Method for implementing quantum-resistant cryptography algorithm based on satisfiability problem in which condition to have solution is strengthened

Abstract

Disclosed is a method for implementing a quantum-resistant cryptography algorithm based on a satisfiability problem in which a condition to have a solution is strengthened. The present invention relates to a method for generating cipher text by counting the number of elements included in a randomly selected subset from a multiset. The advantages of the proposed algorithm are: first, the algorithm is faster than other public key-based algorithms; second, the algorithm can be executed in any device because a large number or a floating point number is not used; and third, the algorithm can be easily extended to a cryptographic system using multiple private keys without loss of quantum resistance.

Description

A method for implementing a quantum-resistant cryptographic algorithm based on the SATISFIABILITY PROBLEM with enhanced conditions for having harm.

[0001] Public-key cryptography has evolved to increase computational complexity to hide messages, and the advancement of the Internet and quantum computing is accelerating this process. This invention introduces a novel public-key cryptography algorithm that randomly extracts a subset from a multiset and then counts the number of elements contained in the subset to generate ciphertext. After explaining the novel cryptographic concept, we illustrate the process of realizing it using the satisfaction problem. The advantages of the proposed algorithm are that, first, it is faster than other public-key-based algorithms; second, it can be run on any device because it does not use large numbers or floating-point numbers; and third, it can be easily extended to a multi-private key public-key cryptosystem, where a single public key corresponds to multiple private keys, without loss of quantum resistance.

[0002] Factorization and discrete logarithm problems, which were the basis of public key-based algorithms, can now be solved in polynomial time using quantum computers through Shor's algorithm, and as quantum computer development technology continues to advance, the security of cryptographic algorithms that apply them can no longer be guaranteed. Therefore, a new public key-based cryptographic algorithm that does not exploit the difficulties of factorization or discrete logarithm problems is required, and such cryptographic technology is called quantum-resistant cryptography or post-quantum cryptography (PQC). Quantum-resistant cryptographic algorithms developed to date are divided into four fields: multivariate-based, code-based, isogeny-based, and lattice-based, excluding hash-based algorithms used in electronic signatures. The National Institute of Standards and Technology (NIST) is standardizing post-quantum cryptography algorithms, and the Public Key Encryption division has selected three lattice-based algorithms (CRYSTALS KYBER, NTRU, and SABER) and one code-based algorithm (Classic McEliece) as candidates for the third round of standardization. CRYSTALS KYBER was recently selected for standardization, and Classic McEliece was selected as a candidate for the fourth round.

[0003] The lattice-based and code-based algorithms described above impart a one-way property that complicates the search for a private key from a public key. While adding a random vector to the relationship between the public and private keys makes it difficult to retrieve the private key, they also impose constraints on the random values ​​added to ensure that the private key can be recovered (creating a trapdoor). These constraints provide the foundation for a variety of attack algorithms, leading to ongoing research into attack algorithms aimed at obtaining or decrypting the private key or original data.

[0004] In this invention, we introduce a novel encryption concept that randomly extracts subsets of a duplicate set and counts the number of elements contained in the array, creating a ciphertext. We then describe the process of formulating the proposed new encryption concept using the satisfiability problem (SAT). The proposed algorithm is characterized by its use of a random sampling method, departing from the conventional concept of adding or multiplying random values ​​to create one-way characteristics.

[0005] Public-key cryptographic algorithms are built on NP-hard problems or problems predicted to be NP-hard. SAT is not only the first proven NP-complete (NP-hard & ∈ NP) problem, but also protects against various algebraic attacks that attempt to find the private key from the public key if the clauses constituting the SAT can be used as public keys. The security of the private key depends solely on the performance of search algorithms such as SAT solvers. A SAT-based cryptographic algorithm was proposed that transforms the clauses constituting the public key into Algebraic Normal Form (ANF) and then multiplies them with random ANFs corresponding to noise. However, it has not been proven that the ciphertext cannot be decoded within polynomial time to find the plaintext, and the encryption time and ciphertext size are too large for practical applications. The algorithm proposed in this invention is based on the fact that it is difficult to find a solution to the SAT instance from the public key in SAT problems with strengthened solution conditions. In the existing SAT problem, the condition for a solution was that all clauses must contain at least one literal having a TRUE value, but in the present invention, the condition for a solution of k-SAT is strengthened to the condition that when k is even, there must be only k / 2 literals having a TRUE value, and when k is odd, there must be only └k / 2┘ literals or └k / 2┘+1 literals.

[0006] The present invention was created to solve the problem of the prior art that the security of public key-based cryptographic algorithms that utilize the difficulty of factoring or discrete logarithm problem in a quantum computing environment is not guaranteed by the Shor algorithm, and provides a method for implementing a quantum-resistant cryptographic algorithm based on the difficulty of finding a solution that creates a public key in a satisfaction problem with strengthened conditions for a solution.

[0007] The variables that make up SAT use Boolean variables that only have the values ​​TRUE (1) or FALSE (0). A literal is represented as a Boolean variable such as 'a' or a negation of a Boolean variable such as '￢a'. An expression in which literals are connected by one or more disjunctions (v, logical OR), such as (a∨￢b∨c), is called a clause, and an expression in which clauses are connected by one or more conjunctions (∧, logical AND), such as (a∨￢b∨c)∧(a∨c∨d), is called Conjunctive Normal Form (CNF). A CNF in which all clauses are composed of k literals is denoted as k-CNF. A clause is said to be satisfied if it contains at least one literal that has a TRUE value. The set of literals with TRUE values ​​that satisfy all clauses of CNF is called a solution of CNF, and the problem of determining whether a solution exists is called the Satisfiability problem (SAT). A clause consisting of k literals with TRUE values ​​based on the solution, that is, a clause containing k literals included in the solution set, is defined as a k-TRUE-clause.

