Post-quantum cryptographic algorithm security evaluation method and system based on lattice with pre-processing nearest vector problem for accelerating solution
Patent Information
- Application Number
- CN202611229005.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-08-13
- Publication Date
- 2026-10-27
AI Technical Summary
尚未有将机器学习成功应用于CVPP并实现多项式时间复杂度的技术方案，也缺乏针对后量子密码安全性评估这一具体应用场景的CVPP高效求解方法
[0040]①查询时间复杂度大幅降低：本发明用机器学习模型替代传统算法中每轮迭代对短向量集合的全局搜索，将每轮迭代的搜索时间从指数级降低为多项式级poly(
)。在实验中，对于维度70的格，每实例查询时间约为5分钟，而现有最优方法之一的Micciancio-Voulgaris算法需要约81分钟，加速比超过16倍；G6K CVPP求解器则需要约66小时，加速比达758倍。这一加速可直接用于后量子密码方案的大规模安全评估，大幅缩短评估周期、降低评估成本。同时，在批量求解多个目标向量时，预处理成本被完全摊销，单实例平均查询时间随实例数量增加而趋近于模型单次推理时间。
Smart Images
Figure CN122993930A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the interdisciplinary field of post-quantum cryptography security assessment and machine learning. Specifically, it relates to a post-quantum cryptography algorithm security assessment method and system based on machine learning to accelerate the solution of CVPP (Closest Vector Problem with Preprocessing). It is suitable for batch accelerated CVPP solution when performing multi-instance security analysis on lattice-based post-quantum cryptography schemes. Background Technology
[0002] With the rapid development of quantum computing technology, traditional public-key cryptography algorithms (such as RSA and elliptic curve cryptography) face the threat of being cracked by Shor's algorithm in polynomial time. To address this challenge, the National Institute of Standards and Technology (NIST) has been promoting the standardization of post-quantum cryptography (PQC) since 2016, and has now incorporated lattice-based PQC schemes such as CRYSTALS-Kyber (now standardized as ML-KEM) and FrodoKEM into the standard system. The security of these schemes depends on the difficulty of solving difficult problems on lattices, the most representative of which are the closest vector problem (CVP) and the shortest vector problem (SVP). CVP refers to finding the lattice point in the lattice that is closest to the target vector, given a lattice and a target vector. Exact CVP has been proven to be NP-hard, and approximate CVP is also NP-hard with a constant approximation factor.
[0003] Hybrid attacks are an important technique for security evaluation of lattice-based post-quantum cryptography schemes. Hybrid attacks transform a single LWE (Learning With Errors) instance into a problem of batch solving a large number of CVP instances on a fixed lattice; essentially, it is the preprocessed nearest vector problem (CVPP) in a multi-instance scenario. CVPP consists of two stages:
[0004] (1) Preprocessing stage: Generate auxiliary information for fixed grids;
[0005] (2) Query phase: The CVP of multiple target vectors is solved quickly using preprocessed information. In multi-instance cryptanalysis scenarios, the preprocessing cost can be amortized by a large number of queries, so CVPP is a key subproblem for evaluating the security strength of post-quantum cryptographic schemes.
[0006] Existing CVPP solution algorithms mainly fall into two categories: one is a deterministic algorithm based on Voronoi units, such as Micciancio and Voulgaris, whose time and space complexity are both exponential; the other uses approximate Voronoi units and randomized slicers, and even with the optimal nearest neighbor data structure, its time complexity is still exponential. These methods incur extremely high computational costs when handling multi-instance queries with high dimensions (e.g., dimensions above 70), making them unsuitable for practical security assessment requirements.
[0007] In recent years, machine learning has made initial progress in cryptanalysis, but mainly focused on learning with error (LWE) problems. There is still no successful technical solution to apply machine learning to CVPP with polynomial time complexity, and there is also a lack of efficient CVPP solution methods for the specific application scenario of post-quantum cryptographic security assessment.
