A fixed-weight vector rejection sampling method and device based on a multi-scale cyclic window

Abstract

The application discloses a fixed weight vector rejection sampling method and device based on a multi-scale cyclic window, and belongs to the technical field of post-quantum cryptography. The method sets at least two different cyclic window lengths, and configures a corresponding upper limit value of the number of support points for each window length; in the construction process of the candidate vector, whether the number of support points in all cyclic windows under each window length exceeds the corresponding upper limit value is determined respectively; if any window is over the limit, the candidate is rejected and regenerated, and only when the candidate vector simultaneously satisfies all scale constraints, the candidate vector is output to the key generation, encapsulation or encryption process of the cryptographic mechanism. Multiple scales jointly form a capacity upper bound envelope, and different scales can control different ranges of local aggregation patterns, realizing multi-range local density constraints that a single scale cannot simultaneously consider. The application can deterministically exclude dangerous samples in the sampling stage, and is suitable for post-quantum cryptographic mechanisms such as HQC and BIKE which have a fixed weight cyclic vector sampling link.

Description

Technical Field

[0001] This invention relates to the field of post-quantum cryptography, and in particular to a fixed weight vector rejection sampling method and apparatus based on a multi-scale cyclic window, for use in the key generation, encapsulation, or encryption process of a post-quantum key encapsulation mechanism (KEM). Background Technology

[0002] Encoding-based post-quantum key encapsulation mechanisms are an important class of post-quantum cryptography schemes [Gaborit, P., Aguilar-Melchor, C., Aragon, N., Bettaieb, S., Bidoux, L., Blazy, O., Deneuville, JC, Persichetti, E., Zémor, G., Bos, J., et al.: Hamming quasi-cyclic (HQC). Tech. rep., PQC-HQC Team, https: / / pqc-hqc.org / doc / hqc_specifications_2025_08_22.pdf (Aug. 2025).]. Taking the Hamming Quasi-Cyclic (HQC) key encapsulation scheme as an example, according to the official HQC documentation, its key generation stage requires sampling a fixed-weight secret vector. , The encapsulation or encryption stage requires sampling a fixed-weight random vector. , and error vector The aforementioned vectors contribute to the noise term in the decryption process.

[0003] .

[0004] Quasi-cyclic coding schemes such as Bit Flipping Key Encapsulation (BIKE) also use a fixed weight vector during the key generation or encapsulation stage.

[0005] The decryption failure rate (DFR) of the above scheme is not only related to the total Hamming weight of the noise or error terms, but may also be related to the local distribution of the support points at the loop positions. Traditional fixed-weight sampling mainly ensures that the output vector has a specified Hamming weight and a predetermined sampling distribution, and usually does not set a limit on the number of local support points over multiple loop window lengths at the same time.

[0006] Existing research has shown that localized clustering structures may alter the noise distribution encountered by the decoder. In HQC, Guo and Johansson [Guo, Q., Johansson, T.: A new decryption failure attack against HQC. In: Moriai, S., Wang, H. (eds.) Advances in Cryptology - ASIACRYPT 2020.pp. 353-382. Springer International Publishing, Cham (2020).] and Guan et al. [Guan, C., et al.: Compact HQC with new (un)balance. IACR Cryptology ePrint Archive, Report 2026 / 461 (2026).] investigated the disequilibrium or local clustering phenomena associated with decryption failures; in BIKE, Wang et al. [Wang, T., Wang, A., Wang, X.: Exploring Decryption Failures of BIKE: New Class of Weak Keys and Key Recovery Attacks. In: PQCrypto The clustering property proposed in [2023.] addresses the case where support points cluster in consecutive cyclic positions. Matthews and McMillon [Matthews, GL, McMillon, E.: A combinatorial approach to avoiding weak keys in the BIKEcryptosystem. Designs, Codes and Cryptography 93, 3413–3436 (2025.] also studied weak key structures. Existing defense or detection strategies can set judgment conditions for a predetermined window length or a predetermined structure, but a single scale mainly controls the local clustering corresponding to that scale, and the upper bound of capacity induced by other length intervals may be relatively loose.

[0007] Existing fixed-weight vector sampling in HQC can employ the Sendrier-improved Fisher–Yates shuffle method combined with rejection sampling to ensure fixed weight, unique position, and predetermined distribution. A constant-time hardware implementation is already available [Schöffel, M., Feldmann, J., Wehn, N.: Efficient Hardware Implementation of Constant Time Sampling for HQC. arXiv:2309.16493 (2023)]. This type of underlying rejection primarily serves the fixed-weight sampling itself and is not equivalent to the local density constraints imposed by this invention on multiple cyclic window scales. Furthermore, when the number of rejections depends on secret candidate data, timing-side channel risks must also be considered.

