Quantum key recovery method and system based on periodic function multi-stage construction, medium and device

Abstract

The present application relates to the field of encryption technology, and provides a quantum key recovery method and system based on a periodic function multi-stage construction, a medium and equipment, comprising: for a target password, the periodic function construction is divided into multiple stages, the number of rounds of each stage is set, each segment round is expanded into a calculation graph composed of multiple operations, and a structure state, a key auxiliary variable and an observable state are set for different stages, a boundary condition is added, a complete constraint model is formed, a solver is used for solving, and an internal periodic core, a public input, ciphertext post-processing, a periodic expression and state propagation routes of each node are restored from the solving result; the restoration result is substituted into the real round function of the target password, it is verified that the input end does not contain unknown keys that need to be known in advance, the output function can be calculated from the ciphertext and the public function, and after verifying the periodicity of the periodic function, quantum key recovery is performed. Avoid finding internal periods that cannot be generated from real input or cannot be calculated from ciphertext.

Description

Technical Field

[0001] This invention belongs to the field of encryption technology, and in particular relates to a quantum key recovery method, system, medium and device based on multi-stage construction of periodic functions. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] The impact of quantum computing on cryptographic security is not limited to the Grover algorithm's second-order acceleration of exhaustive search. The Simon algorithm can solve the hidden XOR periodicity problem in polynomial time. Kuwakado and Morii (both English surnames of the researchers) used this property to propose a quantum distinguishing method for Feistel and Even-Mansour structures. Subsequent studies have applied periodic functions to the quantum analysis of FX structures, message authentication structures, and various Feistel variations. These results show that the quantum security of symmetric cryptography also depends on whether the cryptographic structure can form a periodic function that can be recognized by the Simon algorithm.

[0004] Periodic functions can be used not only for differentiation but also for recovery keys. In practical cryptography, the public function is often used... The round key is XORed with the round key to form an FK or KF round function. For example, its hidden period is the key. Let x be the input variable. If a similar key-related periodic function is constructed from the plaintext computation of a multi-round cipher, the recovered period can yield the round keys, subkey relationships, or a key expression that can be further processed. Compared to a periodic discriminator that merely states that the target structure differs from random permutations, key recovery also requires that key information be actually retained in the period and that the constructed function can be computed through a practical encryption or decryption interface.

[0005] Most existing periodic function constructions rely on manual round-by-round derivation. Current research has established a connection between periodic functions and truncated differences, and proposed symbolic automatic search methods. However, these methods are mainly geared towards key-independent periodic distinguishers and do not represent the round keys and their combinations in intermediate states. At CRYPTO 2022, researchers proposed an automated tool for key-related periodic functions. By enumerating candidate circuits and testing their periods, they obtained polynomial-time quantum key recovery results for five-round MISTY L-FK and five-round Feistel-FK. This method is effective on small-scale structures, but the number of candidate circuits increases rapidly with the number of rounds, branches, and structural complexity, making it difficult to directly extend to other key addition methods of MISTY, generalized Feistel structures, and Skipjack-like structures.

[0006] In complex structures, discovering a periodic form merely in a certain internal state is insufficient. The unknowns required for that internal state may arise from the mixed computation of plaintext variables and round keys, making them uncontrollable by an attacker. Furthermore, the periodic state may reside before the ciphertext interface and cannot be computed from the actual ciphertext. Even if a certain expression satisfies... It is also necessary to determine the cycle. Whether it contains recoverable key information, and whether a direct Simon or nested Simon process can convert the period into a specific subkey. Here, g represents the periodic function obtained by constructing and eliminating directly computable public terms from the intermediate state or output branch of the target cipher, x represents the input variable that can be controlled by the attacker, and s represents a non-zero key-related period that is independent of x. Summary of the Invention

[0007] To address the technical problems existing in the background art, the present invention provides a quantum key recovery method, system, medium, and device based on multi-stage construction of periodic functions. The construction process in multi-round cryptography is divided into multiple interconnected stages, and the algebraic conditions, input realization conditions, and output observability conditions of the key-related periodic function are placed in the same model. The solver only returns the result when the internal core, the source of the round key, and the ciphertext equivalent function are all true. This avoids finding internal periods that cannot be generated from the real input or calculated from the ciphertext, thereby automatically constructing periodic functions that can be used for quantum key recovery.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides a quantum key recovery method based on a multi-stage construction of periodic functions, comprising: For the target cryptography, the periodic function is constructed in multiple stages, the number of rounds in each stage is set, each round is expanded into a computation graph composed of multiple operations, and structural states, key auxiliary variables and observable states are set for different stages. Boundary conditions are added to form a complete constraint model. For the complete constraint model, the solver is used to solve it, and the internal periodic core, public input, encrypted post-processing, periodic expression, and state propagation path of each node are reconstructed from the solution results. Substitute the restored result into the true round function of the target cipher to verify that the input does not contain any unknown key that needs to be known in advance, that the output function can be calculated from the ciphertext and the public function, and after verifying the periodicity of the periodic function, perform quantum key recovery.

[0009] Furthermore, the construction of periodic functions is divided into three stages: the internal periodic core search stage, the input-side expansion stage, and the output-side expansion stage; During the core search phase of the internal cycle, the selected The internal structure of the wheel allows the use of auxiliary unknowns to search for intermediate functions that satisfy either the full or partial form. During the input-side expansion phase, the process involves backtracking or reversing from the input position in the internal cycle core search phase back to the password input interface. In each round, check whether each auxiliary unknown can be uniquely determined by the input variables, the public function, and the actual round key; During the output-side expansion phase, a reverse search is performed from the cryptographic output interface towards the periodic output position of the internal periodic core search phase. The round determines whether a quantity equivalent to the internal periodic function can be constructed from ciphertext branches, public functions, and XOR operations; Here, parameters r1, r2, and r3 are all positive integers, representing the number of rounds covered by the internal cycle core search phase, the input-side expansion phase, and the output-side expansion phase, respectively. Their values ​​are given or enumerated by the target structure and the search range.

[0010] Among them, the constraints of the three stages are solved simultaneously in the same constraint system, so that the internal periodic core, the source of the round key, and the observability of the ciphertext are all met in the same candidate.

[0011] Furthermore, the output-side expansion phase uses a two-bit observable state to represent output constructibility: The first state (1,1) indicates that the branch can be directly obtained from the ciphertext; The second state (0,1) indicates that the branch differs from the known value by a key constant independent of the input variable x, where x represents an input variable that can be controlled by the attacker. This branch can be used to construct an equivalent periodic function. The third state (0,0) indicates that the branch cannot be used to construct the output function.

[0012] Furthermore, the multiple operations include: The F operation represents a public function without a key or its inverse function; The XOR operation represents a bitwise XOR operation between two branches of the same width. The SPLIT operation means copying a state to two successor branches. The ADK operation represents the XOR operation between the current branch and the specified wheel key.

