Method and system for constructing AKE protocol from PKE algorithm having errors

Abstract

Disclosed in the present invention are a method and a system for constructing an AKE protocol from a PKE algorithm having errors. The method comprises: 1) converting a one-way under chosen-plaintext attack (OW-CPA) PKE having a decryption error into an indistinguishability under chosen plaintext attack KEM that can leak an error, and recording same as an IND-CPAwF KEM, which comprises a key generation algorithm of the KEM, an encapsulation algorithm of the KEM, and a de-encapsulation algorithm of the KEM; in the encapsulation algorithm of the KEM, an encapsulation message m is inputted into a hash function H(.), so as to export an encapsulation key K=H(m); in the de-encapsulation algorithm of the KEM, an encapsulation message m' obtained by decryption is inputted into a hash function H(.), so as to export an encapsulation key K'=H(m'); 2) converting an AKE protocol which cannot use a KEM having errors into an AKE protocol which can use a KEM having errors. The present invention provides greater parameter selection flexibility for a PKE algorithm designer.

Description

Method and system for constructing AKE protocol from error-prone PKE algorithm TECHNICAL FIELD

[0001] The present invention belongs to the field of cryptography, and relates to quantum-resistant migration, in particular to a method and system for constructing an authenticated key exchange (AKE) protocol from an error-prone public key encryption (PKE) algorithm. BACKGROUND

[0002] An authenticated key exchange (AKE) protocol is an important and widely used cryptographic protocol in reality, such as the handshake phase of the TLS protocol, which is essentially an AKE protocol that satisfies forward security. The basic functional requirements of an AKE protocol can be briefly divided into two parts: first, both parties need to confirm whether the identity of the interaction object is consistent with their own cognition (referred to as "authentication"); second, the parties who have confirmed the identity of each other can "safely" share a secret value (referred to as "confidentiality"). In addition, in order to be applied in reality, "forward security" is also a security goal that must be considered in the design of an AKE protocol. Forward security means that even if a malicious adversary obtains the long-term private key of one party (used to provide identity proof) during the execution of a protocol, it still cannot learn the shared secret generated by the protocol process that has been completed before that communication.

[0003] In order to provide the two basic functional requirements and an additional security requirement, an AKE protocol often uses two cryptographic primitives as components, as shown in FIG. 1. One primitive is used to bind the long-term secret and the identity of the participant to provide authentication; the other primitive generates a temporary secret and implements the secure sharing of the secret key derivation while ensuring forward security. The former can be implemented in a symmetric cryptographic manner, such as a pre-shared symmetric key combined with a message authentication code, or in a public key cryptographic manner, such as a PKI plus digital signature algorithm. However, it should be noted that the present invention mainly relates to the second part of the primitive, which can be implemented using a key encapsulation (KEM) primitive (in the classic sense, it is called a key exchange KEX, which has a slight difference, and specifically, KEX is a smaller concept than KEM, that is, KEX can also be referred to as a KEM; since KEM and KEX can achieve the same function in most application scenarios, the following will not be distinguished for the purpose of this statement).

[0004] The research background of the present application is the research against quantum cryptography migration. The research of cryptography, including the security analysis of various algorithms, is based on a series of assumptions on computing power. For example, the assumption on the enemy power in the research of classical cryptography is based on the classical computer model, that is, the enemy with powerful classical computer power cannot break the corresponding security target of the cryptographic scheme in a long enough time, and the cryptographic scheme is called secure in the classical sense. However, with the in-depth research of physicists on quantum mechanics since the concept of quantum computing was proposed in the 1980s, it seems that it is no longer a distant reality to design and build a quantum computer with stronger computing power than a classical computer by using quantum effects. The data storage and operation mode of a quantum computer is very different from that of a classical computer, so the classical computing model can no longer cover the description of the computing power of a quantum computer. This also means that once a quantum computer is successfully manufactured, and some "quantum algorithms" that cleverly use the special storage and operation characteristics of quantum computing can solve some "mathematical difficult problems" more efficiently than classical algorithms, the problems that were considered "difficult" in the classical setting will no longer be difficult, and the cryptographic algorithms designed based on such problems will also not be secure in the quantum setting.

[0005] Specifically, for example, various key exchange algorithms used in classical AKE protocols are based on the difficulty of discrete logarithm problems (in different forms), such as Diffie-Hellman or ECDH. The proposal of the quantum algorithm "Shor algorithm" announced that the discrete logarithm problem will no longer be difficult for a quantum computer (of sufficient size), that is, a quantum computer can break the key exchange in all classical AKE protocols. This means that the enemy can now start listening to and storing the protocol execution and communication data between the attack objects, although it is difficult for the current classical computer to obtain any useful information from it, but once the quantum computer is put into practical use, the enemy can use the quantum computer to crack the shared secret from the ciphertext in the key exchange phase, and further decrypt the ciphertext data at that time into plaintext, that is, "Harvest Now, Decrypt Later" attack.

[0006] To resist such attacks, replacing the key exchange algorithm in AKE protocol with a quantum-resistant key encapsulation algorithm designed based on mathematical problems that quantum algorithms cannot solve efficiently, i.e., "quantum-resistant" key encapsulation algorithm, becomes an imminent security upgrade measure. In the route of designing cryptographic schemes based on mathematical problems that are currently considered to be quantum-resistant, lattice-based cryptography is currently one of the most promising candidates. However, including the "lattice-based" technical route, the quantum-resistant algorithms of several new technical routes have a problem that has never appeared in classical algorithms, i.e., "decryption error", due to the form of the mathematical problems they are based on. Such algorithms naturally have decryption errors, so if the design of the classical protocol is not modified (i.e., no error tolerance), the only way to ensure that the probability of such errors occurring is extremely small is to impose additional restrictions on parameter selection, and previous work has done so as shown in FIG. 2. The disadvantage is that it makes parameter selection only available to larger and poorly performing parameters, i.e., lower algorithm performance, and when used to construct AKE protocols, it will also lower the performance size of AKE, i.e., the way shown in FIG. 2 will result in poor performance size of public key encryption (PKE) in the middle box, thereby resulting in poor performance size of AKE in the right box.