[0008] Therefore, when considering local density constraints at a single window scale as existing technology or a comparative scheme, at least the following technical problems still exist:

[0009] (1) A single scale can only directly limit one window length, and the upper bound of the support point capacity induced by it for other window lengths may be too loose, making it easy to miss aggregation patterns of different scales.

[0010] (2) Simply tightening the threshold of a single scale to cover more window lengths may cause an unnecessary increase in rejection rate, expected number of samples and loss of sampling space;

[0011] (3) It lacks an upper bound envelope of cross-window length capacity formed by multiple different scales, as well as a unified mathematical expression for determining whether each scale is non-redundant;

[0012] (4) There is a lack of a fixed weight vector sampling method that can jointly configure the target window exclusion capability, rejection probability, implementation overhead and sampling space loss. Summary of the Invention

[0013] This invention addresses the challenge of limiting the clustering of local support points across multiple spatial ranges and reducing the omission of other clustering patterns by a single window scale during fixed-weight vector sampling in a coding-based post-quantum key encapsulation mechanism, while ensuring that sampling overhead and sampling space loss are measurable. It proposes a fixed-weight vector rejection sampling method and apparatus based on multi-scale cyclic windows. The objective of this invention is to set at least two cyclic windows of different lengths and corresponding upper bounds on the number of support points, ensuring that the fixed-weight sampling output simultaneously satisfies all scale constraints. Each scale collectively forms a deterministic upper bound envelope of capacity across the window length, excluding local clustering windows exceeding this capacity upper bound envelope. This invention also aims to provide reproducible parameter selection, rejection probability assessment, sampling space loss assessment, and constant-time implementation methods, enabling the method to be implemented in different coding-based cryptographic mechanisms and at different sampling locations with fixed-weight cyclic vector sampling stages.

[0014] To achieve the above objectives, the present invention adopts the following technical solution:

[0015] This invention proposes a fixed weight vector rejection sampling method based on a multi-scale cyclic window, comprising:

[0016] Set at least two different loop window lengths, and configure a corresponding upper limit value for the number of local support points for each loop window length;

[0017] Generate a binary vector with a specified length and a specified Hamming weight as a candidate vector;

[0018] During the construction of the candidate vector, for the support set portion of the candidate vector that has been determined, under at least two different loop window lengths, it is determined whether the number of support points actually included or to be included in each loop window exceeds the upper limit value corresponding to the window length.

[0019] If, within any given loop window length, the number of support points exceeds the upper limit value corresponding to that window length, the current candidate vector is rejected, and a new candidate vector is generated.

[0020] When a candidate vector satisfies the condition that the number of support points in all the loop windows does not exceed the corresponding upper limit value under the at least two different loop window lengths, the candidate vector is accepted and output to the key generation process, encapsulation process or encryption process of the cryptographic mechanism.

[0021] Furthermore, for any given loop window length The upper bound envelope of the capacity, formed by all scales, is determined as follows:

[0022] Calculate each scale separately In the window length The induced upper bound of the local capacity, which is equal to a number of complete lengths of... The sum of the maximum number of support points accommodated by the sub-window and the maximum number of support points accommodated by the remaining sub-windows that are less than a complete sub-window; then, the minimum value of the local capacity upper bound is taken across all scales, and this minimum value is restricted to not exceeding the specified Hamming weight, to obtain the capacity upper bound envelope; where , .

[0023] Furthermore, each of the aforementioned scales is configured in a non-redundant manner:

[0024] There exists at least a first window length and a second window length, as well as a first scale and a second scale;

[0025] After deleting the first scale, the value of the upper bound envelope of the capacity formed by all remaining scales is strictly greater than the value of the upper bound envelope of the capacity formed by all scales before deletion, at least over the first window length.

[0026] Furthermore, after deleting the second scale, the value of the upper capacity envelope formed by all remaining scales is strictly greater than the value of the upper capacity envelope formed by all scales before deletion, at least over the second window length.

[0027] Furthermore, the candidate vectors are generated by uniform random sampling across the entire vector space with the specified Hamming weight; the candidate vectors that are accepted for the first time after one or more rejections are uniformly distributed across the final output acceptance set.

[0028] Furthermore, the method applies a fixed-weight secret vector to the key generation phase of the cryptographic mechanism, and / or applies a fixed-weight random vector to the encapsulation or encryption phase of the cryptographic mechanism; the error vector in the cryptographic mechanism uses independently configured multi-scale constraints, or no multi-scale constraints are applied to the error vector.

[0029] Furthermore, when the candidate vector involves secret data, the entire loop window length and the entire loop window position are completely traversed, and the detection is not terminated prematurely due to the discovery of any over-limit situation. The comparison flags of each detection result are accumulated to generate a total rejection flag by means of a mask operation.

