Public key encryption communication method and apparatus

Public key encryption communication method and device

Technical field

[0001] Embodiments of the present invention relate to communication technologies, and in particular, to a public key encryption communication method and apparatus.

Background technique

[0002] In the communication technology, in order to ensure the confidentiality of communication between two communication individuals, it is necessary to encrypt the data by using the key at the transmitting end, and decrypt the key using the key at the receiving end, and use the key and decryption during encryption. If the key used is the same, it is called symmetric key encryption. If it is different, it is called asymmetric key encryption, also known as public key encryption. The public key encryption method has two important principles: first, the requirement Under the premise that both the encryption algorithm and the public key are public, the encrypted ciphertext must be secure. Secondly, the calculation or processing of the encrypted data and the receiving end using the private key to decrypt the data should be relatively simple, but Other people who do not have a private key should be extremely difficult to decipher. With the development of computer networks and the increasing requirements for information confidentiality, public key cryptography algorithms represent the irreplaceable superiority of symmetric key cryptography algorithms.

[0003] The existing public key system secure communication method adopts a public key system such as Number Theory Research Unit (NTRU), and NTRU is a polynomial ring based cryptosystem. The specific algorithm is as follows: Encryption and decryption are performed using a public key and a private key, respectively, which are obtained according to system parameters N, p, q and randomly selected two polynomials f and g. The problem with this method is that Security is not high.

Summary of the invention

Embodiments of the present invention provide a public key encryption communication method and apparatus, so as to implement a public key encryption communication method with higher security.

A first aspect of the embodiments of the present invention provides a public key encryption communication method, including:

[0006] The first device encrypts the random information according to the first public key to obtain a first ciphertext; the first device encrypts the plaintext information according to the second public key to obtain a second ciphertext; the plaintext information is The unencrypted data to be sent by the first device to the second device; the first public key is represented by a polynomial form, and the first public key is calculated on a truncated polynomial ring according to a system parameter; the second public The key is represented by a polynomial form, and the second public key is randomly selected on the truncated polynomial ring; the random information is randomly selected on the truncated polynomial ring;

[0007] The first device sends the first ciphertext and the second ciphertext to a second device.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the random information includes a first random polynomial and a second random polynomial; the first device is configured according to the first public key and the random information Encryption is performed to obtain the first ciphertext, which specifically includes:

[0009] the first device calculates, according to the first public key, the first random polynomial, and the second random polynomial, the first secret on the first truncated polynomial ring of the first system parameter of the module Text.

[0010] In conjunction with the first possible implementation of the first aspect, in a second possible implementation manner of the first aspect, the plaintext information is represented as a polynomial on a second truncated polynomial ring of a second system parameter The first device encrypts the plaintext information according to the second public key to obtain the second ciphertext, which specifically includes:

[0011] the first device, according to the second public key, the first random polynomial, the second random polynomial, and the plaintext information, on a second truncated polynomial ring of the second system parameter of the module Calculating the second ciphertext.

[0012] In conjunction with the first possible implementation of the first aspect, in a third possible implementation manner of the first aspect, the first device, according to the first public key, the first random polynomial, The second random polynomial calculates the first ciphertext on the first truncated polynomial ring of the first system parameter of the modulo, and specifically includes:

[0013] calculating the first ciphertext on the first truncated polynomial ring according to C1 = rihi+r2, the hi is the first public key, and the ^ is the first random polynomial, the ^ For the second random polynomial, the first truncated polynomial ring is

Said as said first system parameter.

[0014] In conjunction with the second possible implementation of the first aspect, in a fourth possible implementation manner of the first aspect, the first device, according to the second public key, the first random polynomial, Calculating, by the second random polynomial and the plaintext information, the second ciphertext on the second truncated polynomial ring of the second system parameter of the modulo, specifically comprising: [0015] according to C2 = rih2+r2+M Computing the second ciphertext on the second truncated polynomial ring, the h2 is the second public key, the ^ is the first random polynomial, and the ^ is the second random polynomial, The second truncated polynomial ring is

The q2 is the second system parameter.

[0016] In combination with the second to third possible implementation manners of the first aspect, in a fifth possible implementation manner of the first aspect, the first public key is configured according to the first system parameter a third random polynomial, a fourth random polynomial, calculated on the first truncated polynomial ring of the first system parameter of the modulus, the first truncated polynomial ring of the first system parameter of the third random polynomial The third truncated polynomial ring of the modulo third system parameter has an inverse element at the same time, and the fourth random polynomial has an inverse JL on the first truncated polynomial ring of the first system parameter of the modulo

[0017] In conjunction with the fifth possible implementation of the first aspect, in a sixth possible implementation manner of the first aspect, the first public key is

Calculated on the first truncated polynomial ring, the P is the third system parameter, and the f is the third random polynomial,

