsulation operations, holds the private key, and recovers the session key from the ciphertext.

[0106] The inverse transformation utilizes a confusion invertible matrix. Perform inverse operation on ciphertext This eliminates line obfuscation introduced during public key generation.

[0107] The decoding input is an intermediate value obtained after inverse transformation. It is in the original parity check matrix The checksum can be directly input into the decoder.

[0108] In practical applications, the ciphertext vector is first received and then inversely transformed. The key decapsulating party receives the ciphertext vector sent by the key encapsulating party. Using the obfuscated invertible matrix in the private key For ciphertext vectors Perform the inverse transformation, that is, calculate , obtain the decoded input .

[0109] Then, the decoding algorithm is called to perform decoding. As input, a preset decoding algorithm (such as an interleaved Gabodus code decoding algorithm) is invoked to decode and recover the initial error matrix. .

[0110] Further, perform an inverse permutation to recover the block error matrix. This is done based on the block permutation matrix in the private key. For the initial error matrix Perform the inverse permutation, i.e., calculate The original block error matrix is ​​obtained. .

[0111] Then, the supporting information is extracted to recover the session key.

[0112] extract Supporting information The session key can be recovered based on this supporting information. .

[0113] The method provided in this embodiment of the invention involves the following steps: First, the key decapsulating party receives a ciphertext vector sent by the key encapsulating party. Then, it performs an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input. The ciphertext vector is generated by the key encapsulating party through a randomly generated block error matrix that satisfies a preset block rank weight condition. This ciphertext vector is calculated based on the block error matrix and the public key matrix sent by the key decapsulating party. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns. The number of columns in each sub-matrix corresponds to the number of columns in a block of the public key matrix. Each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. Then, a preset decoding algorithm is called to decode the decoding input, recovering the initial error matrix. Further, the initial error matrix is ​​inversely permuted using the block permutation matrix in the private key to obtain the block error matrix. Finally, the support information of the block error matrix is ​​extracted, and the session key is recovered based on this support information.

[0114] In this invention, the key decapsulation party sequentially performs reverse obfuscation, interleaved Gabodullin code decoding, and inverse column permutation operations, achieving accurate recovery of the block error matrix generated by the encapsulation end and ensuring the consistency of the session key between the communicating parties. Because the interleaved Gabodullin code has multi-checker decoding capability, it can complete decoding with a low decoding failure rate. This supports the use of a block error matrix structure that supports disjoint blocks to increase the difficulty of algebraic attacks, allowing the overall scheme to use a smaller parameter scale while maintaining security strength, effectively reducing the size of the public key and ciphertext.

[0115] According to a key encapsulation method provided by the present invention, a ciphertext vector is inversely transformed using a confusion invertible matrix to obtain a decoding input, comprising: The ciphertext vector is multiplied by the inverse of the confusion invertible matrix to obtain the decoding input.

[0116] In some embodiments, the specific methods for performing inverse transformation of the ciphertext vector using a confusion invertible matrix include the following: In this embodiment, the key decapsulation party uses a confusion invertible matrix to perform an inverse transformation on the ciphertext vector, specifically: transforming the ciphertext vector... Multiply by a confusion invertible matrix inverse matrix , obtain the decoded input .

[0117] The mathematical principle behind this operation lies in: public key ciphertext .therefore That is, in the original parity check matrix The checksum can be directly input into the decoder for decoding.

[0118] The method provided in this invention eliminates row obfuscation introduced during public key generation through precise matrix inversion, ensuring the correct execution of subsequent decoding algorithms. This step is a crucial bridge connecting public-key cryptography and error-correcting code decoding.

[0119] According to a key encapsulation method provided by the present invention, a preset decoding algorithm is invoked to decode the decoding input and recover the initial error matrix, including: The decoding input is decoded using the decoding algorithm of Interleaved Gabidulin code to obtain the error matrix after column permutation; The error matrix after column permutation is used as the initial error matrix.

[0120] In some embodiments, the decoding steps are specifically implemented as follows: Interleaved Gabodullin codes are... A code consisting of Gabodullin codewords arranged side by side has the following codeword form: Interleaved structures utilize multiple parsers with the same noise support set to obtain more coordinate information, thereby improving decoding capability and reducing decoding failure rate.

[0121] Decoding algorithm for interleaved Gabothian codes: The decoding algorithm corresponding to interleaved Gabothian codes is denoted as InterleavedGab.Decode(·), which can process... An error vector is used to achieve efficient decoding by utilizing multiple checksum information.

