CN110519219B - Lattice-based password authentication key exchange method and system - Google Patents

Abstract

The invention discloses a lattice-based password authentication key exchange method and a lattice-based password authentication key exchange system. The invention uses error coordination mechanism AKC, when two parties exchange information seed, y_CAnd y_SAnd respectively calculating two approximate values sigma according to the information_CAnd σ_SFrom which the same coordination values can be coordinated for subsequent authentication and session key derivation. The signal value generated by AKC is independent of the coordination value, and the coordination value is uniformly distributed, so that the information of the coordination value cannot be deduced from the signal value even if an adversary acquires the signal value, and the safety of the scheme is ensured. The invention greatly improves the response efficiency of the server, and enables the scheme to be more suitable for the high concurrency condition that a large number of clients are connected with the server at the same time.

Description

Lattice-based password authentication key exchange method and system

Technical Field

The invention belongs to the technical field of passwords, and relates to a password authentication key exchange method and system based on lattices.

Background

Since most public key cryptographic algorithms are slower than symmetric cryptographic algorithms, key exchange remains an important issue in the process of secure communication. Meanwhile, authentication is required to prevent attacks such as impersonation, tampering, repudiation and the like during communication. The authentication and the key exchange are combined together to generate an authentication key exchange protocol, the identity of a communication party is authenticated first, and a used session key is generated for the next safe communication on the basis of successful authentication.

Password authenticated key exchange refers to protocol participants establishing a common session key by sharing a low-entropy, easy-to-remember password to enable secure and secure communications over an insecure channel. The password is used as a long-term key of a protocol participant, and is used for mutual authentication of two parties and establishment of a session key under the condition that the password is not leaked or stolen. Because the low-entropy password is used in the identity verification process, the password authentication key exchange avoids using extra equipment and public key infrastructure, does not need to communicate with a trusted third party, and is based on direct trust between the server and the client, so that the authentication process is more flexible and simpler. The method is a very practical key exchange protocol and has wide application prospect.

With the development of quantum computers, many cryptographic primitives may be threatened by quantum adversaries. This makes cryptographic protocols that are resistant to quantum computer attacks a research focus, called post-quantum cryptography. Lattices are one of the most common mathematical techniques for post-construction quantum cryptography. The Ring-LWE problem on an ideal lattice is more general and efficient than other difficult assumptions. Defining an integer coefficient polynomial ring

Wherein n represents the dimension of the polynomial and takes the value of the power of 2, q is a positive integer, and let χ be R_qFrom R_qWhere a is chosen randomly, secret s and error e are chosen according to the distribution χ, an example of the Ring-LWE problem is (a, b as + e) e R_q×R_q。

The Ring-LWE problem introduces an error term, and both communication parties can only calculate approximately equal values, so that the handling of errors becomes an important problem to be solved by the lattice-based cryptographic scheme. One way is to use a wrong coordination mechanism, similar to a fuzzy extractor, which can extract the same coordination value from approximately equal values. The asymmetric key consensus AKC is an error coordination mechanism, which comprises two functions (k)₁,v)←Con(σ₁Params) and k₂←Rec(σ₂V, params), wherein

(q, t, g, d, aux) represents a relevant parameter, (q, t, g, d) are all positive integers and satisfy 2 ≦ t, g ≦ q, and

aux is an auxiliary parameter determined by (q, t, g, d), which may be set to null,

is the value of the signal that assists in the coordination,

is a coordination value, when |. sigma₁-σ₂|_qWhen d is less than or equal to d, k₁＝k₂. If the parameters of AKC satisfy (2d +1) t<q (1-t/g), AKC is correct and safe, and v is independent of k₁. The specific procedure is as follows, and the Con and Rec functions can be extended to the polynomial by applying them separately to each coefficient of the polynomial:

Con(σ₁params): input sigma₁And params, from

In randomly selecting k₁Calculating

And outputting v.

Rec(σ₂V, params): input sigma₂And params, calculation

Output k₂。

At present, the password authentication key exchange protocols based on grids are relatively few, most of the protocols are based on CRS, and in order to achieve the security under the standard model, complex password components are often needed, so that the efficiency is not high. The ROM-based method can make the protocol design simpler and more efficient, but the existing structure causes the loss of performance and safety because the analysis of the error coordination mechanism is not compact enough. In addition, when a large number of clients are connected with the server at the same time and high concurrency exists, the load of the server is large, and the existing post-quantum password authentication key exchange is not efficient enough and is not enough to be applied to the scene.

