A method for NTRU-based key generation, wrapping and unwrapping

Abstract

This invention relates to the field of information security technology, and particularly to a key generation, encapsulation, and decapsulation method based on NTRU. The key generation method includes: providing a first polynomial ring, a second polynomial ring, a first polynomial, and a second polynomial; calculating the first inverse polynomial of the first polynomial in the first polynomial ring; based on the second polynomial, the first inverse polynomial, and the first polynomial ring; calculating the second inverse polynomial of the first polynomial in the second polynomial ring; using the product polynomial as a public key, and the first and second inverse polynomials as private keys, and publishing the public key; by setting an appropriate second polynomial ring and setting smaller parameters, ensuring that the decryption failure probability remains below 2. ‑128 At the same time, it generates shorter public keys, private keys, and ciphertext to accommodate lower network transmission traffic, shorter communication latency, and smaller storage space requirements, thus enabling deployment in resource-constrained scenarios.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a key generation, encapsulation, and decapsulation method based on NTRU. Background Technology

[0002] Key Encapsulation Mechanism (KEM) and public-key encryption are widely used to ensure the confidentiality of information transmission and to establish secure communication channels. In scenarios such as Internet communication, Virtual Private Networks (VPNs), and instant messaging, KEM can securely share symmetric keys between communicating parties and ensure that data is protected from eavesdropping. With the advancement of quantum computing, traditional public-key encryption and key exchange schemes (such as RSA and Diffie-Hellman) face security threats. Therefore, quantum-resistant KEM schemes, such as lattice-based KEM schemes, have been proposed to prevent quantum computing from breaking modern cryptographic systems.

[0003] Hoffstein, Pipher, and Silverman first proposed the NTRU public-key encryption scheme framework based on polynomial rings in 1996. Subsequently, in 2003, Howgrave-Graham et al. proposed the NAEP mechanism using padding modes, effectively enhancing NTRU's security against adaptive chosen ciphertext attacks (CCA). In 2011, Stehlé and Steinfeld proposed an improved variant of SS-NTRU, theoretically proving for the first time that its security could be reduced to a difficult problem on an ideal lattice. In recent years, to reduce the probability of decryption failure while improving performance, researchers have designed schemes such as NTRU-HRSS and NTRU Prime. NTRU+, selected for the first round of the post-quantum cryptography competition in 2023, and entering the final algorithm list in 2025 and now a standard candidate technology, significantly reduces communication overhead while ensuring high security through improvements to the polynomial ring algebraic structure and encapsulation mechanism. In 2025, Liu Yijian et al. proposed DAWN, an NTRU scheme based on double encoding technology, which achieved a more compact and faster KEM mechanism. Overall, the balance between security and efficiency in NTRU-based key encapsulation mechanisms still has room for optimization and warrants further exploration.

[0004] In existing NTRU-based key encapsulation mechanisms, taking NTRU+ as an example, the first polynomial ring involved is: The second polynomial ring is The private key is set in the form of During the decryption process, the polynomial is first calculated in the first polynomial ring. The message can be recovered by transforming the calculated value into the second polynomial ring. The premise that the transformation of the polynomial ring will not cause decryption failure is The infinite norm of the coefficients will not exceed In such schemes, a common approach to reduce the probability of decryption failure is to increase the modulus parameter. However, this approach leads to a rapid increase in the size of the public key, private key, and ciphertext, which is detrimental to deployment in resource-constrained scenarios.

[0005] Therefore, how to reduce the size of public keys, private keys, and ciphertext while ensuring a low decryption failure rate is a pressing technical problem that needs to be solved. Summary of the Invention

[0006] In view of the above problems, the present invention provides a method for key generation, encapsulation and decapsulation based on NTRU that overcomes or at least partially solves the above problems.

[0007] In a first aspect, the present invention provides a key generation method based on NTRU, comprising: Provide a first polynomial ring, a second polynomial ring, a first polynomial, and a second polynomial, wherein the second polynomial ring is... , Modulus Integer ring, For modulus, Indicated by The elements in are coefficients, and A polynomial ring of indeterminate elements. Representing the indefinite elements of a polynomial, Represents a polynomial The generated ideal, the symbol / represents taking the quotient of the ideal, Indicated by The quotient polynomial ring is constructed from the modular polynomials. Both the first and second polynomials are invertible within the first polynomial ring, and the first polynomial is invertible within the second polynomial ring. Both the first and second polynomials are ternary coefficient polynomials. The coefficients of the first polynomial have probabilities of 1 and -1. The probability of taking the value 0 is The coefficients of the second polynomial have the probability of taking the value 1 or -1. The probability of taking the value 0 is ,in, All are integers; Calculate the first inverse polynomial of the first polynomial in the first polynomial ring; Based on the second polynomial, the first inverse polynomial, and the first polynomial ring, the product polynomial is obtained according to the following formula: in, It is a product polynomial. It is the first inverse polynomial. For the second polynomial, Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the first reduced polynomial, and then apply the first reduced polynomial according to the modulo polynomial. After reduction, we obtain the second reduced polynomial, where the coefficients of each term belong to... And the number is less than The first remainder polynomial is the product polynomial. Modulus Integer ring, Modulus; Calculate the second inverse polynomial of the first polynomial in the second polynomial ring; The product polynomial is used as the public key, the first polynomial and the second inverse polynomial are used as the private key, and the public key is published.

[0008] Preferably, after providing the first polynomial ring, the second polynomial ring, the first polynomial, and the second polynomial, the method further includes: Sure The value; based on The value is determined. The value of , where, It is 3. and Coprime, The value of allows the first polynomial ring to perform NTT transformations, thereby accelerating the multiplication operations between elements in the first polynomial ring, which is . ,in, Modulus Integer ring, For modulus, Indicated by The elements in are coefficients, and A polynomial ring of indeterminate elements. Representing the indefinite elements of a polynomial, Represents a polynomial The generated ideal, denoted by / , represents taking the quotient with respect to the ideal; therefore, Indicated by The quotient polynomial ring is constructed from the modular polynomial.