[0008] A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with a strengthened condition for having a solution according to a preferred embodiment of the present invention for realizing the above purpose comprises the steps of: selecting a number of input variables n, a number of clauses e to be randomly extracted, a 2k-CNF used as a public key and composed of k-TRUE-clauses, and then generating a literal spectrum representing pairs of the number of literals having a TRUE value and the number of literals having a FALSE value in an array by randomly extracting e clauses from among the clauses included in the 2k-CNF;

[0009] When encrypting the plaintext '1', the number of literals that make up the literal spectrum array is a i Wow b i The ciphertext is created by recording them in order, and when encrypting the plaintext '0', a i ≠b i After randomly selecting i where (1≤i≤n), a i Wow b i A step of generating a ciphertext by changing and recording the first and the rest in order;

[0010] The above ciphertext restoration is characterized by a step of restoring the value (satisfiability measure) calculated by (Formula 1) below to 1 if ke, and to 0 if not.

[0011] (Formula 1)

[0012]

[0013] L·A: The inner product value between the literal spectrum and the solution vector created with the private key.

[0014] L: literal spectrum, a set of duplicates that has all literals that make up CNF as elements. k Count the number of (1≤k≤n) ak Set the value of ￢x k Count the number of b k a created by setting the value of k Wow b k An array listing pairs [(a k ,b k )] n or [a1,b1,a2,b2,…,a n ,b n ] is indicated,

[0015] A: solution vector, an array made of private keys that are solutions to CNF - n input variables x k Among the 2n literals made by (1≤k≤n), x k If x is included in the solution k Wow ￢x k x is created by assigning 1 and 0 to each and assigning 0 and 1 if not included. k Wow ￢x k An array listing pairs [(x k ,￢x k )] n or [x1,￢x k ,x2,￢x2,… ,x n ,￢x n ] is indicated.

[0016] A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with enhanced conditions for having a solution according to another preferred embodiment of the present invention for realizing the above purpose is provided.

[0017] In the process of implementing the above encryption algorithm, the number of literals that make up the literal spectrum array is a in the step of encrypting the plaintext '1'. i Wow b i Instead of generating a ciphertext by writing it in order, it takes the same amount of time to encrypt the plaintext '0'. i = b i After randomly selecting i where (1≤i≤n), a i Wow bi It is characterized by being performed by changing and recording the number of digits and recording the remaining numbers in order to generate a ciphertext.

[0018] A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with a strengthened condition for having a solution according to another preferred embodiment of the present invention for realizing the above purpose comprises the steps of: selecting the number of input variables n, the number of clauses to be randomly extracted e, a 2k-CNF composed of k-TRUE-clauses used as a public key, and the number of bits b of plaintext to generate a ciphertext, and then randomly selecting 2 from among the n variables; b Select the dog, then select 2 b The number of extracted two literals created by each variable is from 0 to 2. b A step of randomly extracting clauses from 2k-CNF so that the difference is up to -1;

[0019] A step of generating a literal spectrum of CNF consisting of e randomly extracted clauses including the clauses extracted in the previous step;

[0020] The value of the plaintext with b bits is p(0≤p<2 b ) in the step of generating the literal spectrum, 2 is selected. b A step of generating a ciphertext by exchanging the numbers of extracted literals made by one variable among the variables, the numbers of which differ by p;

[0021] When restoring the above ciphertext, if the satisfiability measure value calculated by the above (Formula 1) is ke+p or ke-p, the step of restoring by changing the p value to b bits is performed.

[0022] A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with enhanced conditions for having a solution according to another preferred embodiment of the present invention for realizing the above-mentioned purpose comprises the steps of: generating a public key by dividing clauses included in a (2k+1)-CNF composed of k-TRUE-clauses and (k+1)-TRUE-clauses into a k-TRUE-clause group and a (k+1)-TRUE-clause group;

[0023] The number of input variables n, the number of randomly extracted clauses e are selected, and the number of bits b of the plaintext from which the ciphertext is to be generated is 2. b After setting =e to satisfy, the value of the plaintext with b bits is p(0≤p<2 b ) a step of extracting p from the k-TRUE-clause group and extracting ep from the (k+1)-TRUE-clause group;

[0024] A step of generating a literal spectrum of CNF composed of e clauses extracted in the above step and generating a ciphertext by recording the numbers constituting the literal spectrum array;

[0025] The above ciphertext restoration is characterized by a step of restoring the p value from the relational expression p=(k+1)et after obtaining the satisfiability measure value t=kp+(k+1)(ep) calculated by the above (Formula 1).

[0026] A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with enhanced conditions for having a solution according to another preferred embodiment of the present invention for realizing the above purpose comprises the steps of: generating a public key by dividing clauses included in a 2k-CNF composed of (k-1)-TRUE-clauses and (k+1)-TRUE-clauses into a (k-1)-TRUE-clause group and a (k+1)-TRUE-clause group;

[0027] The number of input variables n, the number of randomly extracted clauses e are selected, and the number of bits b of the plaintext from which the ciphertext is to be generated is 2. b After setting =e to satisfy, the value of the plaintext with b bits is p(0≤p<2 b ) a step of extracting p from the (k-1)-TRUE-clause group and extracting ep from the (k+1)-TRUE-clause group;

[0028] A step of generating a literal spectrum of CNF composed of e clauses extracted in the above step and generating a ciphertext by recording the numbers constituting the literal spectrum array;

[0029] In the case of restoring the above ciphertext, it is characterized by performing a step of obtaining the satisfiability measure value t=(k-1)p+(k+1)(ep) calculated by the above (Formula 1) and then restoring the p value from the relational expression p=((k+1)et) / 2.