[0030] Furthermore, a fixed-batch strategy is employed to achieve constant-time rejection sampling:

[0031] A fixed number of candidate vectors are pre-generated as a batch;

[0032] For all candidate vectors in the batch, the actual number of support points contained in each loop window is counted sequentially.

[0033] The first candidate vector that satisfies all scale constraints is selected from the batch using a masking method as the output;

[0034] If no candidate vectors satisfy all scale constraints are found in the batch, a predefined sampling failure state is returned, or the process continues to generate and detect the next fixed number of batches.

[0035] Furthermore, it also includes parameter configuration steps:

[0036] Based on the security analysis, at least one target window length and the minimum number of support points required to exclude local clustering patterns within that target window length are determined.

[0037] Select the loop window length and the corresponding upper limit of the number of local support points, such that the upper limit of the capacity envelope on the target window length is less than the minimum number of support points required for the local aggregation pattern, so as to deterministically exclude the target window pattern.

[0038] Estimate the joint acceptance probability under each candidate constraint and remove redundant scales that do not substantially contribute to the upper bound envelope of capacity and the rejection set.

[0039] This invention also proposes a fixed weight vector rejection sampling device based on a multi-scale cyclic window, comprising:

[0040] The candidate vector generation unit is used to generate a binary vector with a specified length and a specified Hamming weight as a candidate vector.

[0041] The multi-scale configuration unit sets at least two different loop window lengths and configures a corresponding upper limit value for the number of local support points for each loop window length.

[0042] A multi-scale detection unit is used, during the construction of the candidate vector, to determine, for the currently determined support set portion of the candidate vector, whether the number of support points actually included or to be included in each loop window exceeds the upper limit value corresponding to the window length, respectively, under at least two different loop window lengths.

[0043] The rejection control unit is configured to reject the current candidate vector and regenerate a new candidate vector if, within any given loop window length, the number of support points exceeds the upper limit value corresponding to that window length.

[0044] The accepting output unit is used to accept the candidate vector and output the candidate vector to the key generation process, encapsulation process or encryption process of the cryptographic mechanism when the candidate vector satisfies the condition that the number of support points in all the loop windows does not exceed the corresponding upper limit value under the at least two different loop window lengths.

[0045] The present invention also proposes a cryptographic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement a fixed weight vector rejection sampling method based on a multi-scale cyclic window as described above.

[0046] Compared with fixed-weight sampling methods that only guarantee the total Hamming weight or sampling methods that only use a single cyclic window length constraint, the present invention has at least the following advantages:

[0047] (1) By setting at least two different cyclic window lengths and corresponding upper limits for the number of support points, the present invention can deterministically exclude clusters containing more support points than the upper limit of the scale capacity within any target window length during the sampling phase; under the defined cyclic window local density risk model, it can effectively reduce the set of weak samples that the adversary can use.

[0048] (2) Multiple different scales together form the upper bound envelope of capacity, that is, the lower envelope of the upper bound of capacity of each single scale. Different scales can form tighter constraints in different window length ranges. When each scale is configured in a non-redundant manner, multi-scale constraints can simultaneously handle short-range high-density clustering and long-range cumulative clustering, which are difficult to be taken into account by a single scale.

[0049] (3) The upper limit of the window length, the number of support points and the number of scales can be configured jointly according to the security analysis and implementation requirements, and the expected number of samplings after rejection can be controlled by the joint acceptance probability, thereby making a quantitative trade-off between window rejection capability and implementation overhead.

[0050] (4) When the underlying candidate vectors are independent of each other and are uniformly sampled in all vector spaces with a specified Hamming weight, the output obtained by repeatedly rejecting until the first qualified vector is uniformly distributed in the acceptance set, which facilitates the quantitative evaluation of the sampling space loss and provides a predictable distribution basis for security analysis. Attached Figure Description

[0051] Figure 1 This is a schematic diagram comparing safe and dangerous samples with a fixed weight vector provided in an embodiment of the present invention.

[0052] Figure 2 This is one of the flowcharts for a fixed weight vector rejection sampling method based on a multi-scale cyclic window provided in an embodiment of the present invention;

[0053] Figure 3 This is a schematic diagram of multi-scale density detection with a cyclic window provided in an embodiment of the present invention;

[0054] Figure 4A schematic diagram illustrating the necessity of multiple scales for embodiments of the present invention;

[0055] Figure 5 This is the second flowchart of a fixed weight vector rejection sampling method based on a multi-scale cyclic window provided in an embodiment of the present invention.

