WO2024058298A1

WO2024058298A1 - Method for generating hard sat and method for implementing sat-based quantum-resistant cryptographic algorithm

Info

Publication number: WO2024058298A1
Application number: PCT/KR2022/014158
Authority: WO
Inventors: 조금배
Original assignee: 조금배
Priority date: 2022-09-16
Filing date: 2022-09-22
Publication date: 2024-03-21
Also published as: KR20240038561A; KR20240038399A; KR102657596B1

Abstract

Disclosed in the present invention are a method for generating a hard SAT and a method for implementing an SAT-based quantum-resistant cryptographic algorithm. The present invention relates to a method for generating a 3-CNF having a password as a solution using a toroidal binomial tree and a modular random encapsulation technique, and a method for generating a quantum-resistant cryptographic algorithm that can be decrypted only if a password that is a solution of the hard SAT is known after the hard SAT using the 3-CNF generating method is disclosed as a substitute for a public key and encryption is performed using same.

Description

How to generate a HARD SAT and how to implement a quantum-resistant cryptographic algorithm based on SAT

Hard SAT refers to a satisfiability problem (SAT) that is difficult to find a solution, specifically, the time required to find a solution exceeds polynomial time (the time complexity of the algorithm is expressed as a polynomial for the number of input data). do. The present invention relates to a method of generating a Hard SAT and a method of generating a quantum-resistant cryptographic algorithm based on Hard SAT. More specifically, the present invention relates to a newly created concept of toroidal binomial tree and modular random encapsulation. This is about a method of generating a Hard 3-CNF with a password as the solution using the encapsulation technique and a method of implementing a quantum-resistant encryption algorithm based on the difficulty of finding a solution to the SAT problem using this method.

Prime factorization and discrete logarithms problems, which were the basis of existing public key-based algorithms, could be solved in polynomial time using a quantum computer through the Shor algorithm announced in 1994, and quantum computer development technology was developed. Due to continuous development, the safety of the applied encryption algorithm cannot be guaranteed. Therefore, as a new public key-based algorithm that does not take advantage of the difficulty of prime factorization or the discrete log problem is required, research on public key-based encryption algorithms that are safe even for operations on quantum computers is being actively conducted, and such encryption technology is being developed. It is called quantum-resistant or quantum-safe cryptography, or Post Quantum Cryptography (PQC), which means cryptography that can be safely used even after quantum computers.

To date, quantum-resistant cryptographic algorithms, excluding the hash-based algorithm used in digital signatures, include multivariable-based, code-based, isogeny-based, and lattice-based. ) is being studied in four areas: The Isogeny-based algorithm has a problem that the calculation speed is slow, and the multivariate-based algorithm has a high decryption failure rate. Therefore, grid-based algorithms or code-based algorithms are mainly used in the PKE (Public Key Encryption) field. Recently, the National Institute of Standards and Technology (NIST) is in the process of standardizing post-quantum cryptography algorithms, and in the third round of PKE, three lattice-based algorithms (CRYSTALS KYBER, NTRU, SABER) and one code-based algorithm ( Classic McEliece) was selected.

The grid-based encryption algorithm has the disadvantage of being vulnerable to side-channel attacks using additional information (power, electromagnetic waves, time difference, error injection, etc.) generated during the encryption and decryption process. In the case of the code-based algorithm, the original key is not found and the ISD (Information Set Decoding) techniques are being continuously researched as a method of recovering data. In addition to the quantum-resistant cryptographic algorithms described above, all public key-based cryptographic algorithms used or studied to date have a relationship expressed as a formula between the public key and private key, which is a trapdoor one-way function, and are based on that relationship. Attacks are constantly being attempted to find vulnerabilities in the algorithm and obtain private keys or original data or make decryption impossible.

Public key-based cryptographic algorithms are created based on NP problems or problems predicted to be NP problems. Not only is SAT the first NP-complete problem to be discovered, but if the CNF formula that makes up SAT can be made public as a substitute for a public key and encrypted using this, formulating a Boolean expression expressing SAT requires that the Boolean variables are 0 and 1. It is extremely limited because there are only so many. In addition, this patent is designed to have expressional equality, which means that even if all variables are changed, the same expression is obtained so that formulating becomes meaningless. Therefore, the safety of the algorithm depends on the performance of SAT solvers based on the search algorithm, and since there is no formal relationship between the private key and the public key through arithmetic operations, it is free from various attacks that attempt to find the private key from the public key. However, to date, no method has been found to systematically generate Hard SAT, and no encryption method applicable to real life has been researched using the Boolean expression that makes up SAT, so an encryption algorithm using SAT has not been developed.

To date, there has been no mathematical proof that a SAT instance created using a specific method is a Hard SAT. In order to prove that one SAT instance is a Hard SAT, it must be proven that at least the number of sub-exponential calculation steps equal to the number of input variables is required to find a solution. The assumption that the time it takes to find a solution will exceed the polynomial boundary is called the Exponential Time Hypothesis (ETH), and the problem of proving whether ETH is correct becomes the P vs. NP problem, one of the seven difficult problems in mathematics.

All SAT solvers developed to date are DPLL based on back-tracking (a technique that assumes the value of a variable and when it is confirmed that the assumption is incorrect, goes back to the assumed step and changes the value of the assumed variable to find a solution again) It was created based on an algorithm. The proof in this patent is limited to all back-tracking-based SAT solvers developed to date.

The 3-CNF generated by modular random encapsulation of the single toroidal binomial tree described in the present invention has as many solutions as the sub-exponential number in addition to the basis solution and complement solution (hereinafter referred to as dual solution), and the desired solution (password) It is proven that at least the number of sub-exponential calculation steps is required to find . In addition, it is proven that 3-CNF, which is generated by modular random encapsulation of a dual toroidal binomial tree, has no solution other than a dual solution if the number of input variables is sufficiently large, and that the number of exponential-calculation steps is required to find a dual solution. do.

If it is proven that the search algorithm created to solve the 3-SAT problem must use a back-tracking function, the proof in this patent becomes a proof of ETH, which has been assumed so far, and proves that P is a true subset of NP. It is proven. Considering that the SAT solvers that many researchers have developed over the past several decades are all based on back-tracking, in some ways this may be a trivial problem, but it is necessary to create a new type of SAT solver that does not use the back-tracking function. Contents or results related to “can” or “cannot” are excluded from the scope of description because it is judged not to have a significant impact on the technicality of this patent at this stage.

The present invention provides a method of generating a Hard SAT and a method of implementing an encryption algorithm that discloses the Hard SAT as a public key, encrypts it using this, and then decrypts only if the password that is the solution of the Hard SAT is known.

[Generating 3-CNF using a single toroidal tree]

The method for generating Hard 3-CNF with a password as a solution according to a preferred embodiment of the present invention for realizing the above object is to generate a single toroidal binomial tree with a password as a solution using (method 1) below. It is characterized by deriving the 3-CNF formula by modular random encapsulation using (method 2) below.

(Method 1)

1) Create a password of n (n=ixj, i: number of levels in the tree, j: number of columns in the tree) bits and then assign variables to each bit. (Example: n=16, i=j=4, password="kb", k=01101011b, b=01100010b, x ₁ =0, x ₂ =1, x ₃ =1, x ₄ =0, x ₅ = 1, x ₆ =0, x _{7 =1, x 8} =1, x ₉ =0, x ₁₀ =1, x ₁₁ =1, x ₁₂ =0, x ₁₃ =0, x ₁₄ = ₀ , x ₁₅ = 1, x ₁₆ = 0)

2) [Figure 1] shows the procedure for creating a toroidal binomial tree through a transformation process to satisfy expressional equality and geometric equality from a unit clause. Create a toroidal binomial tree frame like (g) in [Figure 1].

3) Create a set of n literals with TRUE values or n literal sets with FALSE values consisting of the variables assigned in 1) above, and then sort them randomly. (e.g. a set of n literals with the value TRUE, x ₇ , x ₂ , -x ₁₂ , -x ₁₆ , x ₁₀ , -x ₄ , x ₃ , -x ₉ , -x ₁ , x ₁₅ , x ₅ -x ₁₃ , -x ₆ , -x ₁₄ , x ₈ , x ₁₁ )

4) From the set of n literals created in 3) above, take them one by one in order and place them in place of the dominant literal starting from the leftmost column. (Fill all columns from top to bottom and then fill in the next column)

5) Creating a single toroidal binomial tree as shown in [Figure 2] by arranging literals in place of switching literals as complements of dominant literals;

(Method 2)

1) Group the dominant literals that make up the circular binomial tree created in (Method 1) above into groups by column and then sort them randomly. (Example: G ₁ =[x ₇ , x ₂ , -x ₁₂ , -x ₁₆ ], G ₂ =[x ₁₀ , -x ₄ , x ₃ , -x ₉ ], G ₃ =[-x ₁ , x ₁₅ , x ₅ , -x ₁₃ ], G ₄ =[-x ₆ , - x ₁₄ , x ₈ , x ₁₁ ], dominant literal groups after randomly sorting: G ₁ =[x ₇ , -x ₁₂ , x ₂ , -x ₁₆ ], G ₂ =[x ₃ , -x ₉ , x ₁₀ , -x ₄ ], G ₃ =[-x ₁₃ , x ₁₅ , -x ₁ , x ₅ ], G ₄ =[-x ₁₄ , -x ₆ , x ₁₁ , x ₈ ] )

2) Create corresponding groups using the complements of all literals belonging to the group created in 1) above and then sort them randomly. At this time, if the same variable is located in the same position in the group corresponding to the randomly sorted group in 1), it is rearranged to prevent one variable and its complement from being placed together in the same position (e.g., G ₁ =[ -x ₇ , -x ₂ , x ₁₂ , x ₁₆ ], G ₂ =[-x ₁₀ , x ₄ , -x ₃ , x ₉ ], G ₃ =[x ₁ , -x ₁₅ , -x ₅ , x ₁₃ ], G ₄ =[x ₆ , x ₁₄ , -x ₈ , -x ₁₁ ], Groups of complements of dominant literal after random sorting: G ₁ =[x ₁₂ , -x ₂ , x ₁₆ , - x ₇ ], G ₂ =[-x ₁₀ , -x ₃ , x ₄ , x ₉ ], G ₃ =[-x ₁₅ , x ₁₃ , -x ₅ , x ₁ ], G ₄ =[x ₆ , - x ₁₁ , -x ₈ , x ₁₄ ])

3) Set the distance value, d. (You can select number of columns/2, number of columns/2 -1, number of columns/2 + 1, etc., but according to experimental results, d, which increases hardness the most, is number of columns/2 -1)

4) After extracting one by one (one literal has a TRUE value and another literal has a FALSE value) from the group created in 1) above and the corresponding group created in 2), Create a circular tree containing random literals as shown in [Figure 3] by sequentially adding literals with a FALSE value to the left or right or to a random position among the two positions in the random variable positions of the two included clauses.

5) Modular random encapsulation step to create a 3-CNF formula by randomly rearranging the three literals that make up one clause so that the role of each variable cannot be confirmed after extracting clauses from all nodes; (Example: (Formula 1) is two clauses extracted from the first node of the first column in [Figure 3], (Formula 2) is two clauses extracted from the second node of the first column, (Formula 3) are two clauses extracted from the last node of the last column, (Equation 4) shows the final 3-CNF created by randomly sorting the literals constituting each clause and then combining the clauses with the AND operator)

(Formula 1) (x ₇ ∨￢x ₂ ∨x ₆ ), (x ₇ ∨x ₄ ∨￢x ₁₄ )

(Formula 2) (x ₂ ∨x ₁₂ ∨￢x ₁₁ ), (x ₂ ∨￢x ₃ ∨￢x ₆ )

(Formula 3) (x ₁₁ ∨x ₆ ∨x ₁ ), (x ₁₁ ∨￢x ₇ ∨x ₅ )

(Formula 4) (￢x ₂ ∨x ₇ ∨x ₆ ), (￢x ₁₄ ∨x ₄ ∨x ₇ )∧ ... ∧(x ₆ ∨x ₁₁ ∨x ₁ ), (x ₁₁ ∨x ₅ ∨ ￢x ₇ )

[3-CNF generation procedure using dual toroid tree]

A method of generating 3-CNF with a password as a solution according to another preferred embodiment of the present invention for realizing the above object generates a dual toroidal binomial tree with a password as a solution using (method 3) below, and It is characterized by deriving the 3-CNF formula by modular random encapsulation using (method 4).

(Method 3)

2) Create a toroidal binomial tree frame like (g) in [Figure 1].

3) Create a set of n literals with TRUE values composed of the variables assigned in 1) above and then randomly sort them. (e.g. x ₇ , x ₂ , -x ₁₂ , -x ₁₆ , x ₁₀ , -x ₄ , x ₃ , -x ₉ , -x ₁ , x 15 , x ₅ , -x ₁₃ _, -x ₆ , - x ₁₄ , x ₈ , x ₁₁ )

4) In one tree that constitutes a dual toroidal binomial tree, take out one by one from the set of n literals created in 3) above and place them in the position of the dominant literal starting from the leftmost column. (Fill all columns from top to bottom and fill in the next column. fill)

5) Literals that take the place of switching literals are placed as complements of dominant literals.

