CN114065247B - Quantum digital mixing signcryption method - Google Patents

Abstract

The present invention proposes a quantum digital hybrid signcryption method, including a signer negotiating a key with a receiver and a verifier, performing a signcryption operation, and the receiver and the verifier verifying the hybrid signature. The method of the present invention achieves the encryption effect of the plaintext message by mixing a plaintext message, a plaintext summary, and a character string consisting of coefficients of each term except the highest term of an irreducible polynomial. This scheme does not require the use of an additional key to encrypt the plaintext message, effectively saves key resources, and achieves the effect that the plaintext message does not appear directly during the transmission process. At the same time, the hash function used in the signcryption process is improved, so that the receiver and the verifier cannot obtain the irreducible polynomial for generating the hash function in advance before verification, further ensuring the security of the entire signcryption process.

Description

A quantum digital hybrid signcryption method

Technical Field

The present invention relates to the field of quantum security technology, and more specifically, to a quantum digital hybrid signcryption method.

Background technique

Encryption and digital signatures are two basic cryptographic tools that ensure confidentiality, integrity, authenticity, and non-repudiation. Until 1997, they were still considered important but completely different components of various cryptographic systems. In asymmetric key systems, the traditional method is to digitally sign the message first and then encrypt the output (sign-then-encryption). This superposition scheme is inefficient and costly, and there are situations where neither scheme can guarantee security.

Signcryption is a relatively new cryptographic technology. In 1997, Yuliang Zheng proposed the first signcryption scheme. Zheng also proposed a signature encryption scheme based on elliptic curves, which can save 58% of the computational effort and 40% of the communication cost compared to the traditional elliptic curve-based signature-and-encryption scheme. Compared with the traditional sign-then-encryption scheme, signcryption can complete the functions of digital signature and encryption in one logical step, effectively reducing the consumption of computing power and communication loss, and providing the characteristics of digital signature and encryption schemes in a more efficient way.

Currently, most common digital signcryption schemes are based on asymmetric key systems, and their security is based on unproven mathematical calculation problems. With the rapid improvement of classical computing power and the explosive development of quantum algorithms, it will be possible for attackers to brute force various signcryption algorithms in the near future. The security of existing digital signcryption schemes can no longer meet the requirements of ensuring message security while verifying the authenticity of messages in the current rapidly developing digital society.

In summary, the security of existing classical digital signcryption schemes cannot meet the requirements of the current rapidly developing digital society. In addition, when signing long messages, existing schemes also have shortcomings such as too long and too many keys, too low resource utilization, poor system compatibility, and rapidly increasing computational complexity. In this case, it is particularly important and urgent to find an efficient and unconditionally secure quantum digital signcryption scheme.

Summary of the invention

1. Technical problems to be solved

The security of the current classical digital signcryption protocol is under great threat. Many early hash functions and public key algorithms have been broken and are no longer safe. In particular, the emergence of quantum computers in the future will also pose a fatal threat to the algorithm security of the current digital signcryption protocol. At the same time, in the traditional signcryption scheme, the transmitted plaintext message needs to be encrypted, which will consume an additional encryption key and occupy additional communication resources. In order to solve the above problems, the present invention proposes a quantum digital hybrid signcryption method.

2. Technical solution

The present invention proposes a quantum digital hybrid signcryption method, the method comprising:

The signatory party negotiates keys with the receiving party, and each obtains a first Hash function key and a first key respectively; the signatory party negotiates keys with the signature verification party, and each obtains a second Hash function key and a second key respectively;

The signer uses the negotiated key to perform a hybrid signcryption operation on the message plaintext and sends the obtained hybrid signature to the recipient;

The receiver sends the received mixed signature and the two sets of keys negotiated with the signer to the verifier;

The verification party sends the two sets of keys negotiated between it and the encryption party to the receiving party;

The receiver and the verifier perform signcryption verification on the hybrid signature respectively. If both parties pass the verification, the signcryption is successful. Otherwise, the signcryption process is executed again.