Disclosure of Invention

Aiming at the technical problems in the prior art, the invention aims to provide a lattice-based password authentication key exchange method and a lattice-based password authentication key exchange system, so that communication participants can negotiate out a common session key on an unsafe channel and perform mutual authentication through a low-entropy password; this key will be used in subsequent symmetric ciphers to establish a secure communication channel.

Firstly, in order to improve the efficiency and the practicability of password authentication key exchange in a client-server scene, the invention provides an efficient password authentication key exchange method, comprehensively considers the safety and the performance, gives specific parameter selection, further improves the safety intensity of a protocol, and simultaneously reduces the size of transmitted messages. The method is not constructed by using the CRS, so that the low efficiency caused by using a complex password component in the CRS construction is avoided, and the method is simpler and more efficient. In the authentication process, the client and the server respectively hold hash values of the low-entropy password and the password, when the low-entropy password and the password are matched, the same verification value can be calculated, the client and the server can successfully authenticate, and a consistent session key can be obtained for subsequent secret communication.

The technical scheme of the invention is as follows:

a lattice-based password authentication key exchange method includes the steps of:

1) the client C randomly selects a seed and generates a common parameter a, and then a slave ring R_qChoosing secret s from the central binomial distribution_CAnd error e_CCalculating y_C＝as_C+e_C，γ＝H₁(pw_C)，m＝y_C+ gamma, then will<C_id,m,seed>Sending the data to a server S; wherein pw_CA password for client C;

2) the server S receives the message sent by the client C<C_id,m,seed>Thereafter, m is checked first, if not at ring R_qIf so, the protocol is terminated, otherwise, a common parameter a is generated according to the seed and a ring R is used_qUpper central binomial distribution selection secret s_SAnd error e_S、e_σ(ii) a Then calculate y_S＝as_S+e_S、y_C＝m+γ′、σ_S＝y_Cs_S+e_σAnd is to σ_SCoordinating to obtain a coordination value k_σAnd a signal value v; then, the verification value k is calculated as H₂(C_id,S_id,m,y_S,k_σY') and a verification value k ″ ═ H₃(C_id,S_id,m,y_S,k_σGamma') of a reaction of<y_S,v,k>Sending the data to a client C; wherein, the ring R_qIs an integer coefficient polynomial ring, and gamma' is a password hash value of the client C held by the server S; for l ∈ {2,3,4}, the hash function H_l:{0,1}^*→{0,1}^λλ denotes the bit length of the final shared session key, H₂And H₃For verification, H₄For key derivation, C_idRepresenting a client identity;

3) client C receives the message<y_S,v,k>Then, first check y_SIf not in the ring R_qIf so, the protocol terminates, otherwise σ is calculated_C＝y_Ss_CCalling the coordination function Rec (σ)_CV) to obtain the coordinated value k'_σ＝「t(v/g-σ₂/q) modt "; then calculating gamma' ═ gamma, and converting H₂(C_id,S_id,m,y_S,k_σY ') are compared with k, if not identical the protocol is terminated, otherwise k' is calculated as H₃(C_id,S_id,m,y_S,k′_σγ') to obtain the final session key sk_C＝H₄(C_id,S_id,m,y_S,k′_σγ '), and sends k' to the server S; wherein t is 2. ltoreq. t, g. ltoreq. q and

S_idthe identifier of the server S is g, q, d and t are positive integers;

4) the server S verifies whether k' is equal to k ", and if so, the final session key sk is calculated_S＝H₄(C_id,S_id,m,y_S,k_σ,γ′)。

A password authentication key exchange system based on grids is characterized by comprising a server and a plurality of clients; wherein the content of the first and second substances,

a server S for receiving the message sent by the client C<C_id,m,seed>And checking m if m is not in ring R_qIf so, the protocol is terminated, otherwise, a common parameter a is generated according to the seed and a ring R is used_qCentral two points ofCloth selection secret s_SAnd error e_S、e_σ(ii) a Then calculate y_S＝as_S+e_S、y_C＝m+γ′、σ_S＝y_Cs_S+e_σAnd is to σ_SCoordinating to obtain a coordination value k_σAnd a signal value v; the verification value k ═ H is then calculated₂(C_id,S_id,m,y_S,k_σY') and a verification value k ″ ═ H₃(C_id,S_id,m,y_S,k_σGamma') of a reaction of<y_S,v,k>Sending the data to a client C; and receiving k ' sent by the client and verifying whether k ' is equal to k ', if so, calculating to obtain a final session key sk_S＝H₄(C_id,S_id,m,y_S,k_σ,γ′)；

