Rejection sampling method incorporating recycling, and electronic device

Abstract

A rejection sampling method incorporating recycling, and an electronic device. The method comprises: inputting a bit string of a sufficient length; if a bit string of a preset length satisfies a condition for a target distribution requirement, accepting a sample output after processing, discarding a used bit string, and entering the last step; if the bit string of the preset length does not satisfy the condition for the target distribution requirement, performing processing according to the next step; extracting independent and uniformly distributed bit strings from the bit string of the preset length used in the previous step, recycling the bit strings as an input of the previous step or as a part of the input, discarding an un-extracted bit string, and entering the previous step; if the number of output samples does not satisfy the requirement, entering the step of determining whether the distribution requirement is satisfied; and if the number of output samples satisfies the requirement, ending. The present method can be used to ensure that generated samples conform to a specified distribution and the samples are independent of each other while reducing random inputs used by a sampling algorithm, thereby reducing the amount of operations of a random mechanism used by a cryptographic algorithm.

Description

A rejection sampling method with recycling, electronic device TECHNICAL FIELD

[0001] The present application relates to the technical field of quantum computing, and in particular to a rejection sampling method with recycling and an electronic device. BACKGROUND

[0002] The development of quantum computing poses a serious threat to traditional public key cryptography such as RSA, DSA, and ECC, so future network space security urgently needs cryptographic techniques to resist quantum computing attacks, known as post-quantum cryptography. In post-quantum cryptography, lattice-based cryptography occupies a dominant position due to its theoretically provable security and comprehensive performance advantages in space and time resources.

[0003] In existing lattice-based cryptography, generating a probability distribution that meets specified distribution or requirements is an extremely important basic operation of cryptographic algorithms. One widely used operation is to generate a matrix or a polynomial, each coefficient of which is subject to a uniform distribution within a specified range.

[0004] In cryptographic algorithms, a specified pseudo-random mechanism is usually used to generate a pseudo-random byte string, and then a sampling algorithm is used to obtain samples of a specified distribution using the pseudo-random byte string as input. When the number of elements of the above uniform distribution is not a power of 2, the sampling algorithm often uses rejection sampling technology.

[0005] Note that when the sample space is not a power of 2, the rejection sampling algorithm of the above uniform distribution discards (pseudo) random bits that do not meet the requirements. Since the computational resources consumed in generating pseudo-random byte strings account for a significant proportion of post-quantum cryptographic algorithms, reducing the rejection probability and reducing the demand for (pseudo) random byte strings is an important link to improve the overall efficiency of cryptographic algorithms.

[0006] SUMMARY

[0007] The technical problem to be solved by the present application is how to ensure that the generated samples conform to the specified distribution and are mutually independent, while reducing the (pseudo) random input used by the sampling algorithm, thereby reducing the computational load of the (pseudo) random mechanism used by the cryptographic algorithm. In view of this, the present application provides a rejection sampling method with recycling and an electronic device.

[0008] The technical solution adopted by the present application is a rejection sampling method with recycling, comprising:

[0009] Step A1: input a bit string of sufficient length, wherein the bit string is a random bit string or a pseudo-random bit string;

[0010] Step A2: If the bit string of preset length satisfies the condition of target distribution requirement, then accept a sample output, discard the used bit string, and enter Step A4; if the bit string of preset length does not satisfy the condition of target distribution requirement, then process according to Step A3;

[0011] Step A3: Extract an independent uniform distribution bit string from the bit string of preset length used in Step A2, recycle as input or part of input of Step A2 (allowing the length of recycled bit string to be 0 under some conditions), discard the bit string not extracted, and enter Step A2;

[0012] Step A4: If the number of output samples does not satisfy the requirement, enter Step A2; if the number of output samples satisfies the requirement, end.

[0013] In one embodiment, denotes the residue class ring of positive integer modulus q, where the addition and multiplication of elements are operated in the sense of modulo q, and the uniform distribution sampling of , the method comprises:

[0014] Step B2: Take λ bits b0, b1, …, b λ-1 from the given bit string to form a non-negative integer If b , output b as a sample of uniform distribution of λ-1 , discard the used b0, b1, …, b λ-1 , and enter Step B4; if the determination condition is not satisfied, enter Step B3;

[0015] Step B3: Extract an independent uniform distribution bit string from the bit string used in Step B2, recycle and count the available bits for use in Step B2, and enter Step B2;

[0016] Step B4: If the number of output samples does not satisfy the requirement, enter Step B2; if the number of output samples satisfies the requirement, end.

