CN111756727A - McElience system encryption and decryption method based on QC-LDPC code - Google Patents

Abstract

The invention belongs to the field of cryptography based on error correction coding, and particularly relates to an McElience system encryption and decryption method based on QC-LDPC codes. In the field of error correction coding, the matrix decomposition problem cannot be overcome by quantum computers at present. Therefore, a variant McElience encryption and decryption system based on the QC-LDPC code is proposed based on a matrix decomposition problem. In the system, the client side adopts two public keys for encryption, the security is based on the problem that two large matrices are difficult to decompose, and the security level is higher. During decryption, the server side directly utilizes the Q decoder for decryption, and compared with the traditional BF decoding, the server side has higher decoding performance. In conclusion, the variant M system can replace an RSA public key encryption algorithm in the HTTPS protocol, so that the protocol is safer and can resist quantum attack.

Description

McElience system encryption and decryption method based on QC-LDPC code

Technical Field

The invention belongs to the technical field of cryptography, and particularly relates to an McElience system encryption and decryption method based on QC-LDPC codes.

Background

In computer and communication networks, nodes in the network or users communicate with each other continuously, and the security of the communicated information is important nowadays. In the existing computer network, when a client or a browser communicates with a server, an HTTPS protocol is used, and the protocol has a main idea that symmetric keys are encrypted by using a public key cryptography theory, so that the client and the server have the same symmetric key, and then the symmetric keys are used for communication. A common public-key cryptography technique in use today is the RSA algorithm. The security of the RSA algorithm is based on the large integer decomposition difficulty problem. However, the quantum computing technology is developed rapidly at present, and a cryptosystem based on the problems of large integer decomposition and discrete logarithm difficulty is no longer safe. In the quantum computing era, a public key cryptosystem based on error correction coding can resist quantum attack, and a quantum computer cannot attack the problems of matrix decomposition and linear code decoding in an error correction code. Many researchers have begun studying the theory of cryptography based on error correcting codes. In the field of encryption algorithms, a scholars Goppa firstly proposes a McElience system based on Goppa codes, but the size of a check matrix of Goppa is too large to be practical, and later scholars such as Baldi and the like propose the McElience system based on QC-LDPC codes to reduce the storage space of public keys.

Disclosure of Invention

The invention aims to solve the problems, and aims to ensure that the HTTPS protocol of the network is more secure and can resist quantum attack. The RSA public key algorithm used in the protocol is replaced by a public key algorithm based on QC-LDPC codes, so that the original HTTPS protocol is safer and can resist quantum attack. In an error correcting code public key algorithm, in order to improve the decryption accuracy of the traditional McElience system based on QC-LDPC codes and the security of the system, an improved McElience system is provided based on the system. For convenience of description, the proposed modified mcelice regime will be referred to as the variant mcelice regime. In the variant McElience system, in order to directly utilize Q decoder decoding, a double public key is introduced for encryption, compared with BF decoding, the decryption performance is greatly improved, and due to the introduction of the double public key, the security of the system is based on the problem that two matrixes are difficult to decompose, so that the security is also greatly improved.

In order to make the technical scheme of the present invention easier to understand, some of the techniques employed in the present invention are explained as follows:

the check matrix H size of the QC-LDPC code is (n-k) x n. The size of the generator matrix G is k × n. The matrix H, G is used as the private key of the server side.

When introducing the public and private keys of the server side, the method applies to the circulant matrix, and the definition of the circulant matrix is given here.

The circulant matrix form is as follows. As long as its first row element is known, the elements of all following rows are based on cyclic shifts of the first row element. Assume a is a circulant matrix.

The order of the circulant matrix described below is p, and the row weight of the circulant matrix, i.e., the number of elements 1 in the first row of the circulant matrix. The circulant matrix is generated later in such a way that the elements of the first row are randomly generated based on the row weight, and then the entire circulant matrix is obtained based on the circulant characteristic. Thus, even if the row weights of several circulants are consistent, the resulting circulants may not be the same because the first row is randomly generated. The quasi-cyclic matrix mentioned later is formed by splicing a plurality of cyclic matrices.

The following describes a specific generation method of several private keys at the server side.

The server side needs to generate two random quasi-cyclic matrixes, Q, of n × n₁And Q₂. These are two private keys. And n is₀·p＝n，Q₁And Q₂Are all composed of n₀×n₀And p-order cyclic matrixes. The circulant matrix is determined by the first row of the matrix because each row element in the matrix is cyclically shifted right by one bit from the previous row. The server side generates a cyclic matrix through randomly generating the first row elements of the matrix and then through cyclic shift. Q₁And Q₂The general form Q of (a) is as follows.

Wherein Q is_i,j(0≤i≤n₀-1,0≤j≤n₀-1) is also a circulant matrix of order p. Each of Q_i,jRow rearrangement ofTo w (Q):

it can be seen that both the row and column weights of Q are

Q has a size of (n)₀·p)·(n₀P). By generating each circulant matrix Q_i,j(0≤i≤n₀-1,0≤j≤n₀-1), and finally the matrix Q is obtained by stitching. Q₁And Q₂Is the form produced by this method. Although Q is₁And Q₂Is consistent, the generation method is also consistent, but since the first row of the circulant matrix therein is randomly generated, Q is₁And Q₂And not the same.

