203 results about "Key encapsulation" patented technology

The invention discloses a post-quantum TLCP protocol design method, device, equipment and medium, and relates to the field of information security, the post-quantum TLCP protocol design method is applied to a client, and the post-quantum TLCP protocol design method comprises the following steps: constructing client handshake information based on an information security technology transport layer cryptographic protocol, and sending the client handshake information to a server to receive returned server handshake information and establish connection; receiving a server-side digital certificate constructed based on the cryptographic algorithm encrypted public key information and the post-quantum key encapsulation algorithm public key information of the server-side and server-side key exchange information constructed based on the post-quantum key encapsulation algorithm and the cryptographic algorithm; and performing identity authentication based on the post-quantum digital signature algorithm public key information and the national cryptographic algorithm signature public key information to construct a pre-master key for data transmission. An active public key cryptographic algorithm and functions are reserved in an information security technology transport layer cryptographic protocol, and a post-quantum public key cryptographic algorithm is put into the protocol, so that the quantum security is realized while the active public key cryptographic security is realized.

The invention discloses a quantum cryptography migration resisting method based on an FIDO2 protocol, electronic equipment and a medium. The method comprises the steps that interaction between an authenticator and a client side achieves key packaging based on a Kyber algorithm; a registration stage and an authentication stage are completed through three-party interaction of the authenticator, the client and the server; in the registration stage, an identity certificate is created on a server for the first time by a user, and a public key is generated and stored by using a Diithium anti-quantum signature algorithm or a Falcon anti-quantum signature algorithm; in the authentication stage, a user logs in a server, and identity authentication is carried out by using the credential created in the registration stage. According to the method, the Kyber anti-quantum encryption algorithm and the Dilliimum / Falcon anti-quantum digital signature algorithm are introduced into the FIDO2 protocol, so that the confidentiality and integrity of communication and the reliability of authentication can be guaranteed continuously in a quantum computing environment, and the anti-quantum security of the FIDO2 protocol is improved remarkably.

The invention relates to the technical field of information security, in particular to a hybrid key packaging method and system, and the method comprises the steps: determining a first encryption key, a sub-key and a second encryption key according to a public key of an anti-quantum key pair and a public key of a national secret key pair corresponding to an obtained to-be-encrypted information request; generating a first symmetric encryption session key according to the sub-key, the first random number and a second cryptographic algorithm; encrypting a message plaintext corresponding to the to-be-encrypted message request by using the first symmetric encryption session key; a receiving end carries out decryption based on the same mode, and an anti-quantum key packaging technology is added to a traditional national secret key packaging scheme, so that the key has an anti-quantum attack function after being packaged; when the anti-quantum key packaging technical scheme loses efficacy on a classical computer, the security of the session key can still be protected by using a national cryptographic algorithm in hardware, the semantic security required by a current public key encryption algorithm is met, and the security of data is improved.

The invention discloses an efficient and compact key packaging, encryption and decryption method based on NTRU. The invention belongs to the technical field of lattice passwords, and particularly relates to an NTRU-based secret key packaging, encrypting and decrypting method with scalable ciphertext compression and balanced performance. According to the method, a public key compression and scaling ciphertext compression technology is provided for an NTRU password system, only one polynomial is needed in the encryption and decryption process, and the technology is also suitable for other password schemes based on NTRU. The method has the advantages of being shorter in ciphertext size, more flexible in parameter selection, capable of proving security under classical and quantum random oracle models, tighter in theoretical security protocol advantage, higher in known attack resistance, efficient in implementation, negligible in error rate and the like.

The invention discloses a session key generation method and a related device, and relates to the technical field of quantum encryption. When the first SIM card needs to perform information interaction with the second SIM card, a private key team and a public key team can be generated, and the first SIM card is pre-configured with a mixed key encapsulation algorithm, so that the public key team comprises a public key capable of resisting quantum attacks, and after the public key team is sent to the second SIM card, the private key team and the public key team can resist quantum attacks. And the second SIM card can generate key generation information by using an encapsulation algorithm in the mixed key encapsulation algorithm, encrypt the key generation information by using the public key team to obtain ciphertext information, and send the ciphertext information to the first SIM card, so that the first SIM card can decrypt the ciphertext information by using the private key team to obtain the key generation information. Therefore, the session key is obtained.