[0017] In one embodiment, the Step B3 comprises:

[0018] Step C1: Take λ bits b0, b1, …, b λ-1 from the given bit string to form a non-negative integer λ-1 b = b0 + 2·b1 + … + 2 λ-1 ·b λ-1 , take the high-order bit b λ-2 , b λ-η , …, b λ-1 , where 1 < η < λ and q λ-2 , q λ-η are not all 1;

[0019] Step C2: Determine the relationship between the integer formed by η bits b λ-1 , b λ-2 , …, b λ-η and the integer . If c > d, select some or all of the λ - η bits b0, b1, …, b for recycling and count them as available bits for use in step B2 of the sampling algorithm, and proceed to step B2. λ-η-1

[0020] In one embodiment, step B3 includes:

[0021] Step D1: Take λ bits b0, b1, …, b λ-1 from the given bit string to form a non - negative integer s = b0 + 2·b1 + … + 2 λ-1 ·b λ-1 ≥ q. Take the upper - segment η bits b λ-1 , b λ-2 , …, b[[ID=3,3]] λ-η , where 1 < η < λ and q λ-1 , q λ-2 , …, q λ-η are not all 1;

[0022] Step D2: For , determine the set L. The elements of set L consist of one or several integers greater than d. Determine the relationship between the integer formed by η bits b λ-1 , b λ-2 , …, b λ-η and set L; If c belongs to set L, select some or all of the λ - η bits b0, b1, …, b for recycling and count them as available bits for use in step B2 of the sampling algorithm, and proceed to step B2. λ-η-1

[0023] In one embodiment, step B3 includes:

[0024] Step Z1: Find integers k, l such that 0 ≤ k < l < λ and q k , q k+1 , …, q l-1 are all equal to 0;

[0025] Step Z2: Take λ bits b0, b1, …, b λ-1 from the given bit string to form a non - negative integer s = b0 + 2·b1 + … + 2 λ-1 ·b<000,0034>​​≥ q, judge high-order section λ-l bits q λ-1 , λ-2 , …, l+1 , l , λ-1 , λ-2 , …, l+1 , l , If q λ-1 = b λ-1 , q λ-2 = b λ-2 , …, q l+1 = b l+1 , q l = b l , enter step Z3;

[0026] Step Z3: If k > 0, judge the relationship between low-order k bits q k-1 , k-2 , …, k-1 , k-2 , k-1 = b k-1 , q k-2 = b k-2 , …, q0= b0, from l-k bits b k , k+1 , …, l-1 , select part or all of them to be recycled and counted as available bits for step B2 of the sampling algorithm.

[0027] In one embodiment, if there is a sample space positive integer m and a sample 0 ≤ s < m, the method comprises:

[0028] Step E1: Set the sampling space to have complete information of at least v bits, that is

[0029] Step E2: According to the binary representation of non-negative integer s Where s0, s1, …, s v-1 , v ∈ {0, 1}, if s < 2 v , extract part or all of the low-order v bits e0, e1, …, e v-1 from the non-negative integer s, and count them as available bits for step B2 of the sampling algorithm, if s ≥ 2 v , the current recycling fails, and enter step B2.

[0030] In one embodiment, the step B3 comprises:

[0031] Step F1: take λ bits b0, b1, …, b λ-1 The non-negative integer s = b0+ 2·b1+ … + 2 λ-1 ·b λ-1 ≥ q, discard the used b0, b1, …, b λ-1 , take the complement space sampling e = s - q caused by the rejection.

[0032] Step F2: run step E1, E2 for the sample space positive integer 2 λ -q and a sampling e.

[0033] In one embodiment, the step F2 comprises:

[0034] Step G1: run step E1, step E2 for the sample space positive integer 2 λ -q and a sampling e; if the current recycling fails in running step E2, run step E1, step E2 for the sample space positive integer and a sampling .

[0035] Step G2: if the current recycling fails in running step E2, return to step B2, or recycle the bits by using the method of step E1, E2.