[0013] Furthermore, the SPLIT operation directly copies the structure state and key auxiliary variables; The XOR operation performs a bitwise XOR operation on the two structural states and synchronously XORs the corresponding key auxiliary variables. The ADK operation adds the round key symbol to the structure state and updates the key auxiliary variable according to the XOR rule; The F operation propagates the structural state according to a preset state transition diagram.

[0014] Furthermore, the structural state is defined according to full form and half form, and is encoded using a seven-bit vector.

[0015] Furthermore, the boundary conditions include: full-form, half-form, key propagation, input constructibility, output observability, and stage boundary conditions.

[0016] A second aspect of the present invention provides a quantum key recovery system based on a multi-stage construction of periodic functions, comprising: The model generation module is configured to: for the target cryptography, divide the periodic function construction into multiple stages, set the number of rounds for each stage, expand each round into a computation graph composed of multiple operations, and set the structural state, key auxiliary variables and observable state for different stages, add boundary conditions, and form a complete constrained model. The solver module is configured to: solve the complete constraint model using a solver, and reconstruct the internal periodic core, public input, encrypted post-processing, periodic expression, and state propagation path of each node from the solution results; The recovery module is configured to: substitute the restoration result into the real round function of the target cipher, verify that the input does not contain any unknown key that needs to be known in advance, ensure that the output function can be calculated from the ciphertext and the public function, and perform quantum key recovery after verifying the periodicity of the periodic function.

[0017] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the quantum key recovery method based on a multi-stage construction of a periodic function as described above.

[0018] A fourth aspect of the present invention provides a computer device including a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, wherein the processor executes the program to implement the steps of the quantum key recovery method based on a multi-stage construction of a periodic function as described above.

[0019] Compared with the prior art, the beneficial effects of the present invention are: This invention divides the construction process in multi-round cryptography into multiple interconnected stages and incorporates the algebraic conditions, input realization conditions, and output observability conditions of the key-related periodic function into the same model. The solver only returns the result when the internal core, the source of the round key, and the ciphertext equivalent function are all true. This avoids finding internal periods that cannot be generated from the real input or calculated from the ciphertext, thereby automatically constructing periodic functions that can be used for quantum key recovery.

[0020] This invention uses a seven-bit structural state and independent key auxiliary variables to represent intermediate states. The structural state is used to quickly determine whether full and half forms can still be formed, and the key auxiliary variables are used to distinguish between different round key combinations and true cancellation. Compared with directly enumerating complete candidate circuits, branches that do not meet the periodic form can be pruned during propagation, reducing the search amount in complex structures. Attached Figure Description

[0021] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0022] Figure 1 This is a flowchart of a quantum key recovery method based on multi-stage construction of periodic functions according to Embodiment 1 of the present invention; Figure 2 This is a flowchart of the automatic search and verification process for key-related periodic functions according to Embodiment 1 of the present invention; Figure 3 This is a three-stage periodic function construction roadmap for the five-round Feistel-FK according to Embodiment 1 of the present invention; Figure 4 This is a six-round MISTY L-FK key-related periodic function roadmap of Embodiment 1 of the present invention; Figure 5 This is a five-round MISTY L-KF observable equivalent periodic function roadmap of Embodiment 1 of the present invention; Figure 6 This is a schematic diagram of the structure of a computer device according to Embodiment 4 of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0024] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0025] Terminology Explanation: Grover's algorithm is a quantum search algorithm used for unstructured searches and providing quadratic query acceleration.

[0026] The Simon algorithm is a quantum algorithm used to recover hidden XOR cycles.

[0027] Feistel refers to the Feistel bi-branch iterative structure.

[0028] Even-Mansour refers to the Even-Mansour structure that XORs the key before and after the public permutation.

[0029] FX refers to a structure that incorporates whitening keys on both the input and output sides of a block cipher.

[0030] CRYPTO is the name of the International Conference on Cryptography.

[0031] MISTY is the name of a family of block cipher structures proposed by Mitsui Matsui.

[0032] Skipjack is the name of a block cipher designed by the U.S. National Security Agency.

[0033] FK represents a "function-key" combination where the public function F is executed first, and then the wheel key is XORed. KF represents a "key-function" combination where the wheel key is XORed first, and then the public function F is executed. Here, F comes from the English word "function" and K comes from the English word "key".

[0034] The meanings of L and R should be distinguished according to their respective markings: when used as state indicators, L and R come from the English words left and right, respectively, and their Chinese meanings are left branch and right branch; when used as markings in the name of the MISTY structure, L and R represent the left-hand wheel structure and the right-hand wheel structure of the MISTY, respectively.

[0035] MISTY L-FK, MISTY L-KF, MISTY R-FK, and MISTY R-KF respectively indicate that the corresponding left-hand or right-hand wheel structure adopts the FK or KF sequence.

[0036] GFS stands for Generalized Feistel Structure.

[0037] Type comes from the English word "type". The numbers 1 and 2 in Type-1 and Type-2 represent the first and second types of generalized Festor structures, respectively.

[0038] When a structure name or type flag is combined with -FK or -KF, the hyphen is only used to connect the order in which the name and key are added, and does not indicate subtraction.

[0039] Feistel-FK indicates a Feistel structure using the FK order.

[0040] GFS-FK and GFS-KF represent generalized Festor structures using the FK and KF order, respectively.

[0041] In Skipjack-B, the B stands for the B-wheel rule of the Skipjack cipher.

[0042] B-FK and B-KF indicate that the B-type wheel uses the FK and KF sequence, respectively.

[0043] Unless otherwise specified, x and y represent input variables controllable by the attacker, s represents the non-zero XOR period to be recovered, k represents the round key, subkey, or their XOR combination, p represents the internal auxiliary unknown temporarily held in the first phase, and the Greek letter ψ represents a constant or key shift amount formed by the round key that is independent of the input variables; all these quantities are bit strings of equal width to the corresponding cryptographic branch. The symbol ⊕ represents bitwise XOR; 0 used alone as formula input or branch value represents a string of all zero bits, state 0 in the seven-bit code represents a known quantity without unknown parts, code 0000000 indicates that all flag bits of the seven-bit state are 0, and 0 and 1 in the two observable states represent binary flag bits. In the direct periodic construction, f(x) represents the candidate function, g(x) represents the periodic function obtained by eliminating the public terms from f(x), and g′(x) represents the equivalent periodic function that differs from g(x) only from the input-independent key constant; in the nested Simon construction, G y(x) Let g(y) represent the inner periodic function with a fixed outer input y, g(y) represent the mapping of the hidden period of the inner function with respect to y, and H(y) represent the outer periodic function obtained by combining g(y) with the public function.