[0009] Preferred, in When the value is 1152, The value is 577.

[0010] Secondly, the present invention also provides a key encapsulation method based on NTRU, comprising: The first message is generated randomly; Receive the public key in the key generation method described in the first aspect; Based on the first message and the public key, a first shared key and a first byte string seed are obtained; Based on the seed string of the first byte, the perturbation polynomial is obtained; Based on the perturbation polynomial and the first message, a noise polynomial is introduced; Based on the noise polynomial, the perturbation polynomial, and the public key, ciphertext is generated to achieve key encapsulation.

[0011] Preferably, based on the first message and the public key, a first shared key and a first byte string seed are obtained, including: Concatenate the first message with the public key to obtain the first concatenation result; Based on the first concatenation result, the hash function is called to output the first shared key and the first byte seed.

[0012] Preferably, based on the perturbation polynomial and the first message, a noise polynomial is introduced, including: Based on the perturbation polynomial, the hash function is called to obtain the first output result; Based on the first output and the first message, the encoding function is called to generate the first intermediate polynomial; Based on the first intermediate polynomial, generate the second intermediate polynomial; Based on the second intermediate polynomial, call the hash function to output the seed of the intermediate byte string; Based on the intermediate byte string seed, a noise polynomial is introduced.

[0013] Preferably, based on the noise polynomial, the perturbation polynomial, and the public key, ciphertext is generated to achieve key encapsulation, specifically according to the following formula: in, The product polynomial is given, and is used as the public key. For the perturbation polynomial, It is a noise polynomial. This is the second intermediate polynomial. Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the third reduced polynomial, and then apply the third reduced polynomial according to the modulo polynomial. After reduction, a fourth reduced polynomial is obtained, wherein the coefficients of each term belong to... And the number is less than The second remainder polynomial, which is the ciphertext. , Modulus Integer ring, It is the modulus.

[0014] Thirdly, the present invention also provides a key decapsulation method based on NTRU, comprising: Based on the ciphertext generated in the key encapsulation method described in the second aspect and the private key in the key generation method described in the first aspect, the third polynomial is calculated: in, For the third polynomial, The ciphertext, It is the first polynomial and is used as one of the private keys. Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the fifth reduced polynomial, and then apply the fifth reduced polynomial according to the modulo polynomial. After reduction, we obtain the sixth reduced polynomial, where the coefficients of each term belong to... And the number is less than The third remainder polynomial, which is the third polynomial. Modulus Integer ring, Modulus; The noise removal term of the third polynomial is calculated using the following formula to obtain the fourth polynomial: in, It is the fourth polynomial. For the third polynomial, Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of each item are according to the model After reduction, we obtain the seventh reduced polynomial, and then apply the seventh reduced polynomial according to the modulo polynomial. After reduction, the eighth reduced polynomial is obtained, wherein the coefficients of each term belong to And the number is less than The fourth remainder polynomial, which is the fourth polynomial. Modulus Integer ring, Modulus; Based on the fourth polynomial, the fifth polynomial is obtained according to the following formula: in, This is the fifth polynomial. It is the fourth polynomial. It is the second inverse polynomial and is used as another private key. For polynomials The calculation result is subjected to modularization, which includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the ninth reduced polynomial, and then apply the modulo polynomial to the ninth reduced polynomial. After reduction, the tenth reduced polynomial is obtained, and the coefficients of each term of the tenth reduced polynomial belong to... And the number is less than The fifth remainder polynomial, which is the fifth polynomial; Based on the fifth polynomial, the candidate message polynomial is obtained according to the following calculation formula: in, For candidate message polynomials, This is the fifth polynomial. For polynomials The third inverse polynomial in the first polynomial ring Represents a polynomial The calculation result is subjected to modularization, which includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. The reduction is performed to obtain the eleventh reduced polynomial, and the eleventh reduced polynomial is then processed according to the modulo polynomial. After reduction, we obtain the twelfth reduced polynomial, where each coefficient belongs to... And the number is less than The sixth remainder polynomial, which is the candidate message polynomial; The candidate message polynomial is verified and calculated, and the second message is output. Based on the second message, output the second shared key and the second byte string seed.

[0015] Preferably, the candidate message polynomial is verified and calculated to output a second message, including: Based on the candidate message polynomial, a hash function is called to output the seed of the third byte string. Based on the seed of the third byte string, the sixth polynomial is obtained; Calculate the seventh polynomial based on the sixth polynomial; Based on the seventh polynomial, the hash function is called to obtain the second output result; Based on the second output and the fifth polynomial, the encoding function is called to output the second message.

[0016] Preferably, after outputting the second shared key and the second byte string seed based on the second message, the method further includes: Generate the eighth polynomial based on the seed string of the second byte; Determine whether the eighth polynomial is the same as the seventh polynomial; If so, output the second shared key, which is the same as the first shared key; If not, output the terminator.

[0017] One or more technical solutions in the embodiments of the present invention have at least the following technical effects or advantages: This invention provides a key generation method based on NTRU, comprising: providing a first polynomial ring, a second polynomial ring, a first polynomial, and a second polynomial, wherein the second polynomial ring is... The first and second polynomials are both invertible in the first polynomial ring, the first polynomial is invertible in the second polynomial ring, both the first and second polynomials are ternary coefficient polynomials, and the coefficients of the first polynomial take values ​​of 1 and -1 with probabilities of 1 and -1 respectively. The probability of taking the value 0 is The coefficients of the second polynomial have the probability of taking the value 1 or -1. The probability of taking the value 0 is ,in, All are integers; calculate the first inverse polynomial of the first polynomial in the first polynomial ring; based on the second polynomial, the first inverse polynomial, and the first polynomial ring, obtain the product polynomial according to the following formula: ,in, It is a product polynomial. It is the first inverse polynomial. For the second polynomial, Represents a polynomial Perform modularization; compute the second inverse polynomial of the first polynomial in the second polynomial ring; use the product polynomial as the public key and the first and second inverse polynomials as the private keys, and set up such a second polynomial ring to set smaller parameters. This ensures that the probability of decryption failure remains below 2. -128 At the same time, it generates shorter public keys, private keys, and ciphertext to accommodate lower network transmission traffic, shorter communication latency, and smaller storage space requirements, thus enabling deployment in resource-constrained scenarios. Attached Figure Description