Furthermore, the hybrid signcryption operation includes the following steps:

(1) The signatory obtains a set of random numbers from the local computer to generate an irreducible polynomial;

(2) The signatory obtains the signatory's third Hash function key for generating a Hash function by using the first Hash function key and the second Hash function key negotiated with the recipient and the verifier;

(3) The signer selects an irreducible polynomial and a third hash function key to generate a hash function based on a linear shift register;

(4) The signatory uses the hash function to perform a hash operation on the plaintext message to obtain a plaintext summary;

(5) The signatory mixes the plaintext message, the plaintext summary, and the character string consisting of the coefficients of each term except the highest term in the irreducible polynomial according to a preset rule to obtain a mixed summary;

(6) The signatory obtains the signatory's third key for encryption using the first key and the second key negotiated with the recipient and the verifier;

(7) The signatory uses the third key to unconditionally and securely encrypt the mixed digest to obtain a mixed signature.

Furthermore, the generation process of the irreducible polynomial is:

1) First, use each bit of the random number to correspond to the coefficient of each term in the polynomial except the highest term, and generate a polynomial in the GF(2) field, where the coefficient of the highest term is 1;

2) Then, verify whether the polynomial is an irreducible polynomial. If the verification result is "no", obtain another set of random numbers from the local of the signatory party and return to step 1) as new random numbers to regenerate the polynomial and verify it; if the verification result is "yes", stop the verification and obtain an irreducible polynomial.

Furthermore, the method for verifying whether a polynomial is an irreducible polynomial is:

Verify in sequence Is it established? Express Round up. If the verification is passed for all i, then p(x) is an irreducible polynomial of order n over GF(2); where gcd(f(x), g(x)) represents the greatest common divisor of f(x) and g(x) over GF(2), and f(x) and g(x) are two arbitrary polynomials.

Furthermore, the method for verifying whether a polynomial is an irreducible polynomial is:

Verification conditions(1) (2) Whether it is established at the same time, express The remainder of is the same as the remainder of x mod p(x), d is an arbitrary prime factor of n, gcd(f(x), g(x)) represents the greatest common divisor of f(x) and g(x) over GF(2), f(x) and g(x) are two arbitrary polynomials, and when both verification conditions are met, then p(x) is an irreducible polynomial of order n over GF(2).

Furthermore, before step 1), if the last digit of the random number is 0, the last digit of the random number is set to 1; or if the last digit of the n-digit random number is 0, a random number is regenerated until the last digit of the generated random number is 1.

Furthermore, the hash function is a Toeplitz matrix hash function based on a linear shift register.

Furthermore, the signcryption verification includes the following steps:

(1) The receiving party and the signature verifier obtain a fourth Hash function key based on the first Hash function key and the second Hash function key respectively possessed by them, and obtain a fourth key based on the first key and the second key;

(2) The recipient and the verifier use their respective fourth keys to decrypt the mixed signature and obtain a mixed digest;

(3) Separating the mixed summary according to a preset rule to obtain a string consisting of the plaintext message, the inverse plaintext summary, and the coefficients of each term in the irreducible polynomial except the highest term;

(4) Corresponding each bit of the string to the coefficient of each term in the polynomial except the highest term, generates an irreducible polynomial whose highest term coefficient is 1;

(5) obtaining a linear shift register-based hash function using the irreducible polynomial and a third hash function key;

(6) performing a hash operation on the plaintext message using the hash function to obtain a plaintext digest;

(7) Determine whether the forward plaintext digest and the reverse plaintext digest are equal. If they are equal, accept the signature; otherwise, reject the signature.

Furthermore, in the present invention, the length of the plaintext message is m, the length of the first hash function key and the second hash function key is n, and the length of the first key and the second key is 2n+m.

3. Beneficial effects

Compared with the prior art, the advantages of the present invention are:

(1) The quantum digital hybrid signcryption method proposed in the present invention adopts a hybrid method to achieve the effect of encrypting the required plaintext message for transmission, without consuming additional encryption keys, greatly saving key resources and reducing the operational complexity of the three-party processing process;

(2) The present invention proposes a quantum digital hybrid signcryption method, whose unconditional security is guaranteed by the one-time-one-key technology proven by information theory and the one-time-one-hash technology based on non-fixed irreducible polynomials. The security of the hash function used in the signcryption process is jointly ensured by the irreducible polynomial and the hash function key. The irreducible polynomial depends on the local random number of the signer, which will not be known in advance by the recipient and the verifier before the signcryption process, thus ensuring the security of the entire signcryption process;

(3) The signcryption method described in the present invention can be used to signcrypt messages of any length with high efficiency and security.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the hybrid signcryption process.