Another private key H at the server side is shown below

H is a radical of n₀And each cyclic matrix block. H_i(0≤i≤n₀-1) is one of the circulant matrices, of order p, so that the size of H is p × (n)₀P). The row weight of each circulant matrix is d_v. The code rate of the QC-LDPC code is (n)₀-1)/n₀. Assume that the error correction capability of the H matrix is t'. After the elementary transformation, the check matrix H can be transformed as follows:

that is to

The inverse matrix of (c). I is_n-kIs a unit matrix of order n-k.

According to H.G^T＝0，G^TRepresenting the transpose of matrix G. The check matrix H may be converted to a generator matrix G, the expression of which is shown below. Where the symbol T represents the transpose of a certain matrix. I denotes a unit matrix of order k.

The private key matrix S at the server side is a k-order invertible quasi-cyclic matrix. S is represented by k₀×k₀And p-order cyclic matrixes. And the parameter satisfies k ═ k₀× p. its form is shown below.

Wherein S is_i,j(0≤i≤k₀-1,0≤j≤k₀-1) is also a circulant matrix of order p. Each of S_i,jRow reconstruction of (c) w (S):

it can be seen that both the row weight and the column weight of S are

When in use

With an odd number, the matrix S is invertible. The size of S is (k)₀·p)·(k₀·p)。

The technical scheme of the invention is as follows:

the McElience system encryption and decryption method based on the QC-LDPC code is characterized by comprising the following steps of:

s1, generating private key Q by server side₁、Q₂S, H, G, public key SGQ₂、

Wherein Q is₁、Q₂S, H, G are given the detailed expression description before. This is briefly described here. Q₁And Q₂For a random quasi-cyclic matrix of n × n, assume Q₁And Q₂The row weight of (c) is h. S is a k-th order invertible quasi-cyclic matrix with the row weight of S being q. To ensure Q₁、Q₂S is reversible, h and q are odd numbers; g is generated based on the check matrix H of the QC-LDPC code,

i is a unit matrix of order k;

the server sends the public key to the client;

s2, the client side encrypts to obtain a ciphertext c in the following way:

where e is a randomly generated error vector, the weight is t, the length is n bits, m is the plaintext, which is also the symmetric key generated by the client, and the length is k bits. The client sends the ciphertext c to the server;

and S3, the server side decrypts the ciphertext c:

s31, multiplying on the right side of c

To obtain

S32, calculating through the matrix H

By means of a Q decoder, H, s and Q are input₁Decoding output e, wherein t.h is less than or equal to t';

s33, calculating

And mixing it with

Adding and offsetting to obtain mSG, and because the k columns before G are unit arrays, mS can be directly obtained;

s34, multiplying S to the right at mS^-1And obtaining a plaintext m, namely a symmetric key.

In the above scheme, the decoding process of the adopted Q decoder is as follows: input to the Q decoder is the sum matrix H, Q₁. The output is e. Q decoder performs up to l_maxAnd in the second iteration, either e is output or decryption fails. The first iteration of the algorithm is now shown. It should be noted that: the initial value of the algorithm is s⁽⁰⁾＝(s)^T,

(n-bit all-zero vector). The data to be processed in the first iteration is s^(l-1)And

the data outputted is s^(l)And

the algorithm for the ith iteration is as follows:

①, server side computation

Wherein, sigma^(l)The number of check equations representing the errors involved in all codeword bits of a certain codeword. The number is [0, d ]_v]In the meantime. Sigma^(l)The value of some positions is larger, which indicates that the position corresponds to e ═ e · Q₁ ^TIn the vector, 1 is more likely. I.e., ∑^(l)And e' have an intrinsic relationship, according to ∑^(l)E' can be estimated.

②, server side computation

③, calculating

④, update

As follows:

wherein the content of the first and second substances,

is shown except for ζ^(l)The element at these positions is a 1, and the other positions are n-bit vectors of 0.

Fifthly, updating the syndrome as follows:

wherein q is_vRepresents Q₁ ^TRow v.

⑥ if s^(l)If it is zero vector, stopping decoding and returning decoding result

If s is^(l)Is a non-zero vector and the number of iterations l is less than l_maxGo back to step ① and continue the iteration if the number of iterations l ≧ l_maxAnd quitting the decoding algorithm and returning a decoding failure result.

The variable McElience system based on the QC-LDPC codes has the capability of resisting the attack of the current quantum computer, the safety of the variable McElience system is based on the problem of large matrix decomposition, and the variable McElience system based on the QC-LDPC codes is difficult to effectively crack by quantum computation. The confidentiality of the transmission symmetric key can be ensured. And because of using the excellent Q decoder of performance, the decryption accuracy of variant M system is higher, because of introducing the pair of public keys at the same time, the system will be based on the difficult problem of two large matrix decompositions, has also improved the security level. Therefore, in the current quantum computing era, the variant M system can be used to replace the RSA public key algorithm in the HTTPS protocol.