6) Create a set of n literals with FALSE values consisting of the variables assigned in 1) above and sort them randomly. (e.g. -x ₈ , x ₆ , -x ₂ , -x ₁₀ , -x ₃ , x ₁ , x ₁₃ , x ₁₂ , -x ₁₅ , x _{16 , -x 11} _, -x ₇ , x ₉ , x ₁₄ , x ₄ , -x ₅ )

7) In another tree that constitutes the dual toroidal binomial tree, perform 4) and 5) above using the n literals randomly sorted in 6) above to create a dual toroidal binomial tree as shown in [Figure 4]. steps;

(Method 4)

1) Among the two trees created in (Method 3) above, the dominant literals that make up one tree are grouped by column and then randomly sorted. (Example: G ₁ =[x ₇ , x ₂ , -x ₁₂ , -x ₁₆ ], G ₂ =[x ₁₀ , -x ₄ , x ₃ , -x ₉ ], G ₃ =[-x ₁ , x ₁₅ , x ₅ , -x ₁₃ ], G ₄ =[-x ₆ , -x ₁₄ , x ₈ , x ₁₁ ], dominant literal groups after random sorting: G ₁ =[x ₇ , -x ₁₂ , x ₂ , -x ₁₆ ], G ₂ =[x ₃ , -x ₉ , x ₁₀ , -x ₄ ], G ₃ =[-x ₁₃ , x ₁₅ , -x ₁ , x ₅ ], G ₄ =[ -x ₁₄ , -x ₆ , x ₁₁ , x ₈ ] )

3) Set the distance value, d.

4) After extracting one by one from the group created in 1) above and the corresponding group created in 2), a literal with a FALSE value is added to the left or Add sequentially to the right or in a random position among the two digits.

5) Using another tree, perform the above processes 1) to 4) to create a dual toroidal tree containing random literals as shown in [Figure 5].

6) Modular random encapsulation step to create a 3-CNF formula by randomly rearranging the three literals that make up one clause so that the role of each variable cannot be confirmed after extracting clauses from all nodes; (Example: Among the dual toroidal binomial trees in [Figure 5], in the first tree where all dominant literals have the value TRUE, (Equation 1) described above is two clauses extracted from the first node of the first column, ( Equation 2) is two clauses extracted from the second node of the first column, (Formula 3) is two clauses extracted from the last node of the last column, and (Formula 4) randomly extracts the literals that make up each clause. Represents 3-CNF created by sorting the clauses and then combining them with the AND operator.

In the second tree where all dominant literals have the value FALSE, (Equation 5) is two clauses extracted from the first node of the first column, and (Equation 6) is two clauses extracted from the second node of the first column. , (Equation 7) represents two clauses extracted from the last node of the last column, and (Equation 8) represents 3-CNF created by randomly sorting the literals constituting each clause and then combining the clauses with the AND operator. Finally, 3-CNF, which is generated by modular random encapsulation in a dual toroidal binomial tree, has the form of (Equation 4) and (Equation 8) combined with the AND operator. )

(Formula 5) (￢x ₈ ∨￢x ₆ ∨x ₁₄ ), (￢x ₈ ∨￢x ₁ ∨x ₅ )

(Formula 6) (x ₆ ∨x ₂ ∨x ₄ ), (x ₆ ∨￢x ₁₃ ∨￢x ₁₄ )

(Formula 7) (￢x ₅ ∨￢x ₉ ∨￢x ₁₁ ), (￢x ₅ ∨x ₈ ∨x ₁₅ )

(Formula 8) (x ₁₄ ∨￢x ₈ ∨￢x ₆ ), (￢x ₁ ∨x ₅ ∨￢x ₈ )∧...∧(￢x ₁₁ ∨￢x ₅ ∨￢x ₉ ), (x ₈ ∨x ₁₅ ∨￢x ₅ )

[Encryption and decryption algorithm using 3-CNF]

Among the three literals that make up one clause, a clause with only one TRUE value is defined as a 1-TRUE clause, and a clause with only two literals with a TRUE value is defined as a 2-TRUE clause.

In order to apply the encryption algorithm using 3-CNF proposed in this patent, 3-CNF must satisfy the following three conditions.

First, it must consist of the same number of 1-TRUE clauses and 2-TRUE clauses.

Second, you must have a password as a solution.

Third, it must be a Hard CNF, making it difficult to find the password from the CNF.

3-CNF created using (method 1) and (method 2) or (method 3) and (method 4) above satisfies the three conditions above. However, even if 3-CNF created by a method other than the method described above is used, the encryption and decryption algorithms described below can be applied if the three conditions above are satisfied.

A method of generating a quantum-resistant encryption algorithm based on Hard SAT according to a preferred embodiment of the present invention for realizing the above purpose uses (method 1) and (method 2) or (method 3) and (method 4) 3-CNF derivation step that satisfies the above three conditions using or other methods;

When the number of clauses forming the 3-CNF generated in the above derivation step is n, extract q 2-TRUE clauses (q=n/2) and p(p < q) 1-TRUE clauses to obtain p+q clauses. Creating a new CNF formula consisting of;

Among the clauses that make up the newly created CNF formula, 2p+1 clauses are randomly extracted, the number of variables, x _k (1<=k<=n, n=number of password bits) is counted, and the complement of a _k and x _k is obtained. Setting the b _k value by counting the number of;

To encrypt plaintext data 1, 2n arrays are recorded by sequentially combining the n arrays constituting a _k and the n arrays constituting b _k . To encrypt 0, a _k and b _k are exchanged to create b _k . An encryption step of recording 2n arrays by sequentially combining the n arrays constituting the n arrays and the n arrays constituting a _k ;

A formula generation step that reads the ciphertext, sequentially sets the values a _k and b _k , and then calculates the threshold value, t, as shown below (Equation 9);

(Equation 9)

Calculating the t value by substituting x _k =1 and ￢x _k =0 if the value of x _k in the password is TRUE in the above (Equation 9), and substituting x _k =0 and ￢x _k =1 if it is FALSE;

It is characterized in that it is performed as a decoding step; if the t value is greater than or equal to 3p+2, it is 1; if it is less than or equal to 3p+1, it is 0.

[Method to reduce computation amount during encryption process]

As another desirable feature of the present invention, in order to reduce the amount of calculation during encryption, the number of all variables and their complements in all clauses constituting the CNF formula are calculated in advance and the values are (A _k , B _k )(1<=k< = n, n = number of password bits);

Following the above step, instead of selecting 2p+1, select qp-1, calculate all the variables of the selected clauses and the number of their complements, and call the values (c _k , d _k ), a _k =A _k - Deriving the formula c _k , b _k =B _k -d _k ;

A formula generation step of reading the ciphertext, sequentially determining the values a _k and b _k , and then calculating the threshold value, t, as in (Equation 9) above;

Calculating the t value by substituting x _k =1 and ￢x _k =0 if the value of x _k in the password is TRUE in (Formula 9), and substituting x _k =0 and ￢x _k =1 if it is FALSE;

[How to prevent creating CNF formulas consecutively with the same password]

As another preferred feature of the present invention, in order to prevent continuously generating CNF formulas with the same password, in (Method 1) 1), generation time information is included in the generated password.

As another desirable feature of the present invention, in order to prevent continuously generating CNF formulas with the same password, in (Method 3) 1), generation time information is included in the generated password.

[Identity authentication or public key verification procedure]

As another desirable feature of the present invention, the CNF formula possessed by the sender to transmit the ciphertext and the generator of the CNF formula are consistent with the CNF formula possessed by the recipient who will receive the ciphertext, and the receiver knows the solution of the above CNF formula. It is characterized by further performing the step of confirming the constructor of the existing CNF formula by (Method 5) below.

(Method 5)

1) The sender creates a key value the size of the number of input variables, but this key value is not the solution to the CNF formula. When substituted into the CNF formula, clauses that return FALSE are created. This key value is encrypted with the above encryption algorithm and sent to the receiver. Sent to,

2) The receiver decrypts the ciphertext received with his password, checks the key value, substitutes this key value into the CNF formula to obtain the return values of all clauses, and sequentially sends them to the sender.

3) The sender generates return values by substituting the generated key value into the CNF formula holding the generated key value, and then compares the received return values with the generated return values.

4) If the compared values are the same, the recipient becomes the creator of the CNF formula, and it is characterized in that it is performed as a step of confirming that both parties have the same CNF formula.

The present invention provides that, due to the characteristics of the circular structure of the circular binomial tree and the characteristics of the indistinguishability of the variables, all 3-SAT objects (instances) created must at least find a solution for backtracking-based algorithms. It can be used in encryption because it proves that the number of sub-exponential calculation steps is required. In addition, by disclosing the CNF formula that makes up the Hard SAT, using it for encryption, and suggesting a method of decryption only when the private key that is the solution to the CNF formula is known, other disclosures have been subjected to various attacks due to the formal relationship between the public key and private key. It has an advantage in terms of safety compared to key-based algorithms.

In addition, compared to existing quantum-resistant encryption algorithms, the present invention has improved advantages in both fast calculation and ease of implementation, so advanced encryption technology utilizing it can be applied to various fields.

Figure 1 is a schematic diagram illustrating the process of generating a toroidal binomial tree from a unit clause consisting of only one literal.

Figure 2 is a diagram showing an example of a single toroidal binomial tree in which no random variables are added;

Figure 3 is a diagram showing an example of a single toroidal binomial tree with added random variables;

Figure 4 is a diagram showing an example of a dual toroidal binomial tree without random variables added;

Figure 5 is a diagram showing an example of a dual toroidal binomial tree with added random variables;

Figure 6 is a diagram to explain the concept of a dual toroidal binomial tree;

Figure 7 is a diagram to compare and explain the propagation of the effect when the value of one variable changes and unit propagation (Boolean constraint propagation);

Figure 8 is a diagram for explaining the concept of modular random encapsulation;

Figure 9 is a diagram for explaining the concept of CDC (Conditional Don't-Care) variable;

Figure 10 is a diagram illustrating the process of selecting decision literals and implied literals to find circular loops created in TRUE trees and FALSE trees;

Figure 11 is a diagram illustrating the process of changing clauses consisting of three literals into clauses consisting of two literals by deleting the complements of the decision literal and implied literal selected in the previous step from the clause;

Figure 12 is a diagram illustrating the results of an experiment conducted to confirm that 3-CNF generated by modular random encapsulation in a dual toroidal binomial tree does not have a solution other than a dual solution if the number of input variables is sufficiently large;

Figure 13 is a diagram to explain the results of an experiment measuring the time it takes to find a solution while increasing the size of the dual toroidal binomial tree;

14 is a diagram illustrating an encryption and decryption method using Hard CNF;

Hereinafter, the configuration and operation of an embodiment of the present invention will be described in detail with reference to the attached drawings. However, it is not intended to limit the present invention to a specific disclosed form, and should be understood to include all changes, equivalents, and substitutes included in the spirit and technical scope of the present invention.

In addition, repetitive descriptions and detailed descriptions of known functions and configurations that may unnecessarily obscure the gist of the present invention are omitted in order to not obscure the gist of the present invention. Since the embodiments of the present invention are provided to more completely explain the present invention to those with average knowledge in the art, various modifications and changes can be made without departing from the spirit and scope of the present invention, and such modifications Alternatively, it should be said that modified examples fall within the scope of the patent claims of the present invention.

First, the present invention creates a binomial tree by applying a resolution rule and adding redundancy clauses to hide the information that one literal value constituting the unit clause, which is the simplest clause, must have a TRUE value to be satisfiable, In order to remove the characteristic of the expressional inequality of the binomial tree, place the tree on the surface of a spherical object and connect the nodes at the ends to create a circular tree. To remove the characteristic of the geometric inequality of the circular tree, create a circular tree instead of one binomial tree. We explain the process of creating a toroidal binomial tree by combining the two so that they are vertically symmetrical, placing them on the surface of a spherical body, connecting the upper and lower nodes to each other, and connecting the left and right nodes to each other.

Afterwards, it is shown that the circular binomial tree above has a unique dual solution due to the characteristics of the circular structure. However, the 2-CNF formula extracted from the toroidal binomial tree does not undergo back-tracking, so it can be easily solved by the SAT Solver. To solve the above problem, we describe the random encapsulation technique as a method of adding random variables to transform the clauses that make up the circular binomial tree to have three literals. Furthermore, the search algorithm can easily find a subset of the solution. To prevent this case, we describe a newly invented modular random encapsulation technique.

In the process of analyzing the characteristics of 3-CNF generated by modular random encapsulation of a single toroid tree or a dual toroid tree, the following four points are proven. First, it shows that the 3-CNF formula created by modular random encapsulation in the generated single toroidal binomial tree has sub-exponentially many solutions. Second, in order to find the basis solution of the toroidal binomial tree, the roles of variables must be distinguished by analyzing the structure of the tree, and this proves that the number of sub-exponential calculation steps is necessary. Third, if you create two circular binomial trees and generate a 3-CNF formula from the two trees, the characteristics of the circular structure created by each tree are combined into the two trees, and as a result, if the number of input variables is large enough, a unique dual solution Prove that you have Fourth, if there is a unique dual solution, it proves that the number of exponential calculation steps is required for the SAT Solver to find the solution.

In order to use the Hard SAT generated in this way for encryption and decryption, a new CNF formula with a slight difference in the number of 1-TRUE clauses and 2-TRUE clauses is created in the generated Hard 3-CNF formula, and then used to encrypt/decrypt. We introduce the decryption algorithm. Finally, we describe a method for verifying the identity of the creator of the CNF formula online.

Hereinafter, definitions of terms used in the present invention will be explained.

The Boolean variable a has only the value TRUE (1) or FALSE (0) and creates literals such as ￢a, a. An expression expressed as a disjunction (v) of literals, such as (a∨￢b), is called a clause. An expression expressed as a conjunction (∧) of clauses, such as (a∨￢b)∧(b∨￢c), is called Conjunctive Normal Form (CNF).