A client C for randomly selecting seed and generating a common parameter a, and then selecting a ring R_qChoosing secret s from the central binomial distribution_CAnd error e_CCalculating y_C＝as_C+e_C，γ＝H₁(pw_C)，m＝y_C+ gamma, then will<C_id,m,seed>Sending the data to a server S; and receiving the message<y_S,v,k>Post-inspection y_SWhether or not in the ring R_qIf not at ring R_qIf so, the protocol terminates, otherwise σ is calculated_C＝y_Ss_CCalling the coordination function Rec (σ)_CV) obtaining the harmony value

Then calculating gamma' ═ gamma, and converting H₂(C_id,S_id,m,y_S,k_σY ') are compared with k, if not identical the protocol is terminated, otherwise k' is calculated as H₃(C_id,S_id,m,y_S,k′_σγ') to obtain the final session key sk_C＝H₄(C_id,S_id,m,y_S,k′_σγ '), and sends k' to the server S;

wherein, pw_CFor client CPassword, ring R_qIs an integer coefficient polynomial ring, and gamma' is a password hash value of the client C held by the server S; for l ∈ {2,3,4}, the hash function H_l:{0,1}^*→{0,1}^λλ denotes the bit length of the final shared session key, H₂And H₃For verification, H₄For key derivation; t is not less than 2, g is not more than q and

C_idrepresenting client identification, and g, q, d and t are positive integers.

Further, the server S is selected from

In randomly selecting k_σCalculating

Obtain the coordination value k_σAnd a signal value v.

Further, | σ |_C-σ_S|_q＝|e_Ss_C-e_Cs_S-e_σ|_q≤d，(2d+1)t<q(1-t/g)。

Further, the server S generates a common parameter a using the pseudo random generator Gen and the seed; and if the output value a of the Gen is greater than or equal to 5q, regenerating a, otherwise, subtracting q from the currently generated a loop until the updated value a is less than or equal to q, and taking the finally obtained result as the common parameter a.

Further, by calculating

Obtaining central binomial distribution; wherein x_iAnd x_i' are uniformly independent bits.

The method is constructed based on the Ring-LWE difficulty problem on an ideal lattice, so that the method can resist quantum adversaries and is safe in a quantum environment. The scheme is proved to be safe under the BPR model, can resist security threats such as dictionary attack, session key loss and the like, and has forward confidentiality.

By using the error coordination mechanism AKC, when the two parties exchange the information seed, y_CAnd y_SAnd respectively calculating two approximate values sigma according to the information_CAnd σ_SFrom which the same coordination values can be coordinated for subsequent authentication and session key derivation. The signal value generated by AKC is independent of the coordination value, and the coordination value is uniformly distributed, so that the information of the coordination value cannot be deduced from the signal value even if an adversary acquires the signal value, and the safety of the scheme is ensured. By increasing the parameter m, the bit length of a single tune-out can be increased without significantly degrading performance. The characteristic of AKC allows the server to pre-calculate a part of intermediate results in idle time, store the intermediate results, and directly use the intermediate results when interacting with the client, so as to reduce the load on the server, thereby improving the response efficiency of the server, and enabling the scheme to be more suitable for the high concurrency condition that a large number of clients are connected with the server at the same time.

By regenerating the public parameters every time, trap doors are prevented from being implanted in the public parameters, and an all-for-the-price-of-one attack is prevented from being launched by an adversary when the safety of the scheme only depends on one example, a good enough lattice basis is found, and the communication process is cracked. And at each connection, randomly selecting a small seed again, and expanding the seed into the required common parameters through a pseudo random generator. Noise sampling is carried out in the central binomial distribution, the distributed samplers can be efficiently realized on software and hardware, the mode does not obviously affect the safety of the scheme, the low efficiency of high-precision sampling from Gaussian distribution is avoided, and meanwhile timing attack can be prevented.

Drawings

FIG. 1 is a schematic diagram of a lattice-based password authentication key exchange method according to the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings.