[0122] In this embodiment, the key decapsulator calls a preset decoding algorithm to decode the decoding input, specifically including: (1) Use the decoding algorithm of interleaved Gabodulin code to decode the input. Decoding is performed to obtain the error matrix after column permutation. .

[0123] (2) Use the error matrix E′ after column permutation as the initial error matrix.

[0124] The method provided in this invention uses an interleaved Gabodulin code decoding algorithm and leverages the multi-checker feature to improve the decoding success rate, thereby allowing for shorter code lengths and smaller parameter sizes, and further reducing communication overhead.

[0125] According to a key encapsulation method provided by the present invention, before performing an inverse permutation on an initial error matrix based on a block permutation matrix in the private key to obtain a block error matrix, the method further includes: Obtain the preset rank-distance linear error correction code, and generate the corresponding parity check matrix based on the rank-distance linear error correction code; Randomly generate a block permutation matrix and a confusion invertible matrix. Use the block permutation matrix to perform column permutation on the check matrix and use the confusion invertible matrix to perform row confusion on the check matrix to obtain a system-type public key matrix. Store the block permutation matrix, the confusion invertible matrix, and the check matrix as a private key. Send the public key matrix to the key encapsulator.

[0126] In this embodiment, the key decryptor has completed the generation of the private and public keys before performing the inverse permutation of the initial error matrix based on the block permutation matrix in the private key. Specifically, this includes: (1) Obtain a preset rank-distance linear error correction code (such as Gabodulin code), and generate the corresponding parity check matrix based on the error correction code. .

[0127] (2) Randomly generate the block permutation matrix and confusion invertible matrices Using block permutation matrix For the verification matrix Perform column permutations using a confusion invertible matrix. Row obfuscation of the parity check matrix yields a system-type public key matrix. .

[0128] (3) Permuting the block matrix Confusion invertible matrix Sum check matrix Store as private key .

[0129] (4) Public key matrix Send it to the key encapsulator.

[0130] Taking a 128-bit security level as an example, the key decryptor chooses a Gabodulin code on φ_{2^53}, with a length of 52 and a dimension of 26, to generate a parity check matrix. Randomly generate a bipartite permutation matrix. (Dividing 52 columns into two 26-column sub-blocks) and confusing invertible matrices S. Calculation The system-type public key matrix is ​​obtained. Send H′ to the key encapsulator, and... Stored as a private key.

[0131] The method provided in this invention provides a complete key generation process, enabling the decapsulation party to independently generate public and private key pairs, thus providing a complete cryptographic infrastructure for key encapsulation.

[0132] According to the technical solution of the present invention, the main parameters involved in the system include: finite field parameter q, expansion number m, code length n, information dimension k, interleaving multiplicity L, block lengths n1 and n2, block permutation parameters p1 and p2, and block error weights e1 and e2. These parameters must satisfy the following constraints: Constraint 1 (Error Correction Capacity Constraint): To ensure The weight does not exceed the error correction capacity of the Interleaved Gabidulin code, that is... Constraint 2 (Decoding Failure Rate Constraint): Given a classical security level λ, the decoding failure rate must be sufficiently small, i.e.: Constraint 3 (Key Entropy Constraint): The entropy of the encapsulation key must be sufficiently large. Constraint 4 (Difficult Problem Constraint): The block rank distance decoding problem is sufficiently difficult.

[0133] Constraint 5 (Safety Strength Constraint): Actual safety strength Q = min{Q1,Q2} ≥ 2 λ Q1 and Q2 are the lower bounds of the computational complexity for resisting algebraic attacks and combinatorial attacks, respectively.

[0134] Based on the above constraints, the present invention recommends two sets of preferred parameters, as shown in Table 1 below:

[0135] Using the above parameter configuration, the key encapsulation method of the present invention has a classical security strength greater than that of [missing information]. and The decoding failure rate is less than and It has a smaller public key size and ciphertext size compared to existing key encapsulation methods of the same type.

[0136] The key encapsulation device provided by the present invention is described below. The key encapsulation device described below and the key encapsulation method described above can be referred to in correspondence.

[0137] Figure 3 This is one of the structural schematic diagrams of the key encapsulation device provided by the present invention. The device is applied to the key encapsulation process, such as... Figure 3 As shown, the key encapsulation device 300 includes the following modules: The encapsulation module 310 is used to randomly generate a block error matrix that satisfies a preset block rank weight condition; calculate and generate a ciphertext vector based on the block error matrix and the public key matrix sent by the key decapsulation party; and generate a session key based on the support information of the block error matrix; the block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns of a block in the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive.