The invention discloses a digital certificate authentication method and device based on a post-quantum algorithm, equipment and a medium, and relates to the field of information security, and the method comprises the steps: obtaining digital certificate application information of a target entity for auditing; if the digital certificate request passes the verification, analyzing the digital certificate request submitted by the target entity, and obtaining a key encryption key of the digital certificate request by using a post-quantum key encapsulation algorithm after verification; then obtaining user information of the target entity and an active cryptographic algorithm public key value in the digital certificate request, generating an anti-quantum-attack digital certificate according to the user information and a public key, and signing and issuing the anti-quantum-attack digital certificate to the target entity; the digital certificate comprises a post-quantum key packaging public key, a post-quantum signature public key and an active-service public key password public key ciphertext of the entity. According to the application, the public key data of the traditional public key cryptographic algorithm can be protected, the quantum computing attack is resisted, the public key plaintext of the traditional public key cryptographic algorithm can be obtained in the service system, and the influence on the original service using the traditional public key cryptographic algorithm is extremely low.

The invention provides a post quantum cryptography and national cryptographic algorithm hybrid encryption and decryption method and device, and relates to the technical field of password application. The hybrid encryption method comprises the following steps: acquiring a hybrid encryption public key of a receiver and plaintext data to be encrypted, performing de-encapsulation processing on the hybrid encryption public key to obtain a first national cryptographic encryption public key component and a post-quantum key encapsulation public key component, generating a first national cryptographic encryption ciphertext and a post-quantum key encapsulation ciphertext, and transmitting the first national cryptographic encryption ciphertext and the post-quantum key encapsulation ciphertext to the receiver; generating a first temporary key according to a first random number corresponding to the first national cryptographic encryption ciphertext and a symmetric key corresponding to the post-quantum key encapsulation ciphertext, and encrypting the plaintext data to be encrypted by adopting a second national cryptographic encryption algorithm according to the first temporary key to obtain a second national cryptographic message ciphertext, and performing third national cryptographic algorithm hash operation on the to-be-encrypted plaintext data to obtain a message hash value, and performing packaging processing on the first national cryptographic encrypted ciphertext, the post quantum key packaging ciphertext, the second national cryptographic message ciphertext and the message hash value to obtain a mixed encrypted ciphertext.

The invention provides a secure communication method and system based on a QRNG and a Beidou positioning terminal. A sending end and a receiving end of communication preset a pre-shared initial key, and a space-time reference parameter group is obtained through Beidou positioning; a secret key packaging secret key is generated by using a national secret SM4 algorithm; monitoring time-space parameter deviation in a communication process in real time, and triggering a key updating protocol when the time-space parameter deviation exceeds a threshold value; and after the receiving end verifies the Hash verification value, decrypting to obtain the primary encryption key, and restoring the plaintext data. According to the system, the generated true random number sequence is used as an encryption key, so that the unpredictability and randomness of the key are fundamentally enhanced, and quantum computing attack and man-in-the-middle attack are effectively resisted. The use of the pre-shared key mechanism and the key packaging key improves the response speed and efficiency of the communication system. And meanwhile, the position parameter and the timestamp are deeply fused to the key generation process, so that the spatio-temporal information is more difficult to counterfeit, and the defense capability of the system is further improved.

The invention discloses a method for applying an anti-quantum certificate to a TLS1.2 handshake process, which realizes the application of an MLDSA anti-quantum signature algorithm and an MLKEM anti-quantum key encapsulation mechanism in the handshake process by expanding a cipher suite and a signature algorithm field of a TLS1.2 protocol. The method specifically comprises the following steps: defining a cipher suite supporting MLKEM and an MLDSA signature algorithm enumeration value; the client declares algorithm support in ClientHello, and the server responds and returns a certificate chain containing the double-antibody quantum certificate; after the client verifies the certificate, the pre-master key is encapsulated by using MLKEM, and the server de-encapsulates the derived session key; and the two parties send Finished messages to each other to complete handshake. According to the scheme, on the premise that a TLS1.2 basic framework is not changed, the communication security is enhanced through double-resistance quantum algorithm integration, international and national cryptographic algorithms are supported, quantum computing attacks can be resisted, meanwhile, adaptation of the international and national cryptographic algorithms is supported, compatibility with an existing system is ensured, the security risk of a traditional cryptographic algorithm in a quantum environment is solved, and the security risk of the traditional cryptographic algorithm in the quantum environment is reduced. And a standardized solution is provided for anti-quantum upgrade of the TLS1.2 protocol.