[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference figures denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart illustrating the key generation method based on NTRU in an embodiment of the present invention is shown; Figure 2 A flowchart illustrating the key encapsulation method based on NTRU in an embodiment of the present invention is shown; Figure 3 A flowchart illustrating the key decapsulation method based on NTRU in an embodiment of the present invention is shown; Figure 4 A schematic diagram of the structure of the NTRU-based key generation device in an embodiment of the present invention is shown; Figure 5 A schematic diagram of the key encapsulation device based on NTRU in an embodiment of the present invention is shown; Figure 6 A schematic diagram of the key decapsulation and repackaging device based on NTRU in an embodiment of the present invention is shown. Detailed Implementation

[0019] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the invention and to fully convey the scope of the invention to those skilled in the art.

[0020] Example 1: Embodiments of the present invention provide a key generation method based on NTRU, such as... Figure 1 As shown, it includes: S101 provides a first polynomial ring, a second polynomial ring, a first polynomial, and a second polynomial, wherein the second polynomial ring is... The first and second polynomials are both invertible in the first polynomial ring, the first polynomial is invertible in the second polynomial ring, both the first and second polynomials are ternary coefficient polynomials, and the coefficients of the first polynomial take values ​​of 1 and -1 with probabilities of 1 and -1 respectively. The probability of taking the value 0 is The coefficients of the second polynomial have the probability of taking the value 1 or -1. The probability of taking the value 0 is ,in, All are integers; S102, calculate the first inverse polynomial of the first polynomial in the first polynomial ring; S103, based on the second polynomial, the first inverse polynomial, and the first polynomial ring, yields the product polynomial according to the following formula: in, It is a product polynomial. It is the first inverse polynomial. For the second polynomial, Represents a polynomial Modularization is performed, which includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the first reduced polynomial, and then apply the first reduced polynomial according to the modulo polynomial. After reduction, we obtain the second reduced polynomial, where the coefficients of each term belong to... And the number is less than The first remainder polynomial is the product polynomial. Modulus Integer ring, Modulus; S104, use the product polynomial as the public key and the first polynomial and the second inverse polynomial as the private key.

[0021] The entity responsible for generating this key is the recipient. This involves generating a public key and a private key, retaining the private key, and publishing the public key. The process for generating the public and private keys is described below.

[0022] First, in a specific implementation, in S101, the first polynomial ring is obtained. .

[0023] in, Modulus Integer ring, Modulus; Indicated by The elements in are coefficients, and A polynomial ring with indefinite elements; Indefinite elements representing a polynomial; Represents a polynomial The generated ideal; the symbol / represents taking the quotient with respect to the ideal, therefore... Indicated by The quotient polynomial ring is constructed from the modular polynomial; It is a positive integer and represents the degree parameter of the modulo polynomial.

[0024] Obtain the second polynomial ring Similarly, Modulus Integer ring, For modulus, Indicated by The elements in are coefficients, and A polynomial ring with indefinite elements; Indefinite elements representing a polynomial; Represents a polynomial The generated ideal; the symbol / represents taking the quotient with respect to the ideal; therefore, Indicated by The quotient polynomial ring is constructed from the modular polynomial; It is a positive integer and represents the degree parameter of the modulo polynomial.

[0025] Next, obtain the first polynomial. The first polynomial Through sets To specify, specifically, the first polynomial Let be a ternary polynomial, and let the coefficients take the values ​​1 and -1 with probabilities of... The probability of taking the value 0 is .

[0026] Obtain the second polynomial The second polynomial Through sets To specify, specifically, the second polynomial Let be a ternary polynomial, and let the coefficients take the values ​​1 and -1 with probabilities of... The probability of taking the value 0 is .

[0027] The first polynomial Second polynomial It also needs to be combined with the first polynomial ring Second polynomial ring The association is established, and the specific constraints of the association are as follows: First polynomial Second polynomial All in the first polynomial ring Invertible, first polynomial Second polynomial ring Reversible. Of the characters mentioned above, All are integers.

[0028] In a specific implementation, during the process of determining the above parameters, the highest power is determined first. Then based on the highest power Determine parameters , where the parameters The default selection is 3. and Coprime, and, The value of makes the first polynomial ring It can perform NTT transformations to accelerate multiplication operations between elements in the first polynomial ring.

[0029] In a preferred embodiment, When the value is 1152, the The value is 577. Of course, there are other corresponding values, which are not limited here.

[0030] Next, execute S102 to calculate the first inverse polynomial of the first polynomial in the first polynomial ring.

[0031] Specifically, the Extended Euclidean Algorithm is used for calculation: First, determine the two polynomials based on the extended Euclidean algorithm. and This makes the two polynomials in The following equation is satisfied: Next, for polynomials Modularization is performed to obtain the first inverse polynomial. : Specifically, the first polynomial First polynomial ring The first inverse polynomial in the equation is... Indicates, that is .

[0032] Next, S103 is executed. Based on the second polynomial, the first inverse polynomial, and the first polynomial ring, the product polynomial is obtained according to the following formula: in, It is a product polynomial. It is the first inverse polynomial. For the second polynomial, Represents a polynomial Modularization is performed, which includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the first reduced polynomial, and then apply the first reduced polynomial according to the modulo polynomial. After reduction, we obtain the second reduced polynomial, where the coefficients of each term belong to... And the number is less than The first remainder polynomial is the product polynomial. Modulus Integer ring, It is the modulus.

[0033] Next, execute S104 to calculate the second inverse polynomial of the first polynomial in the second polynomial ring.

[0034] Specifically, the Extended Euclidean Algorithm is used for calculation: First, determine the two polynomials based on the extended Euclidean algorithm. and This makes the two polynomials in The following equation is satisfied: Next, for polynomials Modular reduction is performed to obtain the second inverse polynomial. : Finally, S105 is executed to transform the product polynomial. As a public key , the first polynomial The second inverse polynomial as the private key .