An inverse of the third random polynomial on a first truncated polynomial ring of the first system parameter of the modulo, wherein g is the fourth random polynomial, 9: is the first system parameter, The first truncated polynomial ring is

[0018] In conjunction with the second possible implementation of the first aspect, in a seventh possible implementation manner of the first aspect, the second public key is randomly selected on the second truncated polynomial ring, The second truncated polynomial ring is

[0019] A second aspect of the embodiments of the present invention provides a public key encryption communication method, including:

[0020] the second device receives the first ciphertext and the second ciphertext sent by the first device;

[0021] The second device calculates a second random polynomial according to the first private key, the second private key, and the first ciphertext, and obtains a first random polynomial according to the third private key, where the first private key is used. The polynomial form indicates that the first private key is randomly selected on the truncated polynomial ring; the second private key is represented by a polynomial form, and the second private key is an inverse element of the first private key on the truncated polynomial ring The third private key is represented by a polynomial form, and the third private key is calculated according to an inverse element of the system parameter and a polynomial having an inverse element on the truncated polynomial;

[0022] The second device obtains the plaintext information according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key; the plaintext information is the first device to be Unencrypted data sent to the second device; the second public key is represented in a polynomial form, and the second public key is randomly selected on a truncated polynomial ring.

[0023] With reference to the second aspect, in a first possible implementation manner of the second aspect, the second device calculates, according to the first private key, the second private key, and the first ciphertext, a second random polynomial Specifically, including:

[0024] the second device calculates, according to the first ciphertext and the first private key, a process parameter on a first truncated polynomial ring of a first system parameter of the module;

[0025] the second device obtains the second random polynomial on the third truncated polynomial ring of the third system parameter according to the process parameter and the second private key.

With reference to the first possible implementation of the second aspect, in a second possible implementation manner of the second aspect, the obtaining the first random polynomial according to the third private key includes:

[0027] the second device calculates the first random polynomial on the first truncated polynomial ring of the first system parameter of the module according to the process parameter and the third private key.

[0028] In conjunction with the second possible implementation of the second aspect, in a third possible implementation manner of the second aspect, the second device, according to the first random polynomial, the second random polynomial, The second ciphertext and the second public key obtain the plaintext information, and specifically include:

[0029] the second device calculates, according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key, on a second truncated polynomial ring of the second system parameter of the modulo The plaintext information.

[0030] In conjunction with the first possible implementation of the second aspect, in a fourth possible implementation of the second aspect, the second device is configured according to the first ciphertext and the first private key The process parameters are calculated on the first truncated polynomial ring of the first system parameter of the module, and specifically include:

[0031] The second device calculates the process parameter according to s = fC1 on the first truncated polynomial ring of the first system parameter of the module, where f is the first private key, and C1 is the first ciphertext.

[0032] In conjunction with the fourth possible implementation of the second aspect, in a fifth possible implementation manner of the second aspect, the second device is configured according to the process parameter, the second private key Obtaining the second random polynomial on the third truncated polynomial ring of the three-system parameter, specifically including:

[0033] the second device is based on Sp = s (mod p) and

Calculating the second random polynomial on a third truncated polynomial ring of a modulus of the third system parameter, wherein the P is the third system parameter

For the second private key, s is the process parameter, and the third truncated polynomial ring is Zp [X] /Xn-I.

[0034] In conjunction with the fourth possible implementation of the second aspect, in a sixth possible implementation manner of the second aspect, the second device, according to the process parameter and the third private key, Calculating the first random polynomial on the first truncated polynomial ring of the first system parameter, specifically including:

[0035] calculating the first random polynomial on the first truncated polynomial ring according to sP = s (mod p) and ri=(S-Sp) G, where s is the process parameter, and ! is the first a system parameter, P is the third system parameter, G is the third private key, and the first truncated polynomial ring is

[0036] In conjunction with the third possible implementation of the second aspect, in a seventh possible implementation manner of the second aspect, the second device, according to the first random polynomial, the second random polynomial, The second ciphertext and the second public key are used to calculate the plaintext information on the second truncated polynomial ring of the second system parameter, which specifically includes:

[0037] calculating the plaintext information on the second truncated polynomial ring according to M=C2-rih2-r2, where C2 is the second ciphertext, and the ^ is the first random polynomial, the ^ For the second random polynomial, the 1! 2 is the second public key.

[0038] In conjunction with the second possible implementation of the second aspect, in an eighth possible implementation manner of the second aspect, the first private key is a third random polynomial, and the second private key is the An inverse element of a third random polynomial on a third truncated polynomial ring of the third system parameter of the modulo, the third private key being in accordance with an inverse of the third system parameter, a fourth random polynomial at the first system parameter The inverse element of the first truncated polynomial ring of the module is calculated.