Example embodiments of the present disclosure relate to SUCI encryption based on a post quantum key encapsulation mechanism. In an aspect, a terminal device generates a subscription concealed identifier (SUCI) of the terminal device based on a subscription permanent identifier (SUPI) of the terminal device and a public key of a home network of the terminal device, wherein the public key is generated based on a post quantum cryptography (PQC) key encapsulation mechanism (KEM). The terminal device then transmits the SUCI to a network device. According to some embodiments of the present disclosure, a new fully Post Quantum based SUCI ensures to avoid different kinds of attacks.

The invention provides a configuration parameter processing method, electronic equipment and a storage medium, and relates to the field of distributed technologies. The method is applied to a configuration center, and comprises the following steps: receiving key packaging information, a configuration parameter ciphertext and storage request information sent by an application server; randomly selecting an unused target unique identifier according to the storage request information, and inputting the target unique identifier, the key packaging information and the configuration parameter ciphertext into a trusted execution environment for processing to obtain an unpackaging result; determining a storage key according to the deblocking result; when it is detected that the hash value to be verified is equal to the encrypted hash value, an identifier ciphertext and a backup ciphertext of the target unique identifier are obtained through calculation, and the identifier ciphertext is sent to the application server side; and storing the identification hash value and the configuration parameter ciphertext into a parameter database, and storing the backup ciphertext and the pre-stored application identification code into a backup database. According to the method, the storage security of the configuration parameters is improved.

The application discloses a session key generation method and related device, and relates to the technical field of quantum encryption; when a first SIM card needs to interact information with a second SIM card, a private key team and a public key team can be generated; since the first SIM card is pre-configured with a hybrid key encapsulation algorithm, the public key team includes a public key that can resist quantum attacks, so after the public key team is sent to the second SIM card, the second SIM card can generate key generation information by using an encapsulation algorithm in the hybrid key encapsulation algorithm, encrypt the key generation information by using the public key team, obtain ciphertext information, and send the ciphertext information to the first SIM card; in this way, the first SIM card can decrypt the ciphertext information by using the private key team, obtain the key generation information, and thus obtain a session key.

A server and a device can conduct mutually authenticated post-quantum cryptography (PQC) key encapsulation mechanisms (KEM) that also support forward secrecy. The device can store a trusted server public key (PK.server) and the server can store a trusted device public key (PK.device). The device can generate (i) a first KEM ciphertext and (ii) a first key with PK.server and encrypt an ephemeral public key (ePK.device) using the first key. The server can generate (i) a second KEM ciphertext and (ii) a second key with ePK.device. The server can generate (i) a third KEM ciphertext and (ii) a third key with PK.device. The server can encrypt an ephemeral public key (ePK.server) using the first, second, and third keys. The device can generate (i) a fourth KEM ciphertext and (ii) a fourth key with ePK.server. The device can encrypt application data using at least the first, second, third, and fourth keys.

The invention relates to the technical field of quantum computers, in particular to a short message secure transmission method and system based on a post-quantum algorithm and electronic equipment, and the method comprises the steps: obtaining short message data with a signature, and carrying out secret key packaging calculation through employing a first mixed public key provided by a second terminal, thereby obtaining a secret key packaging ciphertext and a symmetric secret key; encrypting the short message data with the signature by using the symmetric key to obtain a short message data ciphertext; the key packaging ciphertext and the short message data ciphertext are sent to a second terminal, and the second terminal decrypts the short message data ciphertext to obtain a short message data plaintext; according to the method and the device, a quantum security resisting key negotiation function is provided for the short message by adopting a mixed key encryption mode, quantum attack resisting protection is provided for the content of the short message, information is prevented from being intercepted or tampered in combination with a signature verification mode, and the security of short message transmission is further improved.