[0008] Therefore, how to significantly reduce the query time of CVPP in multi-instance scenarios while maintaining the quality of the output solution to accurately assess the security strength of post-quantum cryptography schemes is a technical problem that urgently needs to be solved in this field. Summary of the Invention
[0009] This invention aims to provide a security evaluation method and system for post-quantum cryptography algorithms based on the nearest vector problem with lattice preprocessing. By replacing the expensive search steps in the traditional CVPP algorithm with a machine learning model, it achieves an approximate polynomial time complexity for the query phase in multi-instance security evaluation scenarios, while maintaining the quality of the output solution close to the optimal solution, thereby accurately evaluating the security strength of the post-quantum cryptography scheme.
[0010] To achieve the above objectives, the present invention provides the following technical solution:
[0011] A security evaluation method for post-quantum cryptography algorithms based on the accelerated solution of the nearest vector problem with preprocessing on lattices is proposed. This method is applied to multi-instance security analysis of lattice-based post-quantum cryptography schemes and includes the following steps:
[0012] I. Preprocessing stage
[0013] S1: Obtain the target grid A set of short vectors The short vector set A complete set of relevant vectors, generated by lattice sieve or lattice enumeration, is used to approximate the target lattice, which is the lattice corresponding to the post-quantum cryptography scheme to be evaluated, and is determined by the scheme parameters including dimension. Modulus Error distribution Uniquely certain;
[0014] S2: Set of vectors The vectors in the data are clustered into multiple clusters;
[0015] S3: Train a machine learning model The model is used for any input target vector From the set of short vectors One or more candidate vectors are predicted from the target vector. This is the target vector of a single CVP instance when performing a hybrid attack on the post-quantum cryptography scheme.
[0016] II. Query Phase
[0017] For a given target vector
[0018] S4: Initialize the current vector ;
[0019] S5: Repeat the following iterative steps until the termination condition is met:
[0020] S5.1: Set the current vector Input the machine learning model A set of candidate vectors is obtained. ;
[0021] S5.2: From the candidate vector set Selecting the aligned scores Largest vector Record the maximum alignment score. ;
[0022] S5.3: If Then update If the condition is met, return to S5.1; otherwise, terminate the iteration.
[0023] S6: Output As the target vector The nearest lattice vector, the nearest lattice vector With the target vector Euclidean distance between This is used to calculate the actual cost of a hybrid attack on the post-quantum cryptography scheme, where a smaller distance indicates a lower solution cost for the hybrid attack, and outputs the security strength assessment result of the cryptography scheme under the current security model.
[0024] Furthermore, the termination condition is: the current vector satisfy .
[0025] Furthermore, the post-quantum cryptography scheme includes a key encapsulation mechanism based on LWE (Learning With Errors) or a public-key encryption scheme. Preferably, the LWE-based key encapsulation mechanism includes any one of CRYSTALS-Kyber and FrodoKEM.
[0026] Furthermore, the target grid The lattice basis is generated by first randomly generating it, and then reducing it to BKZ (BlockKorkin-Zolotarev).
[0027] Furthermore, the short vector set It is generated using either lattice sieving or lattice enumeration. Preferably, the NV sieve (nv_sieve) from the G6K library is used, with the sieving parameters set to... This parameter is the default configuration parameter for the G6K library. Extensive experiments have verified it as the empirically optimal value for balancing the quality of short vector lists with preprocessing time, generating lists of approximately [size missing]. A list of short vectors.
[0028] Furthermore, the clustering method will divide the vector set The vectors in the dataset are divided into X clusters, and the clustering method is preferably K-Means clustering. Preferably, X represents the nearest clusters. Integers, where For set The number of elements.
[0029] Furthermore, the machine learning model This is a classification model, and its output is the set of short vectors. The predicted probability or score of each vector in the candidate vector set. For the highest scorer vectors, where The preset beam size, and For the lattice dimension The polynomial function, the beam width In security assessments, a trade-off between assessment accuracy and single query time is controlled. Preferably, .