[0007] It should be noted that the AKE composition structure shown in FIG. 1 does not contain PKE, but contains KEM. Those skilled in the art can understand the direct conversion relationship between PKE and KEM as shown in FIG. 3.

[0008] SUMMARY

[0009] The purpose of the present application is to provide a method for constructing a secure AKE protocol using a passive secure but decryption error PKE algorithm. The method is a general method, characterized by containing two parts of transformation: the first part of transformation acts on the PKE algorithm, converting the PKE algorithm that is selectively plaintext secure (OW-CPA) but has decryption errors into a KEM algorithm that is selectively plaintext indistinguishable secure (IND-CPAwF) and can leak errors, still has decryption errors, but the decryption errors do not leak sensitive information; the second part of transformation acts on the AKE protocol, additional steps of key consistency confirmation are introduced in the steps of the conventional AKE protocol, and only when it is confirmed that no decryption error occurs, the derived key is accepted, otherwise the protocol is aborted or waits for re-execution, as shown in FIG. 4.

[0010] The present application provides a method for constructing a secure AKE protocol in a manner of tolerating errors, thereby providing greater flexibility for parameter selection for algorithm designers of PKE. Meanwhile, the greater range of parameter selection means that the algorithm itself can use preferred parameters (which would have been discarded due to the constraint of "requiring a very small decryption error"), so that the algorithm designers can implement an algorithm with better performance and size. In addition, the transformation performed on the PKE algorithm to remove the decryption error constraint, and the additional steps introduced in the AKE protocol design, are often less costly than the constraints on the performance and size of the algorithm due to the decryption error constraint, that is to say: the performance and size improvement brought by relaxing and preferring parameters in the PKE algorithm design by allowing greater decryption errors can still be reflected in the performance and size improvement of the final AKE protocol after following the method and introducing a small amount of overhead.

[0011] Symbol definition. In the following, H(·) represents a hash function satisfying the security strength, and PRF(·, ·) represents a pseudo-random function satisfying the security strength and being injective.

[0012] The technical solutions adopted by the present application are as follows:

[0013] A method for constructing an AKE protocol from a PKE algorithm with errors, comprising the following steps:

[0014] 1) converting a PKE selected plaintext one-way secure (OW-CPA) but with decryption errors into a KEM that is selectively plaintext indistinguishable secure (IND-CPAwF) and can leak errors, denoted as an IND-CPAwF KEM;

[0015] 2) converting an AKE that cannot use the KEM with errors into an AKE protocol that can use the KEM with errors.

[0016] Further, the IND-CPAwF KEM includes a key generation algorithm of the KEM, an encapsulation algorithm of the KEM, and a decapsulation algorithm of the KEM; wherein,

[0017] The key generation algorithm of the KEM is: input is empty, and output is a public key and a private key. The key generation algorithm of the KEM is generated by using the key generation algorithm of the PKE to generate the public key and the private key of the key encapsulation KEM;

[0018] The encapsulation algorithm of the KEM is: the input is a public key, and the output is two values c and K. An encapsulation message m is randomly generated in the plaintext space of the PKE; the encapsulation message m is encrypted using the encryption algorithm of the PKE with the public key of the key encapsulation KEM to obtain a ciphertext, denoted as a ciphertext value c; the encapsulation message m is input into a hash function H(·) to derive an encapsulation key K = H(m);

[0019] The unsealing algorithm of the KEM is: the input is a private key and c, and the output is K'(K'=K in the correct case). The ciphertext value c is decrypted using the decryption algorithm of the PKE to obtain the encapsulated message m'; the obtained encapsulated message m' is input into the hash function H(·) to derive the encapsulation key K'=H(m').

[0020] Further, the AKE protocol capable of using the faulty KEM is a pre-shared symmetric key-based AKE; wherein the party performing the encapsulation algorithm of the KEM uses the pseudo-random function PRF(·,·) to derive a piece of key confirmation data chk=PRF(K, tag1) according to the encapsulation key K and tag1, and includes it in the input data for calculating the message authentication code MAC, and uses the pseudo-random function PRF(·,·) to derive a session key ssk=PRF(K, tag2) according to the encapsulation key K and tag2; the party performing the unsealing algorithm of the KEM uses the pseudo-random function PRF(·,·) to re-calculate the key confirmation data chk'=PRF(K', tag1) according to the encapsulation key K' and tag1, and compares it with the received key confirmation data chk'=?chk, and derives the session key ssk'=PRF(K', tag2) only when the comparison is consistent, otherwise the execution of the protocol is aborted; wherein tag1 and tag2 are any unequal strings agreed upon.

[0021] Further, the AKE protocol capable of using the faulty KEM is a digital signature-based AKE; wherein the party performing the encapsulation algorithm of the KEM uses the pseudo-random function PRF(·,·) to derive a piece of key confirmation data chk=PRF(K', tag1) according to the encapsulation key K and tag1, and includes it in the input data for calculating the digital signature, and uses the pseudo-random function PRF(·,·) to derive a session key ssk=PRF(K, tag2) according to the encapsulation key K and tag2; the party performing the unsealing algorithm of the KEM uses the pseudo-random function PRF(·,·) to re-calculate the key confirmation data chk'=PRF(K', tag1) according to the encapsulation key K' and tag1, and compares it with the received key confirmation data chk'=?chk, and derives the session key ssk'=PRF(K', tag2) only when the comparison is consistent, otherwise the execution of the protocol is aborted; wherein tag1 and tag2 are any unequal strings agreed upon.