[0030] A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with enhanced conditions for having a solution according to an embodiment of the present invention for realizing the above-mentioned purpose is as follows:

[0031] Divide the n-bit private key into two keys of u bits and v bits,

[0032] It is characterized by further including a step of performing a calculation using (Formula 2) below with each private key and then restoring the calculated values ​​by combining them.

[0033] (Formula 2)

[0034]

[0035] A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with enhanced conditions for having a solution according to another embodiment of the present invention for realizing the above-mentioned purpose is characterized in that it further includes a step of dividing the n bits into a plurality of keys when the length of the private key is n bits, performing an operation with each private key, and then combining the operation values ​​to restore them.

[0036] The proposed algorithm suffers from the disadvantage of large public key and ciphertext sizes. However, when using hybrid cryptography, the large ciphertext size does not significantly affect usability, and it has the advantage of a relatively small private key length compared to lattice-based or code-based algorithms. Furthermore, since the encryption process involves randomly selecting variables and then counting them to create an array, and the decryption process is completed with an inner prototyping operation, it is faster than other public-key-based algorithms that perform complex calculations. Furthermore, since it does not involve large numbers that cannot be represented in 64-bit formats or floating-point numbers, it can be implemented on any platform.

[0037] Many public-key algorithms impose constraints on trapdoors after establishing one-way characteristics. These constraints have given rise to various attack algorithms. Lattice-based and code-based algorithms create one-way characteristics by inserting noise (errors). Lattice-based algorithms restrict trapdoors to Gaussian or small noise, while code-based algorithms restrict the weights of codewords containing noise to fall below a predetermined threshold. Public-key algorithms utilizing the Knapsack problem also leverage the one-way characteristics of the Knapsack problem, but impose constraints called super-increasing sequences to add trapdoors. This has led to the development of subsequent polynomial-time attack algorithms. The algorithm proposed in this invention utilizes the one-way characteristics between randomly extracted subsets from a multiset and the number of elements contained within each subset. To ensure recovery using a private key, the algorithm imposes a constraint that the number of literals with a TRUE value must be a fixed number when constructing the subset. However, finding the private key using the above characteristics is difficult through mathematical analysis and is only possible through a search algorithm, making it immune to various algebraic attacks. Furthermore, the condition for a solution to 2k-SAT is strengthened from the condition that all clauses must have at least one TRUE value to the condition that only k clauses must have TRUE values, making it significantly more time-consuming for SAT solvers to find a solution than for a standard SAT problem.

[0038] The proposed encryption algorithm is quantum-resistant because it does not rely on the difficulties of factoring or the discrete logarithm problem. Furthermore, it can be easily scaled to a cryptographic system that allows ciphertext to be generated using a single public key, yet requires a joint agreement from multiple parties to decrypt the encrypted data, much like simultaneously depressing a nuclear missile launch button. Therefore, at a time when the amount of data requiring hierarchical or collaborative encryption is rapidly increasing, the proposed algorithm is expected to serve as a new aegis against quantum computing, whose performance is rapidly improving.

[0039] The features and advantages of the present invention will become more apparent through the following detailed description based on the accompanying drawings. The terms and words used in this specification and claims should not be interpreted in their conventional or dictionary sense. Rather, they should be interpreted in their meanings and concepts consistent with the technical spirit of the present invention, based on the principle that the inventor can appropriately define the concepts of terms to best explain his or her invention.

[0040] FIG. 1 is a schematic diagram for explaining a new public key-based encryption and decryption method proposed in the present invention. When explaining the concept in the drawing, it is limited to the case where even numbers are used, but the concept extended to use odd numbers is described later.

[0041] Figure 2 shows a block diagram illustrating a method for generating and restoring 1-bit ciphertext.

[0042] Figure 3 shows a block diagram illustrating a modified algorithm to compensate for the vulnerability of side-channel attacks when generating 1-bit ciphertext.

[0043] Figure 4 shows a block diagram illustrating a method for generating and restoring ciphertext in block units (multiple bits).

[0044] Figure 5 shows a block diagram illustrating a method for generating and restoring ciphertexts after dividing the public key into two groups when k-CNF is used as a public key and k is odd.

[0045] Figure 6 shows a block diagram illustrating a method of generating and restoring ciphertext after dividing the public key into two groups when k-CNF is used as a public key and k is an even number.

[0046] Hereinafter, the configuration and operation of embodiments of the present invention will be described in detail with reference to the attached drawings. However, it should be understood that the present invention is not intended to be limited to a specific disclosed form, but includes all modifications, equivalents, and substitutes included in the spirit and technical scope of the present invention. It should be understood that the terms "comprise" or "have" in this application are intended to specify the presence of a feature, step, operation, component, part, or combination thereof described in the specification, and do not exclude in advance the possibility of the presence or addition of one or more other features, steps, operations, components, parts, or combinations thereof. In other words, throughout the specification, when a part is said to "comprise" a certain component, this does not mean that other components can be included, but rather that other components can be included, unless specifically stated otherwise.

[0047] Additionally, unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by those of ordinary skill in the art to which this invention pertains. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning within the context of the relevant technology, and shall not be interpreted in an idealized or overly formal sense unless explicitly defined herein.

[0048] Here, repetitive descriptions and detailed descriptions of well-known functions and configurations that may unnecessarily obscure the gist of the present invention are omitted to avoid obscuring the gist of the present invention. The embodiments of the present invention are provided to more fully explain the present invention to those of average skill in the art. Therefore, the shapes and sizes of elements in the drawings may be exaggerated for clarity.