[0030] Furthermore, the machine learning model adopts a divide-and-conquer architecture, which contains a coarse classifier and a set of fine classifiers. The coarse classifier predicts the cluster to which a vector belongs, and the fine classifiers organize each vector in the set of short vectors into a category, forming a binary tree. The model output is a path decision from the root to the leaf node.
[0031] Furthermore, the model The system includes a shared encoder, a hierarchical gated classifier, and a set of conditional expert classifiers. The shared encoder maps the input target vector to a hidden layer representation. The hierarchical gated classifier acts as the coarse classifier, predicting the cluster to which the target belongs based on the hidden layer representation. The conditional expert classifiers act as the fine-grained classifiers, with each classifier corresponding to a cluster. At each internal node of its internal binary tree, the classifier performs binary classification based on the hidden layer representation to determine the path direction. The shared encoder is preferably a multilayer perceptron (MLP) containing multiple fully connected layers and a ReLU activation function. The coarse-grained and fine-grained classifiers are preferably hierarchical softmax structures.
[0032] Furthermore, the preprocessing stage also includes generating a training dataset: randomly sampling multiple target vectors. and calculate each Corresponding tags , constitute the dataset The machine learning model was trained using this dataset in a supervised learning manner, employing the Adam optimizer and a learning rate of [missing information]. (The default recommended learning rate for the Adam optimizer), batch size 256 (a choice that balances training efficiency and gradient estimation stability within the memory limitations of the NVIDIA A40 GPU), training for 100 epochs. The loss function is the sum of the binary cross-entropy losses at each internal node.
[0033] Based on the above methods, this invention also provides a security evaluation system for post-quantum cryptography algorithms based on the accelerated solution of the nearest vector problem with lattice preprocessing, comprising:
[0034] The preprocessing module is configured to acquire the target grid. A set of short vectors The target grid The lattice structure defined for the post-quantum cryptography scheme to be evaluated; for the short vector set Clustering the vectors in the data yields the following results: There are clusters; a machine learning model M is trained for any input target vector. From the set of short vectors One or more candidate vectors are predicted from the data.
[0035] The query module is configured to query a given target vector. Perform the query steps;
[0036] The security assessment output module is configured to calculate the actual cost of a hybrid attack on the post-quantum cryptography scheme based on the Euclidean distance between the nearest lattice vector output by the query module and the target vector, and output the security strength assessment result.
[0037] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.
[0038] This invention also provides a method for training a machine learning model to accelerate the nearest vector solution on a multi-instance lattice, comprising: obtaining a set of short vectors. Generate random target vectors and calculate the vector with the best alignment score as the label; train the classification model using a hierarchical Softmax structure.
[0039] Compared with existing technologies, the security evaluation method and system for post-quantum cryptography algorithms based on the accelerated solution of the nearest vector problem with lattice preprocessing disclosed in this invention have the following beneficial effects:
[0040] ① Significantly reduced query time complexity: This invention replaces the global search of the short vector set in each iteration of the traditional algorithm with a machine learning model, reducing the search time of each iteration from exponential to linear. Reduced to polynomial level (poly( In the experiments, for a 70-dimensional lattice, the query time per instance is approximately 5 minutes, while the Micciancio-Voulgaris algorithm, one of the current best methods, requires approximately 81 minutes, resulting in a speedup of over 16 times; the G6K CVPP solver requires approximately 66 hours, achieving a speedup of 758 times. This acceleration can be directly applied to large-scale security evaluations of post-quantum cryptography schemes, significantly shortening the evaluation cycle and reducing evaluation costs. Furthermore, when solving multiple target vectors in batches, the preprocessing cost is fully amortized, and the average query time per instance approaches the model's single inference time as the number of instances increases.
[0041] ② Output solution quality is close to optimal: Experimental results show that, within the dimension range of 40-70, the distance ratio between the output solution of more than 70% of the test instances and the Micciancio-Voulgaris benchmark algorithm is less than 1.1, and the distance ratio of all instances is less than 1.4. This distance ratio directly corresponds to the ratio of the cost of solving the hybrid attack to the cost of solving the optimal solution. The closer the distance ratio is to 1, the more accurate the security strength assessment is, and the more reliable the assessment results can be guaranteed.