The embodiment of the invention discloses a digital certificate issuing method based on a post-quantum hybrid algorithm and a related device. A user terminal generates three pairs of public and private keys according to an asymmetric encryption algorithm, a post-quantum key signature algorithm and a post-quantum key encapsulation algorithm; generating a certificate signature request according to the mixed public key comprising the first public key and the second public key and the user identification information; the first public key and the third public key are sent to the CA terminal; the CA terminal generates a mixed secret key signature, a packaging certificate, a secret key packaging ciphertext and an encrypted mixed secret key packaging private key according to the two; the user terminal decrypts the secret key packaging ciphertext and the encrypted mixed secret key packaging private key according to the first private key and the third private key to obtain the mixed secret key packaging private key; according to the method, the mixed key signature and the packaging certificate are installed and are bound with the corresponding private key, so that signing and issuing of the mixed key signature and the packaging certificate can be realized, legal use of the certificate in an anti-quantum algorithm scene is ensured, and information security is improved.

The invention discloses a quantum key distribution method and system after satellite communication based on QUIC, and belongs to the field of information security. The method comprises the steps that a two-stage key distribution method is designed, in the first stage, a ground control terminal sends a public key in a public and private key pair generated by a post-quantum key encapsulation algorithm to a satellite terminal requesting to initiate, and the ground control terminal retains a corresponding private key; wherein the public key is used for generating an application key and a key ciphertext, and the private key is used for decrypting the key ciphertext to obtain the corresponding application key; in the second stage, exchange of application keys of the ground control terminal and the satellite terminal is completed; a two-stage key distribution method is integrated with a QUIC protocol, and a next-generation post-quantum encryption algorithm is introduced into the QUIC protocol. The method has the capability of resisting future quantum computing attack, can reduce the computing consumption of the satellite terminal, is low in transformation and migration cost, and is also suitable for multi-scene adaptive use.

The invention relates to the technical field of quantum communication, discloses a quantum key remote security injection method and system based on PQC and zero trust, and aims to solve the problems that post-quantum authentication is high in calculation overhead, difficult in terminal adaptation due to resource limitation and lack of continuous verification capability. The method comprises the following steps: presetting a secret seed; the terminal generates a disturbance public key based on the seed and the basic temporary public key and initiates a request; the server carries out implicit authentication by comparing the disturbance public key and executes key encapsulation to generate a session key; the server encrypts the quantum key and signs and sends the quantum key; and after the terminal verifies the signature, the basic private key is used for de-encapsulation to obtain the quantum key. The system comprises a key injection server, a terminal security agent and a disturbance function module. According to the method, authentication logic is integrated into a cryptographic primitive algebraic structure, so that authentication internal biochemistry and light weight are realized, the terminal power consumption and storage occupation are remarkably reduced, the resource exhaustion attack resistance is enhanced, and the continuous authentication requirement of a zero-trust architecture is met.

The invention provides a key packaging method. The key packaging method comprises the following steps: obtaining key data to be packaged; generating a random disturbance factor, and performing encryption processing on the key data based on the random disturbance factor to obtain target ciphertext data; obtaining authentication data based on the target ciphertext data; and obtaining key encapsulation data at least based on the random disturbance factor, the authentication data and target ciphertext data, the target ciphertext data including updated key data obtained by performing a dynamic refresh operation on the key data during the encryption processing. The invention also provides a key de-encapsulation method.

The invention discloses an anti-quantum-attack lightweight hybrid encryption transmission method and system, and aims to solve the problems that an existing lattice-based encryption algorithm is complex in calculation, high in resource consumption and difficult to adapt to embedded equipment and an internet of things scene. According to the method, a key encapsulation mechanism is constructed based on an LWE problem, key negotiation is performed by using the quantum attack resistance of the key encapsulation mechanism, and encryption transmission is performed on data in combination with a lightweight symmetric encryption algorithm. In the de-encapsulation process, a rapid dimension reduction decoding mechanism is introduced, and dimension reduction mapping is performed on a high-dimensional ciphertext vector and a private key vector through a mapping matrix obtained through training, so that the matrix operation complexity is reduced, and the decryption efficiency is improved. According to the method, the implementation cost and operation burden of an algorithm on an embedded platform can be remarkably reduced while anti-quantum security is kept, and the method is suitable for an Internet of Things terminal, an edge computing node and other low-power-consumption equipment sensitive to security and energy consumption and has good security, light weight and deployment practicability.