[0036] Another aspect of the present application also provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is executed by the processor to implement the steps of the rejection sampling method with recycling as described in any one of the above.

[0037] Another aspect of the present application also provides a computer storage medium, wherein a computer program is stored on the computer storage medium, and the computer program is executed by a processor to implement the steps of the rejection sampling method with recycling as described in any one of the above.

[0038] Compared with the prior art, the present application has at least the following advantages:

[0039] The present application aims at the algorithm of rejection sampling generating a specified distribution, provides a rejection recycling mechanism, ensures that the generated samples are subject to the specified distribution and mutually independent, and reduces the (pseudo) random input used by the sampling algorithm, thereby reducing the operation amount of the (pseudo) random mechanism used by the cryptographic algorithm; such rejection sampling method with recycling can be used to improve the operation efficiency of the post-quantum cryptographic algorithm. BRIEF DESCRIPTION OF DRAWINGS

[0040] Fig. 1 is a flowchart of a rejection sampling method with recycling according to an embodiment of the present application;

[0041] Fig. 2 is a schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to further explain the technical means and effects taken by the present application to achieve the predetermined purposes, the present application will be described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0043] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0044] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0045] An embodiment of the present application is a rejection sampling method with recycling, as shown in Fig. 1, which comprises:

[0046] Step A1: input a bit string of sufficient length, wherein the bit string is a random bit string or a pseudo-random bit string;

[0047] Step A2: if the bit string of the preset length meets the condition of the target distribution requirement, then accept one sample output for processing, discard the used bit string, and enter step A4; if the bit string of the preset length does not meet the condition of the target distribution requirement, then process according to step A3;

[0048] Step A3: extract an independent uniform distribution bit string from the bit string of the preset length used in step A2, recycle it as the input of step A2 or as part of the input (allowing the length of the extracted recycled bit string to be 0 under some conditions), discard the bit string that is not extracted, and enter step A2;

[0049] Step A4: if the number of output samples does not meet the requirement, enter step A2; if the number of output samples meets the requirement, end.

[0050] Referring to Fig. 1, the method provided by the present embodiment will be described in detail below.

[0051] For ease of understanding, the following symbols are used throughout the text:

[0052] For any real number x, represents the maximum integer not greater than x, Denotes the smallest integer not less than x. Positive integer modulus q; Denotes the residue class ring modulo q, where the addition and multiplication of elements are performed modulo q; λ represents all The number of bits of the elements in, that is When q is not a power of 2, the binary bit string of q from left to right with the highest bit first is denoted as q λ-1 q λ-2 …q1q0, that is, q = 2 λ-1 ·q λ-1 +2 λ-2 ·q λ-2 +…+2·q1 + q0, where q0, q1, …, q λ-2 , q λ-1 ∈{0, 1}.

[0053] The technical solution adopted by the present invention to solve the problem of rejection sampling is: A rejection sampling method with recycling, which may include the following steps:

[0054] Step A1: Input a (pseudo) random bit string of sufficient length.

[0055] Step A2: Make a processing decision on a (pseudo) random bit string of appropriate length to determine whether it meets the decision condition of the distribution requirement. If it meets the decision condition, then accept a sample output by the processing, discard the used (pseudo) random bit string, and enter step A4; if it does not meet the decision condition, enter step A3.

[0056] Step A3: Extract an independent and uniformly distributed (pseudo) random bit string from the (pseudo) random bit string of appropriate length used in step A2, recycle it as the input of the sampling algorithm for use in step A2. Enter step A​​​​​​​​​​​​​​​​​​​​​​

[0061] Step B3: Extracting an independent uniformly distributed (pseudo) random bit string from the (pseudo) random bit string of appropriate length used in Step B2, recycling and counting in the available bits for use in Step B2 of the sampling algorithm. Go to Step B2.

[0062] Step B4: If the number of output samples does not meet the requirement, go to Step B2; if the number of output samples meets the requirement, end.

[0063] In the embodiment, the above-mentioned Step B3 can further include the following steps:

[0064] Step C1: Knowing that in the given bit string, take λ bits b0, b1, …, b λ-1 , compose a non-negative integer s = b0+2·b1+…+2 λ-1 ·b λ-1 ≥ q. Take a section of η bits b λ-1 ,b λ-2 ,…,b λ-η , where 1 < η < λ and q λ-1 ,q λ-2 ,…,q λ-η are not all 1.