Detailed ways

According to the consensus of cryptography, a quantum digital hybrid signcryption scheme proposed in the present invention has three participants: the signer Alice, the receiver Bob and the verifier Charlie, denoted as A, B and C respectively. The plaintext message to be transmitted is M, and its length is m.

The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments.

The specific process of a quantum digital hybrid signcryption method proposed in the present invention is shown in FIG1 , and includes the following steps:

1. The signer A and the receiver B perform key negotiation, and each obtains the first hash function key _Lab and the first key _Rab respectively. The signer A and the verifier C perform key negotiation, and each obtains the second hash function key _Lac and the second key _Rac respectively. The length of the first hash function key _Lac and the second hash function key _Lac is n, and the length of the first key _Rab and the second key _Rac is 2n+m. In actual use, the length of n is 128, which is sufficient to ensure the security of the entire signcryption process.

2. Signer A uses the negotiated key to perform a hybrid signcryption operation on the message plaintext, as follows:

(1) The signatory A obtains a set of random numbers k of length n from the local computer to generate an irreducible polynomial p(x), which is:

First, use each bit of the n-bit random number k to correspond to the coefficient of each term in the polynomial except the highest term, and generate an n-order polynomial in the GF(2) field, where the coefficient of the highest term is 1; for example, the random number k = ( _an-1 , _an-2 , ..., _a1 , _a0 ), then the generated polynomial is p(x) = ^xn + _an-1 ^xn-1 + ... + _a1 x + _a0 ; preferably, only when _a0 = 1, the generated polynomial may be an irreducible polynomial. Therefore, in order to reduce the amount of calculation in the subsequent verification of the irreducible polynomial, the n-bit random number k can be judged first: if a0 = 0, then let a0 = 1, and then generate an n-order irreducible polynomial in the GF( ₂ ) field; or if _a0 = 1, then let _a0 = 1, and then generate an n-order irreducible polynomial in the GF(2) field; =0, then regenerate an n-bit random number until the last bit of the generated random number is 1, and then use the newly generated random number to generate an n-order irreducible polynomial in the GF(2) field; this can reduce the amount of calculation when verifying the irreducible polynomial later, and finally make a ₀ =1, and the generated polynomial is p(x) = x ⁿ + a _n-1 x ^n-1 +…+a ₁ x+1;

Then, verify whether this polynomial is an irreducible polynomial. If the verification result is "no", directly generate another set of n-bit random numbers from the random number generator at the sending end, and return this random number as a new n-bit random number to the previous step to regenerate the polynomial and verify it; if the verification result is "yes", stop the verification and obtain the irreducible polynomial p(x).

There are many ways to verify the irreducible polynomial here, and the two methods mentioned in this invention are preferred:

Method 1: Verify one by one Is it established? Express Round up. If the verification is passed for all i, then p(x) is an irreducible polynomial of order n over GF(2); where gcd(f(x), g(x)) represents the greatest common divisor of f(x) and g(x) over GF(2), and f(x) and g(x) are two arbitrary polynomials.

Method 2: Verification conditions (1) (2) Whether it is established at the same time, express The remainder of is the same as the remainder of x mod p(x), d is an arbitrary prime factor of n, gcd(f(x), g(x)) represents the greatest common divisor of f(x) and g(x) over GF(2), f(x) and g(x) are two arbitrary polynomials, and when both verification conditions are met, then p ₁ (x) is an irreducible polynomial of order n over GF(2).

Generally, n = 2 ^k , so in condition (2) only d = 2 is needed. Alternatively, n = 2 ⁷ = 128. Since this method only needs to verify these two conditions, we use the Fast modular composition algorithm to quickly obtain and use Replace condition (2) Perform calculations and obtain results faster by reducing the order.

(2) The signer A uses the first hash function key _Lab and the second hash function key Lac negotiated with the receiver B and the verifier C to obtain the signer's third hash function key _La for generating the hash function. In this embodiment, _a one-time-one-key XOR operation is preferred, that is,

(3) The signatory A selects the irreducible polynomial p(x) and the third hash function key _La to generate a hash function based on a linear shift register: Preferably, this embodiment selects a linear shift register based Toeplitz matrix (LFSR-Toeplitz) hash function

(4) Signatory A uses this hash function Perform a hash operation on the plaintext message M to obtain the plaintext digest;

(5) The signer A mixes the plaintext message M, the plaintext digest digest, and the string str1 consisting of the coefficients of each term except the highest term in the irreducible polynomial according to a preset rule to obtain a mixed digest Mdigest, where Mdigest = (M, digest, str1). The preset rule here can be agreed upon in advance by the signer A, the receiver B, and the verifier C.