[0044] In this invention, i represents the round number, and j represents the subkey or branch number within the same round; the superscript i is used to indicate the round number, and the subscripts L and R represent the left and right branches, respectively. Subscripts 0, 1, 2, etc., are used to distinguish functions, key shift amounts, or constraint stages. The numerical subscripts 1 and 2 in the state name represent the first and second key shift items, not the subkeys of the first and second rounds; the actual round subkey is represented by k. j i The round numbers start from 0, and both the round number and the branch number are positive integers; the inputs, outputs, and XOR terms of each function have the same bit width.

[0045] In the formulas and figures of this invention, the equal sign "=" indicates that the function values ​​or bit strings on both sides are the same, and the symbol "≠" indicates that they are not equal; parentheses represent function inputs or ordered state combinations, and commas are used to separate different components in an ordered combination; the superscript " 1 (also written as "-1" in linear text) represents the inverse function, not the round number; the apostrophe "′" (also written as "'" in linear text) is only used to distinguish functions of the same kind, not to indicate differentiation; in linear text, the characters "^" and "_" are used to introduce superscripts and subscripts respectively, both of which are typesetting marks, and their specific meanings are subject to the corresponding symbol definitions, and do not represent exponentiation or other operations on their own; the symbol ∧ represents the logical "AND"; the question mark "?" indicates that the current branch cannot maintain the pruning state of the registered periodic structure, and the asterisk " "" indicates that the corresponding encoding bit can be 0 or 1 and no further distinction is needed.

[0046] Example 1 This embodiment provides a quantum key recovery method based on multi-stage construction of periodic functions.

[0047] The quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment needs to solve the following technical problems: how to use a unified solvable state representation to characterize the sufficient form of the key-related periodic function; how to extend from the cryptographic interior to the input and output sides respectively, so that the unknown quantity of the periodic core comes only from the round key, and the equivalent periodic function can be calculated from the actual ciphertext; and how to write these three stages into the constraint model at the same time, so as to automatically construct a periodic function that can be used for quantum key recovery.

[0048] The quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment addresses the problems of existing key-related periodic functions relying on manual construction, difficulty in expanding candidate enumeration, and the inability to directly convert internal periods into actual attack functions. It proposes an automatic search method based on sufficient periodic conditions, three-stage construction, and symbolic constraint solution.

[0049] The quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment first summarizes common periodic functions in key recovery into full-form and semi-form, and uses explicit algebraic conditions to determine whether an intermediate expression has a key-related period. Then, the construction process in multi-round cryptography is divided into three interconnected stages: the first stage searches for a core that satisfies the periodic condition within the cryptography; the second stage extends to the plaintext or ciphertext input interface and determines which round keys generate the unknowns in the core; and the third stage extends to the output interface and searches for equivalent periodic functions that can be computed from the ciphertext. The three stages are solved in the same constraint system, rather than finding the internal core independently and then manually supplementing the input and output.

[0050] To achieve automatic propagation, the quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment simplifies the cryptographic structure into four basic operations: public function, XOR, branch replication, and round key addition. A seven-bit vector represents the zero state, key state, input variables, two shift function terms, public function term, periodic core, and pruned state. The solver records the round key combinations while propagating these states round by round, ensuring that auxiliary unknowns correspond to the actual subkeys. After successful solution, the input construction, observable output, and periodic expression are restored, and the direct Simon or nested Simon recovery steps are selected and configured accordingly. Verification is then performed through actual cryptographic computation.

[0051] The quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment includes the following steps: Step 1: Provide sufficient conditions for the period of use.

[0052] (1) Let For public functions known to the attacker, For functions that appear in cryptographic computation, To be related to input variables Unrelated constants that can be constructed from round keys and satisfy the following conditions: and .

[0053] In the above notation, F0 and F0′ represent public functions that an attacker can directly compute and eliminate from candidate outputs; F1 represents an inner function acting on two different key shift inputs; F2 represents an outer deterministic function enclosing the XOR value of the two F1 outputs, which only needs to produce the same output for the same input and does not require the attacker to compute it individually; the apostrophe “′” is only used to distinguish the two public functions and does not indicate differentiation. ψ0 represents an additional key constant independent of x; ψ1 and ψ2 represent two key-related shifts; s represents the non-zero XOR period to be recovered; f(x) represents a candidate function obtained from the intermediate state or output of the cipher; and g(x) represents a periodic function accessible to the Simon algorithm after removing the public terms.

[0054] (2) If obtained from the password output or intermediate state: ; in, These are candidate functions obtained from the intermediate states or output branches of the target cipher. This is a bitwise XOR operation for wide bit strings.

[0055] Remove public items Then, construct: ; in, This represents the periodic function obtained by eliminating the public term F0(x) that can be directly computed by the attacker from the candidate function f(x).

[0056] The function g(x) defined by equation (2) has periodicity: ; Because of Replace with After that, in equation (1) and Exactly swapping the positions leaves the XOR result unchanged. Equation (1) is called the full form, which allows periodic structures to reside in outer functions. The internal structure of the function can be used to describe the period that remains after passing through multiple layers of nonlinear functions.

[0057] (3) If obtained from cryptographic calculation: ; Then construct: ; Equation (5) has a periodicity: ; because and Two places The terms are interchanged after translation. Equation (4) is called a semi-form, and the existing five-round Feistel-FK and five-round MISTY L-FK key recovery functions can all be written in this form; Equations (1) and (4) are sufficient forms for automatic search, and it is not required to exhaust all possible key-related periodic functions.

[0058] Step 2: Based on the above periodic conditions, the construction of periodic functions is divided into three stages.

[0059] (1) The first stage is the internal cycle core search.

[0060] Selected The internal structure of the wheel allows for the temporary use of auxiliary unknowns. Search for intermediate functions that satisfy equation (1) or equation (4).

[0061] The first stage only determines whether the cycle core exists. It does not require that the auxiliary unknowns have been obtained from the plaintext interface, nor does it require that the target output can be observed from the ciphertext.

[0062] (2) The second stage is input-side expansion.

[0063] Backtracking or reverse expansion from the first-stage input position to the target password input interface. In each round, check whether each auxiliary unknown can be uniquely determined by the input variable, the public function, and the actual round key.

[0064] The input submitted by an attacker to the cryptographic oracle cannot contain unknown keys that need to be known in advance; unknowns must be naturally generated within the cryptography through round keys.

[0065] For example, in five-wheeled Feistel-FK, you can choose to expose the input. After the first round, the auxiliary amount was obtained. This allows the unknown quantities required by the internal core to be mapped to the actual round keys.

[0066] (3) The third stage is the output-side expansion.

[0067] Search backwards from the password output interface to the periodic output position of the first stage. The round determines whether a quantity equivalent to the internal periodic function can be constructed from the ciphertext branch, the public function, and the XOR operation.