[0035] Specifically, public key private key .

[0036] By employing the second polynomial ring selected in this invention Choose the smaller parameter accordingly. This reduces the length of the public key, private key, and ciphertext generated during the later encapsulation process, effectively reducing the consumption of communication bandwidth and storage resources.

[0037] One or more technical solutions in the embodiments of the present invention have at least the following technical effects or advantages: This invention provides a key generation method based on NTRU, comprising: providing a first polynomial ring, a second polynomial ring, a first polynomial, and a second polynomial, wherein the second polynomial ring is... The first and second polynomials are both invertible in the first polynomial ring, the first polynomial is invertible in the second polynomial ring, both the first and second polynomials are ternary coefficient polynomials, and the coefficients of the first polynomial take values ​​of 1 and -1 with probabilities of 1 and -1 respectively. The probability of taking the value 0 is The coefficients of the second polynomial have the probability of taking the value 1 or -1. The probability of taking the value 0 is ,in, All are integers; calculate the first inverse polynomial of the first polynomial in the first polynomial ring; based on the second polynomial, the first inverse polynomial, and the first polynomial ring, obtain the product polynomial according to the following formula: ,in, It is a product polynomial. It is the first inverse polynomial. For the second polynomial, Represents a polynomial Modularization is performed to compute the second inverse polynomial of the first polynomial within the second polynomial ring. The product polynomial is used as the public key, and the first and second inverse polynomials as the private keys. By setting up this second polynomial ring, smaller parameters can be configured. This ensures that the probability of decryption failure remains below 2. -128 At the same time, it generates shorter public keys, private keys, and ciphertext to accommodate lower network transmission traffic, shorter communication latency, and smaller storage space requirements, thus enabling deployment in resource-constrained scenarios.

[0038] Example 2 Based on the same inventive concept, this invention also provides a key encapsulation method based on NTRU, such as... Figure 2 As shown, it includes: S201, Randomly generate the first message; S202, Receive the public key from the key generation method in Embodiment 1; S203, based on the first message and the public key, obtain the first shared key and the first byte string seed; S204, based on the seed of the first byte string, obtains the perturbation polynomial; S205 introduces a noise polynomial based on the perturbation polynomial and the first message; S206 generates ciphertext based on noise polynomials, perturbation polynomials, and public keys, thus achieving key encapsulation.

[0039] The sender is responsible for executing this encapsulation process. It can receive the public key published by the receiver, encapsulate the key, and generate ciphertext.

[0040] S201, randomly generate the first message.

[0041] Specifically, by obtaining a set The set , The length is A set of bit strings.

[0042] Based on this set Generate the first message The first news The coefficients are randomly selected from this set. Selected from [the list].

[0043] Next, in step S202, the public key from the key generation method in embodiment one is received. The public key The recipient shall publish it.

[0044] S203, based on the first message and public key Obtain the first shared key and the seed of the first byte string .

[0045] First message With public key The first concatenation result is obtained by concatenating the two data points. Then, a hash function is called to generate a fixed-length first shared key. and the seed of the first byte string The specific formula is shown below: in, This is a hash function.

[0046] Next, execute S204, based on the seed of the first byte string. The perturbation polynomial is obtained. .

[0047] First, based on the seed of the first byte string , obtain the set The set Indicates the number of times The set of polynomials, where the coefficients of the polynomials have a probability of being 1 or -1. The probability of taking the value 0 is The ternary distribution. The seed of the first byte string. It is a fixed-length binary string, and the set contains Limited perturbation polynomial Number of times, Used to limit the perturbation polynomial The coefficient distribution, and thus according to this set The perturbation polynomial is obtained. .

[0048] Then, S205 is executed, based on the perturbation polynomial. And First News Introducing a noise polynomial .

[0049] Specifically, based on perturbation polynomials First, call the hash function to get the first output result. Next, based on the first output result And First News Call the encoding function to generate the first intermediate polynomial. , .

[0050] The encoding function generates a number of times not exceeding... The polynomial whose front The coefficients follow a central binomial distribution with parameter 1. The coefficients of all higher-order terms are 0, which is the first intermediate polynomial.

[0051] Next, based on the first intermediate polynomial Calculate and generate the second intermediate polynomial , ,in, Representing a polynomial The inverse polynomial in the first polynomial ring. Represents a polynomial Modularization is performed, which includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. The reduction is performed to obtain the thirteenth reduced polynomial, and the thirteenth reduced polynomial is then processed according to the modulo polynomial. After reduction, we obtain the fourteenth reduced polynomial, whose coefficients belong to... And the number is less than The seventh remainder polynomial is the second intermediate polynomial. Modulus Integer ring, It is the modulus.

[0052] For the second intermediate polynomial Call the hash function to generate the seed of the intermediate byte string. , from the seed of the intermediate byte string Generate a set Similarly, this set Indicates the number of times The set of polynomials, where the coefficients of the polynomials have a probability of being 1 or -1. The probability of taking the value 0 is The ternary distribution.

[0053] Finally, based on this set The noise polynomial is obtained. .

[0054] Therefore, the perturbation polynomial and noise polynomial All are ternary polynomials.

[0055] S206, based on noise polynomial Perturbation polynomial and public key Generate ciphertext This enables key encapsulation.

[0056] In a specific implementation, based on noise polynomials Perturbation polynomial Public key and the second intermediate polynomial generated along the way Generate ciphertext using the following formula: in, It is a product polynomial. Used as a public key For the perturbation polynomial, It is a noise polynomial. The second intermediate polynomial, For polynomials Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the third reduced polynomial, and then apply the third reduced polynomial according to the modulo polynomial. After reduction, a fourth reduced polynomial is obtained, wherein the coefficients of each term belong to... And the number is less than The second remainder polynomial, which is the ciphertext. This completes the key encapsulation process.

[0057] Noise polynomial The introduction of this method links the ciphertext obtained later with the RLWE problem, thereby ensuring the security of the scheme.