[0138] According to a key encapsulation device 300 provided by the present invention, the block error matrix is ​​a binary block error matrix, which includes a first submatrix and a second submatrix; the number of columns of the first submatrix corresponds to the number of columns of the first block of the public key matrix, and the number of columns of the second submatrix corresponds to the number of columns of the second block of the public key matrix; the support of the block error matrix is ​​composed of the support of the first submatrix and the support of the second submatrix, and the support of the first submatrix and the support of the second submatrix do not intersect; the column weight of each block in the block error matrix is ​​equal to a preset block error weight; the sum of the error weights of the first submatrix and the error weights of the second submatrix is ​​less than or equal to the error correction capacity of the rank-distance linear error-correcting code.

[0139] According to the present invention, a key encapsulation device 300 is provided, wherein the encapsulation module 310 is specifically used for: The ciphertext vector is obtained by multiplying the block error matrix by the transpose of the public key matrix.

[0140] According to a key encapsulation device 300 provided by the present invention, the encapsulation module 310 is further used for: The supporting information is input into a preset hash function to obtain the session key.

[0141] According to a key encapsulation device 300 provided by the present invention, the encapsulation module 310 is further used for: Determine the linear space spanned over a finite field for each non-zero column vector in the block error matrix; The linear space is determined as the supporting information for the block error matrix.

[0142] According to a key encapsulation device 300 provided by the present invention, the public key matrix is ​​generated by the key decapsulation party through the following steps, including: Obtain a preset rank-distance linear error correction code, and generate a corresponding parity check matrix based on the rank-distance linear error correction code; A block permutation matrix and a confusion invertible matrix are randomly generated. The column permutation matrix is ​​used to perform column permutation on the verification matrix, and the row confusion matrix is ​​used to perform row confusion on the verification matrix to obtain the system-type public key matrix. The block permutation matrix, the confusion invertible matrix, and the verification matrix are stored as private keys.

[0143] Figure 4 This is a second schematic diagram of the key encapsulation device provided by the present invention. The device is applied to the key decapsulation process, such as... Figure 4 As shown, the key encapsulation device 400 includes the following modules: The decapsulation module 410 is used to receive the ciphertext vector sent by the key encapsulation party, perform an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input; the ciphertext vector is generated by the key encapsulation party through a block error matrix that randomly satisfies a preset block rank weight condition, and then calculated based on the block error matrix and the public key matrix sent by the key decapsulation party; the block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns in a block of the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive; a preset decoding algorithm is called to decode the decoding input to recover the initial error matrix; the initial error matrix is ​​inversely permuted according to the block permutation matrix in the private key to obtain the block error matrix; the support information of the block error matrix is ​​extracted, and the session key is recovered based on the support information of the block error matrix.

[0144] According to a key encapsulation device 400 provided by the present invention, the decapsulation module 410 is specifically used for: The ciphertext vector is multiplied by the inverse of the confusion invertible matrix to obtain the decoding input.

[0145] According to a key encapsulation device 400 provided by the present invention, the decapsulation module 410 is further configured to: The decoding input is decoded using the decoding algorithm of Interleaved Gabidulin code to obtain the error matrix after column permutation; The error matrix after column permutation is used as the initial error matrix.

[0146] According to the present invention, a key encapsulation device 400 further includes a key generation module; The key generation module is used for: Obtain a preset rank-distance linear error correction code, and generate a corresponding parity check matrix based on the rank-distance linear error correction code; A block permutation matrix and a confusion invertible matrix are randomly generated. The column permutation matrix is ​​used to perform column permutation on the check matrix, and the row confusion matrix is ​​used to perform row confusion on the check matrix to obtain a system-type public key matrix. The block permutation matrix, the confusion invertible matrix, and the check matrix are stored as a private key. The public key matrix is ​​sent to the key encapsulation party.

[0147] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 5As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a key encapsulation method. This method is applied to the key encapsulation side and includes the following steps: Randomly generate a block error matrix that satisfies the preset block rank weight condition; The ciphertext vector is generated by calculating the block error matrix and the public key matrix sent by the key decapsulation party, and a session key is generated based on the support information of the block error matrix. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns. The number of columns of each sub-matrix corresponds to the number of columns of a block in the public key matrix. Each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive.