[0068] If the ciphertext is computable by a function With internal periodic functions Only one difference Unrelated key constants, namely: ; Then the two have the same period.

[0069] The third stage does not require recovering the exact value of the internal state, but only requires finding an equivalent function with the same period that can be computed from the ciphertext.

[0070] The three stages are not independent sequential trials. In actual solving, the auxiliary variables of the first stage, the round key expression obtained in the second stage, and the periodic output position of the third stage share the same set of boundary states, and the solver simultaneously determines whether all three parts are valid.

[0071] Among them, the number of stages and rounds It can be enumerated based on the target structure or given externally.

[0072] The parameters r1, r2, and r3 represent the number of rounds covered by the internal cycle core search phase, the input-side expansion phase, and the output-side expansion phase, respectively. Their values ​​are given or enumerated by the target structure and the search range. The auxiliary variable p represents the internal unknown quantity temporarily retained in the first phase. Its bit width is the same as the corresponding branch. In the second phase, it must be proven that this quantity can be uniquely determined by the public input and the actual wheel key.

[0073] Step 3: In order to write the cryptographic round function into the model, use the following four basic operations.

[0074] (1) F operation: represents a public function without a key. or its inverse function The inverse function is used only if the public function F is invertible; in the corresponding MISTY instance, F is the public permutation. The same public function can be reused in multiple rounds.

[0075] (2) XOR operation: represents the bitwise XOR between two branches of the same width.

[0076] (3) SPLIT operation: means copying a state to two successor branches.

[0077] (4) ADK operation: indicates the relationship between the current branch and the first branch. Round Subkey XOR; each subkey is first treated as an independent symbol, and after obtaining candidates, their relationship is checked by arranging them according to the actual key.

[0078] In the above abbreviations, F stands for function; XOR stands for exclusive OR; SPLIT stands for split; and ADK stands for addkey. The symbol k... j i In this code, the superscript 'i' represents the round number, and the subscript 'j' represents the subkey number within that round. When only one subkey is used in a round, the subscript 'j' is omitted and written as 'k'. i .

[0079] Step 4: Define eight classes of internal states based on the full form and half form, and encode them using a seven-bit vector.

[0080] state It represents a normal zero state or a known constant, and is coded as 0000000.

[0081] state Represents the XOR combination of one or more round keys, encoded as 0000001; State Simultaneously set auxiliary variables Record the specific key expression; when When the state degenerates to .

[0082] Here, the letter v represents an auxiliary variable marker used to record specific variable values, and the subscript k indicates that the auxiliary variable is associated with the key state k; when the auxiliary variable is 0, it means that the recorded round key XOR combination has been canceled into a string of all zero bits.

[0083] state This represents the input variable, coded as 0000010.

[0084] state In expression (1) The code is 0000100; when At that time, this state indicates .

[0085] state The public function terms that can be removed from the candidate output in expression (1) or expression (4) The code is 0001000.

[0086] state In expression (1) The code is 0010000, where .

[0087] state This represents the full-form periodic core, encoded as 0100000.

[0088] The status ? indicates that the current branch no longer satisfies the registered periodic structure, and is coded as 1. This state is dominant in XOR and subsequent propagation, and is used to prune branches that cannot form the objective function.

[0089] The seven-bit code, from left to right, is set as follows: invalid or pruned flag, full-form periodic core flag, first key shift function term flag, revocable public function term flag, second key shift function term flag, input variable flag, and key combination flag. FF(x) is simply the name of the "revocable public function term state," corresponding to F0(x), and does not necessarily mean that function F is executed twice; code 1 The asterisk in the code indicates that the remaining six digits can be either 0 or 1 and do not need to be further distinguished.

[0090] Step 5: Set key auxiliary variables for the nodes in the first and second phases.

[0091] A single basic state uses a vector with only one bit set to 1; the XOR combination of multiple basic items is obtained by bitwise XORing the corresponding codes. For example, With key state The combined encoding is 0000011. In addition to the seven-bit state, each node containing the key also stores corresponding key auxiliary variables to distinguish different round key combinations; it cannot be determined solely by the state. Assume that the two unknowns are the same.

[0092] The SPLIT operation directly copies the seven-bit state and key auxiliary variables. The XOR operation performs a bitwise XOR operation on the two seven-bit codes and synchronizes the XOR with the corresponding key auxiliary variables; if the key combination cancels out to zero, the key state bits are cleared. If any input is '?' and no cancellation rule is registered, the output remains '?'. The ADK operation adds the corresponding round key symbol to the current state according to the XOR rule and updates the key auxiliary variables.

[0093] Operation F propagates strictly according to the state transition diagram and the matching conditions of the key auxiliary variables. For the state The public function output is registered as the second shift function term only when the second key shift is zero; otherwise, it is registered as the cancelable public function term FF(x). For inputs containing a key, the output is registered as the corresponding key shift term only when its key auxiliary variable matches the registered first or second key shift. or The state is defined by subscripts 1 and 2, which represent only the first and second key shift terms and not round numbers. XORing two function terms with the same public function but different shifts can form two shift terms within the full form; when this XOR continues through the public function, a periodic core state is generated. A full-form periodic core, after passing through a public function that depends only on the core value or a key constant independent of the input, maintains the same period. If an unregistered unknown combination enters a general nonlinear function and its structure cannot be further determined, the output is set to ?.

[0094] The first phase requires the input state to be from... , , And selected from the allowed public function states, the output has at least one branch that satisfies the target encoding in full or half form, and the two key shifts in the cycle are different.

[0095] The second phase concatenates the auxiliary key variables from the first phase with the round key symbols in the actual ADK node, and requires that after extending to the cryptographic input interface, there should be no unknown inputs that the attacker needs to know in advance. If the auxiliary variable cannot be uniquely determined by the round key and the public input, the candidate is excluded.

[0096] Step 6: Set up two observable states for the third stage.

[0097] The third phase uses two observable states to represent the constructibility of the output. State (1,1) indicates that the branch can be directly obtained from the ciphertext; state (0,1) indicates that the branch is missing one more element than the known value. Unrelated key constants can still be used in the equivalent periodic function of equation (7); the state (0,0) indicates that this branch cannot be used to construct the output function. The ciphertext branch is initialized to (1,1). After passing through ADK, (1,1) becomes (0,1); (0,1) remains (0,1). When passing through a general nonlinear function, only the fully known (1,1) can still be used, and (0,1) containing unknown key constants becomes (0,0). XOR and copy operations combine these states according to the registration rules. The third stage ultimately requires that the second bit of the state corresponding to the periodic output position of the first stage is 1.