(6) Encryptor A uses the first key _Rab and the second key _Rac negotiated with receiver B and verifier C to obtain the third key _Ra for encryption. The length of the third key _Ra is m+2n.

(7) Signatory A uses the third key _Ra to unconditionally and securely encrypt the mixed digest Mdigest, using an exclusive OR operation to obtain the mixed signature sig, that is,

3. Signature party A sends the obtained mixed signature sig to recipient B;

4. After receiving the mixed signature sig, the receiver B sends the mixed signature sig and the first hash function key L _ab and the first key R _ab negotiated with the signer A to the verifier C;

5. After receiving the information sent by the recipient B, the signature verifier C sends the second hash function key _Lac and the second key _Rac negotiated with the signer A to the recipient B;

The information sent between the receiver B and the signature verifier C is transmitted through an authenticated classic channel to prevent tampering.

6. The recipient B and the signature verifier C perform signcryption verification on the hybrid signature respectively. The verification process of the two parties is the same, so this embodiment takes the verification process of the recipient B as an example to specifically illustrate the process of signcryption verification. The details are as follows:

(1) After the above steps 4 and 5, the receiver B has the first hash function key _Lab and the first key Rab negotiated between itself and the signer A, as well as the second hash function key _Lac and the second key Rac sent by the signer _{C. The receiver B uses} the same processing method as the signer A to obtain the fourth hash function key _La ' for generating the hash function using the first hash function key _Lab and the second hash function key _Lac , and obtains the fourth key _Ra ' for decryption using the first key _Rab and the second key _Rac .

(2) The receiver B uses the fourth key _Ra ' to decrypt the received mixed signature sig to obtain the mixed digest Mdigest;

(3) Separate the mixed digest Mdigest according to a preset rule to obtain a string str1 consisting of the plaintext message M, the inverse plaintext digest digest ^b′ , and the coefficients of each term in the irreducible polynomial except the highest term;

(4) Correspond each bit of the string str1 to the coefficient of each term in the polynomial except the highest term, and generate an irreducible polynomial p(x)′ whose highest term coefficient is 1;

(5) Using the irreducible polynomial p(x)′ and the fourth hash function key _La ′, we obtain the linear shift register-based hash function

(6) Using hash functions Perform a hash operation on the plaintext message M to obtain the plaintext digest ^b ;

(7) Determine whether the plaintext digest ^b is equal to the reverse plaintext digest ^b′ . If they are equal, the recipient B accepts the signature; otherwise, the signature is rejected.

The signature verifier C performs the same method as the receiver B to verify the signcryption. Only when both the receiver B and the signature verifier C pass the verification and accept the signature, can the entire signcryption process be considered successful. Otherwise, as long as Party B does not accept it, the signcryption process fails and needs to be repeated.

After the above process, the receiver B can already obtain the plaintext information M that the signer needs to send. During the entire transmission process, there is no need to use an additional key to encrypt the plaintext, and the plaintext does not appear separately during the entire information transmission process. The use of the hybrid signcryption method greatly saves key resources, reduces the encryption process by the signer and the decryption process by the receiver, and reduces the operational complexity of the processing process.

The hash function based on the linear shift register used in the solution of the present invention can signencrypt messages of any length, thereby realizing the signencryption of long messages with high efficiency and security.