[0022] A security channel establishment method of a pre-shared key-based AKE protocol, the steps of which include:

[0023] 1) The participating parties A and B participating in the communication determine a pre-shared key psk;

[0024] 2) Party A calls the key generation algorithm KGen of KEM to generate a one-time public and private key pair (epk,esk) <- KGen for party A, and let the sending data x = epk; wherein epk is the KEM public key of party A, and esk is the KEM private key of party A;

[0025] 3) Party A calculates the MAC value [x] of data x using the pre-shared key psk; and sends (x, [x]) to party B;

[0026] 4) Party B calculates the MAC value of the received data x using the pre-shared key psk, and verifies whether the MAC value MAC(psk, x) calculated by itself is consistent with the received [x]; if the verification is passed, the ciphertext c and the encapsulation key K are generated according to the received data x = epk by calling the key encapsulation algorithm Encap of KEM; then a key confirmation data chk = PRF(K, tag1) is derived from the encapsulation key K and tag1 by using the pseudo-random function PRF(·, ·), the ciphertext c and chk are spliced to obtain y = (c, chk), and the MAC value [x, [x], y] of (x, [x], y) is calculated using the pre-shared key psk; and the session key ssk = PRF(K, tag2) is derived from the encapsulation key K and tag2 by using the pseudo-random function PRF(·, ·); then (y, [x, [x], y]) is given to party A;

[0027] 5) Party A calculates the MAC value of (y, [x, [x], y]) using the pre-shared key psk, and verifies whether the MAC value MAC(psk, (x, [x], y)) calculated by itself is consistent with [x, [x], y]; if the verification is passed, the encapsulation key K' is decapsulated by calling the decapsulation algorithm Decap of KEM with the ciphertext c and esk as inputs; then the key confirmation data chk' = PRF(K', tag1) is recalculated from the encapsulation key K' and tag1 by using the pseudo-random function PRF(·, ·), and is compared with the received key confirmation data chk, and the session key ssk = PRF(K', tag2) is derived only when the comparison is consistent, otherwise the execution of the protocol is aborted; wherein tag1 and tag2 are arbitrary unequal strings agreed upon.

[0028] A security channel establishment method based on a digital signature AKE protocol, the steps of which comprise:

[0029] 1) Party A calls the key generation algorithm KGen of KEM to generate a one-time public and private key pair (epk,esk) <- KGen for party A, and let the sending data x = epk; wherein epk is the KEM public key of party A, and esk is the KEM private key of party A;

[0030] 2) Party A uses its own signing private key SK A Compute the signature value {x} of the sending data x, and then send (x, {x}) to Party B;

[0031] 3) Party B uses the verifying public key VK of Party A A Verify the signature value {x}, if the verification is passed, call the key encapsulation algorithm Encap of KEM with the receiving data x = epk as input to generate the ciphertext c and the encapsulation key K, and then use the signing private key SK of Party B to sign (x, {x}, y), and get the signature value {x, {x}, y}, and use the pseudo-random function PRF(·, ·) to derive the session key ssk = PRF(K, tag2) according to the encapsulation key K and tag2, and then send (y, {x, {x}, y}) to Party A; B Verify the signature value {x, {x}, y}, if the verification is passed, call the decapsulation algorithm Decap of KEM with the ciphertext c and esk as input to decapsulate the encapsulation key K', and then use the pseudo-random function PRF(·, ·) to recompute the key confirmation data chk' = PRF(K', tag1) according to the encapsulation key K' and tag1, and compare it with the received key confirmation data chk' =? chk, and only when the comparison is consistent, the session key ssk = PRF(K', tag2) is derived, otherwise the execution of the protocol is aborted; wherein, tag1 and tag2 are arbitrary unequal strings agreed upon.

[0032] 4) Party A uses the verifying public key VK of Party B B Verify the signature value {x, {x}, y}, if the verification is passed, call the decapsulation algorithm Decap of KEM with the ciphertext c and esk as input to decapsulate the encapsulation key K', and then use the pseudo-random function PRF(·, ·) to recompute the key confirmation data chk' = PRF(K', tag1) according to the encapsulation key K' and tag1, and compare it with the received key confirmation data chk' =? chk, and only when the comparison is consistent, the session key ssk = PRF(K', tag2) is derived, otherwise the execution of the protocol is aborted; wherein, tag1 and tag2 are arbitrary unequal strings agreed upon.

[0033] A system for constructing an AKE protocol from a PKE algorithm with errors, characterized in that it comprises a PKE transformation module and an AKE transformation module; wherein,

[0034] The PKE transformation module is configured to convert a PKE that is selectively plaintext secure OW-CPA but has decryption errors into a KEM that is selectively plaintext indistinguishable secure with error leakage, denoted as IND-CPAwF KEM.

[0035] The AKE transformation module is configured to convert an AKE that cannot use the KEM with errors into an AKE protocol that can use the KEM with errors.

[0036] To be able to use the framework shown in Fig. 4, by allowing the actual occurrence of decryption errors in a secure way to construct more efficient AKE protocols, there are two aspects required: first, the requirement that AKE never handles decryption errors, to become able to handle decryption errors; second, to make the error-affected PKE by satisfying the OW-CPA security to the KEM satisfying the IND-CPAwF security (but still with errors). By the combination of the two steps, the KEM with errors and satisfying the IND-CPAwF security can be used in the AKE protocol capable of handling decryption errors, to get a secure and more efficient AKE protocol.