[0098] The first bit of the two observable states is the "exactly computable flag," which is 1 to indicate that the branch value can be precisely calculated from the ciphertext and public operations; the second bit is the "periodic equivalence usability flag," which is 1 to indicate that the branch can at least be used to construct an equivalent function with the same period as the inner function. Therefore, (1,1) indicates that it is exactly computable and usable, (0,1) indicates that it is periodic despite differing by a key constant independent of x, and (0,0) indicates that it cannot be used for output construction.

[0099] Step 7: Construct a complete constraint model.

[0100] The complete constraint model can be written as: ; where, represents the operation and connection relationship of the target cipher; represents the propagation of seven-bit states; represents round key combination and cancellation; search for the internal periodic core; connect the public input and internal auxiliary quantities; search for equivalent periodic functions observable by ciphertext; require the final function to satisfy the full form or semi-form, and provide a non-zero key-related period.

[0101] In Equation (8), the script letter represents the complete constraint model, where corresponds to the English word "model", and its Chinese meaning is model; the capital letter represents the constraint condition, where corresponds to the English word "constraint", and its Chinese meaning is constraint; the subscript KR comes from the English phrase "key recovery", and its Chinese meaning is key recovery. The symbol ∧ denotes logical "AND", that is, all connected constraints must be satisfied simultaneously. The English meanings of the subscripts of each constraint are as follows: structure denotes structure, state denotes state, key denotes key, phase1, phase2 and phase3 denote the first, second and third phases respectively, the numbers 1, 2 and 3 denote the phase order, and output denotes output.

[0102] The correspondence between the above constraints and the foregoing content is: the structure constraint C structure corresponds to the F, XOR, SPLIT, ADK operations in step 3 and the intra-round and inter-round connections; the state constraint C state and the key constraint C key correspond to the seven-bit structure state and key auxiliary variable propagation in step 4 and step 5; the first-phase constraint C phase1 corresponds to item (1) of step 2 and the periodic cores in Equation (1) and Equation (4); the second-phase constraint C phase2 corresponds to the input side extension and public input end condition in item (2) of step 2; the third-phase constraint C phase3 corresponds to item (3) of step 2, Equation (7) and the two-bit observable state in step 6; the output constraint C output corresponds to the conditions of non-zero period, full form or semi-form, and the final output can be calculated from the ciphertext and public operations.

[0103] Step 8: After the model is established, as Figure 1 and Figure 2 As shown, follow these steps to perform an automatic search.

[0104] Figure 1 , Figure 2 In this context, XOR, SPLIT, and ADK represent bitwise XOR, branch copy, and adding wheel keys, respectively, and Simon represents the Simon cycle recovery algorithm. Figure 1 and Figure 2 The rectangles in the diagram represent processing steps or constraint solving nodes, and the connecting arrows indicate the order of the process steps and the direction of constraint or solution result transmission. Figure 2 In this context, "unsatisfiable" and "satisfiable" indicate that the joint constraints have no solution and have a solution, respectively, and then proceed to the process of adjusting parameters and searching again, as well as restoring and verifying the results. Figure 1 The forward slash " / " between FK / KF indicates that the FK structure and KF structure are chosen concurrently, and does not indicate division.

[0105] (1) Read the target password's round function, FK or KF key insertion position, branch connection, forward or reverse public function and query direction.

[0106] (2) Set the number of rounds in the three stages The corresponding wheel segment is expanded into a computational graph consisting of F, XOR, SPLIT, and ADK.

[0107] This embodiment completes the computation graph unfolding according to the following steps: First, read the branch positions round by round according to the query direction determined in step (1); establish an F node for each public function or inverse function call; establish a SPLIT node for each branch copy; establish an XOR node for each branch with the same width XOR; establish an ADK node for each round key addition, and record the round number and subkey number; then connect directed edges according to intra-round connections and inter-round permutations. The encryption direction is connected in the forward direction according to the round function, and the decryption or backtracking direction is connected in the reverse direction. The correspondence of the same branch is preserved at the intersection of the three round segments.

[0108] The computation graph is used to uniformly number each round, branch and operation node. It is the carrier for setting the seven-bit structural state, key auxiliary variable and two observable states in step (3), and also the index for generating various constraints in step (4) and restoring the node-by-node state propagation path in step (5).

[0109] In this embodiment, several rounds on the input or output side can be incorporated into the core stage based on the target cipher, or different rounds can be enumerated. As long as the internal core, round key source, and ciphertext observability remain consistent within the same candidate, the three types of constraints remain unchanged.

[0110] (3) Set a seven-bit structure state and key auxiliary variable for the nodes in the first and second stages, and set a two-bit observable state for the third stage.

[0111] Among them, the seven-bit vector is an encoding method for eight types of structural states. It can also be an enumerated variable, a Boolean variable group, or other representations that can distinguish between zero state, key state, variable state, two shift function terms, public function terms, periodic core, and pruned state.

[0112] (4) Incorporate full-form, semi-form, key propagation, input constructibility, output observability, and stage boundary conditions to construct a complete constraint model.

[0113] Specifically, the phase boundary conditions include: the endpoint of the input-side expansion and the starting point of the internal cycle core share the same structural state and key auxiliary variables branch by branch; the endpoint of the internal cycle core and the starting point of the output-side expansion share the same node value and state branch by branch; after the input-side expansion reaches the target cryptographic interface, it must obtain publicly available input that the attacker can submit, and must not contain unknown keys that need to be known in advance; the second bit of the two observable states of at least one selected cycle output branch on the output side is 1; the XOR of the two key shifts in the internal cycle core must be non-zero; and the three phases use the same round key symbol, public function identifier, and forward or reverse query direction. These conditions respectively support the three phases of step 2, the state propagation in steps 4 and 5, and the output observability requirement in step 6.

[0114] (5) Solve equation (8) once; if the complete joint constraint model shown in equation (8) does not have an assignment that satisfies all constraints at the same time, that is, the internal periodic core, input constructibility and output observability cannot be satisfied at the same time under the current stage round number and input / output position, then adjust the stage round number or input / output position and continue the search; this result only indicates that no candidate was found in the current encoding range, and does not indicate that there are no other forms of periodic functions in the target cipher; if it can be satisfied, then restore the internal periodic core, public input, ciphertext post-processing, periodic expression and the state propagation path of each node.

[0115] In this embodiment, the SMT solver is used to represent the seven-bit state, key auxiliary variable, three-stage boundary and two-bit observable state. When the above constraints can be equivalently expressed, SAT, CP-SAT or other constraint solvers can also be used.

[0116] SMT is an abbreviation for satisfiability modulo theories; SAT is an abbreviation for Boolean satisfiability problem; CP comes from constraint programming, and CP-SAT represents a solution method that combines constraint programming with Boolean satisfiability. All of the above solvers are used to determine whether there exist variable assignments that simultaneously satisfy all conditions within the established constraints.