A group of literals that make all the clauses that make up the CNF formula have the value TRUE is defined as the solution to the CNF formula, and the problem of finding whether a solution to the CNF formula exists is called the Satisfiability problem (SAT). If a solution exists, the CNF formula that makes up SAT is expressed as satisfiable.

A CNF formula in which all clauses are composed of two or fewer literals is expressed as 2-CNF, a CNF formula in which all clauses are composed of three or fewer literals is expressed as 3-CNF, and a CNF formula in which all clauses are composed of only three literals is expressed as Exact 3-CNF. The question of whether a solution to each CNF formula exists is expressed as 2-SAT, 3-SAT, and Exact 3-SAT.

Problems that require a yes or no answer are called decision problems, and the SAT belongs to a decision problem. Abstract computer models are divided into deterministic Turing machine (DTM) and non-deterministic Turing machine (NTM). DTM can have only one state transition from the previous step to the next step, and NTM can have multiple. are distinguished. When defining the number of state transitions as the number of steps, the set P is a set of decision problems for which an algorithm exists to solve the problem with a polynomial step number using DTM, and the set NP is a set of decision problems for which an algorithm exists to solve the problem with a polynomial step number using NTM. It is defined as a set of existing decision problems, and SAT belongs to NP. When the algorithm that solves problem A can be replaced with an algorithm that solves problem B through a conversion process of the number of polynomial calculation steps, A is expressed as polynomial-time reducible to B, and all NP problems are polynomial-time reducible to problem B. B is defined as an NP-hard problem, and when all NP problems are polynomial-time reducible to B problems and B belongs to NP, B is defined as an NP-complete problem. SAT is the first representative NP-complete problem discovered.

When the number of input variables is small, a resolution technique can be used to find a solution to the SAT. However, when the number of input variables becomes large, a SAT solver developed to find a solution to the SAT is used. Algorithms have been released through international SAT competitions and various researchers for decades. New SAT solvers with continuously improved performance have been developed.

All SAT solvers created to date are based on the Davis-Putnam-Logemann-Loveland (DPLL) algorithm. Let's take a look at how the solution set of 3-SAT is determined by the DPLL algorithm. Exact 3-SAT consists of clauses with three literals. If a clause is satisfiable, one or more literals must have the value TRUE. Assuming that two literals among the three literals that make up one clause do not contribute to satisfiability, we assign FALSE values to the two literals and delete them from the clause. Alternatively, assuming that one of the two literals that make up one clause does not contribute to satisfiability, we assign a FALSE value to one literal and then delete it from the clause. Through the above process, a unit clause consisting of only one literal is created. Then, in the process of finding a solution, when we find that the assumption is incorrect, we go back to the step where we assumed the variable value to be FALSE and modify the variable value. At this time, to create a unit clause, the act of assigning a literal value to FALSE is expressed as a decision assignment, and the variable assigned a value such that the literal has the value of FALSE is defined as a decision variable. The act of setting a variable value so that the unit clause is satisfiable, that is, the character value is TRUE, is expressed as implied assignment, and the variables that make up the unit clause are defined as implied variables. Variable values set by implied assignment affect the values of other variables to determine the satisfiability of other clauses. This influence occurs by deleting the complement from the clause containing the complement of the implied literal when assigning TRUE. This behavior means assuming that the complement of the implied literal does not contribute to the satisfiability of the clause. If a clause is created in which none of the remaining literals is assigned a TRUE value even though a satisfiable solution exists, the above assumption is incorrect. must be modified. In other words, it affects the values of other variables so that at least one of the two literals must be TRUE. This influence is propagated through the path created by the implied literal and its complement. This is expressed as Boolean constraint propagation or unit propagation.

Since the decision literal is assigned to have the value of FALSE and the implied literal is assigned to have the value of TRUE, the complement of the decision literal or implied literal included in one clause does not affect satisfiability and is therefore deleted. If an empty clause is created in the above process, it is said that a conflict has occurred. If two or more literals remain in one clause even after deleting the complement of implied literals or decision literals, you must successively set another variable as a decision variable and assign the value FALSE. Since the setting of these continuous variable values requires modifying the set value when a conflict occurs, a binary tree created by decision variables is constructed and managed, and the tree level above is called the decision level. Clauses containing the complement of a decision literal or implied literal are deleted because they are satisfiable by the above literals. If there are no clauses remaining in the above process, the algorithm returns a satisfiable result, and the set of all implied literals included in the unit clauses becomes the solution to the CNF formula.

The present invention describes a method of systematically generating a Hard SAT that is difficult for SAT solvers to solve, and a method of encrypting and decrypting using the generated Hard SAT.

Hereinafter, with reference to the attached drawings, a method for generating a 3-CNF with a password as a solution according to the present invention and a method for generating a quantum-resistant encryption algorithm based on SAT using the same will be described as follows.

Figure 1 shows a schematic diagram to explain the process of creating a toroidal binomial tree from a unit clause consisting of only one literal. After creating a binomial tree by applying a resolution rule to the unit clause and inserting redundant clauses, it is transformed into a circular binomial tree to remove the expressional inequality of the binomial tree, and then a circular binomial tree is used to remove the geometric inequality of the circular binomial tree. It shows the transformation procedure.

Figure 2 is a diagram showing an example of a single toroidal binomial tree in which no random variables are added. Literals with TRUE values were randomly sorted and placed in place of dominant literals. Switching literals are placed as complements of dominant literals.

Figure 3 is a diagram showing an example of a single toroidal binomial tree to which random variables are added. It is a form of inserting random literals to change the clauses constituting the circular binomial tree generated in Figure 2 into clauses made up of three literals, and shows the left shift modular random encapsulation technique in which random literals with FALSE values are placed on the left.

Figure 4 is a diagram showing an example of a dual toroidal binomial tree in which no random variables are added. Figure 2 shows an example of creating a dual toroidal binomial tree by adding a FALSE tree to the TRUE tree created.

Figure 5 is a diagram showing an example of a dual toroidal binomial tree to which random variables are added. In order to change the clauses constituting the dual toroidal binomial tree generated in Figure 4 into clauses consisting of three literals, the left shift modular random encapsulation technique is shown with a random literal added.

Figure 6 is a diagram to explain the concept of a dual toroidal binomial tree. It shows that one variable constituting a dual toroidal binomial tree and its complement play a dominant literal role in both trees.

Figure 7 is a diagram to compare and explain the propagation of the effect when the value of one variable changes and unit propagation (Boolean constraint propagation). It shows that a short circular loop is created when a random literal overlaps with a dominant literal or switching literal.

Figure 8 is a diagram to explain the concept of modular random encapsulation. This shows an example of arranging random variables with distance = number of columns / 2 -1 to modularly random encapsulate a toroidal binomial tree with 10 columns and 5 tree levels.

Figure 9 is a diagram to explain the concept of a new concept, CDC (Conditional Don't-Care) variable. It shows an example in which a circular loop is formed in the horizontal and vertical directions and variables are connected to form a CDC.

Figure 10 is a diagram to explain the process of selecting decision literals and implied literals to find circular loops created in TRUE trees and FALSE trees. It shows that if decision literals and implied literals are selected correctly, the tree's unique circular loop can be found.

Figure 11 is a diagram to explain the process in which clauses consisting of three literals are changed into clauses consisting of two literals by deleting the complements of decision literals and implied literals selected in the previous step from the clause. Figure (a) shows a case where dominant literals and random literals are deleted from the FALSE tree, and figure (b) shows a case where switching literals and random literals are deleted from the TRUE tree.

Figure 12 is a diagram to explain the results of an experiment conducted to confirm that 3-CNF generated by modular random encapsulation in a dual toroidal binomial tree does not have solutions other than the dual solution if the number of input variables is sufficiently large. It can be seen that the theoretical predicted value of the probability of having a unique dual solution matches the measured value.

Figure 13 is a diagram to explain the results of an experiment measuring the time it takes to find a solution while increasing the size of a dual toroidal binomial tree. Both the free modular method and the shift modular method show that the time to find a solution increases exponentially in proportion to the number of input variables.

Figure 14 is a diagram for explaining the encryption and decryption method using Hard CNF. After extracting q number of 2-TRUE clauses and p number of 1-TRUE clauses to create a new CNF, randomly extract 2p+1 clauses, count the number of literals to create a ciphertext, extract the number of literals from the ciphertext, and set the threshold value. After creating a formula to check, it shows the process of substituting the password and decrypting it to 1 if it is greater than or equal to 3p+2, and 0 otherwise.

With reference to the above drawings, the main configuration for implementing the present invention will be described in detail, but first, the toroidal binomial tree generation method will be described.

Is it possible to create an algorithm that can figure out what value comes up after throwing a die or a coin? Let's assume we have the problem: In order to conclude that A comes out and B does not come out, there must be an element that distinguishes A and B inside the algorithm, but when it comes to the act of throwing, A and B are indistinguishable from each other. In other words, when it comes to the act of throwing, the numbers are equal to each other.

The above problem can be considered extremely hard because it is difficult to create an algorithm that can find a solution due to indistinguishability. So, we want to create Hard SAT by creating a conceptual indistinguishable space that makes it difficult to create an algorithm to solve the problem and hiding the values of variables in that space. The present invention defines expressional equality and geometric equality.

Hard SAT is created by creating a toroidal binomial tree as an indistinguishable space with the above two equality characteristics and randomly inserting literals into the nodes that make up the tree. A toroidal binomial tree is created through the process of continuously transforming the simplest clause, the unit clause, in the direction of increasing the complexity of the CNF formula.

Referring to [Figure 1], (a) shows a unit clause. (b) is a unit clause transformed into k clauses consisting of two letters, (c) is a form that increases complexity by adding new redundant clauses consisting of two letters, and (d) is a form of resolution by adding variables. Shows the process of creating new paths to which rules can be applied. (e) shows a binomial tree created by repeating the addition process in (d). (f) shows how to create a circular tree to secure expressional equality from a binomial tree. (g) shows how to create a toroidal binomial tree to secure geometric equality from a circular tree. (h) shows the shape of a toroidal binomial tree.

A resolution technique is used as a method to solve SAT problems. In the resolution technique, a resolution rule is used when combining clauses to create new clauses. An example is as follows.

(Formula 1) (a∨￢b)∧(b∨a)⇒a

(Equation 1) indicates that the condition for variable a to have a TRUE value is a necessary condition for both clauses (a∨￢b) and (b∨a) to be TRUE. If you change your perspective, you can interpret that the necessary conditions for variable a are hidden in two clauses, and by expanding the above concept, we want to make it difficult to find the necessary conditions for variable a by continuously increasing the number of clauses. To easily check the above process, one or two pairs of clauses are graphed. In the case of (x _1.1 ∨￢x _2.1 ) and (x _1.1 ∨￢x _2.1 )∧(x _1.1 ∨￢x _2.2 ), the literals are expressed by connecting the literals with a single line as follows.

When displaying a graph, the NOT(￢) operator is indicated as - for convenience. When displaying two verses in one graph, the characters that are common to both verses are placed in front, and the remaining characters are placed at the back with a slight gap. Resolution rules are applied along a path connecting a variable and its complement and are indicated by a slightly curved arrow as shown in [Figure 1].

The unit clause (x _1.1 ) is expanded into several clauses using a resolution rule, and redundant clauses are added to continuously execute the process of making it difficult to find the necessary condition for x _1.1 for all clauses to have a TRUE value. If the above process is represented graphically, a tree like (e) in [Figure 1] is created.

If (b) and (c) in [Figure 1] are expressed as a CNF formula, they are expressed as (Formula 2) and (Formula 3) below.

(Formula 2) (x _1.1 ∨￢x _2.1 )∧(x _2.1 ∨￢x _3.1 )∧...∧(x _K.1 ∨x _1.1 )

(Formula 3) A∧B,

A=(x _1.1 ∨￢x _2.1 )∧(x _2.1 ∨￢x _3.1 )∧...∧(x _K.1 ∨x _1.1 ),

B=(x _1.1 ∨￢x _2.2 )∧(x _2.1 ∨￢x _3.2 )∧...∧(x _K.1 ∨x _k+1.2 )

In the above (Equation 2), if the resolution rule is applied, the necessary condition of x _1.1 is confirmed. Since the CNF formula in equation (3) includes the CNF formula in (equation 2), the requirement for x _1.1 remains the same. In (c) of [Figure 1], the connection line represented by the curved arrow at ￢x _2.1 was created in (x 1.1 ∨￢) among the two clauses, ₍ x _1.1 ∨￢x _2.1 ) and (x _1.1 ∨￢x _2.2 ). This shows that the resolution rule can be applied using x _2.1 ).

The character (variable) that belongs to the two clauses in common is defined as a dominant literal (variable), and the remaining two characters (variables) are defined as switching literal (variable). Switching variable means that the resolution rule plays a role in selecting the applicable clause.

In (c) of [Figure 1], new clauses are created with the complements of variables as dominant literals so that another switching pass can be created using variables that are not selected when applying the resolution rule. In order to minimize the number of variables used at this time, among the unselected variables, one is assigned as a dominant variable, another is assigned as a switching variable, and the remaining one is assigned a new variable. After that, if the path to which the resolution rule can be applied is indicated with an arrow, a connection structure like (d) in [Figure 1] is created, and if the above process is repeated, a tree like (e) in [Figure 1] is created.