[0058] Example 3 Based on the same inventive concept, this invention also provides a key decapsulation method based on NTRU, such as... Figure 3 As shown, it includes: S301, based on the ciphertext generated in the key encapsulation method of Embodiment 2 and the private key in the key generation method of Embodiment 1, calculate the third polynomial: in, For the third polynomial, It is a ciphertext. It is the first polynomial and is used as one of the private keys. Represents a polynomial The results of the calculations are modularized. The modularization process specifically includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the fifth reduced polynomial, and then apply the fifth reduced polynomial according to the modulo polynomial. After reduction, we obtain the sixth reduced polynomial, where the coefficients of each term belong to... And the number is less than The third remainder polynomial is the polynomial with the third remainder. Modulus Integer ring, Modulus; S302, the noise term of the third polynomial is eliminated, and the fourth polynomial is obtained by calculating it according to the following formula: in, It is the fourth polynomial. For the third polynomial, Represents a polynomial Modularization is performed, which includes: reducing the polynomial... The coefficients of each item are according to the model After reduction, we obtain the seventh reduced polynomial, and then apply the seventh reduced polynomial according to the modulo polynomial. After reduction, we obtain the eighth reduced polynomial, where the coefficients of each term belong to... And the number is less than The fourth remainder polynomial is the fourth polynomial. Modulus Integer ring, Modulus; S303, based on the fourth polynomial, yields the fifth polynomial according to the following formula: in, This is the fifth polynomial. It is the fourth polynomial. It is the second inverse polynomial and is used as another private key. Represents a polynomial The calculation result is subjected to modularization, which includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the ninth reduced polynomial, and then apply the modulo polynomial to the ninth reduced polynomial. After reduction, we obtain the tenth reduced polynomial. The coefficients of the terms of the tenth reduced polynomial belong to... And the number is less than The fifth remainder polynomial, the fifth remainder polynomial is the fifth polynomial; S304, based on the fifth polynomial, the candidate message polynomial is obtained according to the following calculation formula: in, For candidate message polynomials, This is the fifth polynomial. For polynomials The third inverse polynomial in the first polynomial ring Represents a polynomial The results of the calculations are modularized, and the modularization process includes: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. The reduction is performed to obtain the eleventh reduced polynomial, and the eleventh reduced polynomial is then processed according to the modulo polynomial. After reduction, we obtain the twelfth reduced polynomial, where each coefficient belongs to... And the number is less than The sixth remainder polynomial, which is the candidate message polynomial. S305, perform verification calculation on the candidate message polynomial and output the second message; S306, based on the second message, output the second shared key and the second byte string seed.

[0059] The receiver is the entity that performs the key decryption process, and the receiver can receive the ciphertext.

[0060] First, in S301, since the second polynomial ring is Therefore, the third polynomial The structure is as follows: in, It is a ciphertext. It is the first polynomial and is used as one of the private keys. Represents a polynomial The calculation results are simplified, which will not be elaborated here.

[0061] Next, the third polynomial To elaborate, specifically, based on , The details are as follows:

[0062]

[0063]

[0064] in, Let be the standard deviation of the noise term. It can be seen that in the noise term... Expanded on the basis In reality, it only increased by a factor of 100. The larger the standard deviation of the noise term, the larger the parameter needs to be. Conversely, the smaller the standard deviation of the noise term, the smaller the parameter should be. .parameter The value of is the smallest prime number that satisfies the conditions required for performing the NTT transformation on the first polynomial ring.

[0065] Next, in S302, The fourth polynomial is obtained. , For the third polynomial, Represents the third polynomial Modular reduction is performed. Then, in S303, based on this fourth polynomial... The fifth polynomial is obtained by following the formula below. : in, This is the fifth polynomial. It is the second inverse polynomial and is used as another private key. It is the fourth polynomial. Represents a polynomial The calculation results are simplified.

[0066] In S304, based on the fifth polynomial The candidate message polynomial is obtained according to the following calculation formula. :

[0067] Among them, Candidate message polynomial, This is the fifth polynomial. For polynomials The third inverse polynomial in the first polynomial ring Represents a polynomial The calculation results are simplified.

[0068] Next, execute S305 to process the candidate message polynomial. Perform verification calculations and output the second message. .

[0069] Specifically, based on candidate message polynomials Call the hash function and output the seed of the third byte string. ; Based on the third byte string seed The sixth polynomial is obtained. ; Based on the sixth polynomial Calculate the seventh polynomial ; Based on the seventh polynomial Call the hash function to get the second output result. ; Based on the second output result and the fifth polynomial Call the encoding function to get the second message. .

[0070] Among them, the seed of the third byte string is obtained as Then, based on the third byte string seed The sixth polynomial is obtained. ,include: First, based on the third byte string seed Generate a set , where the set Indicates the number of times The set of polynomials, where the coefficients of the polynomials have a probability of being 1 or -1. The probability of taking the value 0 is The ternary distribution. The seed of the third byte string. It is a fixed-length binary string.

[0071] Based on this set The sixth polynomial is obtained. .

[0072] Based on the sixth polynomial Calculate the seventh polynomial Specifically, it is calculated using the following formula: in, For the seventh polynomial, For product polynomials That is, the public key The fourth inverse polynomial in the first polynomial ring, It is a ciphertext. Represents a polynomial The results of the calculations are modularized, specifically including: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. The reduction is performed to obtain the fifteenth reduced polynomial, and the result of the operation on the fifteenth reduced polynomial is then processed according to the modulo polynomial. After reduction, we obtain the sixteenth reduced polynomial, where each coefficient belongs to... And the number is less than The eighth remainder polynomial is the seventh polynomial.

[0073] Based on the seventh polynomial Call the hash function to get the second output result. ,in This represents a hash function.

[0074] Next, based on the second output result and the fifth polynomial Call the decoding function to get the second message. : in, This is the fifth polynomial. This is the second output result. This is the decoding function, specifically the inverse function of the decoding function. This is the second message. The length is The bit string.

[0075] S306, based on the second message Output the second shared key Second byte string seed .