[0065] Step C2: Determine the relationship between the integer λ-1 ,b λ-2 ,…,b λ-η composed of η bits b and the integer . If c > d, recycle and count in the available bits for use in Step B2 of the sampling algorithm from part or all of the λ-η bits b0, b1, …, b λ-η-1 . Go to Step B2.

[0066] In the embodiment, the above-mentioned Step B3 can further include the following steps:

[0067] Step D1: Knowing that in the given bit string, take λ bits b0, b1, …, b λ-1 , compose a non-negative integer s = b0+2·b1+…+2 λ-1 ·b λ-1 ≥ q. Take a section of η bits b λ-1 ,b λ-2 ,…,b λ-η , where 1 < η < λ and q λ-1 ,q λ-2 ,…,q λ-η are not all 1.

[0068] Step D2: For A set L is determined, whose elements are composed of one or several integers greater than d. The η bits b0, b1,..., bη-1 are judged λ-1 λ-2 λ-η with the set L. If c belongs to the set L, then some or all of the λ-η bits b0, b1,..., bλ-η-1 are recovered from the given bit string and counted as available bits for use in step B2 of the sampling algorithm. Step B2 is entered. λ-η-1

[0069] In this embodiment, the above step B3 can further include the following steps:

[0070] Step Z1 : Find integers k, l satisfying 0 < k < l < λ, such that qk, qk+1,..., ql-1 all equal 0. k k+1 l-1

[0071] Step Z2: Given that the λ bits b0, b1,..., bλ-1 in the given bit string form a nonnegative integer s = b0+ 2 · b1+... + 2 λ-1 · b λ-1 ≥ q. Judge the relationship between the high-order segment of λ-l bits qk, qk+1,..., ql-1 and b0, b1,..., bλ-l: if qk = b0, qk+1 = b1,..., ql-1 = bλ-l are satisfied, then step Z3 is entered. λ-1 λ-1 λ-2 l+1 l λ-1 λ-2 l+1 l λ-1 λ-1 λ-2 λ-2 l+1 l+1 l l

[0072] Step Z3: If k > 0, judge the relationship between the low-order k bits q0, q1,..., qk-1 and b0, b1,..., bk-1: if q0 = b0, q1 = b1,..., qk-1 = bk-1 are satisfied, then from the l-k bits b, b,..., bl-k-1 are recovered and counted as available bits for use in step B2 of the sampling algorithm. Step B2 is entered. k-1 k-2 k-1 k-2 k-1 k-1 k-2 k-2 k k+1 l-1 ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​Some or all of the recovered bits are taken and added to the available bits for use in step B2 of the sampling algorithm.

[0073] In this embodiment, the above-mentioned step B3 can further comprise the following steps:

[0074] Step E1: Set the sampling space to have full information of at least v bits. That is

[0075] Step E2: According to the binary representation of the non-negative integer s where s0, s1,..., s v-1 v ∈ {0, 1}, if s < 2 v , then some or all of the low v bits e0, e1,..., ev v-1 from the non-negative integer s are recovered and added to the available bits for use in step B2 of the sampling algorithm. If s ≥ 2 v , then the current recovery fails. Go to step B2.

[0076] In this embodiment, the above-mentioned step B3 can further comprise the following steps:

[0077] Step F1: Given that the λ bits b0, b1,..., b λ-1 in the given bit string form a non-negative integer s = b0+ 2·b1+... + 2 λ-1 ·b λ-1 ≥ q. Discard the used b0, b1,..., b λ-1 , but take the complement space sampling e = s - q resulting from the rejection.

[0078] Step F2: For the sample space positive integer 2 λ -q and a sampling e, run steps E1, E2.

[0079] In this embodiment, the above-mentioned step F2 can further comprise the following steps:

[0080] Step G1: For the sample space positive integer 2 λ -q and a sampling e, run step E1, and then run step E2. If the current recovery fails in running step E2, for the sample space positive integer and a sampling , run steps E1, E2.

[0081] Step G2: If the current recovery fails in running step E2, it can return to step B2, or it can continue to recover the available bits according to the method of steps E1, E2 as needed.