Even if you replace x _1.1 at the bottom of the tree with a switching literal at an arbitrary position, a resolution path is created and you can check the condition that x _1.1 = TRUE. At this time, the number of resolution paths created from the root node to a specific child node is expressed as a binomial coefficient, so the generated tree is defined as a binomial tree. The binomial tree differs in the number of complements of dominant literals used in the root node, outer node, and inner node. The root node was never used, the outer nodes were used once, and the inner nodes were used twice. Let's express the difference in the number of uses of variables as above as the expressional inequality of the CNF formula. The morphological inequality of the CNF formula allows the algorithm to easily distinguish between root nodes and inner nodes, making it possible to easily find a solution by selecting the search direction from the inner node to the root node rather than the direction from the root node to the inner node.

In order to eliminate the morphological inequality of the binomial tree, let's assume that the tree spread out on a plane is placed on a spherical curved surface as shown in (f) of [Figure 1], and then add new nodes to connect the unused switching literals twice. . (f) in [Figure 1] explains how to change a binomial tree into a circular binomial tree. Create a new node by sequentially gathering the outer literals that form the triangle one by one. First, create two clauses with _the _dominant literal switching _to Extract to create the remaining 4 pairs. The nodes appearing in the tree are expressed with three literals, but note that they are pairs of clauses made up of two literals. In the existing binomial tree, the root node, outer node, and inner node used different complements of dominant literals, but in the circular binomial tree, all literals and their complements are used twice. Additionally, all nodes have one or more circular loops that return to the starting point by following a path from the starting point.

The circular binomial tree ensures formal equivalence of the CNF formula for variables because the number of uses of variables and their complements is the same. However, the geometric form that creates the tree structure is divided into a start node and an end node. The difference in geometric form is that when you follow the path with one node as the starting point, a circular loop is created that returns to the starting point. At this time, the number of times it passes through the node and returns to it makes a difference. Let's express this difference as the geometric inequality of the CNF formula. The geometric inequality of the circular binomial tree creates a difference in the number of calculation steps required by the search algorithm to find a solution.

To ensure geometric equivalence of the CNF formula, two binomial trees in the form of right triangles are stacked on top of each other to create a tree in the form of a rectangular square. There will be a matrix whose width and height differ by 1, but the concept is expanded to an m x n matrix where the width and height have arbitrary values. Then, as shown in (g) in [Figure 1], if the highest and lowest nodes of the tree are connected and the nodes on both sides are connected, all nodes become indistinguishable between top, bottom, left, and right, so there is no geometric difference. Through the above connection process, a torus-shaped tree is formed as shown in (h) of [Figure 1], so it is defined as a toroidal binomial tree. (h) in [Figure 1] shows a toroidal binomial tree with both the number of columns and the number of levels being 10, and the nodes are expressed as small spheres.

Hereinafter, a dual toroidal binomial tree, which is one of the main technical elements for implementing the present invention, will be described.

Due to the morphological and geometric equivalence of the toroidal binomial tree described above, it has become difficult to distinguish mathematically or geometrically between the two variables used as the dominant variable. However, a variable and its complement are located at different levels, so when a variable is used as a switching variable, a path is formed from that variable to the variable's complement, and when it is used as a dominant variable, a path is formed from the variable's complement to that variable. is formed Let's express this as having directional inequality. The directional inequality characteristic of the toroidal binomial tree leaves room for the algorithm to distinguish the roles of variables and their complements and understand the tree structure.

In order to have directional equality where one variable and its complement do not have direction and it is not possible to distinguish which one is included in the upper level, two circular binomial trees are created taking into account the number of variables. After that, nodes are randomly selected and arranged so that one variable plays the role of the dominant variable in one tree, and the complement of that variable is arranged so that it plays the role of the dominant variable in the other tree. By this arrangement, one variable and its complement play the role of the dominant variable and switching variable in the entire CNF formula, thus establishing directional equality. The tree generated by the above arrangement is defined as a dual toroidal binomial tree.

Since a circular binomial tree has two literals that make up one clause, for all clauses that make up a circular binomial tree to be satisfiable, if one dominant literal has a value of FALSE, the switching literal located in the same clause must have a value of TRUE. Creates a condition in which the dominant literal located at the lower level, which is the complement of the switching literal, must have the value FALSE.

The above condition is propagated through a circular loop, creating a condition in which all dominant literals forming the circular loop must have the value FALSE.

If one switching literal has a FALSE value, a condition is created in the same way that all dominant literals must have a TRUE value. Therefore, the 2-CNF formula that constitutes a toroidal binomial tree or a dual toric binomial tree has a dual solution in which all dominant literals have the same value. In addition, if the value of one literal among the literals that make up the solution set changes, a condition is created in which the values of all literals change through a circular loop, so the completely changed solution becomes another solution of the dual solution, so there is no solution with only some changes. . Therefore, there are no solutions other than the dual solution.

As mentioned in the beginning, we wanted to create Hard SAT by creating a conceptual indistinguishable space that makes it difficult to create algorithms to solve problems and hiding the values of variables in that space. A (dual) toroidal binomial tree with a password as the solution is created in the following way.

(Method 1). Password assignment in a (dual) toroidal binomial tree

1. After creating a password of n bits, assign a variable to each bit. (Example: 1010, x ₁ =1, x ₂ =0, x ₃ =1, x ₄ =0)

2. Considering the password length, create two toroidal binomial tree frames such as (g) in [Figure 1].

3. Create a set of n literals with TRUE values or n literal sets with FALSE values and then sort them randomly. (Example: In the case of a set of n literals with TRUE values: -x ₂ , x ₁ , x ₃ , -x ₄ )

4. After selecting one tree, take them out one by one in order and place them in place of the dominant literal starting from the leftmost column. (Fill all columns from top to bottom and then fill in the next column.)

5. Switching literals are placed in the complement of dominant literals.

6. When creating a dual toroidal binomial tree, create a set of n literals using the complement of the variables set in step 3 and then sort them randomly. (e.g. -x ₁ , x ₄ , -x ₃ , x ₂ )

7. When creating a dual toroidal binomial tree, execute steps 4-5 above using the literal set created in step 6 in another tree that makes up the dual toroidal binomial tree.

The set of n dominant literals used in (Method 1) above is defined as the basis solution. Due to the duality characteristic of the solution, the set of complements of all literals included in the basis solution also becomes the solution. The above solution is defined as a complement solution. A unique dual solution is defined as a case where there is no solution other than the basis solution and complement solution. In addition, a tree in which dominant literals are arranged in a set of n literals with TRUE values is defined as a TRUE tree, and a tree in which dominant literals are arranged in a set of n literals in FALSE values is defined as a FALSE tree.

Above we created a dual toroidal binomial tree using a TRUE tree and a FALSE tree. Here, let's think about the difficulty in finding a solution when creating a double toroidal binomial tree using two TRUE trees or two FALSE trees. The dual toroidal binomial tree can play a role in hiding the tree structure in the new SAT solver created in an attempt to understand the tree structure, but since all SAT solvers created to date do not have this function, the difficulty in finding a solution is due to the dual toroidal binomial tree. It is expected that a toroidal binomial tree or a double toroidal binomial tree will be similar. It was confirmed through experiments that the difficulty in finding a solution is similar to that when using a dual toroidal binomial tree, and the experimental results are described later.

Hereinafter, a method for generating Hard SAT by random encapsulation, which is one of the main technical elements for implementing the present invention, will be described.

The clauses that make up the (dual) toroidal binomial tree described earlier are composed of two literals, and due to the duality characteristic of the solution, one literal can have both TRUE and FALSE values. Therefore, even if you select one literal and assume it is FALSE, the assumption will always be true. Therefore, because back-tracking does not occur, the solution is easily found by the SAT solver. In order to change to the 3-CNF formula, which inevitably causes back-tracking when solving a problem with a SAT solver, all literals and their complements included in the basis solution are randomly sorted and then sequentially added to the clauses that form the (dual) toroidal binomial tree. Let's do it. At this time, it is added while satisfying two conditions.

First, it is made using the Exact 3-CNF formula. (If the variable you want to add overlaps with the two variables that make up one clause, it is randomly rearranged.)

Second, one of the two literals to be added to the two clauses that make up one node uses the one included in the basis solution, and the other uses the one that is not included. This behavior is defined as random encapsulation, and the added character (variable) is defined as random literal (variable). By performing random encapsulation, the (dual) toroidal binomial tree composed of the 2-CNF formula was changed to the 3-CNF formula, and one clause consists of a dominant literal, switching literal, and random literal.

However, satisfiability remains the same. This is because a random literal was added to each clause using the OR operator when all clauses already had the value TRUE. By adding one more literal that can contribute to satisfiability in each clause, there are more solutions than the existing solutions. Now, let's place the added random literals as shown in [Figure 7] on the switching literals of the graph representing the (dual) toroidal binomial tree. At this time, let's mark in gray the literals with the FALSE value necessary for explanation, including random literals.

(a) in [Figure 7] represents the TRUE tree. Therefore, in the basis solution, d ₁ has the value TRUE and both s ₁ and s ₂ have the value FALSE. Assume that the value of d ₁ changes to FALSE. According to the second condition of the random encapsulation method, one of r ₁ and r ₂ must have the value FALSE. Since r ₂ has the value FALSE, in order for the clause (d ₁ ∨s ₂ ∨r ₂ ) to be satisfiable, s ₂ must be changed to TRUE, which causes the condition that d ₂ , the complement of s ₂ , must be changed to FALSE. The above condition is continuously propagated until the previously changed variable appears, that is, until a circular loop is formed. (a) of [FIG. 7] shows a case where d ₄ to d ₇ form a circular loop and d ₁ changes to FALSE, so that d ₂ to d ₇ must continuously change to FALSE.

(b) in [Figure 7] represents the FALSE tree. Therefore, in the basis solution, d ₁ has the value FALSE. Assuming that the value of d ₁ changes to TRUE, the value of s ₁ , the complement of d ₁ , changes to FALSE. At this time, according to the second condition of the random encapsulation method, one of r ₁ and r ₂ must have the value FALSE. Since r ₁ is FALSE, d ₂ must be changed to TRUE, which causes the condition that switching literals, which are the complements of d ₂ , must be changed to FALSE. The above condition is continuously propagated while the values of all dominant literals forming a circular loop are changed. (b) of [FIG. 7] shows a case where d ₂ to d ₄ must continuously change to TRUE when d ₁ changes to TRUE. At this time, if random literals with TRUE and FALSE values are placed in a certain position (on the right) as in (b) of [Figure 3] rather than being added to the two clauses that make up the two nodes at random positions, r ₁ and r ₂ are It is not probable that one will have the value FALSE, but that one will necessarily have the value FALSE and the other will have the value TRUE. The method of placing random literals with FALSE values to be added in a certain position on the left or right is defined as left shift random encapsulation or right shift random encapsulation, and the method of arranging them randomly is defined as free random encapsulation.

(c) in [Figure 7] shows that the minimum length of a circular loop created by a toroidal binomial tree is equal to the number of levels in the tree and that all nodes can be included in one circular loop. (a) in [Figure 7] and (b) show that when the value of one variable changes, the effect is propagated to the values of other variables until a circular loop with a toroidal binomial tree7 is formed. However, as shown in (d) of [Figure 7], when the random variable (r ₃ ) becomes equal to the complement of the dominant literal or switching literal whose value has already changed, the random variable creates a circular loop, forming a short circular loop and no longer Influence does not spread.

The important takeaway here is that the phenomenon of influence being propagated when the value of one variable changes is directly applied to unit propagation by only changing the direction of progress. (e) and (f) in [Figure 7] show the process of finding a circular loop by continuously selecting the correct decision variables (d _i ). Creating a circular loop means that one clause is deleted by previously assigned literals. Since the process of deleting a clause without causing a conflict is the process of finding a circular loop, the process of finding a solution becomes the process of finding all circular loops. At this time, if the implied literal used to form the final cyclic loop becomes a dominant literal or switching literal, it forms a cyclical loop with a toroidal binomial tree, and if it becomes a random literal as in (g) of [Figure 7], the random variable It shows that a short circulation loop is formed by creating a circulation loop. The unit propagation path created in (e), (f), and (g) of [Figure 7] only changes the direction, and one variable created in (a), (b), and (d) of [Figure 7] You can see that the path through which influence is propagated when the value changes is the same.

As seen above, a short circular loop is created when a random variable participates in a circular loop. Short circular loops make it easier to find a solution because the DPLL algorithm allows one clause to be deleted even with a small number of calculation steps. In order for the CNF formula to be used in encryption, it is important to find a difficult solution, but it is also important to avoid cases where the solution is easily obtained accidentally. Therefore, we want to find a way to ensure that all generated SATs have hardness above a set limit in any case.

Hereinafter, modular random encapsulation, one of the main technical elements for implementing the present invention, will be described.

We saw earlier that the minimum length of a circular loop created by a toroidal binomial tree is equal to the number of levels in the tree. If it is possible to prevent random variables from being included in the variables that make up the circular loop, a decision level sufficient to create the original circular loop of the circular binomial tree must be formed, but one clause must be erased by previously assigned variables. Hardness above a certain level is secured. We introduce the modular random encapsulation technique as a method of eliminating short circular loops created by random variables by arranging dominant variables and random variables so that they do not overlap each other.

First, separate dominant literals belonging to the same column into groups. After that, the dominant literals and their complements included in the furthest group are randomly sorted, then taken out one by one and added to the two clauses that make up one node using the random encapsulation method. Since the circular binomial tree has cyclic loops in both the horizontal and vertical directions, the distance between the two groups is mathematically equivalent to the number of columns/2, the number of columns/2-1, and the number of columns/2+1. In the experiment for this patent, the distance was set to the number of columns/2-1 regardless of whether the number of columns was odd or even. The reason why the number of columns/2 is not set as the distance in the case of an even number is because there is a possibility that clauses with the same variables may be created between the two groups with the above settings. Additionally, when the distance is 1, the switching variable that makes up one clause overlaps with the dominant variable of the next node, so set it to be 2 or more. Therefore, set the number of columns to 5 or more.