[0037] Therefore, a method for constructing an AKE protocol from an error-affected PKE algorithm, the components include:

[0038] 1. PKE transformation. Convert the PKE with decryption errors satisfying the OW-CPA security to the KEM satisfying the IND-CPAwF security.

[0039] 2. AKE transformation. Convert the AKE that cannot use the error-affected KEM to the AKE that can use the error-affected KEM.

[0040] Among them, the second part of the AKE transformation is divided into two types:

[0041] 2.1 AKE based on pre-shared symmetric key.

[0042] 2.2 AKE based on digital signature.

[0043] Specifically, the above PKE transformation is as follows:

[0044] Key generation algorithm of KEM: the same as the key generation algorithm of PKE, that is, the key generation algorithm of PKE is used to generate the public key and private key of the key encapsulation KEM.

[0045] Encapsulation algorithm of KEM:

[0046] (1) Randomly generate an encapsulated message m in the plaintext space of PKE;

[0047] (2) Use the encryption algorithm of PKE to encrypt the encapsulated message m with the public key, and the obtained ciphertext is denoted as ciphertext value c;

[0048] (3) Input the encapsulated message m into the hash function H(·) to derive the encapsulation key K = H(m).

[0049] Decapsulation algorithm of KEM:

[0050] (1) Use the decryption algorithm of PKE to decrypt the ciphertext value c with the private key to obtain the encapsulated message m' (decryption errors may occur to cause m' ≠ m);

[0051] (2) The encapsulated message m' is input into the hash function H(·) to derive the encapsulation key K' = H(m').

[0052] The innovation of the present application lies in the use of the hash function H(·) in step (3) of the encapsulation algorithm and step (2) of the decapsulation algorithm. The transformation of the passive secure PKE into the passive secure KEM does not require this step.

[0053] Then, the above two AKE transformations are as follows:

[0054] 1. AKE based on pre-shared symmetric key:

[0055] In this kind of AKE, the identity authentication is realized by using the message authentication code (MAC) of the symmetric key.

[0056] The party that encapsulates the KEM ciphertext (i.e. the party that executes the encapsulation algorithm Encap of the above KEM) additionally uses the pseudo-random function PRF(·,·) to input the encapsulation key K and tagl to derive a piece of key confirmation data chk = PRF(K, tagl), which is included in the input data for calculating the message authentication code, and uses the pseudo-random function PRF(·,·) to input the encapsulation key K and tag2 to derive the session key ssk = PRF(K, tag2).

[0057] The party that decapsulates the KEM ciphertext (i.e. the party that executes the decapsulation algorithm Decap of the above KEM) performs an additional confirmation operation after obtaining the encapsulation key K' through decapsulation, i.e. re-calculates the key confirmation data chk' = PRF(K', tagl) by using the pseudo-random function PRF(·,·) to input the encapsulation key K' and tagl, and compares it with the received key confirmation data chk' =? chk. When and only when the comparison is consistent, the protocol is continued to be executed and the session key ssk = PRF(K', tag2) is derived in the same way, otherwise the execution of the protocol is aborted.

[0058] Wherein, tagl ≠ tag2 can be any fixed string agreed by the protocol, which is used to differentiate the use of PRF.

[0059] 2. AKE based on digital signature:

[0060] In this kind of AKE, the identity authentication is realized by using the digital signature (Digital Signature) of the asymmetric key.

[0061] The party that unseals the KEM ciphertext, after obtaining the sealing key K', performs an additional verification operation, i.e., re-computes the key verification data chk' = PRF(K', tag1) using the pseudo-random function PRF(·, ·) with the sealing key K' and tag1, and compares it with the received key verification data chk' =? chk. If the comparison is consistent, the protocol continues to execute and the session key ssk' = PRF(K', tag2) is derived in the same way. Otherwise, the protocol execution is aborted.

[0062] The party that unseals the KEM ciphertext, after obtaining the sealing key K', performs an additional verification operation, i.e., re-computes the key verification data chk' = PRF(K', tag1) using the pseudo-random function PRF(·, ·) with the sealing key K' and tag1, and compares it with the received key verification data chk' =? chk. If the comparison is consistent, the protocol continues to execute and the session key ssk' = PRF(K', tag2) is derived in the same way. Otherwise, the protocol execution is aborted.

[0063] tag1 ≠ tag2 can be any fixed string agreed by the protocol, which is used to differentiate the use of PRF.

[0064] It should be noted that in any of the above methods, due to the sealing and unsealing process, there is a non-negligible probability of decryption error, so that the unsealed key may not be consistent with the sealed key (K' ≠ K). However, the comparison step of the key verification data chk' and chk added by the above method will require the protocol to be aborted in this case. Further, if chk' and chk are consistent, it means that K' = K, so the protocol continues to execute and will derive a consistent session key ssk' = ssk.

[0065] The innovation of the present application is that the comparison step of chk calculated by the pseudo-random function PRF(·, ·) is introduced, i.e., the consistency verification and error abort step. This step enables the unsealing party to know whether a decryption error has occurred, and when an error occurs, the "unsafe session key" is not used for subsequent cryptographic operations, but is discarded directly, thereby avoiding the occurrence of data security problems.

[0066] Meanwhile, the two transformations of the present application are related. Specifically, performing the AKE transformation alone for the sake of using a KEM with a large decryption error does not ensure that the protocol using the KEM is secure. This is because the KEM with a large decryption error needs to satisfy the IND-CPAwF security first (which is not always true), and then the AKE transformation provided by the present application can ensure security. Therefore, the first transformation starts from a PKE with a large decryption error, first constructs a KEM with a large decryption error and IND-CPAwF security, and then the KEM can be used in the transformed AKE protocol. In other words, there is a sequence and strong relationship between the PKE transformation and the AKE transformation provided by the present application.