[0039] In conjunction with the eighth possible implementation of the second aspect, in a ninth possible implementation manner of the second aspect, the third private key is

Calculating Ij on the first truncated polynomial of the first system parameter of the module, p4 is the inverse of the first system parameter of the third system parameter, and 9 is the first system parameter, being the fourth An inverse of the random polynomial over the first truncated polynomial ring, g being the fourth random polynomial.

[0040] A third aspect of the embodiments of the present invention provides a public key encryption communication device, including:

[0041] an encryption unit, configured to perform encryption according to the first public key and the random information to obtain a first ciphertext; and configured to encrypt the plaintext information according to the second public key to obtain a second ciphertext; the plaintext information is The unencrypted data to be sent by the first device to the second device; the first public key is represented by a polynomial form, and the first public key is calculated on a truncated polynomial ring according to a system parameter; the second public The key is represented by a polynomial form, and the second public key is randomly selected on the truncated polynomial ring; the random information is randomly selected on the truncated polynomial ring;

[0042] The transceiver unit sends the first ciphertext and the second ciphertext to the second device.

In conjunction with the third aspect, in a first possible implementation manner of the third aspect, the random information includes a first random polynomial and a second random polynomial; the encryption unit is specifically configured to:

[0044] calculating, according to the first public key, the first random polynomial, and the second random polynomial, the first ciphertext on a first truncated polynomial ring of a first system parameter of the modulo.

[0045] In conjunction with the first possible implementation of the third aspect, in a second possible implementation manner of the third aspect, the plaintext information is represented as a polynomial on a second truncated polynomial ring of a second system parameter The encryption unit is also specifically used to:

[0046] calculating, according to the second public key, the first random polynomial, the second random polynomial, and the plaintext information, on the second truncated polynomial ring of the second system parameter of the modulo Two ciphers.

[0047] In conjunction with the first possible implementation of the third aspect, in a third possible implementation manner of the third aspect, the cryptographic unit is configured to use the first public key, the first random polynomial The second random polynomial, the first ciphertext is calculated on the first truncated polynomial ring of the first system parameter of the modulo, specifically for:

[0048] calculating the first ciphertext on the first truncated polynomial ring according to Cl = rihi+r2, the hi is the first public key, and the ^ is the first random polynomial, the ^ For the second random polynomial, the first truncated polynomial ring is

Said as said first system parameter.

[0049] In conjunction with the second possible implementation of the third aspect, in a fourth possible implementation manner of the third aspect, the cryptographic unit is configured to use, according to the second public key, the first random polynomial And the second random polynomial and the plaintext information, the second ciphertext is calculated on the second truncated polynomial ring of the second system parameter of the modulo, specifically for:

[0050] calculating, according to C2 = rih2+r2+M, the second ciphertext on the second truncated polynomial ring, the h2 is the second public key, and the ^ is the first random polynomial, Said ^ is the second random polynomial, the second truncated polynomial ring is

The q2 is the second system parameter.

[0051] In combination with the second to third possible implementation manners of the third aspect, in a fifth possible implementation manner of the third aspect, the first public key is configured according to the first system parameter a third random polynomial, a fourth random polynomial, calculated on the first truncated polynomial ring of the first system parameter of the modulus, the first truncated polynomial ring of the first system parameter of the third random polynomial The third truncated polynomial ring of the third system parameter has an inverse element at the same time, and the fourth random polynomial has an inverse element on the first truncated polynomial ring of the first system parameter of the modulus.

[0052] In conjunction with the fifth possible implementation of the third aspect, in a sixth possible implementation manner of the third aspect, the first public key is

Calculated on the first truncated polynomial ring, the P is the third system parameter, and the f is the third random polynomial,

An inverse of the third random polynomial on a first truncated polynomial ring of the first system parameter of the modulo, wherein g is the fourth random polynomial, 9: is the first system parameter, The first truncated polynomial ring is

[0053] In conjunction with the second possible implementation of the third aspect, in a seventh possible implementation manner of the third aspect, the second public key is randomly selected on the second truncated polynomial ring, The second truncated polynomial ring is

A fourth aspect of the embodiments of the present invention provides a public key encryption communication device, including:

[0055] a transceiver unit, configured to receive the first ciphertext and the second ciphertext sent by the first device;

[0056] a decryption unit, configured to calculate a second random polynomial according to the first private key, the second private key, and the first ciphertext, and obtain a first random polynomial according to the third private key, where the first private key is used The polynomial form indicates that the first private key is randomly selected on the truncated polynomial ring; the second private key is represented by a polynomial form, and the second private key is an inverse element of the first private key on the truncated polynomial ring The third private key is represented by a polynomial form, and the third private key is calculated according to an inverse element of the system parameter and a polynomial having an inverse element on the truncated polynomial;

[0057] the decrypting unit is further configured to obtain plaintext information according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key; the plaintext information is the first An unencrypted data to be sent by the device to the second device; the second public key is represented in a polynomial form, and the second public key is randomly selected on the truncated polynomial ring.