(a) in [Figure 8] shows a method of modular random encapsulation of a toroidal binomial tree with 10 columns and 5 levels. For a random variable to become the same as a dominant literal or switching literal, propagation equal to the number of columns/2 -1 is required, so when the number of tree levels is k and the number of columns becomes 2k+1, propagation equal to the number of tree levels is guaranteed. In the case of left shift modular encapsulation, vertical propagation determines the minimum number of propagations to obtain the correct solution. Additionally, in order to confirm an incorrect decision assignment, propagation must occur up to the clause containing the decision variable, so horizontal propagation determines the minimum number of propagations to confirm that a conflict has occurred. Therefore, in the case of left shift modular, vertical propagation as many tree levels occurs regardless of the number of columns, but the minimum number of propagations for horizontal propagation determines the time required when a conflict occurs, so it is necessary to secure hardness above a certain level. To do this, it is necessary to set it so that it propagates beyond the threshold in the horizontal direction.

(b) in [Figure 8] shows that the isosceles triangle shape used when representing a tree has been modified to be biased to the left. In the case above, in the case of left shift, the paths are directed downward, and in the case of right shift, they are directed to the lower right, but if expressed by modifying them to be biased to the right as in (c), in the case of left shift, they are directed to the lower left and right shift. In this case, it is directed downward. Therefore, there is only a difference in expressing the tree. In the case of left shift, the path in the left direction is selected, and in the case of right shift, the path in the right direction is selected. Also, note that if there was a left shift based on the literals included in the basis solution, it would be a right shift from the perspective of the literals included in the complement solution, so they are interchanged. In the experiment for this patent, left shift modular encapsulation was used because dominant literals were placed based on the basis solution.

The correlation graph of variables created through modular random encapsulation can be seen as a bridge connecting nodes by random variables on top of a toroidal binomial tree composed of 2-SAT. When executing unit propagation, the act of assuming a random literal value to be FALSE in order to create a unit clause, that is, setting it as a decision variable, has a 1/2 probability of being a correct assumption, so all nodes can become a return point for back-tracking. . Therefore, it is predicted that the addition of random variables will rapidly increase the number of conflict occurrences in the DPLL algorithm. Additionally, the act of correctly selecting random literals for each node and setting them to FALSE means removing the random literals added to each clause and performing unit propagation in the tree composed of the 2-CNF formula. The 2-CNF formula performs unit propagation without additional decision assignment through a single decision assignment and continuous implied assignment, but the 3-CNF formula sets the decision level by setting a random variable value so that the random literal has the value FALSE at every node. increase In conclusion, the added random variable plays a role in selecting the path through which unit propagation occurs among the two paths branching from one node, and increases the decision level by one each time it is selected. The CNF formula generation method using modular random encapsulation is summarized as follows.

(Method 2). CNF formula generation by modular random encapsulation

1. Among the two trees created in (Method 1), the dominant literals that make up one tree are grouped by column and then randomly sorted.

2. Create corresponding groups using the complements of all literals belonging to the group created in step 1, and then sort them randomly.

3. Set Distance. (Example: distance = number of columns/2 -1)

4. After sequentially extracting literals from the group created in number 1 and the corresponding group created in number 2, among the two clauses that make up each node included in the group separated by distance, place the literal with the value FALSE on the right or left, or After being added to an arbitrary position, literals with a TRUE value are added to the remaining clauses.

5. In the case of a dual toroidal binomial tree, perform steps 1-4 using another tree.

6. After extracting clauses from all nodes, the three literals that make up one clause are randomly rearranged to prevent the role of each variable from being confirmed.

Below, we will look at the characteristics of 3-SAT generated by modular random encapsulation of a toroidal binomial tree.

We created a toroidal binomial tree that satisfies expressional equality and geometric equality as an indistinguishable space, and a dual toric binomial tree that even satisfies the properties of directional equality. After creating a tree frame, literals were randomly placed at each node. Therefore, from the perspective of the algorithm, there is no element to distinguish literals, so the only way to select literals for decision assignment is to select them randomly. At this time, if meaningful information can be accumulated from repeated execution, the number of calculation steps required to find the solution can be reduced, so it is necessary to check whether the information is accumulated.

Lemma 1. If decision literals are randomly selected, information that can reduce the number of back-tracking executions is not accumulated with each repeated execution.”

Proof) When a conflict occurs, if the resolution rule is successively applied to related clauses, starting with the clause containing the implied literal that ultimately caused the conflict, all related implied variables are removed and only decision literals remain. Therefore, in the conflict-driven clause learning (CDCL) algorithm, a newly created clause is expressed as a disjunction of the remaining decision literals. Because the decision literals are randomly selected, the newly created clause only has the information that at least one of them must be changed. In addition, even if a specific variable is selected as a decision literal multiple times whenever a conflict occurs, it cannot be assumed that it increases the possibility that the literal will or will not be included in the solution set because it is a random selection. Therefore, if the variables selected for decision assignment are randomly selected, information that can reduce the number of back-tracking executions is not accumulated from the information generated each time a conflict occurs.

It can be seen that the indistinguishability characteristics of variables maximize the number of back-tracking executions by minimizing the information that can be obtained through previous executions. In addition, the above results mean that the new clause generated by the CDCL algorithm does not play a role in solving problems with indistinguishability characteristics, and that back-tracking must be performed as many times as the number of all worst-case cases to obtain a solution. do.

Below, we will look at the characteristics of 3-SAT generated by modular random encapsulation of a single toroidal binomial tree.

Here, let's look at how many solutions 3-CNF generated by modular random encapsulation of a single toroidal binomial tree has. When left shift modular random encapsulation is executed, the nodes composing the same column form a circular loop through the paths made by switching literals. Let's denote the group of dominant literals constituting the column as G _j (1<=j<=m, m: number of columns) and express the value of the dominant literals as the value represented by the group. -G ₁ means that all dominant literals belonging to G ₁ have the value FALSE, and G ₁ means that all dominant literals belonging to G ₁ have the value TRUE. A circular loop is formed by a switching variable, and if the values of the random variables do not change, the dominant variables (or switching variables) constituting the column can have both TRUE and FALSE values, so the solution set is the basis solution (G ₁ , G ₂ ,…,G _m ) and the complement solution (-G ₁ ,-G ₂ ,…,-G _m ), (G ₁ ,-G ₂ ,…,G _m ),(-G ₁ ,-G ₂ ,… There can be several more solutions such as ,G _m ), etc.

The circular loop is not only formed in the column direction by switching variables, as shown in (a) of Figure (1) of [Figure 9], but also in the row direction by random variables, as shown in (b). At this time, if GCD (number of columns, distance) = 1 as in (c), the length of the circular loop in the row direction becomes the number of columns. Also, when the size of the level is k, in (b) of [Figure 9], r ₁ is one of the complements of dominant literals included in the G ₂ group, so the probability that r ₁ becomes the complement of d ₁ is 1/k. do.

When the value of one dominant variable changes, the values of random variables and switching variables made of the same variable also change, so the dominant variable that makes up one node can have both TRUE and FALSE values depending on what value the random variable has. There are cases where it happens. If the value of the G ₅ group forming the circular loop in (a) of [Figure 9] changes to FALSE and the values of r ₁ and r ₂ change, that is, d ₄ changes from TRUE to FALSE, and r ₁ and r ₂ If changes from FALSE and TRUE to TRUE and FALSE, respectively, the two clauses that make up the node containing d ₅ become satisfiable regardless of the value of d ₅ , so d ₅ can have both TRUE and FALSE values. In this case, d ₅ is defined as a conditional don't-care (CDC) literal. One CDC literal creates another CDC literal. If D ₅ changes to FALSE and the values of r ₃ and r ₄ change as shown in (a) of [Figure 9], d ₆ becomes a CDC literal. We can increase the number of CDC literals by successively adding the condition that the related random variable has a specific value. During this process, if all conditions for random variables to have specific values are satisfied, all CDC literals can have both TRUE and FALSE values, and in the above case, the set of CDC literals is -Defined as care group (DCG).

The DCG concept also applies when a circular loop is formed in the row direction. (b) of [Figure 9] shows that a circular loop is formed starting from d ₁ to d ₂ and d ₃ . In order to create a pass that creates a circular loop as shown in the figure in the clause containing d ₃ , the values of r ₁ and r ₂ must not change. The values of r ₁ and r ₂ may vary depending on the values of the decision variables of the column from which the above values were extracted. Therefore, if the distance is set to 2 in (Method 2), only variables that do not change the values of r ₁ and r ₂ among the dominant variables included in G ₂ can optionally belong to the CDC literal. If the value of d ₄ does not change the values of r ₁ and r ₂ and if the value of d ₂ does not change the values of r ₃ and r ₄ , d ₄ becomes a CDC variable. When the value of d ₄ changes to FALSE, d ₅ becomes a CDC literal if the random variables of the node to which d ₅ belongs do not change their values. d ₆ and d ₇ also become CDC literals if the values of the random variables forming the circular loop are not changed.

When a circular loop is formed, the size of the DCG can be increased or decreased to create a DCG of arbitrary size. Once a circular loop is formed, how much the size of the DCG can increase is determined by how the random literals are distributed. In the left shift modular method, random literals with a FALSE value are placed on the left, and those with a TRUE value are placed on the right. However, if the value of the dominant literal changes, the value of the random literal created with the same variable also changes. Since each random literal is randomly placed, as the value of the dominant literal changes, the location where the value of the random literal created with the same variable changes also becomes random. Therefore, the size and number of DCGs vary for each instance.

Since numerous DCGs can be formed in one tree, there can be many solutions other than the dual solution. How many solutions it has determines how much time it takes the SAT Solver to find passwords through exhaustive searches. It is not easy to prove that there are exponentially many solutions, but that there are sub-exponentially many solutions is easily proven using Lemma 2 below.

Lemma 2. 3-CNF generated by left shift modular random encapsulation of a single toroidal binomial tree has at least sub-exponentially many solutions.

Proof) Let's consider a case where the values of the variables in the basis solution change and the solution is different. Consider a case where the value of the dominant literal group from which the random variable is extracted does not change, but all variable values of the dominant literal group to which the random variable is assigned change. Since a circular loop is formed in the column direction along the switching variable, the satisfiability of the entire CNF is maintained even if the values of all literals forming the circular loop change simultaneously. Therefore, if the number of columns is m, at least 2 ^m/2 different solutions can be created. If the number of levels and the number of columns are the same, there is a relationship of m ² =n (n: number of input variables). Therefore, m is expressed as the fractional power of n. Therefore, the above value is a sub-exponential number, so there are at least sub-exponentially many solutions.”

The above result makes it impossible for the SAT Solver to find the password by examining all solutions in polynomial time.

Since it is impossible to conduct a complete search in polynomial time, decryption is not possible just by the SAT solver finding the solution to 3-CNF, and a basis solution must be found. At this time, the act of finding the basis solution becomes the act of examining the tree structure.

First, let's compare the time to find a solution between finding a basis solution and finding a solution other than the basis solution. When assigning random variables to two clauses constituting one node in the left shift modular method, we inserted a random variable with a FALSE value to the left in the basis solution. Therefore, in the case of a basis solution, a circular loop with a size of at least the number of tree levels is formed, but in other solutions, the length of the circular loop may be longer or shorter. In other years, this corresponds to the case of using the free modular method rather than the shift modular method. Therefore, it has a different type of circulation loop than the basis solution. This means that the time to find a solution is different for a basis solution and a non-basis solution.

Now, let's think about how to find the basis solution. The 3-CNF formula generated by modular random encapsulation has the characteristic that if the values of the added random variables do not change, if the value of one variable in the basis solution changes, the values of at least the variables at least the number of tree levels must change simultaneously to maintain satisfiability. . Passes that create circular loops are created in clauses where the random variable has the value FALSE. When we assign a random variable to two clauses that make up one node in the left shift modular method, we set the position where the random variable has a FALSE value to the left based on the basis solution. Therefore, if the solution is other than the basis solution, it has a different type of circular loop than the basis solution. In (Method 1), we prepared a space for dominant literals in a structure called a circular binomial tree and randomly placed literals in that space. Then, random variables were added using the modular random encapsulation technique in (Method 2). At this time, since the random variables and dominant variables were extracted from different groups, there is a possibility that they can be distinguished from each other. One clause consists of a dominant variable, switching variable, and random variable. The attempt to distinguish between variables is to find their roles, which is an attempt to understand the tree structure. Since literals that play the same role are randomly selected and placed in one group, you must check which group the variables belong to in order to distinguish them from each other. We created groups by arranging variables in column units, and extracted the dominant variables and their complements from the furthest group and used them as random variables. Therefore, in order to find a group of random literals, the algorithm must be able to find a subset of variables belonging to each column, and the above process becomes a process of finding the circular loop created by the column group. When left shift modular random encapsulation is executed, the probability of finding a circular loop created by a column group is calculated as follows.

Lemma 3. When the tree level is k, the probability of finding a column group using the DPLL algorithm is 1/(3x6 ^k-2 ).

Proof) To find a column group, select a random literal as a decision literal and assign a FALSE value to the selected literal. Since the solution has the characteristic of duality, the above settings are always correct. Therefore, the probability of correctly selecting the first decision literal is 1. By assuming that one literal is FALSE, the solution to be found in a pair of solution sets with duality is the solution in which the selected literal has the value of FALSE, and this can be a basis solution or a complement solution. Delete literals assigned a FALSE value in the CNF formula. Then, three clauses with only two literals are created in the TRUE tree and FALSE tree, as shown in [Figure 10]. Among the six clauses, the erased literal plays the role of a dominant literal, switching literal, and random literal twice each.