[0082] ​In this embodiment, bit operations such as AND, OR, NOT, XOR, and other equivalent implementation operations can be used in the above operations.

[0083] It should be emphasized that rejection sampling is one of the important methods in post-quantum cryptography technology, which occupies a large amount of computing resources. For rejection sampling in limited space, especially uniform distribution sampling on the ring of integers modulo a power of 2, the present application proposes a rejection sampling technology with recycling. Through simple and fast detection and judgment, the (pseudo) random bits still available during rejection operation are recycled for subsequent continuous sampling, which can reduce the total number of (pseudo) random bits used and the operation time of the pseudo-random generation mechanism, and can reduce the overall running time of the post-quantum cryptographic algorithm.

[0084] Compared with the previously existing methods, the present application has the following new characteristics and benefits:

[0085] 1) Recycling of (pseudo) random bits still available in rejection sampling, and the recycled bits are independent and random, which does not affect the security;

[0086] 2) Reducing the overall sampling time consumption of the algorithm, especially suitable for integers friendly to Number Theory Transform (NTT).

[0087] The second embodiment of the present application is an electronic device, as shown in FIG. 2, which can be understood as a physical device, comprising a processor and a memory storing processor executable instructions, when the instructions are executed by the processor, the following operations are performed:

[0088] Step A1: input a bit string of sufficient length, wherein the bit string is a random bit string or a pseudo-random bit string;

[0089] Step A2: if the bit string of the preset length meets the condition of the target distribution requirement, then accept a sample output, discard the used bit string, and enter step A4; if the bit string of the preset length does not meet the condition of the target distribution requirement, then process according to step A3;

[0090] Step A3: extract an independent and uniform distribution bit string from the bit string of the preset length used in step A2, recycle it as the input of step A2 or as part of the input, discard the bit string not extracted, and enter step A2;

[0091] Step A4: if the number of output samples does not meet the requirement, enter step A2; if the number of output samples meets the requirement, end.

[0092] The third embodiment of the present application, the flow of the method of the rejected sampling with recovery of the embodiment is same with the first and second embodiments, the difference lies in that, in engineering implementation, the embodiment can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better implementation. Based on such understanding, the method of the present application can be embodied in the form of computer software product, the computer software product is stored in a storage medium (such as ROM / RAM, disk, optical disk), including a plurality of instructions for making a device execute the method described in the embodiment of the present application.

[0093] The above only describes the preferred embodiments of the present application and is not used to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A reject sampling method with recovery, characterized in that, Comprising: Step A1: input a bit string of sufficient length, wherein the bit string is a random bit string or a pseudo-random bit string; Step A2: if the bit string of the preset length meets the condition of the target distribution requirement, then accept a sample output, discard the used bit string, and enter step A4; if the bit string of the preset length does not meet the condition of the target distribution requirement, then process according to step A3; Step A3: extract an independent uniform distribution bit string from the bit string of the preset length used in step A2, recycle as the input of step A2 or as a part of the input, discard the bit string not extracted, and enter step A2; Step A4: if the number of output samples does not meet the requirement, enter step A2; if the number of output samples meets the requirement, end.

2. The rejected sampling method with recovery according to claim 1, wherein, the ring of residues modulo a positive integer q, where the elements are operated on under addition and multiplication modulo q, with respect to uniformly distributed sampling over the above, the method comprising: Step B2, take λ bits b0, b1,..., b λ-1 const non-negative integer If b < q, then output b as one The samples are evenly distributed on the upper, and the used b0, b1,..., b λ-1 , enter step B4; if the determination condition is not met, enter step B3; Step B3: extract an independent uniform distribution bit string from the bit string used in step B2, recycle and count as the available bit for step B2, and enter step B2; Step B4: if the number of output samples does not meet the requirement, enter step B2; if the number of output samples meets the requirement, end.