[0049] First, the present invention introduces a new encryption concept that uses an array created by randomly extracting subsets of a duplicate set and counting the number of elements contained therein as a ciphertext. Then, the process of formulaically specifying the above concept using the satisfiability problem (SAT) is described. Methods 1), 2), and 3) are introduced as methods for encrypting and decrypting without dividing the public key into two groups using k-CNF as a public key, and Methods 4) and 5) are introduced as methods for encrypting and decrypting after dividing the public key into two groups. Afterwards, a method for extending the method to a public key-based algorithm with multiple private keys is described, and finally, a method for setting system variables according to an exemplary embodiment is described.

[0050] Hereinafter, in order to explain a method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with enhanced conditions for having a solution according to the present invention with reference to the attached drawings, the concept of a new public key-based algorithm proposed in the present invention will first be explained.

[0051] The number of input variables n, the multiplicity m of the multiset, the number of elements in the subset 2k, and the number of subsets to be randomly extracted e are set. In the conceptual explanation process, the number of elements in the subset is limited to even, but a method to extend it to allow odd numbers as well will be described later.

[0052] For example, the concept can be explained using balls containing gold and balls without gold as follows.

[0053] Prepare m white balls and m gray balls each with numbers from 1 to n written on them.

[0054] For each number, randomly select a white or gray color, add gold to the selected color, and then write down which color you added gold to on a notepad.

[0055] The balls containing gold and those without gold are divided into two groups. Then, balls are randomly selected from the two groups and grouped into 2k bundles satisfying the following two conditions.

[0056] First, group all bundles so that they contain only k gold.

[0057] Second, group the 2k balls so that they have different numbers.

[0058] Place the generated bundles in a basket. Randomly extract e bundles from the basket, then count the number of balls with the same number written on them, starting from a smaller number, and write them as (number of white balls, number of gray balls) to create the following array.

[0059] [(4,5),(5,3),…,(5,5)]

[0060] Also, randomly select a pair with different numbers of white and gray to create another array with the numbers of white and gray swapped, as shown below.

[0061] [(4,5),(3,5),…,(5,5)]

[0062] In this patent, an array with a changed number of elements is defined as a contaminated array.

[0063] Gold was added randomly in a color, and the number of white and gray balls is the same. Furthermore, the criterion for creating a group is not the color, but the number of gold balls. Therefore, the distribution of colors within the groups exhibits randomness. Furthermore, since the groups were randomly selected and then unpacked to count the number of balls with the same number, the randomness also propagates between the number of white and gray balls within each individual number. Therefore, distinguishing between a normal and a corrupted group requires analyzing all pairs of numbers within the group, making it difficult to distinguish between the two. However, since the number of gold and non-gold balls is the same in all groups, even if e groups are randomly selected, the number of gold and non-gold balls will be the same regardless of the value of e. Therefore, if you have a memo, you can refer to it, select the gold color (white or gray), and add them all up. The normal group will have half the total number of balls drawn, while the corrupted group will have a different value. The fact that only someone with the memo can distinguish between the normal and corrupted arrays means that both arrays can be used as ciphertexts. If the normal array is used as the ciphertext '1' and the corrupted array is used as the ciphertext '0', the basket of empty packets corresponds to the public key, and the memo corresponds to the private key. Figure 1) illustrates a conceptual diagram of the proposed encryption algorithm.

[0064] Below, the process of concretizing the concept using the satisfiability problem, which is one of the main technical elements for implementing the present invention, will be described.

[0065] If we replace balls containing gold with literals having a value of TRUE and balls without gold with literals having a value of FALSE, the group of balls is represented as a single clause. Since the group of balls is restricted to contain only k gold pieces, all groups inserted into the basket become k-TRUE-clauses, and the basket corresponds to an SAT instance with a strengthened condition for having a solution.

[0066] In the case of NAE (Not All Equal)-SAT instance, which has a more stringent condition for a solution than SAT, a clause is expressed as satisfied if all literals constituting the clause do not have the same value. In the present invention, k-CNF is used as a public key, and when k is 3, the condition for a solution is the same as NAE-SAT. However, when k is 4 or greater, the condition for a solution of k-SAT changes to a condition that if k is even, there must be only k / 2 literals with a TRUE value, and a condition that if k is odd, there must be only └k / 2┘ literals or └k / 2┘+1 literals, which is a condition that is much stronger than NAE-SAT. Therefore, in the embodiment, the case where k is 4 or greater is used.

[0067] To specify the act of counting the number of balls containing gold in a formula, the following terms are defined.

[0068] Solution, A is the variables, x k (1≤k≤n) contains n literals among 2n literals made by x. In this case, x k If A is included, x k Wow ￢x k Substitute 1 and 0 for each, and if not included, substitute 0 and 1 for x k Wow ￢x k The pairs represented as an array as shown below are defined as a solution vector.

[0069] [(x k ,￢x k )] n =[x1,￢x1,x2,￢x2,…,x n ,￢x n ], x k and ￢x k ∈ {0,1}

[0070] x in the superset of all literals that make up CNF k Count the number of (1≤k≤n) a k Set the value of x k Count the number of complements of b k By setting the value of a, it is expressed as follows: k Wow b k Creates an array of pairs.

[0071] [(a k ,b k )] n =[a1,b1,a2,b2,…,a n ,b n ]

[0072] The generated array is defined as a literal spectrum. The formula for calculating the inner product of the literal spectrum, L, with the solution vector, A, by considering it as a vector is as follows.