In [Figure 10], the rectangle indicates the decision literal that was first selected and deleted. Marked with d _i means the ith correctly selected decision literal and marked with _i means the ith implied literal. (a) in [Figure 10] shows that two decision literals that played a dominant literal role in the FALSE tree have been deleted. When displaying a dominant literal as a graph, keep in mind that two identical literals are displayed as one. (b) is a case where a decision literal played a random literal role in the same tree, (c) shows that two decision literals that played a switching literal role in a TRUE tree were deleted, and (d) is a case where a decision literal played a random role in the same tree. Indicates the case where a literal role is used. In all four cases above, if the subsequent decision literals are selected correctly, the circular path created by the column group is found, as shown in [Figure 10].

The same method is applied to both trees to calculate the probability. Therefore, regardless of the tree type, three clauses consisting of two literals are created. At this time, since we are in the process of finding the password among many solutions, we can assume that it is the only solution. Therefore, if the value of the decision literal does not have the value FALSE in the solution set password, a conflict occurs or another solution is found. The possibility of making the right choice by following the circular path to find the password is as shown in (a) of [Figure 10], selecting the clause in which the random literal has the value FALSE among the two clauses consisting of two literals forming one node, and selecting the two clauses. A random literal is selected from among literals and assigned a FALSE value, and the above probability is 1/3 x 1/2. Another method is to select the clause in which the erased literal was used as a random literal, as shown in (b) of [Figure 10], and then select the one with a FALSE value among the dominant literal and switching literal, and the probability is 1/3 x 1/ It becomes 2. The above two options proceed with unit propagation once in two different circular loops. Therefore, the probability of correctly selecting two decision literals, d ₁ and d ₂ , in succession is 1/3.

Selecting d ₁ and d ₂ selects one node that forms the group you are looking for. If you select d ₂ and assign a FALSE value, a unit clause is created, and after assigning a TRUE value to the implied literal, if you delete the complement of the implied literal from the CNF formula, up to 3 clauses consisting of 2 literals can be created in one tree. is created. The probability varies depending on how many of the three clauses are erased by decision literals and implied literals that were previously assigned values. Because random variables and dominant variables are placed without overlapping through modular random encapsulation, deleted clauses do not occur during propagation to the level of the tree. Therefore, among the 6 literals, there is only 1 literal (d ₃ ) with the value FALSE that belongs to its column group, so the probability of creating a unit clause through correct decision assignment is 1/6. Therefore, the probability of finding d ₁ ~ d ₃ is 1/(3x6), and the probability of finding d _k by making the correct choice k times without conflict is 1/(3x6 ^k-2 ). When k correct decision literals are found, one clause is deleted for the first time, and the implied literal or group of complements of implied literals forming the unit clause becomes the column group to be found.”

Theorem 1. Even if a new algorithm is developed to understand the tree structure, at least the number of worst-case sub-exponential calculation steps is required to find a group of variables forming one column.

Proof) According to Lemma 3, when the tree level is k, the probability of finding a column group is 1/(3x6 ^k-2 ). In order to form a circular loop of size k in the horizontal direction, the number of columns must be greater than or equal to k, so if the number of columns is ck(c>=1) and the number of tree levels is k, n=ck ² . Therefore, k is expressed as the fractional power of n, so the number of back-tracking executions of the SAT solver requires the number of worst-case sub-exponential calculation steps.”

In the above example, it corresponds to the case of left shift modular, but also in the case of right shift modular, a circular loop is formed in the downward and right direction. As explained previously, this is due to the way the tree is expressed. In the case of left shift, it circulates to the left, and in the case of right shift, it circulates to the right. A loop is formed. Therefore, even in the case of right shift, Lemma 2, Lemma 3, and Theorem 1 hold equally. Regardless of the values of the dominant literal and the switching literal, a circular loop is formed differently depending on whether the random literal with a FALSE value is located on the left or right. Since the literals belonging to one column group are randomly selected and placed, the location of the random literal with a FALSE value becomes the only information for finding the solution. At this time, if free modular random encapsulation is executed, the location of the literal with the value FALSE is also randomly selected, so there is no way to distinguish between the two different solutions. Therefore, there is no way to check whether the solution found by the SAT Solver is the password, so finding the solution itself becomes meaningless. However, since the length of the circular loop varies depending on the location of the random variable, it is not easy to derive Lemma 2 in the case of free modular. In the case of left shift, right shift, and free modular, it is predicted that the average number of solutions will be the same regardless of the encapsulation method, and the difficulty of finding the average solution will be the same, but further research is needed to prove this. In the case of a dual toroidal binomial tree, which will be described later, the experimental result showing that the difficulty of finding a solution in the two cases of shift modular and free modular is the same supports that the above prediction is correct.

Below, we will look at the characteristics of 3-SAT generated by modular random encapsulation in a dual toroidal binomial tree.

In a dual toroidal binomial tree, the two trees share variables with each other. If a DCG formed by the same literals is created in both trees and the set of variables in the group is expressed as G ₁ and the set of remaining variables is expressed as G ₂ , the basis solution is (G ₁ ,G ₂ ) and the complement solution is (-G ₁ ,-G ₂ ), and in addition to the above two solutions, there can be additional solutions such as (-G ₁ ,G ₂ ) and (G ₁ ,-G ₂ ). However, the 3-CNF formula generated by modular random encapsulation has the characteristic that satisfiability is maintained only when the values of at least the number of tree levels change when the value of one variable changes in the basis solution. -When creating a CNF, the probability of multiple solutions existing is significantly reduced.

Our goal here is to find the maximum probability of having a solution other than the dual solution. According to Lemma 2, there are at least sub-exponentially many DCGs in one tree. No matter which of the two trees is selected, the logical expansion results in the same result, so for convenience, let's assume that one of the numerous DOGs is selected from the TRUE tree. At this time, if all variables forming the selected DCG form a DCG in the FALSE tree, a solution other than the dual solution is generated. In order for all literals included in the DCG extracted from the TRUE tree to create a DCG from the FALSE tree, a circular loop is created and all literals not involved in forming the circular loop must become CDC literals. Therefore, the overall probability is expressed as the product of the probability that a circular loop will be formed in the FALSE tree and the probability that all remaining literals constituting the extracted DCG will be CDC literals. Therefore, the probability of having a solution other than the dual solution is smaller than the maximum probability that some of the literals forming the DCG extracted from the TRUE tree create a circular loop in the FALSE tree. We placed the random variables so that the minimum length of the circular loop is the tree level. Therefore, if the size of the tree level is k, the minimum length of a circular loop that can be created in a FALSE tree is k.

First, let’s find the probability of creating a circular loop. Assume that in the TRUE tree, a specific variable extracts one from the set of all DCGs that create a circular loop, then converts the values of the dominant variables into their complements and assigns them to the FALSE tree. To have a solution other than the dual solution, the FALSE tree must be satisfiable. FALSE For the tree to be satisfiable, a connected path of at least k lengths must be formed starting from a specific variable, regardless of the size of the extracted DCG.

In order to create a column-directed circulation pass, the values of random variables must not change and the values of switching variables must change. When the size of the extracted DCG is m, the probability that the random variable does not change its value is (nm)/n, and the probability that the switching variable changes its value is m/n. Therefore, the probability of creating a circular loop varies depending on the length of the extracted DCG. We saw that once a circular loop is formed, the length of the DCG can be increased or decreased by adding or deleting variables. Therefore, the maximum probability of forming a circular loop is the maximum value of (nm)/nxm/n for all ms where m is greater than or equal to k and less than n, and when the value of m is n/2, the maximum value is 1. It has /4. Since the above condition must be satisfied k-1 times in a row, it has a value of 1/4 ^k-1 when m=n/2. The probability of creating a circular path in the row direction has a value of 1/( ^k ^k-1 ).

The other variables that form a circular loop for n variables can be any, so they are independent for each variable. Additionally, a single variable is divided into a case where a random variable creates a circular loop and a case where a switching variable creates a circular loop, and the two cases cannot overlap. Therefore, the overall probability is expressed as the sum of probabilities for all input variables, so the probability of having a solution other than the dual solution is expressed by Ari's (Equation 4).

(Formula 4)

(Equation 4) uses the maximum value of the probability of forming a circular loop in the FALSE tree when the length of the DCG extracted from the TRUE tree is variable. Therefore, the value a is not only in the FALSE tree, but also in the TRUE tree from which the DCG is extracted. When the length of the DCG is allowed to change by adding or deleting variables while maintaining the circular loop, DCGs formed from the same group of literals can exist at the same time in both trees. It means probability.

Lemma 4. When the number of columns and distance are mutually prime, the number of columns and tree level are k, and the number of input variables is n, the probability of having a solution other than the basis solution and complement solution is 2 n(k+1)/(k4 ^k It is smaller than ^-1 ).

Proof) (Equation 4).”

In the case of K=20, n=400, the above value is approximately 1/(3.27x10 ⁸ ), so it is a negligible value. Therefore, it can be assumed that 3-SAT generated by performing modular random encapsulation on a dual toroidal binomial tree has no solutions other than the basis solution and complement solution if the number of input variables is sufficiently large.

With a unique dual solution, when the value of one variable changes, the effect is felt on all variables, so the variables cannot be divided into two groups. Therefore, how large the decision level is formed until the values of all variables are confirmed determines the difficulty of finding a solution.

Lemma 5. When finding a solution to 3-SAT generated by modular random encapsulation of a toroidal binomial tree with the DPLL algorithm, if the number of input variables is n, on average 2n/7 decision assignments are performed.

In the case of a Proof) Unit clause, implied assignment is executed without decision assignment, so the decision variable increases by 0 and the implied variable increases by 1. A clause consisting of two literals executes one decision assignment and one implied assignment.

Let us assume that k decision assignments have occurred at some stage of finding a solution. In a clause consisting of two literals, a subsequent implied assignment is executed after one decision assignment, so the values of 2k variables are confirmed. A unit clause is created by the 2k confirmed decision variables and implied variables, and the variables included in the generated unit clauses and the unit clauses created by previously confirmed variables are combined, that is, all unit clauses created at a certain point in time. Let us assume that the number of unit clauses excluding the clause in which decision assignment occurred is a. Based on the above assumption, when decision assignment k times occurs, the values of 2k+a variables are confirmed. For n variables, if you add one variable and its complement, a total of 2n literals are created. Among the 2n literals above, there are 2k+a literals that are confirmed as FALSE. The number of decision variables is k, the number of complements of implied variables in the unit clause created after decision assignment is k, and the number of complements of implied variables constituting the unit clause created by these is a.

At this time, when 2k+a variables are confirmed, the probability of one clause becoming a unit clause is that two out of 3 literals must have the value FALSE, so among the 2k+a variables confirmed as FALSE, any two This is the probability that a dog is included in one clause and is calculated as (Equation 5).

(Formula 5)

Among the 4n clauses created by the dual circular binomial tree, the number of clauses in which two literals have the value FALSE is 2n.

When 2k+a variables are confirmed, the number of unit clauses with k decision assignments becomes k. Therefore, among the 2n clauses, the number of remaining clauses that can be unit clauses is 2n-k. Among the remaining clauses, the average number of clauses that become unit clauses is calculated as (Formula 6).

(Formula 6)

Since the number of unit clauses generated by the decision variables and implied variables of the 2k confirmed variable values was assumed to be a, excluding the number of unit clauses created after decision assignment, the average value of (Equation 6) should be equal to a. do.

(Equation 7)

When 2k+a=n, all variable values are confirmed.

(Equation 8)

If (n-1)/n ≒ 1 is set and the relationship between n and k is obtained using the above two equations, it is as follows.

(Equation 9)

Therefore, on average, 2n/7 decision assignments are performed to find a solution until the values of all n variables are confirmed.”

Lastly, when the decision level value is determined, let's check how many calculation steps are needed to find the solution with the correct choice.

Lemma 6. If you have a unique dual solution, to find a solution with the DPLL algorithm when the decision level is k, the number of worst-case calculation steps is 2 ^k-1 to 3 ^k-1 .

Proof) To create a Unit clause, one literal is initially assumed to be FALSE. At this time, the solution to be found in the pair of solution sets is the solution in which the selected literal has the value FALSE. Since a unique dual solution can be assumed by Lemma 4, the solution to be found is one of the basis solution and complement solution. Therefore, from the perspective of the DPLL algorithm, it can be assumed that 3-SAT generated by modular random encapsulation has a unique solution.

To create a unit clause, select one literal during the decision assignment process and assign a FALSE value. Therefore, if you have a unique solution, the selected decision literals must have the value FALSE in the solution set to avoid causing a conflict. At this time, if the 3-SAT generated by modular random encapsulation has a unique dual solution, a change in the value of one variable affects the variable values of all variables, so at the end of unit propagation, all variables are extracted as decision variables or implied. It must belong to a group of variables.

Since the decision level is k, only k correct decision assignments are executed to obtain a solution without causing a conflict. The above probability is calculated as follows. Initially, a random literal is selected as the decision literal and a FALSE value is assigned to the selected literal. Since the solution has the characteristic of duality, the above settings are always correct. Therefore, the probability of correctly selecting the first decision literal is 1. Delete literals assigned a FALSE value in the CNF formula. Then, 6 clauses containing only 2 literals are created as shown in [Figure 11]. Among the six clauses, the erased literal plays the role of a dominant literal, switching literal, and random literal twice each.