Gen is a pseudo-random generator that expands small seeds into a loop R_qElement of (A) and (B)₁～H₄Representing four different hash functions, H₁:{0,1}^*→R_qFor l ∈ {2,3,4}, H_l:{0,1}^*→{0,1}^λλ denotes the bit length of the final shared session key, H₂And H₃For verification, H₄For key derivation. In particular implementations, H can be instantiated using an XOF function, such as SHAKE-128₁Separately for H, hash functions such as SHA3-256 are used_lTo be instantiated, e.g. H_l(x)＝SHA3-256(x,l)，l∈{2,3,4}。ψ_bRepresents a ring R_qCentral binomial distribution of (a) and standard deviation of

Client C holds password pw_CObtaining the server identifier S_idThereafter, a seed is randomly selected, and a common parameter a is generated from the ring R using a pseudo-random generator Gen_qChoosing secret s from the central binomial distribution_CAnd error e_CCalculating y_C＝as_C+e_C，γ＝H₁(pw_C)，m＝y_C+ gamma, will<C_id,m,seed>Is sent to a server S, where C_idRepresenting the client identity. The method flow of the invention is shown in figure 1, and the steps comprise:

1) the server S holds the hash value γ' ═ H of the client password₁(pw_C) On receipt of the message sent by client C<C_id,m,seed>Thereafter, m is checked first, if not at ring R_qIf so, the protocol is terminated, otherwise the common parameter a is generated using the pseudo-random generator Gen and the seed, according to the ring R_qUpper central binomial distribution selection secret s_SAnd error e_S,e_σCalculating y_S＝as_S+e_S，y_C＝m+γ′,σ_S＝y_Cs_S+e_σBy the function Con vs_STo coordinate, i.e. from

(i.e. small)Non-negative integer of t) as a polynomial k_σN coefficients of (i)

And for each coefficient, calculating

Finally obtaining a coordination value k_σSum signal value v ═ v (v)¹,...,vⁿ) Separately, the verification values k ═ H are calculated₂(C_id,S_id,m,y_S,k_σY') and a verification value k ″ ═ H₃(C_id,S_id,m,y_S,k_σGamma') of a reaction of<y_S,v,k>And sending the data to the client C.

2) Client receives message<y_S,v,k>Then, first check y_SIf not in the ring R_qIf so, the protocol terminates, otherwise σ is calculated_C＝y_Ss_CCalling the coordination function Rec (σ)_CV) obtaining the harmony value

Calculating gamma' ═ gamma, and converting H₂(C_id,S_id,m,y_S,k_σY ') are compared with k, if not identical the protocol is terminated, otherwise k' is calculated as H₃(C_id,S_id,m,y_S,k′_σγ'), the final session key sk_C＝H₄(C_id,S_id,m,y_S,k′_σγ '), k' is sent to the server S.

3) The server verifies whether k' is equal to k ", if not, the protocol is terminated, otherwise the final session key sk is calculated_S＝H₄(C_id,S_id,m,y_S,k_σ,γ′)。

Client C holds password pw_CThe server holds the hash value of the password. 1) Authentication of the server: when sending a message, the client adds the hash value of the password to the original message, only when the server savesAnd when the corresponding hash value exists, the correct original message can be obtained. Once the server has no hash value of the password, it cannot compute the correctly computed original message, and the subsequent verification value k will be compared with the client computed H₂(C_id,S_id,m,y_S,k_σγ'), authentication to the server fails and the protocol will terminate. 2) Authentication of the client: when the password held by the client does not correspond to the hash value stored by the server, the calculated k 'will not coincide with the k' calculated by the server, the authentication to the client fails, and the protocol terminates.

When sigma_C-σ_S|_q＝|e_Ss_C-e_Cs_S-e_σ|_qWhen d is less than or equal to d, the client and the server can obtain the same coordination value k_σAnd the protocol can be executed correctly according to the flow, if the passwords of the two parties are matched with the password hash value and the authentication is successfully completed, the communication parties hold (C)_id,S_id,m,y_S,k_σγ') are completely identical, the obtained session key sk_C＝sk_SAnd the key exchange is successful, and the two parties can utilize the obtained session key to carry out subsequent communication. The error rate is related to the selected parameters, on one hand, the parameters need to satisfy t is more than or equal to 2, g is more than or equal to q,

(2d+1)t<q (1-t/g), ensuring the correctness and safety of AKC, and on the other hand, selecting d as large as possible to ensure that the error rate of the whole scheme is as low as possible. When the standard deviation is selected to be

When the dimension n is 1024, the modulus q is 12289, the AKC-related parameter t is 2, and g is 64, the maximum d satisfying the condition is calculated to be 2975, and | e is obtained_Ss_C-e_Cs_S-e_σ|_qCan obtain a scheme error rate of 2^-41For most key exchange scenarios, this is sufficient.

