后量子时代,基于格理论的公钥密码被认为是最有前途的抵抗量子计算机攻击的公钥密码体制.然而,相对于格上公钥加密体制和数字签名方案的快速发展,基于格上困难问题的密钥协商协议成果却较少.因此,现阶段如何构建格上安全的密钥协商协议...后量子时代,基于格理论的公钥密码被认为是最有前途的抵抗量子计算机攻击的公钥密码体制.然而,相对于格上公钥加密体制和数字签名方案的快速发展,基于格上困难问题的密钥协商协议成果却较少.因此,现阶段如何构建格上安全的密钥协商协议是密码学领域具有挑战性的问题之一.针对上述问题,基于环上带错误学习问题困难假设,采用调和技术构造了一种新的认证密钥协商协议RAKA(authenticated key agreement protocol based on reconciliation technique),该方案采用格上陷门函数技术提供了单向认证功能,并且在Ring-LWE假设下证明是安全的.与现有的基于LWE的密钥协商协议相比,该方案的共享会话密钥减小为2nlog q,效率更高;同时,由于该方案的安全性是基于格上困难问题,因此可以抵抗量子攻击.展开更多
密文域可逆信息隐藏是一种以密文为载体进行信息嵌入与提取,同时能够对嵌入信息后的密文进行无失真解密并恢复出原始明文的信息隐藏技术,具有隐私保护与信息隐藏双重功能,在密文域数据处理与管理中具有较好的应用前景.因此,提出了一种基...密文域可逆信息隐藏是一种以密文为载体进行信息嵌入与提取,同时能够对嵌入信息后的密文进行无失真解密并恢复出原始明文的信息隐藏技术,具有隐私保护与信息隐藏双重功能,在密文域数据处理与管理中具有较好的应用前景.因此,提出了一种基于R-LWE(ring-learning with errors)的密文域多比特可逆信息隐藏方案.首先使用R-LWE算法对载体明文进行快速高强度加密,然后通过对单位比特明文在密文空间映射区域的重量化以及对应密文的再编码,实现了在密文中嵌入多比特隐藏信息;嵌入信息时,根据加密过程中的数据分布特征来进行嵌入编码,保证了加解密与信息提取的鲁棒性;解密与提取信息时,先计算量化系数,而后采用不同的量化标准分别进行解密或信息提取,实现了解密与提取过程的可分离.分析方案的正确性时,首先推导方案出错的概率,说明了算法中引入的噪声的标准差对方案正确性的影响,然后结合理论分析与实验得出了保证方案正确性的噪声标准差的取值区间;通过推导嵌入后密文的分布函数,分析密文统计特征的变化,论证了密文中嵌入隐藏信息的不可感知性.实验结果表明:该文方案不仅能够实现嵌入后密文的无差错解密与秘密信息的可靠提取,并且单位比特明文在密文域能够负载多比特隐藏信息,密文嵌入率最高可达到0.2353bpb.展开更多
随着量子计算机的发展,传统的公钥加密方案,如RSA加密和椭圆曲线加密算法(Ellipticcurve cryptography,ECC)受到了严重威胁。为了对抗量子攻击,基于格的密码学引起了关注,其中环错误学习(Ring-learning with error,R-LWE)格加密算法具...随着量子计算机的发展,传统的公钥加密方案,如RSA加密和椭圆曲线加密算法(Ellipticcurve cryptography,ECC)受到了严重威胁。为了对抗量子攻击,基于格的密码学引起了关注,其中环错误学习(Ring-learning with error,R-LWE)格加密算法具有电路实现简单、抗量子攻击等优点,在硬件加密领域具有极大的应用潜力。本文从硬件应用的角度,提出并实现了一种R-LWE加密方案中多项式乘法的并行电路结构,采用了数论转换(Number theoretic transforms,NTT)方法,并使用了两个并行的蝶形运算单元。结果表明在增加较少硬件资源的情况下,本文设计的算法提升了42%的运算速度。展开更多
The group signature scheme is an important primitive in cryptography,it allows members in a group to generate signatures anonymously on behalf of the whole group.In view of the practical application of such schemes,it...The group signature scheme is an important primitive in cryptography,it allows members in a group to generate signatures anonymously on behalf of the whole group.In view of the practical application of such schemes,it is necessary to allow users’registration and revocation when necessary,which makes the construction of dynamic group signature schemes become a significant direction.On the basis of(Ling et al.,Lattice-based group signatures:achieving full dynamicity with ease,2017),we present the first full dynamic group signature scheme over ring,and under the premise of ensuring security,the efficiency of the scheme is improved mainly from the following three aspects:the size of keys,the dynamic construction of a Merkle hash tree that used to record the information of registered users,and the reuse of the leaves in this tree.In addition,the public and secret keys of both group manager and trace manager are generated by a trusted third party,which prevents the situation that the two managers generate their respective public key and secret key maliciously.Compared with the counterpart of the scheme in(Ling et al.,Lattice-based group signatures:achieving full dynamicity with ease,2017)over ring,the expected space complexity of the Merkle tree used in our work down almost by half,and the computational complexity of its update has been reduced by a notch because of the dynamic construction of the hash tree.展开更多