[0067] Compared with the prior art, the positive effects of the present application are:

[0068] The present application can use a passively secure but decryption error PKE to construct a secure AKE method and system. Specifically, the method first transforms an OW-CPA but decryption error PKE into a KEM with IND-CPA and error information that does not affect its indistinguishable security (hereinafter referred to as IND-CPAwF) through a simple transformation; secondly, an additional confirmation step is introduced in the design of the conventional authentication key exchange protocol, and the derived key is only accepted when it is confirmed that no decryption error occurs, otherwise the protocol is aborted or waits for re-execution.

[0069] The method can be used to relax the parameter selection of some PKE algorithm in design, which naturally has decryption errors (determined by the underlying mathematical difficult problem) and therefore if it is used in a protocol that does not tolerate errors, it can only be used by imposing additional restrictions on parameter selection to ensure that the probability of such errors is extremely small; the present application provides a method for constructing a secure AKE protocol in an error-tolerant manner, thereby providing greater flexibility in parameter selection for PKE algorithm designers. At the same time, since the larger parameter selection range means that the algorithm itself can be optimized by selecting (otherwise discarded due to the requirement of a small decryption error) parameters, the algorithm designer can implement an algorithm with better performance and size. In addition, the transformation performed on the PKE algorithm to remove the decryption error restriction, and the additional step introduced in the AKE protocol design, is often less expensive than the original decryption error restriction imposed on the algorithm performance and size, that is, the performance and size improvement brought by relaxing and optimizing parameters in the PKE algorithm design by allowing a larger decryption error can still be reflected in the performance and size of the final AKE protocol after following the method and introducing a small amount of overhead. BRIEF DESCRIPTION OF DRAWINGS

[0070] Figure 1 is two constructions of AKE protocol;

[0071] (a) pre-shared symmetric key based AKE, (b) digital signature based AKE.

[0072] Figure 2 is a flow chart of an existing AKE design.

[0073] Figure 3 is a diagram of the relationship between PKE and KEM.

[0074] Figure 4 is a flow chart of an AKE design of the present application.

[0075] Figure 5 is an embodiment of the AKE transformation of the present application applied to a pre-shared key based AKE protocol.

[0076] Figure 6 is an embodiment of the AKE transformation of the present application applied to a digital signature based AKE protocol. DETAILED DESCRIPTION

[0077] In order to make the above objectives, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with specific examples and drawings.

[0078] Figures 5 and 6 are modifications of the KEM resulting from the transformation of the present application when applied to AKE, and are specific embodiments applied to pre-shared key based and digital signature based AKE protocols respectively.

[0079] The transformation takes an existing PKE as input and outputs a KEM. Note that both the PKE and KEM before and after the transformation can have non-negligible decryption errors. Specifically, the PKE algorithm, which includes the key generation algorithm KGen, the encryption algorithm Enc, and the decryption algorithm Dec, is transformed into a KEM algorithm, which includes the key generation algorithm KGen, the encapsulation algorithm Encap, and the decapsulation algorithm Decap.

[0080] The specific steps have been described above and will not be repeated here.

[0081] Figure 5 is an embodiment of the AKE transformation of the present application applied to a pre-shared key based AKE protocol.

[0082] It uses the KEM (with non-negligible decryption errors) resulting from the transformation of the present application, and adds additional steps to ensure the security of the protocol when applied to a pre-shared key based AKE. This type of AKE protocol assumes that the two communicating parties A and B have pre-shared a key psk, and does not discuss how to achieve the sharing of psk.

[0083] Specifically, the modified AKE protocol flow is as follows:

[0084] Party A (initiator):

[0085] (1) Call the KEM's key generation algorithm KGen to generate a one-time public and private key pair (epk,esk) for the participant A, and send the data x = epk to the participant B;

[0086] (2) Compute the MAC value [x] = MAC(psk,x) on the sending data x using the pre-shared key psk between the participant A and the participant B;

[0087] Then send the data (x, [x]) to the participant B.

[0088] Participant B (responder):

[0089] (3) Compute and verify the MAC value MAC(psk,x) = [x] on the receiving data x using the pre-shared key psk between the participant A and the participant B;

[0090] (4) If the verification is passed, call the KEM's key encapsulation algorithm Encap to generate the ciphertext and encapsulation key (c,K) = Encap(epk) with the receiving data x = epk as the input, where the participant B independently generates (c,K) by calling the Encap algorithm with the participant A's epk as the input, and this step does not require additional interaction with the participant A;

[0091] (5) Derive the key confirmation data chk = PRF(K,tagl) using the encapsulation key K generated in the step (4);

[0092] (6) Let the reply data be the concatenation of c generated in the step (4) and chk generated in the step (5) y = (c,chk), and compute the MAC value [x,[x],y] = MAC(psk,(x,[x],y)) on the concatenation of the receiving and reply data using the psk;

[0093] (7) Derive the session key ssk = PRF(K,tag2) using the encapsulation key K generated in the step (4);

[0094] Then return the data (y, [x,[x],y]) to the participant A.

[0095] Participant A (initiator):

[0096] (8) Compute and verify the MAC value MAC(psk,(x,[x],y)) = [x,[x],y] on the concatenation of the sending data (x, [x]) and the receiving data y using the pre-shared key psk between the participant A and the participant B;

[0097] (9) If the verification is passed, call the decapsulation algorithm Decap of the KEM with the ciphertext c extracted from the received data y and the esk of A in the step (1) as inputs to decapsulate the encapsulation key K' = Decap(esk, c);

[0098] (10) Extract the chk from the received data y, and re-compute the key confirmation data using the encapsulation key K' decapsulated in the step (9) and verify PRF(K', tagl)? = chk;

[0099] (11) If the verification is passed, derive the session key ssk = PRF(K', tag2) using the encapsulation key K' decapsulated in the step (9); otherwise, abort the protocol.