[0042] ③ Preprocessing costs are amortizable, making it naturally suitable for multi-instance evaluation scenarios: Preprocessing (training data generation and model training) only needs to be performed once, and its cost can be fully amortized by subsequent infinite queries. It is particularly suitable for large-scale security evaluation scenarios where batch CVP instance solutions are performed for the same post-quantum cryptography scheme.
[0043] ④ Breaking the exponential barrier: No matter how the traditional CVPP algorithm is optimized, its query complexity has been proven to have an exponential lower bound. This invention is the first to achieve heuristic polynomial-time CVPP solution, providing a new and efficient technical path for post-quantum cryptography security evaluation.
[0044] ⑤ Predictable number of iterations: Experiments show that the number of iterations of the method of this invention and the benchmark method increases with the dimension very slowly (no more than 40 times), which is far below the upper bound of the theoretical worst case. This further supports the feasibility of polynomial time complexity.
[0045] To clarify the correspondence between the technical solution of this invention and the post-quantum cryptography security assessment scenario, the mapping relationship between each algorithm element in this invention and the security assessment scenario is explained below:
[0046] In the security evaluation of post-quantum cryptography schemes (such as CRYSTALS-Kyber), hybrid attacks are a core method for assessing their security strength. The core steps of a hybrid attack are: after lattice-based reduction of a single LWE instance, it collapses into a batch solution of a large number of CVP instances on a fixed lattice. That is, for the same target lattice, CVP needs to be solved for hundreds or thousands of different target vectors t, which is the standard multi-instance scenario of CVPP (the closest vector problem with preprocessing).
[0047] Based on this, the correspondence between the various algorithm elements and security assessment scenarios in this invention is as follows:
[0048] The target grid Corresponding to the lattice structure defined by the cryptographic scheme to be evaluated, the scheme parameters (including dimensions) Modulus Error distribution (Uniquely certain)
[0049] The target vector Corresponding to the target vector of a single CVP instance in a hybrid attack;
[0050] The short vector set The candidate lattice vector pool, which corresponds to the preprocessing stage, is used to approximate the Voronoi cell geometry of the lattice.
[0051] The alignment score Used to determine candidate lattice vectors Current residual vector The higher the score, the better the geometric alignment between them. The more effectively Reduce within the Voronoi unit;
[0052] The beam width It controls the trade-off between evaluation accuracy and single query time: The larger the value, the closer the assessment result is to the actual security strength, but the longer the single instance solution time.
[0053] The iterative process corresponds to the solution process for a single CVP instance. The number of iterations per instance (maximum of 40 in the experiment) multiplied by the number of instances is the total number of iterations for batch evaluation.
[0054] The output To find the nearest lattice vector obtained by solving, its relationship with the target vector is... Euclidean distance between The solution cost of the CVP instance is used to evaluate the attack complexity of the LWE instance, and finally output the security strength level of the post-quantum cryptography scheme under the current security model.
[0055] Through the above mapping, this invention organically embeds the machine learning-accelerated CVPP solution method into the complete process of post-quantum cryptography security assessment, with each parameter having a clear physical meaning in the scenario. Attached Figure Description
[0056] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0057] Figure 1 This is a schematic diagram of the machine learning model framework of the present invention, which includes a shared encoder, a hierarchical gated classifier, and an expert classifier.
[0058] Figure 2 This is a schematic diagram of the Voronoi unit correlation vector of the present invention, wherein the light yellow area... It is a Voronoi unit, each It is a related vector. Detailed Implementation
[0059] The invention will be further described in detail below with reference to the specific embodiments and accompanying drawings. Except for the contents specifically mentioned below, the processes, conditions, and experimental methods for implementing the invention are all common knowledge and general knowledge in the art, and the invention does not have any particular limitations.