[0148] Alternatively, a key encapsulation method may be executed, which is applied to the key decapsulation party and includes: The key encapsulation party receives a ciphertext vector sent by the key encapsulation party, and performs an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input. The ciphertext vector is generated by the key encapsulation party through a block error matrix that randomly satisfies a preset block rank weight condition, and is calculated based on the block error matrix and the public key matrix sent by the key decapsulation party. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns in a block of the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. The preset decoding algorithm is invoked to decode the decoding input and recover the initial error matrix; The initial error matrix is ​​inversely permuted using the block permutation matrix in the private key to obtain the block error matrix; Extract the supporting information of the block error matrix, and recover the session key based on the supporting information of the block error matrix.

[0149] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0150] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the key encapsulation method provided by the above methods. The method is applied to the key encapsulation party, and the method includes the following steps: Randomly generate a block error matrix that satisfies the preset block rank weight condition; The ciphertext vector is generated by calculating the block error matrix and the public key matrix sent by the key decapsulation party, and a session key is generated based on the support information of the block error matrix. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns. The number of columns of each sub-matrix corresponds to the number of columns of a block in the public key matrix. Each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive.

[0151] Alternatively, a key encapsulation method may be executed, which is applied to the key decapsulation party and includes: The key encapsulation party receives a ciphertext vector sent by the key encapsulation party, and performs an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input. The ciphertext vector is generated by the key encapsulation party through a block error matrix that randomly satisfies a preset block rank weight condition, and is calculated based on the block error matrix and the public key matrix sent by the key decapsulation party. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns in a block of the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. The preset decoding algorithm is invoked to decode the decoding input and recover the initial error matrix; The initial error matrix is ​​inversely permuted using the block permutation matrix in the private key to obtain the block error matrix; Extract the supporting information of the block error matrix, and recover the session key based on the supporting information of the block error matrix.

[0152] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the key encapsulation methods provided by the above methods. The method is applied to a key encapsulation party, and the method includes the following steps: Randomly generate a block error matrix that satisfies the preset block rank weight condition; The ciphertext vector is generated by calculating the block error matrix and the public key matrix sent by the key decapsulation party, and a session key is generated based on the support information of the block error matrix. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns. The number of columns of each sub-matrix corresponds to the number of columns of a block in the public key matrix. Each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive.

[0153] Alternatively, a key encapsulation method may be executed, which is applied to the key decapsulation party and includes: The key encapsulation party receives a ciphertext vector sent by the key encapsulation party, and performs an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input. The ciphertext vector is generated by the key encapsulation party through a block error matrix that randomly satisfies a preset block rank weight condition, and is calculated based on the block error matrix and the public key matrix sent by the key decapsulation party. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns in a block of the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. The preset decoding algorithm is invoked to decode the decoding input and recover the initial error matrix; The initial error matrix is ​​inversely permuted using the block permutation matrix in the private key to obtain the block error matrix; Extract the supporting information of the block error matrix, and recover the session key based on the supporting information of the block error matrix.

[0154] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0155] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0156] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A key encapsulation method, characterized in that, Applied to key encapsulation, including: Randomly generate a block error matrix that satisfies the preset block rank weight condition; The ciphertext vector is generated by calculating the block error matrix and the public key matrix sent by the key decapsulation party, and a session key is generated based on the support information of the block error matrix. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns. The number of columns of each sub-matrix corresponds to the number of columns of a block in the public key matrix. Each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive.

2. The key encapsulation method according to claim 1, characterized in that, The block error matrix is ​​a binary block error matrix, which includes a first submatrix and a second submatrix; the number of columns in the first submatrix corresponds to the number of columns in the first block of the public key matrix, and the number of columns in the second submatrix corresponds to the number of columns in the second block of the public key matrix; The support of the block error matrix is ​​composed of the support of the first sub-matrix and the support of the second sub-matrix, and the support of the first sub-matrix and the support of the second sub-matrix do not intersect each other; The column weight of each block in the block error matrix is ​​equal to the preset block error weight; The sum of the error weights of the first submatrix and the error weights of the second submatrix is ​​less than or equal to the error correction capacity of the rank-distance linear error-correcting code.

3. The key encapsulation method according to claim 1, characterized in that, The step of calculating and generating a ciphertext vector based on the block error matrix and the public key matrix includes: The ciphertext vector is obtained by multiplying the block error matrix by the transpose of the public key matrix.

4. The key encapsulation method according to claim 1, characterized in that, The step of generating a session key based on the supporting information of the block error matrix includes: The supporting information is input into a preset hash function to obtain the session key.