[0073] (Formula 1)

[0074]

[0075] The value of (Equation 1) represents the number of times the literal spectrum uses the literals included in solution A. The number of times the literals included in the solution are used also indicates the strength of the satisfiability of the CNF. Therefore, the above value is defined as the satisfiability measure. The array that records the number of extracted balls becomes the literal spectrum, and the act of counting the number of balls containing gold by looking at the memo is the act of calculating the satisfiability measure. Since all clauses contain only k literals with a TRUE value, when e clauses are extracted from 2k-CNF, the satisfiability measure value of the literal spectrum becomes ke. Therefore, if the satisfiability measure value is ke, it is restored to '1', and if not, it is restored to '0'. The above encryption and decryption process can be summarized as follows.

[0076] Method 1)

[0077] 1. The ciphertext writer randomly extracts e clauses from the 2k-CNF used as the public key to generate a literal spectrum.

[0078] 2. When encrypting plaintext '1', the literal spectrum array is transmitted as is, and when encrypting '0', a literal with different usage counts for the literal and its complement is randomly selected from the literal spectrum, and then the usage counts are changed and transmitted.

[0079] 3. When restoring, if the satisfiability measure value is ke, it is restored to '1', otherwise it is restored to '0'.

[0080] Figure 2) shows a block diagram of the proposed encryption algorithm.

[0081] The above method requires more computational effort to generate ciphertext from plaintext '0' than from plaintext '1'. To prevent this difference in computational effort from making the algorithm vulnerable to side-channel attacks, the algorithm is modified as follows.

[0082] Method 2)

[0083] 1. The ciphertext writer randomly extracts e clauses from the 2k-CNF used as the public key to generate a literal spectrum.

[0084] 2. When encrypting plaintext '1', randomly select a literal from the literal spectrum whose literal and its complement have the same number of uses, then change the number of uses and transmit it. When encrypting '0', randomly select a literal from the literal spectrum whose literal and its complement have different numbers of uses, then change the number of uses and transmit it.

[0085] 3. When restoring, if the satisfiability measure value is ke, it is restored to 1, otherwise it is restored to 0.

[0086] Figure 3) shows a block diagram of the proposed encryption algorithm.

[0087] The proposed method is very fast in encryption, as it only requires randomly extracting and counting the number of literals. However, it has the disadvantage of lengthening the ciphertext because the number of all extracted literals must be recorded in the ciphertext. To mitigate this drawback, encryption is performed in units of multiple bits rather than single bits, as shown below.

[0088] What happens if we try to restore with a random password? Substituting a random password into CNF generates clauses with a number of literals with a value of TRUE other than k. In this patent, we refer to these clauses as "tainted clauses." Because of the sporadic presence of tainted clauses, there's no guarantee that randomly extracting clauses will always yield the same number of literals with a value of TRUE and literals with a value of FALSE. Consequently, the value of ke cannot be used to distinguish between "1" and "0."

[0089] Method 3)

[0090] 1. Set the value of b to generate ciphertext from plaintext of b bits instead of 1 bit. In this case, 2 b The value must be less than or equal to the multiplicity of the multiset, which is the maximum number of times a literal is included in the CNF.

[0091] 2. Randomly 2 b variable, y i (0≤i<2 b ) is selected.

[0092] 3. Variables selected in step 2, y i (0≤i<2 b ) about y i Wow ￢y i Randomly extract clauses so that the difference in the number of y is i. At this time, y i Wow ￢y i The literal that is extracted more frequently among them is randomly selected.

[0093] 4. After randomly extracting the remaining clauses so that the number of extracted clauses including the clauses extracted in step 3 becomes e among the clauses that do not contain the variables selected in step 2 above, a literal spectrum is generated using all extracted clauses.

[0094] 5. The ciphertext writer divides the plaintext into b bits and the value of b bits is p (0≤p<2 b ) is a variable y whose count value differs by p. p After swapping the count values ​​of the two literals created by , it is transmitted.

[0095] 6. The ciphertext writer cannot determine whether the satisfiability measure value increases or decreases by changing the count value. Therefore, the satisfiability measure value becomes ke+p or ke-p. After calculating the satisfiability measure value, t, the b-bit value p is restored from the formula t=ke±p.

[0096] Figure 4) shows a block diagram of the proposed encryption algorithm.

[0097] The above method slows down the encryption speed, but reduces the length of the ciphertext by 1 / b, as the ciphertext written in 1-bit units is converted to b-bit units. Therefore, it is used when a short ciphertext length is important, and the method described above is used when fast encryption speed is important.

[0098] Hereinafter, a method for extending the concept so that clauses composed of an odd number of literals, which is one of the main technical elements for implementing the present invention, can be used as a public key will be described.

[0099] The algorithms proposed above require an even number of literals in a clause. Using (2k+1)-CNF, all clauses can be configured to be k-TRUE-clauses or (k+1)-TRUE-clauses, and then encryption and decryption can be performed in the same way as for the even-numbered clauses. However, this configuration requires a different number of literals with TRUE values ​​and FALSE values, resulting in a morphological asymmetry in the literals that compose the public key. This morphological asymmetry not only exposes some information about the private key, but also complicates the encryption process by requiring clause extraction while avoiding cases where the normal literal spectrum and the permuted literal spectrum can be morphologically distinguished.

[0100] Here, let's consider the case where the public key is divided into two groups. If the k-TRUE-clauses and (k+1)-TRUE-clauses are separately disclosed, the literals in the (k+1)-TRUE-clause set have a 1 / 2k higher probability of being TRUE than the literals in the k-TRUE-clause set. Therefore, by checking which literal and its complement are more frequently included, we can determine which of the two has a higher probability of being TRUE. However, if a 256-bit secret key is reconstructed based on probability without knowing the private key, and all bits are incorrect, there is no way to verify that even the correctly restored bits are correct. Therefore, a high probability is not very helpful in block-level restoration. In other words, the All-or-Nothing rule applies. When dividing the public key into two groups, even if (2k+1)-CNF is used, if half of the total clauses are made into k-TRUE-clauses and the remaining half are made into (k+1)-TRUE-clauses, the formal symmetry is maintained because a literal and its complement have the same number of occurrences in the entire CNF. The proposed cryptographic algorithm for distributing the public key by dividing it into k-TRUE-clause groups and (k+1)-TRUE-clause groups is summarized as follows.