Regenerating the common parameters every session may yield slight performance penaltyInfluence. In order to minimize the performance loss, the present invention does not need to transmit the common parameter a, but only transmits the seed for generating a and assumes that the generated a is directly in the NTT domain to reduce the number of times of using NTT. Meanwhile, the invention adopts the following measures to reduce the sampling rejection rate of a to accelerate the generation: when generating the common parameter a from the small seed extension, if the output value of Gen is greater than or equal to 5q, rejecting the value and regenerating, otherwise, circularly subtracting q from the value until the value is within q, and taking the result as the coefficient of the common parameter. Central binomial distribution psi_kCan be calculated by

To obtain wherein x_iAnd x_i' are uniformly independent bits.

In the Ring-LWE problem based approach, polynomial computation is the most time consuming operation. The present invention selects the dimension n 1024, which is a suitable choice for long-term security and performance. The modulus q-12289 is the smallest prime number satisfying q ≡ 1mod2n, so polynomial multiplication can be accelerated using NTT, which can greatly improve the calculation speed. Meanwhile, the polynomial can be smaller due to smaller modulus, and the communication overhead of the protocol can be reduced. Since the security level increases with the noise-to-modulus ratio, selecting a small modulus can increase security strength while increasing compactness and efficiency.

Although specific details of the invention, algorithms and figures are disclosed for illustrative purposes, these are intended to aid in the understanding of the contents of the invention and the implementation in accordance therewith, as will be appreciated by those skilled in the art: various substitutions, changes and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. The invention should not be limited to the preferred embodiments and drawings disclosed herein, but rather should be defined only by the scope of the appended claims.

Claims (10)

1. A lattice-based password authentication key exchange method includes the steps of:

1) the client C randomly selects seeds and generates a public keyWith a parameter a, then from ring R_qChoosing secret s from the central binomial distribution_CAnd error e_CCalculating y_C＝as_C+e_C，γ＝H₁(pw_C)，m＝y_C+ gamma, then will<C_id,m,seed>Sending the data to a server S; wherein pw_CA password for client C;

2) the server S receives the message sent by the client C<C_id,m,seed>Thereafter, m is checked first, if not at ring R_qIf so, the protocol is terminated, otherwise, a common parameter a is generated according to the seed and a ring R is used_qUpper central binomial distribution selection secret s_SAnd error e_S、e_σ(ii) a Then calculate ys ═ as_S+e_S、y_C＝m+γ′、σ_S＝y_Cs_S+e_σAnd is to σ_SCoordinating to obtain a coordination value k_σAnd a signal value v; then, the verification value k is calculated as H₂(C_id,S_id,m,y_S,k_σY') and a verification value k ″ ═ H₃(C_id,S_id,m,y_S,k_σGamma') of a reaction of<y_S,v,k>Sending the data to a client C; wherein, the ring R_qIs an integer coefficient polynomial ring, and gamma' is a password hash value of the client C held by the server S; for l ∈ {2,3,4}, the hash function H_l:{0,1}^*→{0,1}^λλ denotes the bit length of the final shared session key, H₂And H₃For verification, H₄For key derivation, C_idRepresenting a client identity;

3) client C receives the message<y_S,v,k>Then, first check y_SIf not in the ring R_qIf so, the protocol terminates, otherwise σ is calculated_C＝y_Ss_CCalling the coordination function Rec (σ)_CV) obtaining the harmony value

Then calculating gamma' ═ gamma, and converting H₂(C_id,S_id,m,y_S,k_σY ') are compared with k, if not identical the protocol is terminated, otherwise k' is calculated as H₃(C_id,S_id,m,y_S,k′_σγ') to obtain the final session key sk_C＝H₄(C_id,S_id,m,y_S,k′_σγ '), and sends k' to the server S; wherein t is 2. ltoreq. t, g. ltoreq. q and

S_idthe identifier of the server S is g, q, d and t are positive integers;

4) the server S verifies whether k' is equal to k ", and if so, the final session key sk is calculated_S＝H₄(C_id,S_id,m,y_S,k_σ,γ′)。

2. The method of claim 1, wherein in step 1), σ is measured_SThe method for coordinating comprises the following steps: from

In randomly selecting k_σCalculating

Obtain the coordination value k_σAnd a signal value v.