A computer processing system configured to perform lattice-based cryptographic primitives with resistance to side-channel attacks with a computer processing architecture operably configured to perform at least one of key generation, key encapsulation, and key decapsulation and process security sensitive data, a sampling submodule performing hashing operations and centered binomial sampling routines, a polynomial arithmetic unit performing polynomial multiplication, polynomial addition, and polynomial subtraction by processing the security sensitive data that is divided into shares stored on a plurality of memory banks, an auxiliary submodule mathematical operations, a data interface unit operably configured to perform input and output operations and to input data and output data in shares, and de-serialize the input data into polynomial coefficients utilized by the polynomial arithmetic unit, and a controller submodule operably configured to sequence any operations needed to perform the at least one of key generation, key encapsulation, and key decapsulation.

Disclosed is a reconfigurable module-lattice-based key encapsulation mechanism (ML-KEM) post-quantum cryptography system and method using memory-based numbers theoretic transform (NTT). A post-quantum cryptography method of a post-quantum cryptography system including a plurality of internal submodules includes reconfiguring the plurality of internal submodules by variably selecting one security level from among the plurality of security levels; reconfiguring execution of the plurality of internal submodules to be changed through a main controller; and variably processing data according to the selected security level to perform key generation, encapsulation, and decapsulation through the reconfigured plurality of internal submodules.

The invention discloses a communication method based on a post-quantum key encapsulation algorithm, which overcomes the problems that in the prior art, TLS protocol communication cannot cope with the threat of a quantum computing technology and is low in security, and comprises the following steps: generating a public and private key pair, and sending a handshake message from a user side to a server side; generating a random message from the message space, packaging the random message and the public key by adopting a quantum key packaging algorithm after CPA security, and sending a handshake message from the server side to the user side; decrypting the private key and the ciphertext and calculating an intermediate variable of the TLS protocol, wherein the user side and the server side receive the intermediate variable required by the negotiation key in the TLS protocol; and the server side calculates the signature information by using the mask function, the user side receives the signature information and compares the signature information with the original signature information, and if the comparison succeeds, data transmission is carried out. Therefore, security guarantee against quantum computing attack is provided for communication, and the communication security is improved.

A server and a device can conduct mutually authenticated post-quantum cryptography (PQC) key encapsulation mechanisms (KEM) that also support forward secrecy. The device can store a trusted server public key (PK.server) and the server can store a trusted device public key (PK. device). The device can generate (i) a first KEM ciphertext and (ii) a first key with PK.server and encrypt an ephemeral public key (ePK. device) using the first key. The server can generate (i) a second KEM ciphertext and (ii) a second key with ePK. device. The server can generate (i) a third KEM ciphertext and (ii) a third key with PK.device. The server can encrypt an ephemeral public key (ePK. server) using the first, second, and third keys. The device can generate (i) a fourth KEM ciphertext and (ii) a fourth key with ePK. server. The device can encrypt application data using at least the first, second, third, and fourth keys.

A server and a device can conduct a secure session with (i) multiple post-quantum cryptography (PQC) key encapsulation mechanisms (KEM) and (ii) forward secrecy. The device can store a server static public key (PK.server) before establishing a secure session with the server. The device can use PK.server to encrypt a device ephemeral public key (ePK.device) into a first ciphertext. The first ciphertext can also include a device digital signature. The server can receive and decrypt the first ciphertext. The server can use the ePK.device to encrypt a server ephemeral public key (ePK.server) into a second ciphertext. The second ciphertext can also include a server digital signature. The device can receive and decrypt the second ciphertext. The device can encrypt application data into a third ciphertext using both PK.server and ePK.server. PK.server can support a first PQC algorithm and ePK.server can support a different, second PQC algorithm.

The invention relates to a key negotiation method and system and computer equipment. The method comprises the following steps: acquiring first vehicle driving information and a post quantum public key; according to the post-quantum public key, based on a post-quantum encapsulation algorithm, performing encapsulation operation to obtain key encapsulation information and a first key; transmitting the secret key packaging information to the vehicle end, so that the vehicle end obtains a second secret key according to the rear quantum private key and the secret key packaging information, and updates a second session key according to the second secret key and the first vehicle driving information; and updating the first session key according to the first key and the first vehicle driving information. The post-quantum key has the characteristic of quantum attack resistance, the first key and the second key are transmitted through the post-quantum key, and the first session key and the second session key are updated in combination with the first vehicle driving information, so that the security during session key negotiation is improved, and the session key is prevented from being leaked.