[0117] In this embodiment, when the period directly corresponds to the subkey, the Simon algorithm can be used; when the period is a composite expression of the subkey, nested Simon, layer-by-layer recovery, or other quantum recovery methods combining key arrangement can be used.

[0118] (6) Substitute the restored result into the true round function of the target cipher, check that the input does not contain any unknown key that needs to be known in advance, and verify that the output function can indeed be calculated from the ciphertext and the public function. .

[0119] (7) Check except and Whether the external shift produces too many collisions; for small parameters, all inputs can be exhaustively enumerated; for large parameters, random instances and sampling tests can be used, but sampling is only used to screen candidates and cannot replace the check for non-zero period, unique non-zero period or controlled additional collision conditions; if a candidate does not satisfy the functional commitment of the selected Simon recovery process, the corresponding quantum recovery step is not executed.

[0120] (8) Select the direct Simon or nested Simon recovery process according to the periodic expression; if the period is directly equal to a subkey, output the subkey; if the period is a combination of multiple subkeys and public function values, continue to construct the outer periodic problem with the period as the function value; if the current result can only give the key relationship, solve the candidate that satisfies the relationship according to the actual key arrangement, and continue to perform wheel stripping or residual key recovery. Only after verifying all candidate subkeys with known plaintext and ciphertext will the complete key be output.

[0121] The aforementioned quantum recovery is performed under the Q2 model, allowing attackers to access the target cipher's encryption or decryption oracle via quantum superposition. The query direction is determined by the specific instance; for Type-1 GFS, the FK and KF instances employ quantum-selective ciphertext access in the decryption direction, while the other typical instances described above employ quantum-selective plaintext access as listed in the research paper. Quantum access to periodic functions consists of public reversible input preprocessing, one or more calls to the target oracle, and coherent ciphertext post-processing. After calculating the function value, the result is copied to the output register, and the corresponding calculations are then performed in reverse order to clear the intermediate registers. The linear equation obtained from Simon measurements is used to solve for the period, and the recovered subkey or key relationship then proceeds to the wheel stripping, co-key recovery, and known plaintext / ciphertext verification steps.

[0122] Q2 represents the second type of quantum query model, where the letter Q comes from the English word "quantum" and the number 2 indicates the second type of query method. Its query register can be in a quantum superposition of multiple plaintext or ciphertext ground states. An oracle call coherently computes each superposition component. The target oracle retains the query input and writes the corresponding encryption or decryption result bitwise XORed into the output register. Public input preprocessing, target oracle calling, and ciphertext post-processing are all executed coherently in a reversible manner, copying the required function values ​​and then reversing the computation to clear intermediate working registers that should not be retained.

[0123] In the attached diagram, x and y represent input variables with a width equal to the cryptographic branches that are controllable by the attacker; F represents the public round function without a key. -1 Describe the inverse function when F is invertible, in Figure 4 and Figure 5 In the corresponding MISTY instance, F is a public permutation, therefore the inverse function exists, where the superscript -1 indicates the inverse operation rather than the round number; k i This represents the subkey used in the i-th round, where i is the round number starting from 0; x L i and x R i These represent the left and right branch states in the i-th round, respectively. The superscript i indicates the round number, and the subscripts L and R represent the left and right branches, respectively. The plus sign inside the circle indicates a bitwise XOR operation; (The last part, "k", appears to be a typo and can be omitted.) i An arrow pointing to a plus sign inside a circle indicates that the i-th round key is added at that position; a plain solid line represents the propagation path of a branch state, and the arrowhead at the end of the line indicates the input direction of the corresponding operation. Figures 3 to 5 The rounds proceed from top to bottom; black dots indicate the connection or copying position of the branch value, and cross lines indicate the exchange of left and right branches after a round ends.

[0124] In the attached diagram, the red formula is the state expression obtained by expanding the round function from top to bottom, and represents the actual value of its immediate branch in the corresponding round, but does not represent newly added input variables; the black formula or letter is the input, subkey, function block or state name. Figures 3 to 5 The thick black lines in the text indicate observation paths that can be directly obtained from the encrypted side or obtained through public calculations, and are not applicable to... Figure 6 All XOR terms are bit strings of equal width; the values ​​within parentheses represent function inputs, and nested parentheses indicate that calculations are performed sequentially from the inside out; the F box indicates that the public function F is executed on the branch values ​​entering this box.

[0125] Figure 6 The thick black horizontal lines in the diagram represent bus or other communication connections, not observable paths; the numbered leader lines indicate the relationship between the number and the corresponding component.

[0126] like Figure 3 As shown, taking the five-wheeled Feistel-FK as an example, the internal core can be written in semi-form, with a period of... The second stage involves selecting public input. This causes the first round of internal states to be generated. The third stage calculates the equivalent function from the two ciphertext branches that differs from the final round key constant from the internal periodic function. This structure was previously found in approximately twelve minutes using a candidate enumeration method; the symbolic constraint model of this invention can find a similar result again without enumerating the complete candidate circuit.

[0127] Figure 3 The local state expansion used to establish three-stage constraints in five rounds of Feistel-FK construction is given. In the diagram, x is the public input variable, F(x) and F(x)⊕x are both public variables that can be directly calculated from x, and k... 0 k 1 and k 2 These are the subkeys for rounds 0, 1, and 2, respectively. The formulas on either side of each row indicate the left and right branch states of the corresponding round. The compound expression at the bottom is the state value obtained after sequentially executing the F-box, XORing the round keys, and swapping the branches. In the complete five-round route, the hidden period of the core internal cycle is k. 1 ⊕F(k 0 In the final round, only a key constant unrelated to x is added to the output side, thus not changing the cycle.

[0128] like Figure 4 As shown, for six rounds of MISTY L-FK, the model receives the input... and output the constructor on the left. Remove public items. The period of the resulting function is: ; Since equation (9) is a composite subkey relationship, further for each fixed Constructing inner-layer periodic functions using Simon subroutines without intermediate measurements Quantum access, reconstruction: Specifically, under the superposition state of the outer variable y, an inner function and its working register are coherently constructed for each y. g(y) is recovered without measuring the inner register. When g(y) is zero, the inner function is constant, and this unique case is interpreted as the function value g(y) = 0. Subsequently, g(y) is copied to the outer output register, the inner circuit is executed in reverse order to clear the working register, and then XORed with the public function F(y) to form a reversible access to the outer function. Finally, the first round subkey is recovered by the outer Simon process.

[0129] In this six-round MISTY L-FK example, the inner function calculated with respect to x after fixing y is denoted as G. y(x) Here, the subscript y represents a fixed outer input, and x represents an inner input; the public function F is a permutation. Therefore, g(y)=0 is equivalent to F(y⊕k) 0 )=k 2 There exists exactly one y in the complete domain that satisfies this equation; at this time, G y(x) The output of does not change with x, and is called a constant function. It is agreed that the corresponding recovered value is recorded as a string of all-zero bits.