[0056] Figure 6 This is a schematic diagram of a fixed weight vector rejection sampling device based on a multi-scale cyclic window, provided as an embodiment of the present invention. Detailed Implementation

[0057] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0058] This invention provides a fixed-weight vector rejection sampling method based on multi-scale cyclic windows. After generating fixed-weight candidate vectors, the method counts the number of local support points in the support set of the candidate vectors in at least two cyclic windows of different lengths. If any cyclic window at any scale exceeds the corresponding upper bound, the candidate vector is rejected and resampled. Only when the candidate vector satisfies all scale constraints is it output to the subsequent key generation, encapsulation, or encryption process.

[0059] This invention addresses the security risk of decryption failure caused by the use of local density clustering in cyclic windows to trigger weak samples. Its technical effect is limited to: under the stated conditions and selected parameters, deterministically excluding local clustering windows exceeding the upper bound of the multi-scale capacity envelope, and reducing the corresponding sample set searchable by the adversary; this invention does not claim to eliminate all security risks or all causes of decryption failure under ciphertext selection conditions.

[0060] Let the binary vector of the fixed weight to be sampled be... The vector length is The target weight of Hamming is Its support set is defined as For the starting point of the loop and window length Discrete cyclic window is defined as Each position is according to the mold calculate.

[0061] Set multi-scale parameter set ,in Length of each window Different from each other and satisfying ; For any length of The maximum number of support points allowed within a cyclic window. Candidate vectors must simultaneously satisfy all scale constraints. The multi-scale approach used in this invention does not include single-scale schemes with only one window length; single-scale schemes are only used as background technology or comparative schemes.

[0062] .

[0063] like Figure 1 As shown, the left side represents safe samples that satisfy all multi-scale constraints, where the local density of their support points does not exceed the corresponding threshold in each cyclic window length; the right side represents dangerous samples that violate a certain scale constraint, where a local high-density cluster appears in a certain cyclic window and will be rejected for sampling.

[0064] like Figure 2 As shown, the sampling process of the present invention includes the following steps:

[0065] (1) Input cryptographic mechanism parameters and length of the vector to be sampled Target Hamming weight Random number context parameters and multi-scale parameter sets .

[0066] (2) Call the fixed weight sampling function with uniform or predetermined distribution to generate candidate vectors. ,make During the construction of the candidate vectors, subsequent multi-scale detection steps are executed simultaneously; that is, the detection is not limited to waiting for the candidate vectors to be fully generated, but can be performed at any time during the candidate vector construction process, targeting the currently determined support set.

[0067] (3) Extract and sort To handle looping windows that span consecutive positions, the sorted support position sequence can be copied, and the positions in the copy can be incremented. The length is obtained as An extended sequence; cyclic bitmaps, prefix sums, or other equivalent data structures can also be used.

[0068] (4) In the process of constructing candidate vectors, for each group and the starting point of the cycle The statistical length is Number of support points within the loop window :

[0069] .

[0070] If the candidate vectors have not yet been fully generated, then This refers to the currently determined support set, and based on the currently determined support point distribution, it determines whether the number of support points to be included in each window has reached or necessarily exceeded the corresponding upper limit; if the candidate vectors have been completely generated, then... Refers to the complete support set.

[0071] To facilitate understanding of the multi-scale detection process, Figure 3 A schematic diagram of multi-scale density detection with a cyclic window is given. For example... Figure 3 As shown, for the support set of the same candidate vector, a sliding scan is performed window by window along the cyclic position using cyclic windows of different lengths; short windows are used to capture local high-density clusters, while longer windows are used to detect cumulative density anomalies spanning a wider range. If a window in any row (i.e., any scale) exceeds the threshold corresponding to that scale, the candidate vector is deemed unqualified, needs to be rejected, and resampled.

[0072] (5) If a scale exists and the starting point of the cycle ,make If so, the rejection flag will be set and the candidate vector will be discarded. (If the candidate vectors have not been fully generated, stop the current construction process) and regenerate the candidate vectors according to the predetermined sampling procedure.

[0073] (6) If for all scales and the starting point of all loops All Then accept the candidate vector. It then outputs this information to the subsequent key generation, encapsulation, or encryption processes of the cryptographic mechanism.

[0074] For any length of A loop window, which is scaled according to any scale. Divided into A complete child window and a length of The remaining sub-windows provide the upper bound of the capacity induced by this scale. This is combined with the total Hamming weight across all scales. This yields a tighter deterministic upper bound envelope for the capacity:

[0075] .

[0076] The reason for the above upper bound is: every complete The child window contains at most Each support point, and the remaining sub-windows contain at most one support point. There are several support points; after obtaining the upper bound for all dimensions, the minimum value is taken, and further affected by the total weight. Limitations. This conclusion does not depend on probability assumptions.

[0077] If a certain type of local aggregation pattern to be excluded requires a length of... The loop window contains at least One support point, and If the window shape cannot appear in the sampling output of this invention, it is therefore deterministically excluded.