[0060] Example 1: CVPP Accelerated Solution for Security Evaluation of CRYSTALS-Kyber Key Encapsulation Mechanism
[0061] This embodiment uses the security assessment of the NIST-standardized post-quantum key encapsulation mechanism CRYSTALS-Kyber (ML-KEM) as an example to illustrate the specific implementation of the present invention.
[0062] Application Scenario Description: When conducting hybrid attack security assessments of the Kyber scheme, attackers need to transform a single LWE instance into a batch solution of a large number of CVP instances on a fixed lattice. This embodiment demonstrates the complete implementation process of the invention for a scaled-down verification scenario (n=70) corresponding to the Kyber-512 parameter set. It should be noted that... The verification is conducted because a complete comparative experiment can be performed with the existing best CVPP solver (G6K) in this dimension, and the experimental results can directly reflect the performance trend of the present invention in a larger dimension.
[0063] Step 1: Preprocessing – Generating a set of short vectors
[0064] For the cell Λ corresponding to the target Kyber instance, the nv_sieve algorithm from the G6K library is used to sieve the target cell, with the sieve parameters set as follows. Generate a short vector list L. At dimension 70, A short vector.
[0065] Step 2: Preprocessing – Generating the training dataset
[0066] Random sampling Use an integer vector as the target vector. For each Calculate tags To improve efficiency, parallel computing (such as multi-core CPUs) can be used to accelerate tag computation. The generated... It is divided into a training set (80%) and a validation set (20%).
[0067] Step 3: Preprocessing – Training the machine learning model
[0068] Build as Figure 1 The model shown:
[0069] Clustering preprocessing: for short vector lists Each vector in the dataset is encoded into a semantic vector using Sentence-BERT, and then clustered using the K-Means algorithm to obtain X clusters. Each cluster contains... A subset of the set, where vectors within the cluster have high semantic similarity.
[0070] Shared encoder: A multilayer perceptron, with the target vector as input. It contains three fully connected layers, each with 128 neurons, using the ReLU activation function, and outputs a 128-dimensional hidden layer vector. .
[0071] Hierarchical gated classifier: using hidden layer vectors As input, the algorithm passes through a linear layer and outputs X logits, which are then normalized using Softmax to obtain the probability that the target vector belongs to each cluster. This classifier is used to predict the cluster to which the target belongs in a coarse-grained manner.
[0072] Conditional expert classifier: Each cluster is assigned an independent fine-grained classifier (called an "expert"). Each expert internally treats short vectors within its cluster as classes, organized into a complete binary tree using a hierarchical Softmax structure. Each internal node of the binary tree contains a binary classifier with parameters... The classifier output is , where σ is the sigmoid function. By making path decisions from the root node to the leaf node, the probability of belonging to a specific short vector within the cluster is output.
[0073] Training: Using the Adam optimizer, learning rate The batch size is 256, and the training lasts for 100 epochs. The loss function is the sum of the binary cross-entropy losses on each internal node. Training is performed using an NVIDIA A40 GPU.
[0074] Step 4: Query Phase – Finding the nearest grid point of the target vector
[0075] For a given target vector (For example, randomly selected from the test set):
[0076] initialization Set the bundle width
[0077] Iteration:
[0078] Will Input the trained model, obtain the prediction scores for all categories (short vectors), and select the top scorers. The vectors constitute .
[0079] calculate And record the corresponding .
[0080] like Then update Repeat step 1; otherwise, exit the loop.
[0081] return This is the result of the solution.
[0082] Step 5: Output of safety assessment results
[0083] For 1000 independent test target vectors, calculate the distance ratio between the output vector and the output vector of the benchmark algorithm (Micciancio-Voulgaris iterative slicer). Statistical results show that 73.9% of the instances have All instances This distance is greater than This represents the ratio of the CVP distance solved by this invention to the optimal CVP distance: The closer the value is to 1, the more accurate the safety assessment.