[0130] The aforementioned "no intermediate measurement" refers to implementing reversible quantum computing instead of classically reading the cycle in the inner layer process. This involves calculating the inner function, generating the Simon sampling vector a predetermined number of times based on the branch bit width, reversibly solving for the cycle candidate in a linear fashion, and recording the success state. The Simon sampling vector is a bit vector whose binary inner product with the hidden period is zero. The working register carries the input, function value, sampling vector, cycle candidate, and success flag. A non-zero cycle is written when the sampling vector uniquely determines it; a zero-valued candidate is written when all samples are zero, corresponding to the constant function mentioned earlier; other cases where the cycle cannot be uniquely determined are written to the failure flag. The outer layer access simultaneously retains either the success or failure flag: the successful branch writes the verified cycle candidate to the outer layer output, while the failed branch does not use unverified candidates as function values. By increasing the predetermined number of Simon samplings, the failure probability of each fixed y is reduced to a predetermined threshold. Therefore, this outer layer access is an error-controlled approximate oracle, and the process is only executed when the overall failure probability meets the requirements of the selected outer layer recovery process. After copying the cycle candidates and status flags, the inner working registers are cleared in reverse order, and then the outer function access is constructed to maintain the coherence required by the outer Simon algorithm.

[0131] ; The period of equation (10) is Recovery by the outer Simon algorithm After recovering the first round subkey, the first round of inverse mapping is used to convert any desired suffix input into the original six-round oracle input, thereby obtaining the Q2 accesses for the remaining five rounds of MISTY L-FK suffixes; then, the existing five-round recovery process is invoked to recover the remaining subkeys in the suffix, and the final verification is completed using known plaintext and ciphertext. This invention thus extends the automated key recovery result of MISTY L-FK from five rounds to six rounds.

[0132] Figure 4 This represents a nested Simon construction of a six-round MISTY L-FK. In the diagram, x and y are equal-width variables controlled by the attacker; k 0 To k 5 These represent the subkeys for rounds 0 through 5 respectively; x L i and x R i F represents the left and right branch inputs of the i-th round, respectively; -1 This represents the inverse function of the public function F. The top two inputs are F. -1 (F -1 (x)⊕y) and F -1 Let y take all zero values ​​to obtain the input of the aforementioned six-round periodic function; the red formulas provide the algebraic expansion of each branch round by round. For a fixed y, the period of the inner function with respect to x is g(y) = F(y⊕k). 0 )⊕k 2 Reconstruct H(y) = g(y) ⊕ F(y), where the period of the outer function with respect to y is k. 0 Therefore, the first round subkey k can be recovered. 0 .

[0133] like Figure 5 As shown, for a five-round MISTY L-KF, the model starts from the input The ciphertext branch yields an equivalent periodic function with the following period: ; Similarly, recovery can be achieved using nested Simon procedures. After recovering the first round subkey, the first round is removed in reverse, and a publicly disclosed zero-key round is appended to the remaining suffix to maintain the five-round format. The same process is repeated to recover the remaining four subkeys in turn, and finally verified with known plaintext and ciphertext. The model also yields a five-round MISTY R-KF periodic function. For this instance, the periodic expression after restoring the solution result and verifying it with the actual round function is used as the standard. The direct Simon or nested Simon recovery process is selected and configured, and the same round stripping and publicly disclosed zero-key round method is used to process the remaining subkeys after recovering the corresponding subkeys or key relationships. Previously, MISTY R-KF only had four rounds of periodic differentiation results, and the corresponding key recovery results were not given.

[0134] Figure 5 This represents the observable equivalent periodic function of the five-round MISTY L-KF. In the figure, x and y are equal-width input variables controlled by the attacker, and k... 0 To k 4 These represent the subkeys for rounds 0 through 4, x L i and x R i Let represent the left and right branch inputs of the i-th round, respectively; the red formula is the algebraic expansion of the state of each round, and the thick black line marks the observable path obtained by backtracking from the ciphertext branch of the last round. Letting y take all zero values, we obtain the period F(k) of equation (11). 0 )⊕k 1 ⊕k 2 In nested recovery, the inner period for a fixed y is g(y) = F(y⊕k). 0 )⊕k 1 ⊕k 2 Then construct H(y) = g(y) ⊕ F(y), the hidden period of this outer function is k. 0 .

[0135] The quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment can also be used for Type-1 and Type-2 generalized Feistel structures and Skipjack-B structures, including key-related periodic functions for 17-round Skipjack B-FK, 14-round Skipjack B-KF, 7-round Type-2 GFS-FK, and 5-round Type-2 GFS-KF. For Type-1 GFS-FK, the model searches for periodic functions with 17, 65, 257, and 1025 rounds on 4, 8, 16, and 32 branch instances, respectively, indicating that the state model can handle structures with a large number of branches.

[0136] In addition to Feistel, MISTY, Type-1 GFS, Type-2 GFS, and Skipjack-B, the quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment can also be used for other symmetric cryptographic structures composed of public functions, XOR, branch replication, and explicit round key addition. When expanding, it is necessary to register the corresponding round functions and the state propagation rules in the forward and reverse directions.

[0137] In this context, Type-1 GFS and Type-2 GFS represent the first and second types of generalized Festot structures, respectively; Skipjack-B represents a structure that uses only the Skipjack cipher B-type wheel rules in each round; B-FK and B-KF represent the order in which the B-type wheel uses the combination of publishing the function first and then adding the wheel key, and adding the wheel key first and then publishing the function, respectively.

[0138] The quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment incorporates the algebraic conditions, input realization conditions, and output observability conditions of the key-related periodic functions into the same model. The solver only returns a result when the internal core, round key source, and ciphertext equivalence function are all true simultaneously, thus avoiding the discovery of internal periods that cannot be generated from the real input or computed from the ciphertext.

[0139] The quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment uses a seven-bit structural state and independent key auxiliary variables to represent intermediate states. The structural state is used to quickly determine whether the full form and half form can still be formed, and the key auxiliary variables are used to distinguish between different round key combinations and true cancellation. Compared with directly enumerating complete candidate circuits, this method can prune branches that do not satisfy the periodic form during propagation, reducing the search amount in complex structures.

[0140] The three-stage construction decomposes complex multi-round periodic functions into an internal core, an input-side extension, and an output-side extension, while maintaining consistency in a single solution through a common boundary. The quantum key recovery method based on the multi-stage construction of periodic functions provided in this embodiment can recover the existing five-round Feistel-FK and MISTY results, and significantly shorten the search time for representative instances compared to enumerating complete candidate circuits. It also obtains key-related periodic function candidates and corresponding recovery configurations such as six-round MISTY L-FK, five-round MISTY L-KF, and five-round MISTYR-KF.