[0078] Single Scale Only corresponding single-scale upper bounds can be formed. This invention utilizes... A multi-scale capacity upper bound envelope is formed, which is the lower bound of each single-scale upper bound. When different scales obtain strictly smaller upper bounds at different window lengths, deleting any one of the scales will loosen the capacity upper bound at least one window length. Therefore, these scales constitute non-redundant collaborative constraints, rather than a simple repetition of the same judgment condition.

[0079] like Figure 4 As shown, a single short window scale can only detect local high-density clusters within the short window, but cannot capture cumulative cluster patterns formed on a longer window. When the longer window scale is increased, these cumulative cluster patterns are captured and excluded by the multi-scale envelope. Therefore, it can be seen that the collaborative detection of multiple windows of different lengths can cover cluster patterns that cannot be covered by a single scale.

[0080] Multi-scale parameters are selected according to the non-redundancy principle: there must be at least two different window lengths. , and two different scales , , to make scale exist It provides a stricter upper bound on capacity, while the scale... exist This provides a stricter upper bound on capacity. This non-redundant relationship can serve as a further definition for parameter configuration and backup claims.

[0081] The present invention preferably applies a fixed-weight secret vector to the key generation stage and a fixed-weight random vector to the decryption noise term during the encapsulation or encryption stage. Different vectors may use the same or different sets of multi-scale parameters; for error vectors with different target weights and security impacts, the parameters should be determined separately, rather than directly reusing the thresholds of other vectors.

[0082] This invention does not limit the specific set of numerical parameters, nor does it limit the specific software or hardware implementation of the cyclic window statistics; however, its application should have a fixed weight cyclic vector sampling stage, and be able to apply local support point number constraints simultaneously according to at least two different window lengths.

[0083] The following describes specific implementations of the present invention using HQC as a typical example, and provides parameter selection, capacity upper bound envelope, constant-time implementation, and application methods in other coding cryptographic mechanisms with fixed-weight cyclic vector sampling stages. The following embodiments are intended to fully illustrate the present invention and do not limit the scope of protection.

[0084] (I) Specific implementation methods using HQC as a typical solution (e.g.) Figure 5 (As shown)

[0085] (1) Input and output. The input includes the HQC parameter set and the length of the vector to be sampled. Target Hamming weight Random number context parameters and a multi-scale parameter set containing at least two different window lengths. The output is the length. Hamming weight A binary vector that simultaneously satisfies all multi-scale cyclic window constraints. .

[0086] (2) Candidate generation. Call the existing or functionally equivalent fixed-weight sampling function of HQC (hereinafter referred to as...). Generate candidate vectors The underlying sampling function should have a defined output distribution; when it is necessary to maintain a uniform distribution across the receiving set, it is preferable to use a function with a total weight of [missing information]. A candidate generating function that is uniformly sampled on a vector.

[0087] (3) Multi-scale detection. For each scale Count all loop windows Alternatively, calculate the maximum local count at that scale. If any If all candidates are ineligible, then the candidate is disqualified; only when all are ineligible... Candidates are considered qualified only when the specified conditions are met. Sliding window, two pointers, circular prefix sum, and bitmap counting are all equivalent statistical methods.

[0088] The counting of local support points is not limited to the specific implementation methods described above. Those skilled in the art can, depending on the target platform and performance requirements, employ methods such as sliding window sequentially moving and updating the count, dual-pointer scanning on the sorted support sequence, interval sum lookup based on a cyclic prefix sum array, batch bit-map-based set-point counting, or perform the counting at the register level using a dedicated hardware counting module. All of these methods represent different engineering implementations of the same local counting function and do not depart from the multi-scale detection concept of this invention.

[0089] (4) Acceptance and rejection. In a typical implementation, if a candidate is unqualified, it is discarded and regenerated; if a candidate is qualified, it is output. If the candidates are independent of each other and the underlying sampling is uniform, the output obtained after the first qualified candidate is uniform across the acceptance set.

[0090] The above implementation method employs a scheme of generating complete candidate vectors first and then performing multi-scale detection. Alternatively, the currently set support positions can be dynamically maintained during the candidate vector construction process. Once it can be determined from the generated local support point distribution that a candidate necessarily violates a certain scale constraint (e.g., the number of support points within a certain window has exceeded the upper limit and cannot be reduced further), the current candidate is immediately abandoned and generation restarts. This alternative method is equivalent to generating first and then detecting in the final output effect—both ensure that the final output candidate vectors simultaneously satisfy all scale constraints; the only difference lies in the insertion position of the detection during the construction process.