[0101] Method 4)

[0102] 1. Divide the public key composed of (2k+1)-CNF into a k-TRUE-clause group and a (k+1)-TRUE-clause group.

[0103] 2. The number of bits of the plaintext to be encrypted, b, and the number of clauses to be extracted, e, are 2. b Set to satisfy =e.

[0104] 3. p(0≤p <e) 값을 암호화하기 위해서 p 개를 k-TRUE-clause 그룹에서 추출하고 e-p 개를 (k+1)-TRUE-clause 그룹에서 추출한 후에 literal spectrum을 생성한다.

[0105] 4. The satisfiability measure value t becomes kp + (k+1)(ep). Since we know the values ​​of k and e, we restore the p value from the relationship p=(k+1)et.

[0106] Figure 5) shows a block diagram of the proposed encryption algorithm.

[0107] The proposed algorithm splits the public key into two groups, which probabilistically exposes some information about the private key. However, considering the number of input variables and the multiplicity value, the value of e is 2. 10 ~2 12 If allocated as , 10-bit to 12-bit plaintext can be encrypted at once, so the length of the ciphertext is reduced by 2.5 to 3 times. The previously described (Method 4) used (2k+1)-CNF as an example when it is used as a public key, but it can also be applied to 2k-CNF and has the advantage of significantly shortening the ciphertext generation time compared to Method 3). When using 2k-CNF, (Method 4) is modified as follows.

[0108] Method 5)

[0109] 1. Generate a public key by dividing the clauses included in 2k-CNF, which consists of (k-1)-TRUE-clauses and (k+1)-TRUE-clauses, into (k-1)-TRUE-clause groups and (k+1)-TRUE-clause groups.

[0110] 2. The number of bits of the plaintext to be encrypted, b, and the number of clauses to be extracted, e, are 2. b Set to satisfy =e.

[0111] 3. p(0≤p <e) 값을 암호화하기 위해서 p개를 (k-1)-TRUE-clause그룹에서 추출하고 e-p개를 (k+1)-TRUE-clause그룹에서 추출한 후에 literal spectrum을 생성한다.

[0112] 4. The satisfiability measure value t becomes (k-1)p+(k+1)(ep). Since we know the values ​​of k and e, we restore the p value from the relationship p=((k+1)et) / 2.

[0113] Figure 6) shows a block diagram of the proposed encryption algorithm.

[0114] Below, we will explain the extension to a public key-based algorithm with multiple private keys, which is one of the key technical elements for implementing the present invention.

[0115] If a practitioner encrypts the original data and requests approval from the person in charge when restoration is required, the person in charge's signature alone cannot prevent misconduct by the practitioner holding the encryption key. Therefore, separating data management and restoration authority is difficult. One solution to the above problem is to split the n-bit private key into two keys, each containing u bits and v bits. Equation 1) is transformed as follows.

[0116] (Formula 2)

[0117]

[0118] (Equation 2) indicates that the original can be restored by dividing the private key into two halves, performing calculations with each private key, and then combining the two calculation results. The person in charge with a u-bit private key reads the ciphertext, calculates the U value in (Equation 2) with his or her private key, and then sends the above data array to the practitioner as a restoration authorization. The practitioner then calculates the V values ​​in (Equation 2) with his or her private key and adds them to the restoration authorization to restore the data. The above concept also applies when dividing a single private key into three or more pieces. In the case of lattice-based algorithms that do not use big numbers, dividing a single private key into two halves creates a problem: the counterparty's key can be easily identified from the calculation results received from the counterparty for restoration. Therefore, implementing a public key-based algorithm with multiple private keys is difficult. Furthermore, finding a way to divide a single private key into two or more pieces is not easy for code-based algorithms.

[0119] Public-key cryptographic algorithms, beginning with Diffie and Hellman's announcements, have evolved toward increasing computational complexity to better hide messages. Current public-key algorithms perform algebraic operations, modulus operations, and matrix operations consisting of hundreds of rows and columns to hide messages. However, the proposed algorithm simply performs a simple permutation to hide the message.

[0120] The system variables of the proposed cryptosystem are (k, b, m, n, e, q), and each has the following meaning. k: the number of literals included in clauses, b: the number of bits of plaintext used when generating ciphertext, m: the number of times a literal is used in a public key, which is the multiplicity value of the duplicate set, n: the number of input variables, e: the number of clauses to be randomly extracted, q: the number of bits recording the number of extracted literals.

[0121] If the count value of literals is expressed in nibbles instead of bytes to reduce the length of the ciphertext, q becomes 4 and it should be adjusted so that one literal is extracted less than 15 times. The number of clauses c becomes 2mn / k. In the experiment for verifying the algorithm proposed in this patent, when Method 1) and Method 2) are used, the value of e is selected as 0.3 to 0.5 of the number of clauses. When Method 3), Method 4) and Method 5) are used, the value of e is 2 b is set to be. If you write the ciphertext in nibble units, choose a multiplicity value greater than 15. However, if you choose a value that is too large, the process of adjusting the number of literals to be extracted to less than 15 requires more computational power, which increases the ciphertext generation time. The table below shows an example of system parameter settings for comparison with CRISTALS-KABER, which was first standardized by the PKE branch of the quantum-resistant cryptography algorithm at NIST.