The hardness of NTRU problem affects heavily on the securities of the cryptosystems based on it.However,we could only estimate the hardness of the specific parameterized NTRU problems from the perspective of actual at...The hardness of NTRU problem affects heavily on the securities of the cryptosystems based on it.However,we could only estimate the hardness of the specific parameterized NTRU problems from the perspective of actual attacks,and whether there are worst-case to average-case reductions for NTRU problems like other lattice-based problems(e.g.,the Ring-LWE problem)is still an open problem.In this paper,we show that for any algebraic number field K,the NTRU problem with suitable parameters defined over the ring of integers R is at least as hard as the corresponding Ring-LWE problem.Hence,combining known reductions of the Ring-LWE problem,we could reduce worst-case basic ideal lattice problems,e.g.,SIVPγproblem,to average-case NTRU problems.Our results also mean that solving a kind of average-case SVPγproblem over highly structured NTRU lattice is at least as hard as worst-case basic ideal lattice problems in K.As an important corollary,we could prove that for modulus q=Õ(n^(5.5)),average-case NTRU problem over arbitrary cyclotomic field K with[K:Q]=n is at least as hard as worst-case SIVP_(γ)problems over K with γ=Õ(n^(6)).展开更多
The group signature scheme is an important primitive in cryptography,it allows members in a group to generate signatures anonymously on behalf of the whole group.In view of the practical application of such schemes,it...The group signature scheme is an important primitive in cryptography,it allows members in a group to generate signatures anonymously on behalf of the whole group.In view of the practical application of such schemes,it is necessary to allow users’registration and revocation when necessary,which makes the construction of dynamic group signature schemes become a significant direction.On the basis of(Ling et al.,Lattice-based group signatures:achieving full dynamicity with ease,2017),we present the first full dynamic group signature scheme over ring,and under the premise of ensuring security,the efficiency of the scheme is improved mainly from the following three aspects:the size of keys,the dynamic construction of a Merkle hash tree that used to record the information of registered users,and the reuse of the leaves in this tree.In addition,the public and secret keys of both group manager and trace manager are generated by a trusted third party,which prevents the situation that the two managers generate their respective public key and secret key maliciously.Compared with the counterpart of the scheme in(Ling et al.,Lattice-based group signatures:achieving full dynamicity with ease,2017)over ring,the expected space complexity of the Merkle tree used in our work down almost by half,and the computational complexity of its update has been reduced by a notch because of the dynamic construction of the hash tree.展开更多
文摘后量子时代,基于格理论的公钥密码被认为是最有前途的抵抗量子计算机攻击的公钥密码体制.然而,相对于格上公钥加密体制和数字签名方案的快速发展,基于格上困难问题的密钥协商协议成果却较少.因此,现阶段如何构建格上安全的密钥协商协议是密码学领域具有挑战性的问题之一.针对上述问题,基于环上带错误学习问题困难假设,采用调和技术构造了一种新的认证密钥协商协议RAKA(authenticated key agreement protocol based on reconciliation technique),该方案采用格上陷门函数技术提供了单向认证功能,并且在Ring-LWE假设下证明是安全的.与现有的基于LWE的密钥协商协议相比,该方案的共享会话密钥减小为2nlog q,效率更高;同时,由于该方案的安全性是基于格上困难问题,因此可以抵抗量子攻击.