[0100] It should be noted that the tagl, tag2 in the steps (5), (7), (10), (11) in the above procedure are arbitrary fixed strings defined by the protocol itself, and should be regarded as protocol parameter constants.

[0101] In the embodiment, the steps (5) and (10) are the steps added by the AKE transformation provided by the present application. If the two steps are deleted, the remaining steps constitute a pre-shared key based AKE protocol which cannot handle decryption errors.

[0102] In combination with the description of the AKE transformation in the foregoing, in the embodiment, the party encapsulating the KEM ciphertext is the responder B, and the party decapsulating the KEM ciphertext is the initiator A; and in the embodiment, the "including the key confirmation data chk in the input data for computing the message authentication code" is embodied in that the chk is part of the reply data y, and is input for the MAC in the computation of the message authentication code [x, [x], y].

[0103] It should be noted that the embodiment is only an example for illustrating the AKE transformation steps of the present application. There are more than one pre-shared key based AKE protocol, and the protocol procedure and details can have various differences. The AKE transformation steps of the present application are not only applicable to the protocol procedure of the embodiment, but also applicable to any AKE protocol using KEM as a construction element.

[0104] Fig. 6 is an embodiment of the AKE transformation provided by the present application applied to a digital signature based AKE protocol.

[0105] The use of the transformed KEM (with non-negligible decryption error) of the present application adds extra steps to the AKE based on digital signature to guarantee the security of the protocol. This kind of AKE protocol assumes a public key infrastructure (PKI), i.e. both communicating parties A and B each possess their own pair of signing / verification public and private keys (VK, SK), and both can obtain the verification public key of the other party (e.g. through a certificate sent with the protocol message flow) and verify the legitimacy of the public key. The private key SK A of party A is generated by A himself and a certificate containing the signing public key VK A is requested from a CA authority to be issued to A, so that anyone can obtain the verification public key VK A of A through the certificate and trust the CA and thus the certificate issued by the CA. The same applies to the private key SK B and the signing public key VK B of party B.

[0106] In particular, the modified AKE protocol flow is as follows:

[0107] Party A (initiator):

[0108] (1) call the key generation algorithm KGen of the KEM to generate a one-time public and private key pair (epk, esk) <- KGen for party A, and let the sending data x = epk;

[0109] (2) use the signing private key SK A of party A to calculate the signature value of the sending data {x} = Sign(SK A , x);

[0110] (subsequently send data x, {x})

[0111] Party B (responder):

[0112] (3) use the verification public key VK A of party A to verify the signature value of the received data x Ver(VK A , x, {x})? = 1;

[0113] (4) if the verification is passed, use the received data x = epk as input to call the key encapsulation algorithm Encap of the KEM to generate the ciphertext and encapsulation key (c, K) <- Encap(epk), where party B independently generates (c, K) by calling the Encap algorithm with epk received from party A as input, and this step does not require additional interaction with party A; the ciphertext c is the ciphertext of the encapsulation key K encrypted by epk.

[0114] (5) Using the encapsulation key K generated in step (4), derive the key confirmation data chk = PRF(K, tagl);

[0115] (6) Let the reply data equal the concatenation of c generated in step (4) and chk generated in step (5) y = (c, chk), and compute the signature value {x, {x}, y} = Sign(SK B , (x, {x}, y)) using the own signature private key SK B ;

[0116] (7) Using the encapsulation key K generated in step (4), derive the session key ssk = PRF(K, tag2);

[0117] Then return the data (y, {x, {x}, y}) to the participant A.

[0118] Participant A (initiator):

[0119] (8) Using the verification signature public key VK B of participant B, verify the signature value Ver(VK B , (x, {x}, y), {x, {x}, y}) = 1; i.e. verify the signature value {x, {x}, y} with the verification signature public key VK B of participant B;

[0120] (9) If the verification is passed, then call the decapsulation algorithm Decap of the KEM with c and esk as inputs to decapsulate the encapsulation key K' = Decap(esk, c);

[0121] (10) Using the decapsulated encapsulation key K' in step (9), re-compute the key confirmation data and verify PRF(K', tagl) = chk;

[0122] (11) If the verification is passed, then using the decapsulated encapsulation key K' in step (9), derive the session key ssk = PRF(K', tag2); otherwise abort the protocol.

[0123] The same as the pre-shared key based embodiment is that tagl, tag2 in steps (5), (7), (10), (11) in the above procedure are arbitrary fixed strings defined by the protocol itself, which should be regarded as protocol parameter constants. Different from the pre-shared key based embodiment is that the verification signature public key VK A , VK BPKI, i.e. assuming there is a CA that provides certificates containing the identities of the participants A, B and their corresponding verification public keys, respectively. For simplicity, it is assumed that both participants A and B have already downloaded and verified each other's certificates. It should be noted that the certificates of participants A and B can also be transmitted in the protocol flow described above, but in this case the signed data needs to additionally contain the certificate data itself: for example, the data transmitted by participant A in step (2) becomes (x, cert_A, {x, cert_A}), where cert_A is the certificate containing the identity of participant A and VK A of participant B issued by a CA trusted by B, and {x, cert_A} is a signature on the concatenation of data x and certificate cert_A, i.e. Sign(SK A , x || cert_A), which also needs to be verified together with the certificate data when verifying the signature; similarly, the certificate cert_B of participant B can be added to the data sent by participant B in step (6), and this part of data is also included in the signed data.

[0124] In the described embodiment, steps (5) and (10) are the steps provided by the AKE transformation of the present application. If these two steps are removed, the remaining steps form a digital signature based AKE protocol that cannot handle decryption errors.