3. The rejected sampling method with recovery according to claim 2, wherein, The step B3 comprises: Step C1: take λ bits b0, b1,..., b λ-1 from the given bit string, and let b = b0+ 2 · b1+... + 2 λ-1 · b λ-1 ≥ q, take the high-order segment of η bits b λ-1 , b λ-2 ,..., b λ-η , where 1 < η < λ and q λ-1 , q λ-2 ,..., q λ-η are not all 1; Step C2: Determine η bits b λ-1 ,b λ-2 ,…,b λ-η constituting an integer with integer the relationship if c > d, from the λ-η bits b0, b1, …, b λ-η-1 Some or all of the recovered bits are selected and counted into the available bits for use in step B2 of the sampling algorithm, and step B2 is entered.

4. The rejected sampling method with recovery according to claim 2, wherein, The step B3 comprises: Step D1: take λ bits b0, b1,..., b λ-1 The non-negative integer s = b0+ 2·b1+... + 2 λ-1 ·b λ-1 ≥ q, take the high-order segment of η bits b λ-1 , b λ-2 ,..., b λ-η , where 1 < η < λ and q λ-1 , q λ-2 ,..., q λ-η are not all 1; Step D2: For each of the following, the corresponding step D1 is performed: determining a set L, the elements of which are composed of one or several integers greater than d, judging the η bits b λ-1 ,b λ-2 ,…,b λ-η composing an integer Relation to set L; if c belongs to set L, from λ-η bits b0, b1, …, b λ-η-1 Part or all of the recovered bits are selected and counted as available bits for use in step B2 of the sampling algorithm, into step B2.

5. The rejected sampling method with recovery according to claim 2, wherein, The step B3 comprises: Step Z1 : Find integers k, l satisfying 0 < k < l < λ such that q k q k+1 q l-1 are all equal to 0; Step Z2: Take λ bits b0, b1, ..., b from the given bit string. λ-1 The non-negative integer s = b0 + 2·b1 + ... + 2 λ-1 ·b λ-1 ≥q, determine the high-order segment λ-l bits q λ-1 ,q λ-2 ,…,q l+1 ,q L With b λ-1 ,b λ-2 ,…,b L+1 ,b L Relationship: If q is satisfied λ-1 =b λ-1 q λ-2 =b λ-2 , ..., q L+1 =b L+1 q l =b l Proceed to step Z3; Step Z3: If k > 0, judge the relationship between the low k bits q k-1 , q k-2 , …, q0 and b k-1 , b k-+2 , …, b0: If q k-1 = b k-1 , q k-2 = b k-2 , …, q0 = b0 are met, part or all of b k , b k+1 , …, b l-1 are recovered from l-k bits and counted as available bits for use in step B2 of the sampling algorithm.

6. The rejected sampling method with recovery according to claim 2, wherein, If there is a sample space positive integer m and a sampling 0≤s<m, the method comprises: Step E1: Set the sampling space to have at least v bits of full information, i.e. Step E2: from the binary representation of the non-negative integer s where s0, s1,..., s v-1 ∈ {0, 1}, if s < 2 v ∈ {0, 1}, if s < 2 v from the lower v bits e0, e1,..., ev-1 of the non-negative integer s v-1 extracting some or all of the recovered bits and counting them as available for use in step B2 of the sampling algorithm, if s ≥ 2 v then the current recovery fails and step B2 is entered.

7. The rejected sampling method with recovery according to claim 6, wherein, The step B3 comprises: Step F1: Take λ bits b0, b1, ..., b from the given bit string. λ-1 The non-negative integer s = b0 + 2·b1 + ... + 2 λ-1 ·b λ-1 ≥q, discard used values ​​of b0, b1, ..., b λ-1 The sampled space e = sq is taken due to rejection. Step F2: For sample space positive integer 2 λ - q and one sample e, run steps El, E2.

8. The rejected sampling method with recovery according to claim 7, wherein, The step F2 comprises: Step Gl: For sample space positive integer 2 λ - q and one sample e, run Step El, Step E2; if Step E2 fails to recover the current, then for sample space positive integer and one sample Run step E1, step E2; Step G2: if the current recycling fails in running step E2, return to enter step B2, or recycle the bit by using the method of steps E1 and E2.

9. An electronic device, comprising: The electronic device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is executed by the processor to implement the steps of the rejection sampling method with recycling according to any one of claims 1 to 8.

10. A computer storage medium, the computer storage medium storing a computer program, and the computer program being executed by a processor to implement the steps of the rejection sampling method with recycling according to any one of claims 1 to 8.

Images