Drawings

When fig. 1 n is 1899, the decryption performance of the improved M scheme is compared with that of the original M scheme;

fig. 2 n 1266 shows a comparison between the decryption performance of the improved M scheme and that of the original M scheme;

when fig. 3 n is 1899, the decryption performance of the M variant and the original M system is compared with the row weight of the check matrix;

when fig. 4 n is 1266, the decryption performance of the M variant and the original M system is compared with the row weight of the check matrix.

Detailed Description

The technical scheme of the invention is described in detail in the following with the accompanying drawings and simulation examples:

taking QC-LDPC codes with different code lengths and code rates as an example; first, the simulation parameters are 1899 for the code length n, 633 for p, and n₀＝3，k₀The code rate is 2/3, the number of simulated frames is 1000, the row weight of the check matrix is 9, d _v3. Q in variant M regime₁And Q₂Has a row weight of 3, and the elements w (Q) in the formula (2) are all 1. In the formula (5)

Wherein g is₀＝1，g₁2. The row weight q of the matrix S is 3. The simulation curve obtained under the parameters is shown in fig. 1. Meanwhile, simulation comparison is performed when the parameters are that the code rate is 1/2, the code length is 1266, and the row weight of the check matrix is 10, and the comparison graph is shown in fig. 2. Finally, under two code lengths 1899 and 1266, the influence of the row repetition of the check matrix on the decryption performance in the variant M system is obtained through simulation. And compared with the original M system. The comparative figures are shown in fig. 3 and 4, respectively.

As can be seen from the above sets of simulation comparison graphs, no matter the error vector weight changes or the rows of the check matrixIn a further variation, decryption performance is improved after the Q decoder is used in the modified M scheme. In general, the frame error rate of fig. 2 is higher than that of fig. 1, and the decryption performance is somewhat reduced because the check matrix corresponding to fig. 2 is more dense. Similarly, the frame error rate of fig. 4 is higher than that of fig. 3. It was also found on the above simulation chart that even for a Q decoder, there is still a small error rate for decryption at an error vector weight of 3 or 4. This is due to the fact that, firstly, BF decoding has a probabilistic decoding characteristic, and since a Q decoder is an improved algorithm based on a BF decoder, even if the weight of an error vector is small, it is likely to have a decoding error. Secondly, the error correction capability is not high due to the small code length setting. Because decryption requires solving the matrix Q₂The code length of the inverse matrix is too long, and the calculation time is too long. Therefore, medium code length simulations were chosen. As shown in FIG. 1, when the code length is 1899, i.e., the p value is 633, n₀＝3,d_vWhen the error correction capability of the Q decoder is 3, the error correction capability of the Q decoder is 4.

If the method is applied in practice, the inverse matrix of Q is calculated before communication at the server end, and direct operation is needed when decryption is carried out. And the code must have strong enough error correction capability, so the code length is long enough, and the check matrix is sparse enough. With the increase of the code length and the sparser check matrix, the decryption performance is better. However, because the Q decoder has a probabilistic decoding characteristic, when a suitable parameter is selected, few decoding errors still occur, which can be solved by retransmission mechanisms of both communication parties. And the client resends the message with the decryption error to complete the complete, accurate and safe transmission of the information. The message encrypted and decrypted by the variant M system is a symmetric key, and when the client and the server obtain the same symmetric key, symmetric communication is performed.

Claims (1)

1. The McElience system encryption and decryption method based on the QC-LDPC code is characterized by comprising the following steps of:

s1, generating private key Q by server side₁、Q₂S, G, public key SGQ₂、

The server sends the public key to the client; wherein Q is₁And Q₂Quasi-cyclic matrix of random n × n, Q₁And Q₂The row weight of (a) is h; s is a k-order reversible quasi-cyclic matrix, the row weight of S is q, and h and q are odd numbers; generating G by using a check matrix H based on QC-LDPC codes, wherein H is defined by n₀Made up of blocks of circulant matrices of order p, i.e.

H has a size p × (n)₀P) code rate of QC-LDPC code is (n)₀-1)/n₀Transforming the check matrix H into a first class transform

That is to

Inverse matrix of (I)_n-kIs a unit matrix of order n-k, according to H.G^T＝0，G^TExpressing the transposition of the matrix G, converting the check matrix H into a generating matrix G, and obtaining the expression of G as

I is a unit matrix of order k;

s2, the client side encrypts to obtain a ciphertext c in the following way:

where e is a randomly generated error vector, weight is t, length is n bits; m is a plaintext, is a symmetric key generated by a client, and has a length of k bits; the client sends the ciphertext c to the server;

and S3, the server side decrypts the ciphertext c:

s31, multiplying on the right side of c

To obtain

S32, calculating through the matrix H

By means of a Q decoder, H, s and Q are input₁Decoding output e;

s33, calculating

And mixing it with

Adding and canceling to obtain mSG, wherein mS can be directly obtained because the front k columns of the matrix G are unit arrays;

s34, multiplying S to the right at mS^-1And obtaining a plaintext m, namely a symmetric key.

Images