[0076] Specifically, upon receiving the second message Then, the second message With public key By concatenating the components and calling a hash function, the second shared key is output. Second byte string seed , specifically, .

[0077] Following S306, it also includes: Based on the second byte string seed Generate the eighth polynomial ; Determine the eighth polynomial With the seventh polynomial Are they the same? If so, output the second shared key. The second shared key With the first shared key same; If not, output the terminator.

[0078] Specifically, from the seed of the second byte string Generate a set The set Indicates the number of times The set of polynomials, where the coefficients of the polynomials have a probability of being 1 or -1. The probability of taking the value 0 is The ternary distribution.

[0079] Based on this set This generates the eighth polynomial. .

[0080] Determine the eighth polynomial With the seventh polynomial Whether they are the same, i.e., judging Check if the condition is met; if so, output the second shared key. The second shared key With the first shared key If they are the same, output the terminator; otherwise, output the terminator.

[0081] The following is an analysis of the correctness of decapsulation: In the third polynomial In the expansion of, ,when When, we can obtain the fourth polynomial. The following relationship exists: At this point, there exists: the fifth polynomial ,So .

[0082] The seed string generated during key encapsulation and decapsulation processes seed of intermediate byte string seed of the second byte string , third byte string seed and ciphertext The structure is easy to see, in the current At that time, generated during the decapsulation process They can generate the same session key.

[0083] Security Analysis: The security of the solution of this invention is guaranteed by the difficulty of the NTRU problem and the difficulty of the RLWE problem. Specifically, if the solution is converted into a key encryption scheme (PKE), it has the security of IND-CPA, and: The PKE scheme with IND-CPA security can be converted into the key encapsulation scheme set in this invention through a special FO transformation (a universal transformation in classical cryptography). This IND-CCA scheme has a higher security level than IND-CPA. For the advantage of attack, For a basic public-key cryptosystem, it is based on the shortest vector problem on a polynomial ring. For the error-learning problem on rings, the core difficult assumption of post-quantum cryptography.

[0084] This formula means that if there exists an efficient adversary A that can effectively break through PKE, then we can construct an efficient adversary B or adversary C that can effectively break through the NTRU or RLWE difficult problem.

[0085] Conversely, if NTRU and RLWE are computationally difficult, then the PEK scheme must have an IND-CPA security level.

[0086] The solution provided by this invention is different from existing NTRUs. + The parameters are compared as follows:

[0087] As can be seen, the public key, private key, and ciphertext of this invention are smaller in size, and therefore can be deployed in resource-constrained scenarios.

[0088] The present invention is based on the NTRU assumption and combines the zero division technique in dual coding to construct a key encapsulation mechanism. Theoretical analysis on correctness and security is given, and relevant experiments are also conducted to prove the effectiveness of the scheme.

[0089] Parameters set in this invention , This still ensures that the probability of decryption failure is less than 2. -128Meanwhile, smaller parameters It can generate shorter public key, private key, and ciphertext sizes, with public key and private key sizes reduced by approximately 17% and ciphertext size reduced by approximately 8%.

[0090] Example 4 Based on the same inventive concept, embodiments of the present invention provide a key generation device based on NTRU, such as... Figure 4 As shown, it includes: Module 401 is provided to provide a first polynomial ring, a second polynomial ring, a first polynomial, and a second polynomial, wherein the second polynomial ring is... , Modulus Integer ring, For modulus, Indicated by The elements in are coefficients, and A polynomial ring of indeterminate elements. Representing the indefinite elements of a polynomial, Represents a polynomial The generated ideal, the symbol / represents taking the quotient of the ideal, Indicated by The quotient polynomial ring is constructed from the modular polynomials. Both the first and second polynomials are invertible within the first polynomial ring, and the first polynomial is invertible within the second polynomial ring. Both the first and second polynomials are ternary coefficient polynomials. The coefficients of the first polynomial have probabilities of 1 and -1. The probability of taking the value 0 is The coefficients of the second polynomial have the probability of taking the value 1 or -1. The probability of taking the value 0 is ,in, All are integers; The first calculation module 402 is used to calculate the first inverse polynomial of the first polynomial in the first polynomial ring. The first module 403 is used to obtain the product polynomial based on the second polynomial, the first inverse polynomial, and the first polynomial ring, according to the following formula: in, It is a product polynomial. It is the first inverse polynomial. For the second polynomial, Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the first reduced polynomial, and then apply the first reduced polynomial according to the modulo polynomial. After reduction, we obtain the second reduced polynomial, where the coefficients of each term belong to... And the number is less than The first remainder polynomial is the product polynomial. Modulus Integer ring, Modulus; The second calculation module 404 is used to calculate the second inverse polynomial of the first polynomial in the second polynomial ring; The publishing module 405 is used to publish the product polynomial as a public key, the first polynomial and the second inverse polynomial as private keys, and publish the public key.

[0091] In one alternative implementation, the system further includes a determining module, configured to: Sure The value; based on The value is determined. The value of , where, It is 3. and Coprime, The value of allows the first polynomial ring to perform NTT transformations, thereby accelerating the multiplication operations between elements in the first polynomial ring, which is . ,in, Modulus Integer ring, For modulus, Indicated by The elements in are coefficients, and A polynomial ring of indeterminate elements. Representing the indefinite elements of a polynomial, Represents a polynomial The generated ideal, denoted by / , represents taking the quotient with respect to the ideal; therefore, Indicated by The quotient polynomial ring is constructed from the modular polynomial.

[0092] In one alternative implementation, in When the value is 1152, The value is 577.

[0093] Example 5 Based on the same inventive concept, the present invention also provides a key encapsulation device based on NTRU, such as... Figure 5 As shown, it includes: The first generation module 501 is used to randomly generate the first message; The receiving module 502 is used to receive the public key in the key generation method described in Embodiment 1; The second obtaining module 503 is used to obtain a first shared key and a first byte string seed based on the first message and the public key; The third module 504 is used to obtain the perturbation polynomial based on the first byte string seed; Module 505 is introduced to introduce a noise polynomial based on the perturbation polynomial and the first message; The second generation module 506 is used to generate ciphertext based on the noise polynomial, the perturbation polynomial and the public key, and to achieve key encapsulation.