文摘密文域可逆信息隐藏是一种以密文为载体进行信息嵌入与提取,同时能够对嵌入信息后的密文进行无失真解密并恢复出原始明文的信息隐藏技术,具有隐私保护与信息隐藏双重功能,在密文域数据处理与管理中具有较好的应用前景.因此,提出了一种基于R-LWE(ring-learning with errors)的密文域多比特可逆信息隐藏方案.首先使用R-LWE算法对载体明文进行快速高强度加密,然后通过对单位比特明文在密文空间映射区域的重量化以及对应密文的再编码,实现了在密文中嵌入多比特隐藏信息;嵌入信息时,根据加密过程中的数据分布特征来进行嵌入编码,保证了加解密与信息提取的鲁棒性;解密与提取信息时,先计算量化系数,而后采用不同的量化标准分别进行解密或信息提取,实现了解密与提取过程的可分离.分析方案的正确性时,首先推导方案出错的概率,说明了算法中引入的噪声的标准差对方案正确性的影响,然后结合理论分析与实验得出了保证方案正确性的噪声标准差的取值区间;通过推导嵌入后密文的分布函数,分析密文统计特征的变化,论证了密文中嵌入隐藏信息的不可感知性.实验结果表明:该文方案不仅能够实现嵌入后密文的无差错解密与秘密信息的可靠提取,并且单位比特明文在密文域能够负载多比特隐藏信息,密文嵌入率最高可达到0.2353bpb.
基金This work was supported by National Natural Science Foundation of China(Grant No.61379141 and No.61772521)Key Research Program of Frontier Sciences,CAS(Grant No.QYZDB-SSW-SYS035),and the Open Project Program of the State Key Laboratory of Cryptology.
文摘The group signature scheme is an important primitive in cryptography,it allows members in a group to generate signatures anonymously on behalf of the whole group.In view of the practical application of such schemes,it is necessary to allow users’registration and revocation when necessary,which makes the construction of dynamic group signature schemes become a significant direction.On the basis of(Ling et al.,Lattice-based group signatures:achieving full dynamicity with ease,2017),we present the first full dynamic group signature scheme over ring,and under the premise of ensuring security,the efficiency of the scheme is improved mainly from the following three aspects:the size of keys,the dynamic construction of a Merkle hash tree that used to record the information of registered users,and the reuse of the leaves in this tree.In addition,the public and secret keys of both group manager and trace manager are generated by a trusted third party,which prevents the situation that the two managers generate their respective public key and secret key maliciously.Compared with the counterpart of the scheme in(Ling et al.,Lattice-based group signatures:achieving full dynamicity with ease,2017)over ring,the expected space complexity of the Merkle tree used in our work down almost by half,and the computational complexity of its update has been reduced by a notch because of the dynamic construction of the hash tree.
基金supported by the National Key Research and Development Program of China (2018YFA0704702)the National Natural Science Foundation of China (Grant No.61832012).
文摘The hardness of NTRU problem affects heavily on the securities of the cryptosystems based on it.However,we could only estimate the hardness of the specific parameterized NTRU problems from the perspective of actual attacks,and whether there are worst-case to average-case reductions for NTRU problems like other lattice-based problems(e.g.,the Ring-LWE problem)is still an open problem.In this paper,we show that for any algebraic number field K,the NTRU problem with suitable parameters defined over the ring of integers R is at least as hard as the corresponding Ring-LWE problem.Hence,combining known reductions of the Ring-LWE problem,we could reduce worst-case basic ideal lattice problems,e.g.,SIVPγproblem,to average-case NTRU problems.Our results also mean that solving a kind of average-case SVPγproblem over highly structured NTRU lattice is at least as hard as worst-case basic ideal lattice problems in K.As an important corollary,we could prove that for modulus q=Õ(n^(5.5)),average-case NTRU problem over arbitrary cyclotomic field K with[K:Q]=n is at least as hard as worst-case SIVP_(γ)problems over K with γ=Õ(n^(6)).
基金supported by National Natural Science Foundation of China(Grant No.61379141 and No.61772521)Key Research Program of Frontier Sciences,CAS(Grant No.QYZDB-SSW-SYS035)the Open Project Program of the State Key Laboratory of Cryptology.
文摘The group signature scheme is an important primitive in cryptography,it allows members in a group to generate signatures anonymously on behalf of the whole group.In view of the practical application of such schemes,it is necessary to allow users’registration and revocation when necessary,which makes the construction of dynamic group signature schemes become a significant direction.On the basis of(Ling et al.,Lattice-based group signatures:achieving full dynamicity with ease,2017),we present the first full dynamic group signature scheme over ring,and under the premise of ensuring security,the efficiency of the scheme is improved mainly from the following three aspects:the size of keys,the dynamic construction of a Merkle hash tree that used to record the information of registered users,and the reuse of the leaves in this tree.In addition,the public and secret keys of both group manager and trace manager are generated by a trusted third party,which prevents the situation that the two managers generate their respective public key and secret key maliciously.Compared with the counterpart of the scheme in(Ling et al.,Lattice-based group signatures:achieving full dynamicity with ease,2017)over ring,the expected space complexity of the Merkle tree used in our work down almost by half,and the computational complexity of its update has been reduced by a notch because of the dynamic construction of the hash tree.