In [Figure 11], the rectangle indicates an erased decision literal. At this time, when a decision literal is initially selected, all six clauses remain, but when a decision literal and an implied literal are subsequently selected, the complement of the previously selected decision literal or the clauses containing the implied literal are satisfied with the satisfiable condition by the two literals. Since this is established, it is deleted. Therefore, it is unknown how many clauses remain in which the complement of the implied literal has been subsequently deleted. Among the six clauses, the erased literal plays the role of a dominant literal, switching literal, and random literal twice each. The remaining 12 literals play the roles of dominant literal, switching literal, and random literal 4 times each. At this time, the value is FALSE twice in the random literal and once each in the dominant literal and switching literal. Therefore, in a situation where none of the 12 literals are deleted, there are 4 literals with the value FALSE, so the probability of performing a correct decision assignment is 1/3. If all are deleted and only one clause remains, the probability of making the correct choice is that one of the remaining two literals is It must have the value TRUE, so it is 1/2. Therefore, the probability that correct decision assignments will be executed k times in succession without causing a conflict is between 1/3 ^k-1 and 1/2 ^k-1 . Therefore, the number of calculation steps required to find the solution is worst-case 2 ^k-1 to 3 ^k-1 .”

Theorem 2 below is derived from Lemma 1, Lemma 5, and Lemma 6.

Theorem 2. To find the solution of 3-SAT created by modular random encapsulation of a dual toroid tree, a back-tracking-based algorithm that performs decision assignment by random selection requires the number of worst-case exponential calculation steps.

Proof) According to Lemma 5 and Lemma 6, when the number of input variables is n, the number of calculation steps required to find a solution by random selection is worst-case 2 ^2n/7-1 ~3 ^2n/7-1 . According to Lemma 1, information that can reduce the number of back-tracking executions is not accumulated each time it is repeatedly executed. Therefore, the number of worst-case exponential calculation steps is required.”

Even if a new algorithm is created to find the password by understanding the tree structure, the derived Theorem 1 is applied when used as a single toroidal binomial tree, and after implied assignment, the two literals are deleted by previously selected variables and remain. Since the number of clauses consisting of is greater than when using a single toroidal binomial tree, the number of calculation steps increases.

Due to the expressive equality and geometric equality characteristics of 3-SAT generated by modular random encapsulation, a solution cannot be found using any algorithm based on the mathematical or geometric distinction of the two variables. Therefore, if all search algorithms to find a solution to 3-SAT must include a backtracking function, P by the above theorem

It is proven to be NP. As described earlier, the backtracking function refers to the function of making assumptions about variable values, the function of checking if the assumption is incorrect, and the function of returning to the previous assumption and executing again after changing the assumed value when it is confirmed to be incorrect. . Since all current SAT solvers are built based on the DPLL algorithm based on backtracking, they can be used for encryption if you set the appropriate number of input variables (password length) to meet the given security strength.

Hereinafter, the experimental verification of the hardness of the 3-SAT generated according to the present invention will be described with reference to [FIG. 12] and [FIG. 13]. The Sat Solver used to derive the results in [Figure 12] and [Figure 13] is MiniSat_v1.14_cygwin, and the computer specifications are Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz, Windows 10 64bit, Ram 16GB.

Since the DCGs belonging to one tree form at least sub-exponentially many numbers according to Lemma 2, it is extremely difficult to mathematically obtain the value of a in (Equation 4), and this was confirmed through experiment in the present invention. The length of the row direction circular loop is determined by the number of columns and distance. If the number of columns and the distance are relatively prime, the length of the row direction circular loop becomes the number of columns. After randomly setting the password, we created a CNF formula and conducted an experiment where the SAT solver found a solution from the CNF formula.

According to the experimental results, it is confirmed that the value of a in (Equation 4) converges to 1/2 as the number of input variables increases. In order to prevent variables from overlapping with each other, the number of columns must be set to 5 or more, but cases of 3 and 4 were also tested to check the trend.

[Figure 12] shows the number of times solutions other than the basis solution and complement solution were found in 100,000 experiments while changing the number of columns and levels from 3 to 13. Distance = number of columns /2 -1 was used. In the case of k = 9, n = 81, if the distance is set to 4, the number of columns and the distance become relatively prime, and the length of the circular loop in the row direction shown in (b) of [Figure 9] becomes 9, but the distance is set to 3. In this case, the length of the circular loop becomes 3, forming a shorter circular loop, increasing the probability of having a solution other than the dual solution. When probability P = ax 2 n(k+1)/ (k x4 ^k-1 ), experimental results confirm that the value of a converges to 1/2 as the number of input variables increases. The above experimental results show that they are consistent with the theoretical results of Lemma 4.

To experimentally check how difficult the problem 3-SAT created by modular random encapsulation of a dual toroidal binomial tree is to solve, we randomly set a password, generated a CNF formula, and measured the time the SAT solver took to find the password from the CNF formula. I did an experiment.

In (a) and (b) of [Figure 13], clauses are extracted from both trees by changing the number of columns and levels from 10 to 19, and then (a) uses free modular random encapsulation and (b) uses left This is the result of a test using shift modular random encapsulation, and no significant difference can be found, and it is confirmed that the square of the number of input variables increases exponentially. (c) and (d) set the number of columns to 2k+1 and the number of levels to k, change the k value from 4 to 13, extract clauses from both trees, and (c) uses free modular random encapsulation ( d) is the result of testing with left shift modular random encapsulation. As in cases (a) and (b), no significant difference can be found, and it is confirmed that the square of the number of input variables increases exponentially. The above experimental results show that they are consistent with the theoretical results of Theorem 2.

When using a dual toroidal binomial tree, the number of conflicts was tested with 29x14=406 variables in both the free modular random encapsulation technique and the shift modular random encapsulation technique, and the number of conflicts exceeded the 2 ³² set in MiniSat_v1.14. I confirmed the case where this happens. In this case, no solution was found even after 100,000 seconds.

The number of input variables to maintain security strength of 128 can be estimated as follows. Since it was tested using 2.2Ghz, it performs 2.2x10 ⁹ calculations per second. To maintain a security level of 128, you must ensure that vulnerabilities in the algorithm cannot be found even after 2 ¹²⁸ operations. Therefore, it should take more than 2 ¹²⁸ /2.2x10 ⁹ = 1.5x10 ²⁹ seconds to find the solution. Because the number of samples is limited to 10 due to time constraints, it is difficult to make an accurate prediction. However, if the number of input variables is 45x45, it can be seen from the graph that it will take about 10 ^{to 30} seconds, so using 2025 bits can achieve a security level of 128. Of course, the above security strength is based on the tested SAT solver, and as the performance of the SAT solver improves, a larger number of bits will be needed.

We conducted an experiment to measure the time to find a solution after extracting the 3-CNF formular by increasing the number of trees. TRUE If the CNF formula is extracted from only one tree, a circular loop is formed for each column and variables are not shared with each other, so there are multiple solutions. Therefore, solutions other than the dual solution were easily found. When clauses were extracted from two TRUE trees, the time to find a solution was similar to when clauses were extracted from a dual toroidal binomial tree composed of a TRUE tree and a FALSE tree. TRUE When clauses were extracted from three or four trees, the time to find a solution drastically shortened as the number of trees increased. This means that as the number of trees increases, two clauses consisting of three literals, such as (x ₁ ∨x ₂ ∨x ₃ )∧(x ₁ ∨x ₂ ∨￢x ₃ ), become two clauses such as (x ₁ ∨x ₂ ). It is interpreted that this is because the probability of occurrence of cases that can be converted to clauses consisting of only literals increases. Therefore, the more trees are used, the less time it takes to find a solution. The 3-CNF formula created by extracting clauses from an extremely numerous tree can be changed to the 2-CNF formula, and the solution is obtained without conflict occurring. Therefore, in the case of one, the encryption algorithm must be created so that the basis solution must be found even if there are multiple solutions. In the case of using two, if the number of input variables is large enough, a unique dual solution is guaranteed, increasing the difficulty of finding the best solution. If three or more circular binomial trees with the same basis solution are used, the number of conflicts decreases and the time to obtain a solution becomes shorter. Therefore, a method must be provided to prevent three or more circular binomial trees from being created with the same password. .

Hereinafter, encryption with Hard SAT according to the present invention will be described.

So far, we have proposed a Hard SAT generation method with a password as the solution. 3-SAT, which was created by modular random encapsulation of the toroidal binomial tree, has a sub-exponentially-many solution, so the password cannot be found in polynomial time by exhaustive search, and in the case of shift modular, the time to find the password is also polynomial time. It was shown that it exceeds . It was also explained that when free modular is used, there is no element to distinguish between the password and the general solution, so finding the solution itself becomes meaningless. Therefore, even if the CNF formula is made public, the password cannot be found within polynomial time from that information. Here, let's think about the degree of information exposure and encryption strength. Even if we arbitrarily determine the values of n bits that make up the password, in the set of 2n literals created by n variables, half have TRUE values and half have FALSE values. Let's assume here that we extract literals and create a set of m literals, where k have TRUE values and m-k have FALSE values. The sum of the binomial coefficients is expressed by the formula below.

(Equation 10)

If it is not known that the number of literals with the TRUE value is k, that is, if there is no information leakage, there may be no literals in the set of m literals or all of them may have the TRUE value. Therefore, if you add up all the numbers in the above cases, the sum of all m+1 binomial coefficients becomes 2 ^m , and the above value becomes the number of executions of the exhaustive survey. The act of informing that k values have the value TRUE is the act of informing that this applies to only one case among m+1 binomial coefficients. Since, on average, _m C _k number of exhaustive searches are required, the average number of exhaustive searches to find the solution is reduced. However, the above value also exceeds the polynomial boundary. Therefore, telling how many of the total have TRUE values lowers the encryption strength by providing some information needed to find the solution, but since the number of executions of the exhaustive search is outside the polynomial boundary, the solution cannot be found in polynomial time with that information alone.

The CNF formula generated by random encapsulation of a toroidal binomial tree has a solution set that has the characteristic of duality. Therefore, all three literals cannot have the value TRUE. This is because it must be satisfiable even if all literals are changed to their complement, but a clause in which all three are TRUE becomes unsatisfiable if the complement is taken. Additionally, there must be the same number of clauses where only one of the three literals has the TRUE value and clauses where only two have the TRUE value. This is because changing all literals to their complements changes a clause in which only one literal has the value TRUE into a clause in which two literals have the value TRUE. When substituting the basis solution, let's define a clause with only one TRUE value as a 1-TRUE clause, and a clause with only two TRUE values as a 2-TRUE clause.

Just as we created a set of m literals by extracting the difference between the number of literals with the TRUE value and the number of literals with the FALSE value among the 2n literals, there is a difference in the number of 1-TRUE clauses and 2-TRUE clauses among the 2n clauses. and extracts to create a set of m clauses. Since only one clause composed of two literals constituting a circular binomial tree composed of a dominant literal and a switching literal has a TRUE value, it is determined whether it is a 2-TRUE clause or a 1-TRUE clause depending on the value of the random literal. Therefore, random literals and clauses can be matched one to one. Therefore, the act of disclosing the new CNF created by the extracted clauses and disclosing that there are k 2-TRUE clauses among them has the same intensity of information exposure as disclosing the set of m extracted literals and notifying that the k clauses have the value TRUE. . Therefore, the act of finding a password from a newly constructed CNF reduces the encryption strength, but the number of exhaustive searches to find the solution exceeds the polynomial boundary. We want to use this newly created CNF formula for encryption.

Above, we saw that the password could not be found in polynomial time in the newly created 3-CNF formula by making a difference in the number of 1-TURE clauses and 2-TRUE clauses. Now, how to distribute the CNF formula and use it as a public key is as follows.

The CNF formula generated with n input variables through a toroidal binomial tree and modular random encapsulation consists of 2n clauses. Assume that you extract q 2-TRUE clauses (q=n) and p(p < q) 1-TRUE clauses to create a new CNF formula consisting of p+q clauses. It does not tell you which clause is a 1-TRUE clause, but only the p value. Among these, 2p+1 clauses are randomly extracted, the number of variables and their complements are counted, and a formula is created to calculate the threshold value, t, as shown below.

(Equation 11)

In (Equation 11), a _k is the sum of the numbers of x _k and b _k is the sum of the numbers of ￢x _k . If the value of x _k in the basis solution is TRUE, substitute x _k = 1, ￢x _k = 0, and if it is FALSE, substitute x _k = 0, ￢x _k = 1. Then, the t value of (Equation 11) becomes greater than or equal to 3p+2. This is because even if all 1-TRUE clauses are extracted, the number of literals with a TRUE value in the above clauses is p, and in all remaining extracted clauses, 2 literals in one clause have a TRUE value. Changing all variables to their complements is the same as swapping a _k and b _k in the above formula. If all variables are changed to their complements, the 1-TRUE clause changes into a 2-TRUE clause, and the 2-TRUE clause changes into a 1-TRUE clause. Therefore, in (Equation 11), replace a _k and b _k with each other, and if x _k is TRUE in the solution set, substitute x _k = 1 and ￢x _k =0, and if x _k is FALSE, x _k = 0, ￢x _k =1 If you substitute, the value of (Equation 11) becomes less than or equal to 3p+1. This is because even if all 2-TRUE clauses are extracted, 2p literals with a TRUE value are included, and the remaining clauses all have only one TRUE value. Therefore, to encrypt plaintext data 1, record 2n arrays that sequentially combine the n arrays constituting a _k and the n arrays constituting b _k . To encrypt 0, a _k and b _k are exchanged to create b _k . Record 2n arrays that sequentially combine the n arrays that make up and the n arrays that make up a _k .