[0091] The basic rejection sampling pseudocode is as follows:

[0092]

[0093] (5) Application location in HQC. This invention can be used for fixed-weight secret vectors in the key generation phase. , and fixed-weight random vectors during the encapsulation or encryption phase. , Error vector The target weight, security impact, and rejection probability may differ from the vectors mentioned above, therefore separate multi-scale parameters can be used, or no parameters can be used when sufficient evaluation is lacking. Apply this constraint. Different vectors are not required to use the same set. .

[0094] This invention does not require applying multi-scale constraints to all fixed-weight vectors simultaneously. Implementers can, based on the needs of security analysis, only apply multi-scale constraints to the fixed-weight secret vectors during the key generation phase. , Imposing constraints on random vectors during the encapsulation or encryption phase. , The existing sampling method can be used; conversely, it can be used in another way. Different target vectors correspond to different security risk models, and their corresponding multi-scale parameter sets are different. The parameters can be the same or different; for example, a stricter threshold can be set for secret vectors to resist weak key searches assisted by side channels, while a more lenient threshold can be set for random vectors to reduce the rejection probability. The parameter selection for each vector should be evaluated separately, and a uniform configuration is not required.

[0095] (6) Parameter selection and target window exclusion. First, determine the length of one or more target windows based on the security analysis. and the minimum number of support points required Next, select the candidate window length. and threshold and utilize Test whether the target window can be deterministically excluded; re-estimate the rejection probability and joint acceptance probability of each candidate constraint, and delete the constraints. Redundant scales that contribute nothing to the rejection set are considered; finally, parameters are selected between the target window's exclusion capacity, the expected number of samples, and the sampling space loss. Short window scales can limit local high clustering, while longer window scales can limit cumulative clustering across a longer location range.

[0096] This invention requires at least two different loop window lengths, but does not limit the upper limit on the number of scales. Implementers can set two, three, or more scales based on the target window distribution and the allowed rejection rate; the length of each window... They must be pairwise distinct, but the total number of scales It is not limited by specific numerical values, so as to preserve the implementer's configuration flexibility in actual deployment.

[0097] As one specific implementation method, the fixed weight secret vector in HQC-128 is used. To describe the object, take , and with This section explains the calculation of the capacity upper bound envelope. This parameter set is used to demonstrate multi-scale configuration and non-redundancy, and does not represent the sole recommendation for all implementations; production implementations should be re-verified based on the adopted HQC specification version, target vector, and security analysis.

[0098] The example of non-redundancy of the upper bound envelope of capacity is given above. Calculation yields:

[0099]

[0100] In the example above, different scales determine the upper bound of the capacity envelope at different window lengths, indicating that the four scales are not simply repeating the judgment of the same threshold. If the corresponding scales are deleted, the deterministic upper bound at the corresponding window length will become looser.

[0101] (7) Sampling overhead and sampling space impact. Let the joint acceptance probability be... The probability of rejection is Then the expected number of candidates for ordinary repeated rejection sampling is If the bottom-level candidate has a total weight of If the vectors are uniformly distributed, then the logarithmic loss of the accepting set relative to the original fixed-weight set is: This value can be used as one of the inputs for evaluating the key space or search space; its actual impact on information set decoding algorithms and other structured algorithms should also be analyzed separately in conjunction with the accept set structure.

[0102] (II) Deployment Method Description

[0103] This invention can be deployed as an outer rejection filtering module for existing fixed-weight sampling functions. Specifically, in the key generation, encapsulation, or encryption process of existing cryptographic mechanisms, the method steps of this invention are executed after the existing fixed-weight sampling function and before the public key / ciphertext format encoding. After the candidate vector passes the multi-scale detection of this invention, it is then processed according to the original encoding / decoding interface of the cryptographic mechanism. This deployment method does not change the public key format, ciphertext format, or encoding / decoding interface of the cryptographic mechanism, making it easy to integrate into existing implementations. Changes in sampling distribution and security parameters should be reassessed according to the actual acceptance probability and specific security risk model.

[0104] (III) Constant Time and Vectorized Implementation (Applicable to various coding-based KEMs)

[0105] When detecting secret-related vectors, it is preferable to fully scan all scales and all windows to be detected, and not to exit prematurely due to the discovery of exceeding the limit; the cumulative mask of each comparison result is used as the total rejection flag.

[0106] Rejecting resampling can be achieved using a fixed-batch strategy: pre-generated batches. For each candidate, perform the same detection on all candidates and select the first qualified candidate using a mask. If no qualified candidate exists in the batch, the vector of failed detection should not be output; instead, a predefined sampling failure status should be returned, or another batch of the same fixed length should be executed. The failure probability should be based on... Security parameters are preset. Implementation can utilize bitmaps, popcount instructions, and Single Instruction Multiple Data (SIMD) instructions, but lookup tables or gather accesses relying on secret addresses should be avoided. As long as each candidate is independent and identically distributed, and the selection rule does not depend on the specific values ​​of qualified candidates, the selected output will maintain the corresponding conditional distribution on the accept set when qualified candidates exist in the batch.