[0125] In connection with the description of the AKE transformation above, in the described embodiment the "party that encapsulates the KEM ciphertext" is the responder B, and the "party that decapsulates the KEM ciphertext" is the initiator A; and in the described embodiment, "including the key confirmation data chk in the input data for computing the digital signature" is embodied in that chk is part of the reply data y, and is included as the signed message input in the computation of the digital signature {x, {x}, y}.

[0126] It should be noted that the described embodiment is merely an example of the AKE transformation steps of the present application. There are more than one digital signature based AKE protocols, and the protocol flow and details can vary, and the AKE transformation steps of the present application are not limited to the protocol flow of the described embodiment, but are applicable to any AKE protocol that uses KEM as a building block.

[0127] Although specific embodiments of the present application have been disclosed for illustrative purposes, it is understood that various substitutions, modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application and the appended claims. Therefore, the present application should not be limited to the disclosed embodiments, but should be defined by the scope of the appended claims.

Claims

1. A method for constructing an AKE protocol from a PKE algorithm with errors, comprising the steps of: 1) transforming a PKE with decryption errors but chosen-plaintext secure (OW-CPA) into a KEM that is selectively indistinguishable secure (IND-CPAwF) with errors, denoted as the KEM of IND-CPAwF; 2) transforming an AKE that cannot use the KEM with errors into an AKE protocol that can use the KEM with errors.

2. The method of claim 1, wherein, The KEM of IND-CPAwF comprises a key generation algorithm of the KEM, an encapsulation algorithm of the KEM and a decapsulation algorithm of the KEM; wherein, the key generation algorithm of the KEM is to generate a key encapsulation KEM public key and private key by using the key generation algorithm of the PKE; the encapsulation algorithm of the KEM is to generate an encapsulation message m randomly in the plaintext space of the PKE; to encrypt the encapsulation message m with the key encapsulation KEM public key by using the encryption algorithm of the PKE, and the obtained ciphertext is denoted as ciphertext value c; to input the encapsulation message m into a hash function H(·) to derive an encapsulation key K = H(m); the decapsulation algorithm of the KEM is to decrypt the ciphertext value c with the key encapsulation KEM private key by using the decryption algorithm of the PKE to obtain an encapsulation message m'; and to input the obtained encapsulation message m' into the hash function H(·) to derive an encapsulation key K' = H(m').

3. The method of claim 2, wherein, The AKE protocol that can use the KEM with errors is an AKE based on a pre-shared symmetric key; wherein, a party that executes the encapsulation algorithm of the KEM uses a pseudo-random function PRF(·,·) to derive a piece of key confirmation data chk = PRF(K, tag1) according to the encapsulation key K and tag1, and includes it in the input data for calculating the message authentication code MAC, and uses the pseudo-random function PRF(·,·) to derive a session key ssk = PRF(K, tag2) according to the encapsulation key K and tag2; a party that executes the decapsulation algorithm of the KEM uses the pseudo-random function PRF(·,·) to recalculate the key confirmation data chk' = PRF(K', tag1) according to the encapsulation key K' and tag1, and compares it with the received key confirmation data chk' =? chk, and derives the session key ssk = PRF(K', tag2) only when the comparison is consistent, otherwise the execution of the protocol is aborted; wherein, tag1 and tag2 are arbitrary unequal strings agreed upon.

4. The method of claim 2, wherein, The AKE protocol using the KEM with error is a digital signature based AKE; wherein the party executing the encapsulation algorithm of the KEM uses a pseudo random function PRF(·,·) to derive a piece of key confirmation data chk=PRF(K,tagl) from the encapsulation key K and tagl, and includes it in the input data for calculating the digital signature, and uses a pseudo random function PRF(·,·) to derive a session key ssk=PRF(K,tag2) from the encapsulation key K and tag2; the party executing the decapsulation algorithm of the KEM uses a pseudo random function PRF(·,·) to re-calculate the key confirmation data chk'=PRF(K',tagl) from the encapsulation key K' and tagl, and compares it with the received key confirmation data chk'=?chk, and derives the session key ssk'=PRF(K',tag2) only when the comparison is consistent, otherwise the execution of the protocol is aborted; wherein tagl and tag2 are arbitrary unequal strings agreed upon.

5. A method for establishing a secure channel based on a pre-shared key based AKE protocol, comprising the steps of: 1) Participants A and B participating in the communication determine a pre-shared key psk; 2) Participant A invokes the key generation algorithm KGen of the KEM to generate a one-time public and private key pair (epk,esk) of participant A, and lets the sending data x=epk; wherein epk is the KEM public key of participant A, and esk is the KEM private key of participant A; 3) Participant A uses the pre-shared key psk to calculate the MAC value [x] of the data x, and sends (x,[x]) to participant B; 4) Participant B uses the pre-shared key psk to calculate the MAC value of the received data x, and verifies whether the MAC value MAC(psk,x) calculated by himself is consistent with the received [x]; if the verification is passed, the party invokes the encapsulation algorithm Encap of the KEM according to the received data x=epk to generate a ciphertext c and an encapsulation key K; then uses a pseudo random function PRF(·,·) to derive a piece of key confirmation data chk=PRF(K,tagl) from the encapsulation key K and tagl, splices the ciphertext c and chk to obtain y=(c,chk), and uses the pre-shared key psk to calculate the MAC value [x,[x],y] of (x,[x],y); and uses a pseudo random function PRF(·,·) to derive a session key ssk=PRF(K,tag2) from the encapsulation key K and tag2; then sends (y,[x,[x],y]) to participant A; 5) Party A computes the MAC value of (y, [x, [x], y]) using the pre-shared key psk, and verifies the MAC value MAC(psk, (x, [x], y)) computed by itself?= [x, [x], y]; if the verification is passed, the unsealing algorithm Decap of the KEM is called with the ciphertext c and the esk as inputs to unseal the encapsulation key K'; then the key confirmation data chk' is recalculated according to the encapsulation key K' and tag1 using the pseudo-random function PRF(K', tag1), and is compared with the received key confirmation data chk, and the session key ssk = PRF(K', tag2) is derived only when the comparison is consistent, otherwise the execution of the protocol is aborted; wherein tag1 and tag2 are arbitrary unequal strings agreed upon.