[0094] In one alternative implementation, the second obtaining module 503 is used to: Concatenate the first message with the public key to obtain the first concatenation result; Based on the first concatenation result, the hash function is called to output the first shared key and the first byte seed.

[0095] In an alternative implementation, module 505 is introduced for: Based on the perturbation polynomial, the hash function is called to obtain the first output result; Based on the first output and the first message, the decoding function is called to generate the first intermediate polynomial; Based on the first intermediate polynomial, generate the second intermediate polynomial; Based on the second intermediate polynomial, call the hash function to output the seed of the intermediate byte string; Based on the intermediate byte string seed, a noise polynomial is introduced.

[0096] In one optional implementation, the second generation module 506 is specifically implemented according to the following formula: in, The product polynomial is given, and is used as the public key. For the perturbation polynomial, It is a noise polynomial. This is the second intermediate polynomial. Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the third reduced polynomial, and then apply the third reduced polynomial according to the modulo polynomial. After reduction, a fourth reduced polynomial is obtained, wherein the coefficients of each term belong to... And the number is less than The second remainder polynomial, which is the ciphertext. , Modulus Integer ring, It is the modulus.

[0097] Example 6 Based on the same inventive concept, the present invention also provides a key decapsulation and repackaging device based on NTRU, such as... Figure 6 As shown, it includes: The third calculation module 601 is used to calculate the third polynomial based on the ciphertext generated in the key encapsulation method described in Embodiment 2 and the private key in the key generation method described in Embodiment 1: in, For the third polynomial, The ciphertext, For one of the private keys, Represents the expression for a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the fifth reduced polynomial, and then apply the fifth reduced polynomial according to the modulo polynomial. After reduction, we obtain the sixth reduced polynomial, where the coefficients of each term belong to... And the number is less than The third remainder polynomial, which is the third polynomial. Modulus Integer ring, Modulus; The fourth module 602 is used to eliminate noise terms from the third polynomial, specifically by calculating the fourth polynomial according to the following formula: in, It is the fourth polynomial. For the third polynomial, Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of each item are according to the model After reduction, we obtain the seventh reduced polynomial, and then apply the seventh reduced polynomial according to the modulo polynomial. After reduction, the eighth reduced polynomial is obtained, wherein the coefficients of each term belong to And the number is less than The fourth remainder polynomial, which is the fourth polynomial. Modulus Integer ring, Modulus; The fifth module, 603, is used to obtain the fifth polynomial based on the fourth polynomial, according to the following formula:

[0098] in, This is the fifth polynomial. It is the fourth polynomial. It is the second inverse polynomial and is used as another private key. Represents a polynomial The calculation result is subjected to modularization, which includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the ninth reduced polynomial, and then apply the modulo polynomial to the ninth reduced polynomial. After reduction, the tenth reduced polynomial is obtained, and the coefficients of each term of the tenth reduced polynomial belong to... And the number is less than The fifth remainder polynomial, which is the fifth polynomial; The sixth module 604 is used to obtain the candidate message polynomial based on the fifth polynomial, according to the following calculation formula:

[0099] in, For candidate message polynomials, This is the fifth polynomial. For polynomials The third inverse polynomial in the first polynomial ring Represents a polynomial The calculation result is subjected to modularization, which includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. The reduction is performed to obtain the eleventh reduced polynomial, and the eleventh reduced polynomial is then processed according to the modulo polynomial. After reduction, we obtain the twelfth reduced polynomial, where each coefficient belongs to... And the number is less than The sixth remainder polynomial, which is the candidate message polynomial; The first output module 605 is used to verify and calculate the candidate message polynomial and output the second message. The second output module 606 is used to output the second shared key and the second byte string seed based on the second message.

[0100] In one alternative implementation, the first output module 605 is used for: Based on the candidate message polynomial, a hash function is called to output the seed of the third byte string. Based on the seed of the third byte string, the sixth polynomial is obtained; Calculate the seventh polynomial based on the sixth polynomial; Based on the seventh polynomial, the hash function is called to obtain the second output result; Based on the second output and the fifth polynomial, the decoding function is called to output the second message.

[0101] In one optional implementation, it further includes: a determination module, used for: Generate the eighth polynomial based on the seed string of the second byte; Determine whether the eighth polynomial is the same as the seventh polynomial; If so, output the second shared key, which is the same as the first shared key; If not, output the terminator.

[0102] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0103] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. An NTRU-based key generation method, characterized by, include: Provide a first polynomial ring, a second polynomial ring, a first polynomial, and a second polynomial, wherein the second polynomial ring is... , Modulus Integer ring, For modulus, Indicated by The elements in are coefficients, and A polynomial ring of indeterminate elements. Representing the indefinite elements of a polynomial, Represents a polynomial The generated ideal, the symbol / represents taking the quotient of the ideal, Indicated by The quotient polynomial ring is constructed from the modular polynomials. Both the first and second polynomials are invertible within the first polynomial ring, and the first polynomial is invertible within the second polynomial ring. Both the first and second polynomials are ternary coefficient polynomials. The coefficients of the first polynomial have probabilities of 1 and -1. The probability of taking the value 0 is The coefficients of the second polynomial have the probability of taking the value 1 or -1. The probability of taking the value 0 is ,in, All are integers; Calculate the first inverse polynomial of the first polynomial in the first polynomial ring; Based on the second polynomial, the first inverse polynomial, and the first polynomial ring, the product polynomial is obtained according to the following formula: ； in, It is a product polynomial. It is the first inverse polynomial. For the second polynomial, Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the first reduced polynomial, and then apply the first reduced polynomial according to the modulo polynomial. After reduction, we obtain the second reduced polynomial, where the coefficients of each term belong to... And the number is less than The first remainder polynomial is the product polynomial. Modulus Integer ring, Modulus; Calculate the second inverse polynomial of the first polynomial in the second polynomial ring; The product polynomial is used as the public key, the first polynomial and the second inverse polynomial are used as the private key, and the public key is published.