A server and a device can support secure sessions with both (i) post-quantum cryptography (PQC) key encapsulation mechanisms (KEM) and (ii) session resumption. In an initial secure session, the device and server can mutually generate a first shared secret key K1 from a first KEM based on a device PKI key pair. The device and server can mutually generate a second shared secret key K2 from a second KEM based on a server PKI key pair. The device and server can mutually generate a symmetric ciphering key S2 from both K1 and K2. The server can encrypt an identity for a “pre-shared” secret key (PSK-ID) with S2. The device and server can (i) mutually generate a PSK from both K1 and K2 and (ii) close the initial secure session. The device can transmit a message to resume the session, where the message includes the PSK-ID and a MAC value.

The invention belongs to the technical field of post-quantum cryptography, and particularly relates to a post-quantum key encapsulation method based on modular lattices and lattice coding. The method disclosed by the invention comprises a scale nested lattice code encoding and decoding method based on a Barnes-Wall lattice; an IND-CPA security public key encryption method is adopted; an IND-CCA security key packaging method is adopted; according to the method, a scale nested lattice code encoding and decoding method based on Barnes-Wall lattices is constructed, and a novel error correction mechanism and a ciphertext compression technology are introduced, so that the limitation of an existing lattice-based secret key packaging algorithm on bandwidth performance is broken through, the decryption error rate is reduced, and the communication efficiency and safety are improved. Besides, the method has flexible parameter selection capability, and adaptive parameter configuration can be provided for different security levels so as to meet security requirements of various application scenes.

The invention discloses a TLS1.3 protocol security enhancement method and system based on a homologous cryptographic algorithm, and the method comprises the steps: 1), certificate generation: signing and issuing a certificate through an SQISign signature algorithm, and guaranteeing the verification and use of a post-quantum security signature algorithm through the certificate; and 2) protocol design: the client and the server complete identity verification through certificate verification based on an SQISign signature algorithm in a handshake stage of a TLS 1.3 protocol. And the server uses a FleS public key encryption algorithm to carry out key encapsulation and send the key encapsulation to the client, completes key exchange and establishes secure encryption connection with the client. The step 1) and the step 2) comprise compatibility design, and a homology-based post-quantum algorithm and a traditional cryptographic algorithm are allowed to coexist, so that the compatibility of an existing system is ensured. Through the method provided by the invention, the TLS 1.3 protocol can effectively resist security threats brought by quantum computing, the security of network communication in the quantum era is ensured, and meanwhile, the smooth transition of the existing system is ensured.

The invention discloses a secret key exchange method, system and device and a storage medium, and relates to the field of information security, and the method comprises the steps that a first device and a second device respectively generate respective public and private key pairs; the public and private key pair comprises a public and private key pair of a classic shared key algorithm and / or a public and private key pair of a post-quantum shared key algorithm; furthermore, the first equipment exchanges data with the second equipment; a shared key is established between the first device and the second device through key negotiation or key encapsulation; and finally, the first equipment and the second equipment mutually verify whether the shared keys are consistent or not. The security of the key exchange process is ensured by combining a classical algorithm and a post-quantum algorithm, and the system compatibility and performance are considered while the quantum attack resistance is provided.

The invention discloses a construction method of a hybrid key encapsulation mechanism, which comprises the following steps of: generating a public and private key pair of two PKE (Public Key Exchange) algorithms based on security parameters, and outputting a public and private key pair of the hybrid key encapsulation mechanism; taking a public key of a mixed key encapsulation mechanism as the input of an encapsulation algorithm, randomly selecting two plaintexts, respectively generating ciphertexts through public key encryption algorithms of two PKE algorithms, deriving a shared key through a key derivation function, and outputting the shared key; and taking the ciphertext and the private key of the mixed key encapsulation mechanism as the input of a de-encapsulation algorithm, and outputting a shared key. According to the method, a construction method based on the KEM is not used any more, universal construction of the hybrid KEM based on the PKE scheme is achieved, multiple PKE schemes can be adopted for instantiation, multi-level safety under classical and quantum models is achieved, a key derivation function of the KEM for achieving CPA and CCA safety only depends on a plaintext part, and therefore the key derivation function of the hybrid KEM is independent of the plaintext part. Running efficiency is improved by simplifying hash operations and removing redundant hash operations.