[0107] (iv) Application to other encoding-based KEM instances (BIKE, LEDAcrypt)

[0108] (1) Implementation method applied to BIKE. BIKE uses a fixed-weight cyclic vector and a Black-Gray Flip (BGF) decoder during key generation and encapsulation. The clustering effect described in reference [] is related to the clustering of support points on consecutive cyclic positions. Therefore, at least two different window lengths and corresponding thresholds can be set for the BIKE key vector and / or error vector respectively, and candidates exceeding any scale upper bound can be rejected according to the method of this invention. Specifically It should be determined individually based on the BIKE version, loop block length, vector weight, decoder, and allowed rejection rate.

[0109] (2) Implementation in other quasi-cyclic coding cryptographic mechanisms. For LEDAcrypt or other quasi-cyclic low-density parity-check (QC-LDPC) and quasi-cyclic moderate-density parity-check (QC-MDPC) mechanisms that simultaneously have fixed-weight cyclic vector sampling stages and local clustering risks, multi-scale cyclic window constraints can be applied according to the same definition. The technical premise for this extension is that the object to be sampled can be represented as a length ,weight The cyclic vector can be used to determine the target window or threshold associated with local clustering. The specific defense effectiveness should be verified based on the corresponding decoder and parameter set, and should not be directly replaced by the conclusions of HQC or BIKE.

[0110] (v) Other alternative implementation methods

[0111] This invention is implemented primarily along the lines of "generating candidates → multi-scale detection → rejecting resampling if unqualified candidates are found." Alternatively, if the implementer uses a direct condition generation method (i.e., directly ensuring the output satisfies all multi-scale constraints during candidate construction, rather than by rejecting unqualified candidates), the output distribution characteristics of this generation method must be separately proven or explained. The technical solution using the direct condition generation method is not considered a substitute for this invention, nor can it be used to claim that the core concept of rejection sampling in this invention has been circumvented; only when the final output of the direct condition generation is mathematically equivalent to the rejection sampling output distribution of this invention can it be considered substantially equivalent to this invention.

[0112] All alternative methods described in Sections (I) to (III) above and in this subsection, without departing from the core concept of multi-scale rejection sampling of this invention, are alternative implementation methods of this invention.

[0113] like Figure 6As shown, a fixed weight vector rejection sampling device based on a multi-scale cyclic window according to the present invention includes:

[0114] The multi-scale configuration unit sets at least two different loop window lengths and configures a corresponding upper limit value for the number of local support points for each loop window length.

[0115] The candidate vector generation unit is used to generate a binary vector with a specified length and a specified Hamming weight as a candidate vector.

[0116] A multi-scale detection unit is used, during the construction of the candidate vector, to determine, for the currently determined support set portion of the candidate vector, whether the number of support points actually included or to be included in each loop window exceeds the upper limit value corresponding to the window length, respectively, under at least two different loop window lengths.

[0117] The rejection control unit is configured to reject the current candidate vector and regenerate a new candidate vector if, within any given loop window length, the number of support points exceeds the upper limit value corresponding to that window length.

[0118] The accepting output unit is used to accept the candidate vector and output the candidate vector to the key generation process, encapsulation process or encryption process of the cryptographic mechanism when the candidate vector satisfies the condition that the number of support points in all the loop windows does not exceed the corresponding upper limit value under the at least two different loop window lengths.

[0119] The specific functions of each unit of this device are the same as the steps of the fixed weight vector rejection sampling method based on multi-scale cyclic windows, and will not be repeated here.

[0120] The present invention also proposes a cryptographic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the aforementioned fixed weight vector rejection sampling method based on a multi-scale cyclic window.

[0121] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A fixed weight vector rejection sampling method based on a multi-scale cyclic window, characterized in that, include: Set at least two different loop window lengths, and configure a corresponding upper limit value for the number of local support points for each loop window length; Generate a binary vector with a specified length and a specified Hamming weight as a candidate vector; During the construction of the candidate vector, for the support set portion of the candidate vector that has been determined, under at least two different loop window lengths, it is determined whether the number of support points actually included or to be included in each loop window exceeds the upper limit value corresponding to the window length. If, within any given loop window length, the number of support points exceeds the upper limit value corresponding to that window length, the current candidate vector is rejected, and a new candidate vector is generated. When a candidate vector satisfies the condition that the number of support points in all the loop windows does not exceed the corresponding upper limit value under the at least two different loop window lengths, the candidate vector is accepted and output to the key generation process, encapsulation process or encryption process of the cryptographic mechanism.