At the receiving end, the number of literals is extracted from the transmitted ciphertext, generating (Equation 11), substituting the password, and decrypting the value to 1 if it is greater than or equal to 3p+2 and 0 if it is less than or equal to 3p+1. [Figure 14] shows the encryption and decryption process using the CNF formula. At this time, in order to reduce the amount of calculation, all variables and the number of their complements are calculated in advance in all clauses that make up the CNF formula. Let us express the above values as (A _k , B _k ), 1<=k<=n. Then, instead of selecting 2p+1, we select qp-1 and calculate the number of all variables and their complements in the selected clauses. If the above values are (c _k , d _k ), the equations a _k =A _k -c _k , b _k =B _k -d _k are established. If p is 490 and q is 500 out of 1000, if 2p+1 is selected, it becomes 981, but if qp-1 is selected, it becomes 9, so even if the number of clauses that make up the CNF formula increases, only a small number of clauses are extracted and the number of variables is Since you only need to count the numbers, real-time calculation is possible on any platform.

Here, let's look at the appropriate size of qp. When 1000 clauses are composed of 500 2-TRUE clauses and 490 1-TRUE clauses with a difference of 2%, the number of cases of selecting 9 is ₁₀₀₀ C ₉ , which is a large number of about 2.6x10 ²¹ . Therefore, even if the size of qp increases slightly, the number of differently randomly selected samples increases exponentially. However, if qp=1, we can know which clauses were not extracted. In the toroidal binomial tree, all variables and their complements are the same and are used 3 times, so when calculating a _k and b _k , there are 3 literals that are 2. In the dual toroidal binomial tree, all variables and their complements are the same and are used 6 times each. Therefore, if you find a _k and b _k , you will get 3 literals equal to 5. The clause consisting of the above literals becomes the unextracted clause. In other words, the total number of literals in each clause is revealed when literals included in several clauses are mixed, so the smaller the qp value, the greater the possibility of finding the clauses before the literals are mixed. Also, since qp-1 is randomly extracted and the number of literals is counted, the larger qp is, the slower the encryption speed is. Therefore, the size of the qp value should be set as small as possible without degrading the richness of the sampling data. In the experiments of the present invention, p=0.9 xq was set. Another thing to consider is morphological equivalence. When we encode 0, we change the variables to their complement in all clauses. We need to check whether this harms morphological equivalence. Because random sampling is used, the equality of the number of times the variables and their complements are used is maintained. Also, since it has a dual solution, we can see that even if we take the complement of all the literals that make up the solution set, morphological equivalence will not be harmed considering that they belong to the solution set.

A dual toroidal binomial tree has a unique dual solution if the number of input variables is large enough. As the number of circular binomial trees increases, there is a unique dual solution, but as the number of pair clauses that can be reduced to the 2-CNF formula increases, the time to find a solution rapidly increases. If you continuously add CNF formulas made with the same password to create one CNF formula, the clauses made up of three literals will be combined, increasing the number of clauses made up of two literals. If you combine an extremely large number of things, all the clauses will be made up of two literals. It changes into clauses consisting of . Since the difficulty of finding a solution is determined by the size of the decision level, the decision level is gradually reduced and eventually the decision level becomes 1.

Therefore, if a user repeatedly creates CNF formulas with the same basis solution, there is a risk that the basis solution can be easily found by combining them. To prevent this, as an example, a basis solution is created by adding an identification code with a different value each time it is created, such as the creation time, after the user's password. This method prevents CNF formulas with the same basis solution from being repeatedly created even if they have the same private key.

Hereinafter, the identification process according to the present invention will be described.

It is necessary to check whether the CNF formula held by the sender matches the CNF formula held by the receiver and whether the receiver is a creator of the CNF formula who knows the solution to the above CNF formula. You can check whether it has the same CNF formula as the CNF formula constructor by using the procedure below.

(Method 3). Identification

The sender generates a key value of the size of the number of input variables. This value is not a solution to the CNF formula, and when substituted into the CNF formula, clauses that return FALSE are created.

1) Encrypt the key value and send it to the recipient.

2) The recipient decrypts it with his or her password and finds the key value.

3) Substitute the key value into the CNF formula to obtain the return values of all clauses and send them to the sender sequentially.

4) The sender substitutes the generated key value into the CNF formula and compares the returned return values with the generated return values.

5) If they are the same, the recipient becomes the creator of the CNF formula and it is confirmed that they both have the same CNF formula.

The CNF formula serves as an online identity verification for an individual or organization. In order to receive encrypted data, each party sends the CNF formula to the other party, encrypts the data using the other party's CNF formula, and then transmits it.

The circular structure of the toroidal binomial tree prevents repeated pairs and triangle pairs from occurring while maintaining expressional equality. This maximizes the number of unit propagation steps inside the SAT solver and finds a solution by increasing the decision level. Increases the number of calculation steps required.

It is clear that the encryption algorithm proposed in the present invention is quantum resistant because it is based on SAT and is not based on the difficulties of prime factorization or discrete logarithm problems. One clause consists of three variables. If the number of variables is less than ²¹⁵ , it is possible to allocate 2 bytes to represent one variable and its complement. Therefore, one clause can be expressed in 6 bytes, and if you use the CNF formula with the number of clauses m, 6 x m bytes becomes the length of the public key. In one tree, one variable is used a total of 6 times: 2 dominant variables, 2 switching variables, and 2 random variables.

Therefore, the number of uses of one variable constituting a single toroid tree is 6, and the number of uses of one variable constituting a dual toroid tree is 12, so they can be expressed in 4 bits. If the number of input variables is 1000, the encrypted data length is 1k bytes because the coefficients of all variables and their complements must be expressed.

Therefore, the proposed encryption algorithm has the disadvantage that the public key size and encrypted data size are large. However, since the relationship between public and private keys is expressed in the CNF formula, it has the advantage of being free not only for current quantum algorithms that can easily solve prime factorization or discrete log problems, but also for formula-based algorithms that will be developed in the future. Additionally, since the encryption process consists of adding the number of variables after random sampling, faster calculations are possible than any other algorithm. The decryption process also ends with an addition operation, so real-time encryption and decryption is possible, and since there is no calculation process using large numbers, it has the advantage of being able to be implemented on any platform.

Encryption using a public key is mainly used to encrypt a secret key, so increasing the size of the public key and ciphertext does not cause serious problems in implementing the encryption system. In addition, it is free from the side-channel attacks of the lattice-based algorithm adopted as a post-quantum encryption algorithm and is also free from the ISD attack of the code-based algorithm, so it is expected to be a new algorithm that will lead quantum-resistant public key-based algorithms in the future.

Claims

After assigning each bit value of the password to a Boolean variable value, nodes consisting of a plurality of clauses made up of literals made by the variables are three-dimensionally connected to each other at the top, bottom, and left and right. A Hard SAT generation method comprising the step of generating a toroidal binomial tree.
The method of claim 1, wherein the toroidal binomial tree is generated by (method 1) below.

(Method 1)

1) After creating a password, assign variables to each bit.

2) Create a toroidal binomial tree frame where the product of the number of levels and the number of columns in the tree is the length of the password.

3) Create a set of n literals with TRUE values or n literal sets with FALSE values consisting of the variables assigned in 1) above and sort them randomly.

4) Take out one by one from the set of n literals created in 3) above and place them in the position of the dominant literal that makes up the tree.

5) Literals that take the place of switching literals are placed as complements of dominant literals to create a circular binomial tree.
According to claim 1, variables are added so that one clause consists of three literals by a random encapsulation technique in which all literals and their complements are randomly sorted in the clauses forming the generated circular binomial tree and then added sequentially. After addition, a Hard SAT generation method characterized by a configuration including a step of extracting all clauses constituting the tree and generating a 3-CNF formula with the password as the solution.
The method of claim 3, wherein the 3-CNF formula is derived using a random encapsulation technique using (method 2) below.

(Method 2)

All literals and their complements included in the basis solution are randomly sorted and then sequentially added to the clauses forming the toric binomial tree.

At this time, add while satisfying two conditions.

First, generated with the Exact 3-CNF formula. (If the variable you want to add overlaps with the two variables that make up one clause, rearrange it randomly.)

Second, of the two literals to be added to the two clauses that make up one node, one uses the one included in the basis solution and the other uses the one that does not.
According to claim 1, one clause is divided into three literals by the modular random encapsulation technique in which all literals and their complements are divided into groups, randomly sorted, and then added sequentially to the clauses forming the generated circular binomial tree. A Hard SAT generation method comprising the step of extracting all clauses constituting the tree and generating a 3-CNF formula with the password as the solution, after adding variables to be composed of .
The method of claim 5, wherein the 3-CNF formula is derived using a modular random encapsulation technique using (method 3) below.

(Method 3)

1) Group the dominant literals that make up the circular binomial tree created in Section 1 by column and then sort them randomly.

2) Create corresponding groups using the complements of all literals belonging to the group created in 1) above and sort them randomly. If the same variable is placed in the same position in the row randomly sorted in 1) above, rearrange it to form one Prevents a variable and its complement from being placed in the same location.

3) Set the distance value, d.

4) After extracting literals one by one from the group created in 1) above and the corresponding group created in 2), a literal with the value FALSE is left at the random variable position of the two clauses included in each node constituting the column at a distance of d. Or create a toric binomial tree containing random literals by adding them to the right or at random positions.

5) Modular random encapsulation step to create a 3-CNF formula by randomly rearranging the three literals that make up one clause so that the role of each variable cannot be confirmed after extracting clauses from all nodes;
According to claim 1, after creating several circular binomial trees in which all dominant literals have TRUE values and several circular binomial trees in which all dominant literals have FALSE values;,

A Hard SAT generation method characterized by a configuration that includes a 3-CNF formula generation step with a password as the solution that extracts all clauses constituting an arbitrary number of circular binomial trees to create one CNF formula.
From the 3-CNF formula that has the password as the solution and has the same number of 1-TRUE clauses and 2-TRUE clauses, extract clauses by varying the number of 1-TRUE clauses and 2-TRUE clauses to create a new 3-CNF formula. Step 1,

After randomly extracting the clauses that make up the 3-CNF, the number of x k (1<=k<=n, x k : variable assigned to the kth bit of the password, n: number of bits of the password) is counted and the first Step 2: create the first array and count the number of ￢x k to create the second array,

Step 3: Create a ciphertext of 0 and 1 by sequentially recording or reversing the two arrays,

SAT is characterized in that it is performed by reading the two arrays from the ciphertext, creating the following (Equation 1), substituting the bit values that make up the password into the formula, and determining whether the value is above a threshold or not to decrypt 0 and 1. A method of implementing a quantum-resistant cryptographic algorithm based on .

(Formula 1)

x k : variable assigned to the kth bit of the password, a k : number of extracted x k , b k : number of extracted ￢x k .
A step of generating a new 3-CNF formula by extracting the difference in the number of 1-TRUE clauses and 2-TRUE clauses from the 3-CNF formula that has the password as the solution and the same number of 1-TRUE clauses and 2-TRUE clauses. ,

From the above 3-CNF formula, q 2-TRUE clauses (q=n/2, n: number of clauses) and p(p < q) 1-TRUE clauses are extracted to create a new CNF consisting of p+q clauses. Steps to create a formula;

Among the clauses constituting the newly created CNF formula, 2p+1 clauses are randomly extracted and the number of variables and their complements are counted to obtain a k and b k (1<=k<=n, n=number of password bits) setting a value;

To encrypt plaintext data 1, record 2n arrays by sequentially combining the n arrays constituting a k and the n arrays constituting b k . To encrypt 0, a k and b k are exchanged to create b k . An encryption step of recording 2n arrays by sequentially combining the n arrays constituting the n arrays and the n arrays constituting a k ;

A formula generation step of reading the ciphertext and sequentially determining the values a k and b k (1<=k<=n, n=number of password bits) and then calculating a threshold value, t, as shown in (Formula 2) below;

(Formula 2)

If the value of x k derived from the password in the above (Equation 2) is TRUE, substitute x k = 1 and ￢x k = 0. If it is FALSE, substitute x k = 0 and ￢x k = 1 to calculate the t value. step;

A method of implementing a quantum-resistant encryption algorithm based on SAT, characterized in that the decryption step is performed as 1 if the t value is greater than or equal to 3p+2 and 0 if it is less than or equal to 3p+1.
According to claim 8 or 9, whether the CNF formula held by the sender who will transmit the ciphertext and the CNF formula held by the receiver who is the generator of the CNF formula and who will receive the ciphertext match, and whether the receiver finds the solution of the above CNF formula A method of implementing a quantum-resistant cryptographic algorithm based on SAT, comprising the step of confirming whether the known CNF formula generator is recognized by (Method 4) below.

(Method 4)

1) The sender who delivers the ciphertext generates a key value the size of the number of input variables, but this key value is not the solution to the CNF formula used as a substitute for the public key. When substituted into the CNF formula, clauses that return FALSE are created, and this key Encrypt the value using the above encryption algorithm and send it to the recipient.

2) The recipient, who is the generator of the CNF formula and will receive the ciphertext, decrypts it with his or her password, checks the key value, substitutes this key value into the CNF formula to derive the return values of all clauses, and sequentially sends them to the sender.

3) The sender substitutes the generated key value into the CNF formula it holds and compares the returned return values with the generated return values.

4) If the compared values are the same, the recipient becomes the creator of the CNF formula and confirms that they have the same CNF formula.
The method of claim 1, wherein the password includes generation time information.