Claims (8)

1. A quantum digital hybrid signcryption method, characterized in that the method comprises: The signatory party negotiates keys with the receiving party, and each obtains a first Hash function key and a first key respectively; the signatory party negotiates keys with the signature verification party, and each obtains a second Hash function key and a second key respectively; The signer uses the negotiated key to perform a hybrid signcryption operation on the message plaintext and sends the obtained hybrid signature to the recipient; The receiver sends the received mixed signature and the two sets of keys negotiated with the signer to the verifier; The verification party sends the two sets of keys negotiated between it and the encryption party to the receiving party; The receiver and the verifier perform signcryption verification on the hybrid signature respectively. If both parties pass the verification, the signcryption is successful. Otherwise, the signcryption process is executed again. The hybrid signcryption operation includes the following steps: (1) The signatory obtains a set of random numbers from the local computer to generate an irreducible polynomial; (2) The signatory obtains the signatory's third Hash function key for generating a Hash function by using the first Hash function key and the second Hash function key negotiated with the recipient and the verifier; (3) The signer selects an irreducible polynomial and a third hash function key to generate a hash function based on a linear shift register; (4) The signatory uses the hash function to perform a hash operation on the plaintext message to obtain a plaintext summary; (5) The signatory mixes the plaintext message, the plaintext summary, and the character string consisting of the coefficients of each term except the highest term in the irreducible polynomial according to a preset rule to obtain a mixed summary; (6) The signatory obtains the signatory's third key for encryption using the first key and the second key negotiated with the recipient and the verifier; (7) The signatory uses the third key to unconditionally and securely encrypt the mixed digest to obtain a mixed signature. 2. A quantum digital hybrid signcryption method according to claim 1, characterized in that the generation process of the irreducible polynomial is: 1) First, use each bit of the random number to correspond to the coefficient of each term in the polynomial except the highest term, and generate a polynomial in the GF(2) field, where the coefficient of the highest term is 1; 2) Then, verify whether the polynomial is an irreducible polynomial. If the verification result is "no", obtain another set of random numbers from the local of the signatory party and return to step 1) as new random numbers to regenerate the polynomial and verify it; if the verification result is "yes", stop the verification and obtain an irreducible polynomial. 3. A quantum digital hybrid signcryption method according to claim 2, characterized in that the method for verifying whether a polynomial is an irreducible polynomial is: Verify in sequence whether gcd(p(x),x ²ⁱ -x) = 1 holds, where Express Round up. If the verification is passed for all i, then p(x) is an irreducible polynomial of order n over GF(2); where gcd(f(x), g(x)) represents the greatest common divisor of f(x) and g(x) over GF(2), and f(x) and g(x) are two arbitrary polynomials. 4. A quantum digital hybrid signcryption method according to claim 2, characterized in that the method for verifying whether a polynomial is an irreducible polynomial is: Verification condition 1: Condition 2: Whether it is established at the same time, express The remainder of is the same as the remainder of xmodp(x), d is an arbitrary prime factor of n, gcd(f(x), g(x)) represents the greatest common divisor of f(x) and g(x) over GF(2), f(x) and g(x) are two arbitrary polynomials, and when both verification conditions are met, then p(x) is an irreducible polynomial of order n over GF(2). 5. A quantum digital hybrid signcryption method according to claim 2, characterized in that, before step 1), if the last digit of the random number is 0, the last digit of the random number is set to 1; or if the last digit of the n-digit random number is 0, a random number is regenerated until the last digit of the generated random number is 1. 6. A quantum digital hybrid signcryption method according to claim 1, characterized in that the hash function is a Toeplitz matrix hash function based on a linear shift register. 7. A quantum digital hybrid signcryption method according to claim 1, characterized in that the signcryption verification comprises the following steps: (1) The receiving party and the signature verifier obtain a fourth Hash function key based on the first Hash function key and the second Hash function key respectively possessed by them, and obtain a fourth key based on the first key and the second key; (2) The recipient and the verifier use their respective fourth keys to decrypt the mixed signature and obtain a mixed digest; (3) Separating the mixed summary according to a preset rule to obtain a string consisting of the plaintext message, the inverse plaintext summary, and the coefficients of each term in the irreducible polynomial except the highest term; (4) Corresponding each bit of the string to the coefficient of each term in the polynomial except the highest term, generates an irreducible polynomial whose highest term coefficient is 1; (5) obtaining a linear shift register-based hash function using the irreducible polynomial and a third hash function key; (6) performing a hash operation on the plaintext message using the hash function to obtain a plaintext digest; (7) Determine whether the forward plaintext digest and the reverse plaintext digest are equal. If they are equal, accept the signature; otherwise, reject the signature. 8. A quantum digital hybrid signcryption method according to any one of claims 1 to 6, characterized in that the length of the plaintext message is m, the length of the first hash function key and the second hash function key is n, and the length of the first key and the second key is 2n+m.