5. The key encapsulation method according to claim 1, characterized in that, Before generating the session key based on the supporting information of the block error matrix, the method further includes: Determine the linear space spanned over a finite field for each non-zero column vector in the block error matrix; The linear space is determined as the supporting information for the block error matrix.

6. The key encapsulation method according to any one of claims 1-5, characterized in that, The public key matrix is ​​generated by the key decapsulation party through the following steps: Obtain a preset rank-distance linear error correction code, and generate a corresponding parity check matrix based on the rank-distance linear error correction code; A block permutation matrix and a confusion invertible matrix are randomly generated. The column permutation matrix is ​​used to perform column permutation on the verification matrix, and the row confusion matrix is ​​used to perform row confusion on the verification matrix to obtain the system-type public key matrix. The block permutation matrix, the confusion invertible matrix, and the verification matrix are stored as private keys.

7. A key encapsulation method, characterized in that, Applications to key decapsulation include: The key encapsulation party receives a ciphertext vector sent by the key encapsulation party, and performs an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input. The ciphertext vector is generated by the key encapsulation party through a block error matrix that randomly satisfies a preset block rank weight condition, and is calculated based on the block error matrix and the public key matrix sent by the key decapsulation party. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns in a block of the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. The preset decoding algorithm is invoked to decode the decoding input and recover the initial error matrix; The initial error matrix is ​​inversely permuted using the block permutation matrix in the private key to obtain the block error matrix; Extract the supporting information of the block error matrix, and recover the session key based on the supporting information of the block error matrix.

8. The key encapsulation method according to claim 7, characterized in that, The step of performing an inverse transformation on the ciphertext vector using a confusion invertible matrix to obtain the decoding input includes: The ciphertext vector is multiplied by the inverse of the confusion invertible matrix to obtain the decoding input.

9. The key encapsulation method according to claim 7, characterized in that, The step of calling a preset decoding algorithm to decode the decoding input and recover the initial error matrix includes: The decoding input is decoded using the decoding algorithm of Interleaved Gabidulin code to obtain the error matrix after column permutation; The error matrix after column permutation is used as the initial error matrix.

10. The key encapsulation method according to claim 7, characterized in that, Before performing an inverse permutation on the initial error matrix based on the block permutation matrix in the private key to obtain the block error matrix, the method further includes: Obtain a preset rank-distance linear error correction code, and generate a corresponding parity check matrix based on the rank-distance linear error correction code; A block permutation matrix and a confusion invertible matrix are randomly generated. The column permutation matrix is ​​used to perform column permutation on the check matrix, and the row confusion matrix is ​​used to perform row confusion on the check matrix to obtain a system-type public key matrix. The block permutation matrix, the confusion invertible matrix, and the check matrix are stored as a private key. The public key matrix is ​​sent to the key encapsulation party.

11. A key encapsulation device, characterized in that, Applied to key encapsulation, including: The encapsulation module is used to randomly generate a block error matrix that satisfies a preset block rank weight condition; calculate and generate a ciphertext vector based on the block error matrix and the public key matrix sent by the key decapsulation party; and generate a session key based on the support information of the block error matrix; the block error matrix is ​​a matrix divided into multiple sub-matrices by columns, the number of columns of each sub-matrix corresponds to the number of columns of a block in the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive.

12. A key encapsulation device, characterized in that, Applications to key decapsulation include: The decapsulation module receives a ciphertext vector sent by the key encapsulation party, performs an inverse transformation on the ciphertext vector using a confusion invertible matrix, and obtains the decoding input. The ciphertext vector is generated by the key encapsulation party through a randomly generated block error matrix that satisfies a preset block rank weight condition, and is calculated based on the block error matrix and the public key matrix sent by the key decapsulation party. The block error matrix is ​​a matrix divided into multiple sub-matrices by columns, where the number of columns in each sub-matrix corresponds to the number of columns in a block of the public key matrix, each sub-matrix has a preset rank weight, and the supports of any two different sub-matrices are mutually exclusive. A preset decoding algorithm is invoked to decode the decoding input and recover the initial error matrix. The initial error matrix is ​​then inversely permuted using the block permutation matrix in the private key to obtain the block error matrix. The support information of the block error matrix is ​​extracted, and the session key is recovered based on the support information of the block error matrix.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the key encapsulation method as described in any one of claims 1 to 6, or the key encapsulation method as described in any one of claims 7 to 10.

Images