3. The method of claim 1, wherein | σ_C-σ_S|_q＝|e_Ss_C-e_Cs_S-e_σ|_q≤d，(2d+1)t<q(1-t/g)。

4. The method of claim 1, wherein in step 1), the common parameter a is generated using a pseudo-random generator Gen and a seed; and if the output value a of the Gen is greater than or equal to 5q, regenerating a, otherwise, subtracting q from the currently generated a loop until the updated value a is less than or equal to q, and taking the finally obtained result as the common parameter a.

5. The method of claim 1, characterized by calculating

Obtaining central binomial distribution; wherein x_iAnd x_i' are uniformly independent bits.

6. A password authentication key exchange system based on grids is characterized by comprising a server and a plurality of clients; wherein the content of the first and second substances,

a server S for receiving the message sent by the client C<C_id,m,seed>And checking m if m is not in ring R_qIf so, the protocol is terminated, otherwise, a common parameter a is generated according to the seed and a ring R is used_qUpper central binomial distribution selection secret s_SAnd error e_S、e_σ(ii) a Then calculate y_S＝as_S+e_S、y_C＝m+γ′、σ_S＝y_Cs_S+e_σAnd is to σ_SCoordinating to obtain a coordination value k_σAnd a signal value v; the verification value k ═ H is then calculated₂(C_id,S_id,m,y_S,k_σY') and a verification value k ″ ═ H₃(C_id,S_id,m,y_S,k_σGamma') of a reaction of<yS,v,k>Sending the data to a client C; and receiving k ' sent by the client and verifying whether k ' is equal to k ', if so, calculating to obtain a final session key sk_S＝H₄(C_id,S_id,m,y_S,k_σ,γ′)；

A client C for randomly selecting seed and generating a common parameter a, and then selecting a ring R_qChoosing secret s from the central binomial distribution_CAnd error e_CCalculating y_C＝as_C+e_C，γ＝H₁(pw_C)，m＝y_C+ gamma, then will<C_id,m,seed>Sending the data to a server S; and receiving the message<yS,v,k>Post-inspection y_SWhether or not in the ring R_qIf not at ring R_qIf so, the protocol terminates, otherwise σ is calculated_C＝y_Ss_CCalling the coordination function Rec (σ)_CV) obtaining the harmony value

Then calculating gamma' ═ gamma, and converting H₂(C_id,S_id,m,y_S,k_σY ') are compared with k, if not identical the protocol is terminated, otherwise k' is calculated as H₃(C_id,S_id,m,y_S,k′_σγ') to obtain the final session key sk_C＝H₄(C_id,S_id,m,y_S,k′_σγ '), and sends k' to the server S;

wherein, pw_CFor client C password, ring R_qIs an integer coefficient polynomial ring, and gamma' is a password hash value of the client C held by the server S; for l ∈ {2,3,4}, the hash function H_l:{0,1}^*→{0,1}^λλ denotes the bit length of the final shared session key, H₂And H₃For verification, H₄For key derivation; t is not less than 2, g is not more than q and

C_idrepresenting client identification, and g, q, d and t are positive integers.

7. The system of claim 6, wherein the server S is selected from

In randomly selecting k_σCalculating

Obtain the coordination value k_σAnd a signal value v.

8.The system of claim 6, wherein | σ_C-σ_S|_q＝|e_Ss_C-e_Cs_S-e_σ|_q≤d，(2d+1)t<q(1-t/g)。

9. The system of claim 6, wherein the server S generates the common parameter a using a pseudo-random generator Gen and a seed; and if the output value a of the Gen is greater than or equal to 5q, regenerating a, otherwise, subtracting q from the currently generated a loop until the updated value a is less than or equal to q, and taking the finally obtained result as the common parameter a.

10. The system of claim 6, wherein the computing is performed by

Obtaining central binomial distribution; wherein x_iAnd x_i' are uniformly independent bits.

Images