[0122] cct(b bits)skpkct (256 bits)(k,b,m,n,e,q)2mn / k2qnn2mn(log2n+1)ct*32(byte) / b(4,4,20,512,0.3*c,4)5K4K64 (byte)25K (byte)32K (byte)(4,4,20,1024,0.3*c,4)10K8K128 (byte)55K (byte)64K (byte)(5,10,20,512,2 b ,4)4K4K64 (byte)25K (byte)12.8K (byte)(5,10,20,1024,2 b ,4)8K8K128 (byte)55K (byte)25.6K (byte)CRISTALS-KABER10243168 (byte)1568 (byte)1568 (byte)

[0123] * c: number of clauses in public key, ct: cipher text size, sk: secret key (private key) size, pk: public key size

[0124] Compared to CRISTALS-KABER1024, the public key and ciphertext lengths are approximately 10 to 40 times longer, but the private key length is approximately 25 to 50 times shorter. Furthermore, while CRISTALS-KABER has a non-zero decryption failure probability, albeit a very small one, the proposed algorithm reduces the decryption failure probability to zero by not using random values.

[0125] Meanwhile, the present invention is not limited to the described embodiments. It is possible to use the present invention by changing the application area, and various modifications and variations can be made without departing from the spirit and scope of the present invention, as will be apparent to those skilled in the art. Accordingly, such modifications or variations should fall within the scope of the claims of the present invention.

Claims

1. A step in which a ciphertext writer selects a 2k-CNF consisting of k-TRUE-clauses and used as a public key, with the number of input variables n, the number of clauses to be randomly extracted e, and then randomly extracts e clauses from among the clauses included in the 2k-CNF to generate a literal spectrum; Following the above steps, when encrypting the plaintext '1', the number of literals that make up the literal spectrum array is a i Wow b i Create a ciphertext by recording them in order, and when encrypting '0', a i ≠b i After randomly selecting i where (1≤i≤n), a i Wow b i A step of generating a ciphertext by changing and recording the first and the rest in order; A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with a strengthened condition for having a solution, characterized in that when restoring the above ciphertext, a person who has an array made of a private key that is a solution of 2k-CNF with a strengthened condition for having a solution restores the satisfiability measure value calculated by (Formula 1) below to 1 if ke, and to 0 otherwise. (Formula 1) L·A: The inner product value between the literal spectrum and the solution vector created with the private key. L: literal spectrum - x in the overlapping set of all literals that make up CNF k Count the number of (1≤k≤n) a k Set the value of ￢x k Count the number of b k a created by setting the value of k Wow b k [(a as an array listing pairs k ,b k )] n or [a1,b1,a2,b2,…,a n ,b n ] is indicated, A: solution vector, an array made of private keys that are solutions to CNF - n input variables x k Among the 2n literals made by (1≤k≤n), x k If x is included in the solution k Wow ￢x k x is created by assigning 1 and 0 to each and assigning 0 and 1 if not included. k Wow ￢x k An array listing pairs [(x k ,￢x k )] n or [x1,￢x k ,x2,￢x2,… ,x n ,￢x n ] is indicated.

2. A step of generating a literal spectrum by randomly extracting e clauses from among clauses included in the 2k-CNF after the ciphertext writer selects the number of input variables n, the number of clauses to be randomly extracted e, and a 2k-CNF used as a public key and composed of k-TRUE-clauses; When encrypting the plaintext '1' following the above steps, a i = b i After randomly selecting i where (1≤i≤n), a i Wow b i Change and record the remaining numbers in order to create a ciphertext, and when encrypting '0', a i ≠b i After randomly selecting i where (1≤i≤n), a i Wow b i A step of generating a ciphertext by changing and recording the first and the rest in order; A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with a strengthened condition for having a solution, characterized in that when restoring the above ciphertext, a person who has an array made of a private key that is a solution of 2k-CNF with a strengthened condition for having a solution restores the satisfiability measure value calculated by (Formula 1) below to 1 if ke, and to 0 otherwise. (Formula 1) L·A: The inner product value between the literal spectrum and the solution vector created with the private key. L: literal spectrum - x in the overlapping set of all literals that make up CNF k Count the number of (1≤k≤n) a k Set the value of ￢x k Count the number of b k a created by setting the value of k Wow b k An array listing pairs [(a k ,b k )] n or [a1,b1,a2,b2,…,a n ,b n ] is indicated, A: solution vector, an array made of private keys that are solutions to CNF - n input variables x k Among the 2n literals made by (1≤k≤n), x k If x is included in the solution k Wow ￢x k x is created by assigning 1 and 0 to each and assigning 0 and 1 if not included. k Wow ￢x k An array listing pairs [(x k ,￢x k )] n or [x1,￢x k ,x2,￢x2,… ,x n ,￢x n ] is indicated.