[0084] The Euclidean distance d between the nearest lattice vector obtained by the solution and the target vector t is used to calculate the actual cost of a hybrid attack on the Kyber-512 parameter set. Experiments show that, at the same evaluation accuracy, this invention can reduce the total time for a complete security evaluation from approximately 239,231 seconds (approximately 66 hours) to approximately 315.56 seconds (approximately 5 minutes) compared to the G6K CVPP solver, achieving an end-to-end speedup of 758 times. This efficiency improvement makes it possible to perform large-scale, high-frequency security evaluations of post-quantum cryptography schemes, effectively supporting cryptographic standard-setting bodies (such as NIST) and security vendors to rapidly verify the security strength of candidate schemes.
[0085] Example 2: CVPP Accelerated Solution for Security Evaluation of the FrodoKEM Public-Key Encryption Scheme
[0086] This embodiment uses the security evaluation of FrodoKEM, a candidate scheme for NIST post-quantum cryptography standardization, as an example to illustrate the applicability of the present invention to different post-quantum cryptography schemes.
[0087] FrodoKEM is also based on the LWE problem, and its security assessment of hybrid attacks also requires batch solving of CVPP. The difference from Example 1 is that FrodoKEM uses a different parameter set (e.g., FrodoKEM-640 corresponds to different dimensions and moduli). When applying this invention, only the target lattice needs to be replaced with the lattice corresponding to FrodoKEM; the remaining preprocessing and query steps are exactly the same as in Example 1. Experiments show that this invention can also achieve significant query acceleration, proving the universality of this method across different post-quantum cryptography schemes.
[0088] Example 3: Variants – Different beam width settings
[0089] remove In addition, the value of k can be adjusted according to the trade-off between accuracy and time. For example, It can achieve faster inference speed but may reduce output quality; It can improve the accuracy of precise matching but increase inference time. In security assessment scenarios, if high-precision assessment is required, a larger k value can be selected; if a large number of candidate parameters need to be screened quickly, a smaller k value can be selected.
[0090] Example 4: Variants – Different methods for generating short vector sets
[0091] Besides sieving, enumeration methods (such as depth-first enumeration) can also be used to generate short vector sets. If the lattice has a special structure (such as an ideal lattice), a more compact lattice can be generated using specialized algorithms. .
[0092] This invention can be applied to the following fields:
[0093] Security assessment of post-quantum cryptography algorithms: Specifically targeting multi-instance CVP solutions in hybrid attacks on LWE-based post-quantum cryptography standard candidates such as CRYSTALS-Kyber (ML-KEM) and FrodoKEM, this invention provides efficient security analysis tools for cryptography standard-setting bodies (such as NIST), security vendors, and research institutions. Through this invention, security assessment organizations can complete security verification of more parameter combinations within the same timeframe, or conduct more refined security strength assessments of the same parameter set, thereby better supporting the development and deployment decisions of post-quantum cryptography standards.
[0094] Parameter selection and verification of lattice-based cryptosystems: During the design phase of a cryptosystem, quickly verify the security strength under different parameter sets to assist in the optimization and selection of parameters.
[0095] Nearest grid search in large-scale optimization problems: any batch computation scenario that requires repeatedly solving CVP on the same grid.
[0096] Because this invention can reduce the query complexity from exponential to polynomial level, it significantly improves the computational efficiency of multi-instance CVPP, which can greatly shorten the security evaluation cycle and reduce the evaluation cost of post-quantum cryptography schemes, and has clear industrial application value and commercial prospects.
[0097] Unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.
[0098] As used in this invention, the term "comprising" is an open-ended expression, meaning it includes the contents specified in this invention but does not exclude other aspects.
[0099] As used in this invention, the term "and / or" includes any one or more of the related listed items and all combinations thereof.
[0100] The scope of protection of this invention is not limited to the above embodiments. All variations and advantages that can be conceived by those skilled in the art within the technical scope disclosed in this invention are included in this invention and are protected by the appended claims.