6. A secure channel establishment method based on a digital signature-based AKE protocol, comprising the steps of: 1) Party A calls the key generation algorithm KGen of the KEM to generate a one-time public-private key pair (epk, esk) of party A, and let the sending data x = epk; wherein epk is the KEM public key of party A, and esk is the KEM private key of party A; 2) Party A uses its own signing private key SK A Compute the signature value {x} of the data x; then send (x, {x}) to Party B; 3) Party B uses Party A's verification public key VK A Verifies the signature value {x}, if the verification is passed, calls the key encapsulation algorithm Encap of KEM with the received data x = epk as input to generate the ciphertext c and the encapsulation key K; uses the pseudo-random function PRF(·, ·) to derive a piece of key confirmation data chk = PRF(K', tag1) according to the encapsulation key K and tag1, splices the ciphertext c and chk to obtain y = (c, chk), and uses its own signature private key SK B Signs (x, {x}, y) to obtain the signature value {x, {x}, y}; and uses the pseudo-random function PRF(·, ·) to derive the session key ssk = PRF(K', tag2) according to the encapsulation key K and tag2; then gives (y, {x, {x}, y}) to Party A; 4) Party A uses Party B's verification public key VK B The signature value {x, {x}, y} is verified, and if the verification is passed, the decapsulation algorithm Decap of the KEM is called with the ciphertext c and esk as inputs to decapsulate the encapsulation key K'; then the key confirmation data chk' = PRF(K', tag1) is recalculated according to the encapsulation key K' and tag1 using the pseudo-random function PRF(·, ·), and is compared with the received key confirmation data chk' =?chk. When and only when the comparison is consistent, the session key ssk = PRF(K', tag2) is derived, otherwise the execution of the protocol is aborted; wherein tag1 and tag2 are arbitrary unequal strings agreed upon.

7. A system for constructing an AKE protocol from an error prone PKE algorithm, characterized by, comprising a PKE conversion module and an AKE conversion module; wherein the PKE conversion module is configured to convert a PKE that is selectively plaintext secure (OW-CPA) but with decryption errors into a KEM that is selectively plaintext indistinguishable secure (IND-CPAwF) with errors that can be leaked; the AKE conversion module is configured to convert an AKE that cannot use the KEM with errors into an AKE protocol that can use the KEM with errors.

8. The system of claim 7, wherein, the IND-CPAwF KEM comprises a key generation algorithm of the KEM, an encapsulation algorithm of the KEM, and an unsealing algorithm of the KEM; wherein the key generation algorithm of the KEM is to generate the public key and the private key of the key encapsulation KEM using the key generation algorithm of the PKE; the encapsulation algorithm of the KEM is to randomly generate an encapsulation message m in the plaintext space of the PKE; use the encryption algorithm of the PKE to encrypt the encapsulation message m with the public key of the key encapsulation KEM, and obtain a ciphertext value c; input the encapsulation message m into a hash function H(·) to derive an encapsulation key K = H(m); the unsealing algorithm of the KEM is to use the decryption algorithm of the PKE to decrypt the ciphertext value c with the private key of the key encapsulation KEM, and obtain an encapsulation message m'; input the obtained encapsulation message m' into the hash function H(·) to derive an encapsulation key K' = H(m').

9. The system of claim 8, wherein, The AKE protocol capable of using the KEM with errors is a pre-shared symmetric key based AKE; wherein the party executing the encapsulation algorithm of the KEM uses a pseudo-random function PRF(·,·) to derive a piece of key confirmation data chk = PRF(K, tag1) according to the encapsulation key K and tag1, and includes it in the input data for calculating a message authentication code MAC, and uses a pseudo-random function PRF(·,·) to derive a session key ssk = PRF(K, tag2) according to the encapsulation key K and tag2; the party executing the decapsulation algorithm of the KEM uses a pseudo-random function PRF(·,·) to re-calculate the key confirmation data chk' = PRF(K', tag1) according to the encapsulation key K' and tag1, and compares it with the received key confirmation data chk' =? chk, and derives the session key ssk = PRF(K', tag2) only when the comparison is consistent, otherwise the execution of the protocol is aborted; wherein tag1 and tag2 are any agreed unequal strings.

10. The system of claim 8, wherein, The AKE protocol capable of using the KEM with errors is a digital signature based AKE; wherein the party executing the encapsulation algorithm of the KEM uses a pseudo-random function PRF(·,·) to derive a piece of key confirmation data chk = PRF(K, tag1) according to the encapsulation key K and tag1, and includes it in the input data for calculating a digital signature, and uses a pseudo-random function PRF(·,·) to derive a session key ssk = PRF(K, tag2) according to the encapsulation key K and tag2; the party executing the decapsulation algorithm of the KEM uses a pseudo-random function PRF(·,·) to re-calculate the key confirmation data chk' = PRF(K', tag1) according to the encapsulation key K' and tag1, and compares it with the received key confirmation data chk' =? chk, and derives the session key ssk' = PRF(K', tag2) only when the comparison is consistent, otherwise the execution of the protocol is aborted; wherein tag1 and tag2 are any agreed unequal strings.

Images