2. The fixed weight vector rejection sampling method based on a multi-scale cyclic window according to claim 1, characterized in that, For any given loop window length The upper bound envelope of the capacity, formed by all scales, is determined as follows: Calculate each scale separately In the window length The induced upper bound of the local capacity, which is equal to a number of complete lengths of... The sum of the maximum number of support points accommodated by the sub-window and the maximum number of support points accommodated by the remaining sub-windows that are less than a complete sub-window; then, the minimum value of the local capacity upper bound is taken across all scales, and this minimum value is restricted to not exceeding the specified Hamming weight, to obtain the capacity upper bound envelope; where , .

3. The fixed weight vector rejection sampling method based on a multi-scale cyclic window according to claim 2, characterized in that, Each of the aforementioned scales is configured in a non-redundant manner: There exists at least a first window length and a second window length, as well as a first scale and a second scale; After deleting the first scale, the value of the upper bound envelope of the capacity formed by all remaining scales is strictly greater than the value of the upper bound envelope of the capacity formed by all scales before deletion, at least over the first window length. Furthermore, after deleting the second scale, the value of the upper capacity envelope formed by all remaining scales is strictly greater than the value of the upper capacity envelope formed by all scales before deletion, at least over the second window length.

4. The fixed weight vector rejection sampling method based on a multi-scale cyclic window according to claim 1, characterized in that, The candidate vectors are generated by uniform random sampling across the entire vector space with the specified Hamming weight; the candidate vectors that are accepted for the first time after one or more rejections are uniformly distributed across the final output acceptance set.

5. The fixed weight vector rejection sampling method based on a multi-scale cyclic window according to claim 1, characterized in that, The method applies a fixed-weight secret vector to the key generation phase of the cryptographic mechanism, and / or applies a fixed-weight random vector to the encapsulation or encryption phase of the cryptographic mechanism; the error vector in the cryptographic mechanism uses independently configured multi-scale constraints, or no multi-scale constraints are applied to the error vector.

6. The fixed weight vector rejection sampling method based on a multi-scale cyclic window according to claim 1, characterized in that, When the candidate vector involves secret data, the entire loop window length and the entire loop window position are completely traversed. The detection is not terminated prematurely due to the discovery of any over-limit situation. The comparison flags of each detection result are accumulated to generate a total rejection flag by masking operation.

7. The fixed weight vector rejection sampling method based on a multi-scale cyclic window according to claim 1, characterized in that, A constant-time rejection sampling strategy is implemented using a fixed-batch strategy: A fixed number of candidate vectors are pre-generated as a batch; For all candidate vectors in the batch, the actual number of support points contained in each loop window is counted sequentially. The first candidate vector that satisfies all scale constraints is selected from the batch using a masking method as the output; If no candidate vectors satisfy all scale constraints are found in the batch, a predefined sampling failure state is returned, or the process continues to generate and detect the next fixed number of batches.

8. The fixed weight vector rejection sampling method based on a multi-scale cyclic window according to claim 1, characterized in that, It also includes parameter configuration steps: Based on security analysis, at least one target window length and the minimum number of support points required to exclude local clustering patterns within that target window length are determined. Select the loop window length and the corresponding upper limit of the number of local support points, such that the upper limit of the capacity envelope on the target window length is less than the minimum number of support points required by the local aggregation pattern, so as to deterministically exclude the target window pattern. Estimate the joint acceptance probability under each candidate constraint and remove redundant scales that do not substantially contribute to the upper bound envelope of capacity and the rejection set.

9. A fixed weight vector rejection sampling device based on a multi-scale cyclic window, characterized in that, include: The multi-scale configuration unit sets at least two different loop window lengths and configures a corresponding upper limit value for the number of local support points for each loop window length. The candidate vector generation unit is used to generate a binary vector with a specified length and a specified Hamming weight as a candidate vector. A multi-scale detection unit is used, during the construction of the candidate vector, to determine, for the currently determined support set portion of the candidate vector, whether the number of support points actually included or to be included in each loop window exceeds the upper limit value corresponding to the window length, respectively, under at least two different loop window lengths. The rejection control unit is configured to reject the current candidate vector and regenerate a new candidate vector if, within any given loop window length, the number of support points exceeds the upper limit value corresponding to that window length. The accepting output unit is used to accept the candidate vector and output the candidate vector to the key generation process, encapsulation process or encryption process of the cryptographic mechanism when the candidate vector satisfies the condition that the number of support points in all the loop windows does not exceed the corresponding upper limit value under the at least two different loop window lengths.

10. A cryptographic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a fixed weight vector rejection sampling method based on a multi-scale cyclic window as described in any one of claims 1 to 8.

Images