Claims
1. A method for security evaluation of post-quantum cryptography algorithms based on the lattice-based nearest vector problem with preprocessing, characterized in that, Includes the following steps: S1: Obtain the target grid A set of short vectors ; S2: Train the machine learning model M for any input target vector. From the set of short vectors One or more candidate vectors are predicted from the target vector; The target vector of a single CVP instance when performing a hybrid attack on the post-quantum cryptography scheme; S3: For a given target vector Initialize the current vector ; S4: Repeat the iteration until the termination condition is met; S5: Output As the target vector The nearest lattice vector, the nearest lattice vector With the target vector Euclidean distance between This is used to calculate the actual cost of a hybrid attack on the post-quantum cryptography scheme, where a smaller distance indicates a lower solution cost for the hybrid attack, and outputs the security strength assessment result of the cryptography scheme under the current security model.
2. The method according to claim 1, characterized in that, The target grid The lattice structure defined for the post-quantum cryptography scheme to be evaluated consists of scheme parameters including dimensions. Modulus Error distribution The only certainty.
3. The method according to claim 1, characterized in that, The iterations in S4 include: The current vector Input the machine learning model A set of candidate vectors is obtained. ; From the candidate vector set Selecting the aligned scores Largest vector ; like Then update ,in If the iteration continues, it continues; otherwise, the iteration terminates.
4. The method according to claim 1, characterized in that, The post-quantum cryptography scheme includes an LWE-based key encapsulation mechanism or a public-key encryption scheme; the LWE-based key encapsulation mechanism includes either CRYSTALS-Kyber or FrodoKEM.
5. The method according to claim 1, characterized in that, The short vector set L is generated by lattice sieve or lattice enumeration; before performing lattice sieve or lattice enumeration, the target lattice Λ is reduced to a lattice basis using the BKZ method.
6. The method according to claim 1, characterized in that, The machine learning model This is a classification model, and its output is the set of short vectors. The predicted probability or score of each vector in the candidate vector set. For the highest scorer vectors, where The preset beam width, and For the lattice dimension A polynomial function; preferably, The beam width In security assessments, a trade-off between assessment accuracy and single query time is controlled.
7. The method according to claim 6, characterized in that, Before training the machine learning model, each vector in the short vector set L is clustered to obtain X clusters, each containing at least one vector. The machine learning model adopts a divide-and-conquer architecture, including: a coarse classifier for predicting the cluster to which the input target vector belongs; and a set of fine-grained classifiers, with one fine-grained classifier corresponding to each cluster.
8. The method according to claim 7, characterized in that, The model includes a shared encoder, a hierarchical gated classifier, and a set of conditional expert classifiers; the shared encoder is used to map the input target vector into a hidden layer representation. The hierarchical gated classifier serves as the coarse classifier, predicting the cluster to which a class belongs based on the hidden layer representation; the conditional expert classifier serves as the fine-grained classifier, with each conditional expert classifier corresponding to a cluster, and performing binary classification based on the hidden layer representation at each internal node of its internal binary tree to determine the path direction.
9. The method according to claim 1, characterized in that, The preprocessing stage also includes: generating a training dataset. ,in For the target vector sampled randomly, The machine learning model is trained using the dataset in a supervised learning manner.
10. A security evaluation system for post-quantum cryptography algorithms based on the nearest vector problem accelerated by preprocessing on lattices, characterized in that, The system employs the method described in any one of claims 1-9, the system comprising: The preprocessing module is configured to acquire the target grid. A set of short vectors The target grid The lattice structure defined for the post-quantum cryptography scheme to be evaluated; for the short vector set Clustering the vectors in the data yields the following results: A cluster; train a machine learning model The model is used for any input target vector From the set of short vectors One or more candidate vectors are predicted from the data. The query module is configured to query a given target vector. Perform the query steps; The security assessment output module is configured to calculate the actual cost of a hybrid attack on the post-quantum cryptography scheme based on the Euclidean distance between the nearest lattice vector output by the query module and the target vector, and output the security strength assessment result.