3. After the ciphertext writer selects the number of input variables n, the number of clauses to be randomly extracted e, the 2k-CNF consisting of k-TRUE-clauses used as the public key, and the number of bits b of the plaintext to generate the ciphertext, 2 is randomly selected from among the n variables. b Select the dog, then select 2 b The number of extracted two literals created by each variable is from 0 to 2. b A step of randomly extracting clauses from k-CNF so that the difference is up to -1; A step of generating a literal spectrum of CNF consisting of randomly e clauses including the clauses extracted in the previous step; Following the above step, the value of the plaintext with b bits is p(0≤p<2 b ) in the step of generating the literal spectrum, 2 is selected. b A step of generating a ciphertext by exchanging the numbers of extracted literals created by the variables among the variables that have a difference of p; A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with a strengthened condition for having a solution, characterized in that when restoring the above ciphertext, a person who has an array made of a private key that is a solution of 2k-CNF with a strengthened condition for having a solution obtains t=ke+p or t=ke-p, which is a satisfiability measure value calculated by (Formula 1) below, and then restores p=t-ke or p by changing the p value to b bits from the relation of ke-t; (Formula 1) L·A: The inner product value between the literal spectrum and the solution vector created with the private key. L: literal spectrum - x in the overlapping set of all literals that make up CNF k Count the number of (1≤k≤n) a k Set the value of ￢x k Count the number of b k a created by setting the value of k Wow b k [(a as an array listing pairs k ,b k )] n or [a1,b1,a2,b2,…,a n ,b n ] is indicated, A: solution vector, an array made of private keys that are solutions to CNF - n input variables x k Among the 2n literals made by (1≤k≤n), x k If x is included in the solution of CNF, which is a private key, k Wow ￢x k x is created by assigning 1 and 0 to each and assigning 0 and 1 if not included. k Wow ￢x k An array listing pairs [(x k ,￢x k )] n or [x1,￢x k ,x2,￢x2,… ,x n ,￢x n ] is indicated.

4. A step in which the ciphertext writer divides clauses included in (2k+1)-CNF, which are composed of k-TRUE-clauses and (k+1)-TRUE-clauses, into k-TRUE-clause groups and (k+1)-TRUE-clause groups to generate a public key; Following the above steps, the number of input variables n, the number of randomly extracted clauses e are selected, and the number of bits b of the plaintext from which the ciphertext is to be generated is 2. b After setting =e to satisfy, the value of the plaintext with b bits is p(0≤p<2 b ) a step of extracting p from the k-TRUE-clause group and extracting ep from the (k+1)-TRUE-clause group; A step of generating a literal spectrum of CNF composed of e clauses extracted in the above step and generating a ciphertext by recording the numbers constituting the literal spectrum array; A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with a strengthened condition for having a solution, characterized in that when restoring the above ciphertext, a person who has an array made of a private key that is a solution of (2k+1)-CNF with a strengthened condition for having a solution obtains a satisfiability measure value t=kp+(k+1)(ep) calculated by (Formula 1) below, and then restores the p value from the relation p=(k+1)et. (Formula 1) L·A: The inner product value between the literal spectrum and the solution vector created with the private key. L: literal spectrum - x in the overlapping set of all literals that make up CNF k Count the number of (1≤k≤n) a k Set the value of ￢x k Count the number of b k a created by setting the value of k Wow b k [(a as an array listing pairs k ,b k )] n or [a1,b1,a2,b2,…,a n ,b n ] is indicated, A: solution vector, an array made of private keys that are solutions to CNF - n input variables x k Among the 2n literals made by (1≤k≤n), x k If x is included in the solution of CNF, which is a private key, k Wow ￢x k x is created by assigning 1 and 0 to each and assigning 0 and 1 if not included. k Wow ￢x k An array listing pairs [(x k ,￢x k )] n or [x1,￢x k ,x2,￢x2,… ,x n ,￢x n ] is indicated.

5. A step in which the ciphertext writer divides the clauses included in 2k-CNF, which are composed of (k-1)-TRUE-clauses and (k+1)-TRUE-clauses, into a (k-1)-TRUE-clause group and a (k+1)-TRUE-clause group to generate a public key; Following the above steps, the number of input variables n, the number of randomly extracted clauses e are selected, and the number of bits b of the plaintext from which the ciphertext is to be generated is 2. b After setting =e to satisfy, the value of the plaintext with b bits is p(0≤p<2 b ) a step of extracting p from the (k-1)-TRUE-clause group and extracting ep from the (k+1)-TRUE-clause group; A step of generating a literal spectrum of CNF composed of e clauses extracted in the above step and generating a ciphertext by recording the numbers constituting the literal spectrum array; A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with a strengthened condition for having a solution, characterized in that when restoring the above ciphertext, a person who has an array made of a private key, which is a solution of 2k-CNF with a strengthened condition for having a solution, obtains the satisfiability measure value t=(k-1)p+(k+1)(ep) calculated by (Formula 1) below, and then restores the p value from the relation p=((k+1)et) / 2. (Formula 1) L·A: The inner product value between the literal spectrum and the solution vector created with the private key. L: literal spectrum - x in the overlapping set of all literals that make up CNF k Count the number of (1≤k≤n) a k Set the value of ￢x k Count the number of b k a created by setting the value of k Wow b k [(a as an array listing pairs k ,b k )] n or [a1,b1,a2,b2,…,a n ,b n ] is indicated, A: solution vector, an array made of private keys that are solutions to CNF - n input variables x k Among the 2n literals made by (1≤k≤n), x k If x is included in the solution of CNF, which is a private key, k Wow ￢x k x is created by assigning 1 and 0 to each and assigning 0 and 1 if not included. k Wow ￢x k An array listing pairs [(x k ,￢x k )] n or [x1,￢x k ,x2,￢x2,… ,x n ,￢x n ] is indicated.

6. In any one of paragraphs 1 to 5, A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with enhanced conditions for having a solution, characterized by further including the step of dividing an n-bit private key into two keys of u bits and v bits, performing an operation using the following (Formula 2) with each private key, and then restoring the operation values ​​by combining them. (Formula 2) 7. A method for implementing a quantum-resistant cryptographic algorithm based on a satisfiability problem with enhanced conditions for having a solution, characterized in that, in any one of paragraphs 1 to 5, when the length of the private key is n bits, the n bits are divided into a plurality of keys or more, and after performing an operation with each private key, the operation values ​​are combined and restored.

Images