[0141] The quantum key recovery method based on multi-stage construction of periodic functions provided in this embodiment can be extended to multi-branch structures such as Type-1, Type-2 generalized Feistel, and Skipjack-B, and has been successfully searched on instances with up to 32 branches. For candidates whose periods directly correspond to subkeys, Simon recovery can be configured; for candidates whose periods are composite subkey relationships, nested Simon or subsequent key relationship processing can be configured, thereby enabling the automatic search results to continue to be transformed into the actual quantum key recovery process.

[0142] Example 2 The quantum key recovery system based on a multi-stage construction of periodic functions provided in this embodiment includes: The model generation module is configured to: for the target cryptography, divide the periodic function construction into multiple stages, set the number of rounds for each stage, expand each round into a computation graph composed of multiple operations, and set the structural state, key auxiliary variables and observable state for different stages, add boundary conditions, and form a complete constrained model. The solver module is configured to: solve the complete constraint model using a solver, and reconstruct the internal periodic core, public input, encrypted post-processing, periodic expression, and state propagation path of each node from the solution results; The recovery module is configured to: substitute the restoration result into the real round function of the target cipher, verify that the input does not contain any unknown key that needs to be known in advance, ensure that the output function can be calculated from the ciphertext and the public function, and perform quantum key recovery after verifying the periodicity of the periodic function.

[0143] It should be noted that each module in this embodiment corresponds one-to-one with each step in Embodiment 1, and their specific implementation processes are the same, so they will not be repeated here.

[0144] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the quantum key recovery method based on a multi-stage construction of a periodic function as described in Embodiment 1 above.

[0145] Example 4 This embodiment provides a computer device, such as... Figure 6 As shown, the system includes a computer-readable storage medium 1003, a processor 1001, a communication interface 1002, and a computer program stored on the computer-readable storage medium 1003 and executable on the processor 1001. The processor 1001, communication interface 1002, and computer-readable storage medium 1003 can be connected via a bus or other means. The communication interface 1002 is used to receive and transmit data. When the processor 1001 executes the program, it implements the steps in the quantum key recovery method based on a multi-stage construction of a periodic function as described in Embodiment 1 above.

[0146] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A quantum key recovery method based on multi-stage construction of periodic functions, characterized in that, include: For the target cryptography, the periodic function is constructed in multiple stages, the number of rounds in each stage is set, each round is expanded into a computation graph composed of multiple operations, and structural states, key auxiliary variables and observable states are set for different stages. Boundary conditions are added to form a complete constraint model. For the complete constraint model, the solver is used to solve it, and the internal periodic core, public input, encrypted post-processing, periodic expression, and state propagation path of each node are reconstructed from the solution results. Substitute the restored result into the true round function of the target cipher to verify that the input does not contain any unknown key that needs to be known in advance, that the output function can be calculated from the ciphertext and the public function, and after verifying the periodicity of the periodic function, perform quantum key recovery.

2. The quantum key recovery method based on multi-stage construction of periodic functions as described in claim 1, characterized in that, The construction of periodic functions is divided into three stages: the internal periodic core search stage, the input-side expansion stage, and the output-side expansion stage. During the core search phase of the internal cycle, the selected The internal structure of the wheel allows the use of auxiliary unknowns to search for intermediate functions that satisfy either the full or partial form. During the input-side expansion phase, the process involves backtracking or reversing from the input position in the internal cycle core search phase back to the password input interface. In each round, check whether each auxiliary unknown can be uniquely determined by the input variables, the public function, and the actual round key; During the output-side expansion phase, a reverse search is performed from the cryptographic output interface towards the periodic output position of the internal periodic core search phase. The round determines whether a quantity equivalent to the internal periodic function can be constructed from ciphertext branches, public functions, and XOR operations; Among them, the constraints of the three stages are solved simultaneously in the same constraint system, so that the internal periodic core, the source of the round key, and the observability of the ciphertext are all met in the same candidate.

3. The quantum key recovery method based on multi-stage construction of periodic functions as described in claim 2, characterized in that, The output-side expansion phase uses a two-bit observable state to represent output constructibility: The first state (1,1) indicates that the branch can be directly obtained from the ciphertext; The second state (0,1) indicates that the branch differs from the known value by a key constant independent of the input variable x, where x represents an input variable that can be controlled by the attacker. This branch can be used to construct an equivalent periodic function. The third state (0,0) indicates that the branch cannot be used to construct the output function.

4. The quantum key recovery method based on multi-stage construction of periodic functions as described in claim 1, characterized in that, The multiple operations include: The F operation represents a public function without a key or its inverse function; The XOR operation represents a bitwise XOR operation between two branches of the same width. The SPLIT operation means copying a state to two successor branches. The ADK operation represents the XOR operation between the current branch and the specified wheel key.

5. The quantum key recovery method based on multi-stage construction of periodic functions as described in claim 4, characterized in that, The Split operation directly copies the structure state and key auxiliary variables; The XOR operation performs a bitwise XOR operation on the two structural states and synchronously XORs the corresponding key auxiliary variables. The ADK operation adds the round key symbol to the structure state and updates the key auxiliary variable according to the XOR rule; The F operation propagates the structural state according to a preset state transition diagram.

6. The quantum key recovery method based on multi-stage construction of periodic functions as described in claim 1, characterized in that, The structural states are defined according to full form and half form, and are encoded using a seven-bit vector.

7. The quantum key recovery method based on multi-stage construction of periodic functions as described in claim 1, characterized in that, The boundary conditions include: full-form, half-form, key propagation, input constructibility, output observability, and stage boundary conditions.

8. A quantum key recovery system based on a multi-stage construction of periodic functions, characterized in that it includes: The model generation module is configured to: for the target cryptography, divide the periodic function construction into multiple stages, set the number of rounds for each stage, expand each round into a computation graph composed of multiple operations, and set the structural state, key auxiliary variables and observable state for different stages, add boundary conditions, and form a complete constrained model. The solver module is configured to: solve the complete constraint model using a solver, and reconstruct the internal periodic core, public input, encrypted post-processing, periodic expression, and state propagation path of each node from the solution results; The recovery module is configured to: substitute the restoration result into the real round function of the target cipher, verify that the input does not contain any unknown key that needs to be known in advance, ensure that the output function can be calculated from the ciphertext and the public function, and perform quantum key recovery after verifying the periodicity of the periodic function.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the quantum key recovery method based on the multi-stage construction of periodic functions as described in any one of claims 1-7.

10. A computer device comprising a computer-readable storage medium, a processor, and a computer program stored on the computer-readable storage medium and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the quantum key recovery method based on multi-stage construction of periodic functions as described in any one of claims 1-7.

Images