2. The method as described in claim 1, characterized in that, After providing the first polynomial ring, the second polynomial ring, the first polynomial, and the second polynomial, it also includes: Sure The value; based on The value is determined. The value of , where, It is 3. and Coprime, The value of allows the first polynomial ring to perform NTT transformations, thereby accelerating the multiplication operations between elements in the first polynomial ring, which is . ,in, Modulus Integer ring, For modulus, Indicated by The elements in are coefficients, and A polynomial ring of indeterminate elements. Representing the indefinite elements of a polynomial, Represents a polynomial The generated ideal, denoted by / , represents taking the quotient with respect to the ideal; therefore, Indicated by The quotient polynomial ring is constructed from the modular polynomial.

3. The method as described in claim 1, characterized in that, exist When the value is 1152, The value is 577.

4. A key encapsulation method based on NTRU, characterized in that, include: The first message is generated randomly; Receive the public key in the key generation method as described in any one of claims 1 to 3; Based on the first message and the public key, a first shared key and a first byte string seed are obtained; Based on the seed string of the first byte, the perturbation polynomial is obtained; Based on the perturbation polynomial and the first message, a noise polynomial is introduced; Based on the noise polynomial, the perturbation polynomial, and the public key, ciphertext is generated to achieve key encapsulation.

5. The key encapsulation method as described in claim 4, characterized in that, Based on the first message and the public key, a first shared key and a first byte string seed are obtained, including: Concatenate the first message with the public key to obtain the first concatenation result; Based on the first concatenation result, the hash function is called to output the first shared key and the first byte seed.

6. The key encapsulation method as described in claim 4, characterized in that, Based on the perturbation polynomial and the first message, a noise polynomial is introduced, including: Based on the perturbation polynomial, the hash function is called to obtain the first output result; Based on the first output and the first message, the encoding function is called to generate the first intermediate polynomial; Based on the first intermediate polynomial, generate the second intermediate polynomial; Based on the second intermediate polynomial, call the hash function to output the seed of the intermediate byte string; Based on the intermediate byte string seed, a noise polynomial is introduced.

7. The key encapsulation method as described in claim 6, characterized in that, Based on the noise polynomial, the perturbation polynomial, and the public key, ciphertext is generated, and key encapsulation is implemented, specifically according to the following formula: ； in, The product polynomial is given, and is used as the public key. For the perturbation polynomial, It is a noise polynomial. This is the second intermediate polynomial. Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the third reduced polynomial, and then apply the third reduced polynomial according to the modulo polynomial. After reduction, a fourth reduced polynomial is obtained, wherein the coefficients of each term belong to... And the number is less than The second remainder polynomial, which is the ciphertext. , Modulus Integer ring, It is the modulus.

8. A key decapsulation method based on NTRU, characterized in that, include: Based on the ciphertext generated in the key encapsulation method as described in any one of claims 4 to 7 and the private key in the key generation method as described in any one of claims 1 to 3, calculate the third polynomial: ； in, It is the fourth polynomial. For the third polynomial, Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of each item are according to the model After reduction, we obtain the seventh reduced polynomial, and then apply the seventh reduced polynomial according to the modulo polynomial. After reduction, the eighth reduced polynomial is obtained, wherein the coefficients of each term belong to And the number is less than The fourth remainder polynomial, which is the fourth polynomial. Modulus Integer ring, Modulus; Based on the fourth polynomial, the fifth polynomial is obtained according to the following formula: ； in, It is the fourth polynomial. For the third polynomial, Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of each item are according to the model After reduction, we obtain the seventh reduced polynomial, and then apply the seventh reduced polynomial according to the modulo polynomial. After reduction, the eighth reduced polynomial is obtained, wherein the coefficients of each term belong to And the number is less than The fourth remainder polynomial, which is the fourth polynomial. Modulus Integer ring, Modulus; Based on the fourth polynomial, the fifth polynomial is obtained according to the following formula: ； in, This is the fifth polynomial. It is the fourth polynomial. It is the second inverse polynomial and is used as another private key. Represents a polynomial Modularization is performed, the modularization process including: converting the polynomial... The coefficients of the calculation results are calculated according to the modulus. We perform reduction to obtain the ninth reduced polynomial, and then apply the modulo polynomial to the ninth reduced polynomial. After reduction, the tenth reduced polynomial is obtained, and the coefficients of each term of the tenth reduced polynomial belong to... And the number is less than The fifth remainder polynomial, which is the fifth polynomial; Based on the fifth polynomial, the candidate message polynomial is obtained according to the following calculation formula: ； in, For candidate message polynomials, This is the fifth polynomial. For polynomials The third inverse polynomial in the first polynomial ring Represents a polynomial The calculation result is subjected to modularization, which includes: reducing the polynomial... The coefficients of the calculation results are calculated according to the modulus. The reduction is performed to obtain the eleventh reduced polynomial, and the eleventh reduced polynomial is then processed according to the modulo polynomial. After reduction, we obtain the twelfth reduced polynomial, where each coefficient belongs to... And the number is less than The sixth remainder polynomial, which is the candidate message polynomial; The candidate message polynomial is verified and calculated, and the second message is output. Based on the second message, output the second shared key and the second byte string seed.

9. The method as described in claim 8, characterized in that, The candidate message polynomial is verified and calculated to output a second message, including: Based on the candidate message polynomial, a hash function is called to output the seed of the third byte string. Based on the seed of the third byte string, the sixth polynomial is obtained; Calculate the seventh polynomial based on the sixth polynomial; Based on the seventh polynomial, the hash function is called to obtain the second output result; Based on the second output and the fifth polynomial, the encoding function is called to output the second message.

10. The method as described in claim 9, characterized in that, After outputting the second shared key and the second byte string seed based on the second message, the following is also included: Generate the eighth polynomial based on the seed string of the second byte; Determine whether the eighth polynomial is the same as the seventh polynomial; If so, output the second shared key, which is the same as the first shared key; If not, output the terminator.

Images