[0058] With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the decrypting unit is specifically configured to:

[0059] calculating, according to the first ciphertext, the first private key, a process parameter on a first truncated polynomial ring of a first system parameter of the module;

[0060] obtaining the second random polynomial on a third truncated polynomial ring of a third system parameter according to the process parameter and the second private key.

[0061] In combination with the first possible implementation of the fourth aspect, in a second possible implementation manner of the fourth aspect, the decrypting unit is further configured to:

[0062] the second device calculates the first random polynomial on the first truncated polynomial ring of the first system parameter of the module according to the process parameter and the third private key.

[0063] In conjunction with the second possible implementation of the fourth aspect, in a third possible implementation manner of the fourth aspect, the decrypting unit is further configured to:

[0064] calculating the plaintext information on the second truncated polynomial ring of the second system parameter according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key.

[0065] In conjunction with the first possible implementation manner of the fourth aspect, in a fourth possible implementation manner of the fourth aspect, the decrypting unit is configured according to the first ciphertext and the first private key The process parameters are calculated on the first truncated polynomial ring of the first system parameter, specifically for:

[0066] calculating the process parameter according to s = fC1 on a first truncated polynomial ring of the first system parameter of the module, where f is the first private key, and C1 is the first ciphertext.

With the fourth possible implementation of the fourth aspect, in a fifth possible implementation manner of the fourth aspect, the decrypting unit is in the third mode according to the process parameter, the second private key The second random polynomial is obtained on the third truncated polynomial ring of the system parameter, specifically for:

[0068] according to Sp = s(mod p) and

Calculating the second random polynomial on a third truncated polynomial ring of a modulus of the third system parameter, wherein the P is the third system parameter,

For the second private key, s is the process parameter, and the third truncated polynomial ring is Zp [X] /Xn-I.

[0069] In conjunction with the fourth possible implementation of the fourth aspect, in a sixth possible implementation manner of the fourth aspect, the decrypting unit, according to the process parameter and the third private key, Calculating the first random polynomial on the first truncated polynomial ring of the first system parameter of the module, specifically for:

[0070] calculating the first random polynomial on the first truncated polynomial ring according to Sp = S (mod P) and ri = (S-Sp) G, where s is the process parameter, and ! is the first a system parameter, P is the third system parameter, G is the third private key, and the first truncated polynomial ring is

[0071] In conjunction with the third possible implementation of the fourth aspect, in a seventh possible implementation manner of the fourth aspect, the decrypting unit is configured according to the first random polynomial, the second random polynomial, The second ciphertext and the second public key are used to calculate the plaintext information on the second truncated polynomial ring of the second system parameter of the modulo, specifically for:

Obtaining the plaintext information on the second truncated polynomial ring according to M=C2-rih2-r2, where C2 is the second ciphertext, and the ^ is the first random polynomial, the ^ For the second random polynomial, the 1! 2 is the second public key.

[0073] In conjunction with the second possible implementation of the fourth aspect, in an eighth possible implementation manner of the fourth aspect, the first private key is a third random polynomial, and the second private key is the An inverse element of a third random polynomial on a third truncated polynomial ring of the third system parameter of the modulo, the third private key being in accordance with an inverse of the third system parameter, a fourth random polynomial at the first system parameter of the modulo The inverse of the first truncated polynomial ring is calculated.

In conjunction with the eighth possible implementation of the fourth aspect, in a ninth possible implementation manner of the fourth aspect, the third private key is

Calculating Ij on the first truncated polynomial of the first system parameter of the module, p4 is the inverse of the first system parameter of the third system parameter, and 9 is the first system parameter,

Is the inverse of the fourth random polynomial on the first truncated polynomial ring of the first system parameter of the modulo, and g is the fourth random polynomial.

[0075] In the public key encryption communication mode of the embodiment of the present invention, the first device encrypts the random information according to the first public key to obtain the first ciphertext, and encrypts the plaintext information according to the second public key to obtain the second secret. The plaintext information is unencrypted data to be sent by the first device to the second device; the first public key is represented by a polynomial form, and the first public key is in a truncated polynomial ring according to system parameters. Calculated on the second public key in a polynomial form, the second public key is randomly selected on the truncated polynomial ring; the random information is randomly selected on the truncated polynomial ring; the first device will Sending a ciphertext and the second ciphertext to the second device is equivalent to using the random information as a shared key and encrypting the random information once, and then encrypting the plaintext information by using the public key and the random information, thereby realizing A more secure public key encryption communication method.

DRAWINGS

[0076] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, in the following description The drawings are some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive labor.

1 is a flowchart of Embodiment 1 of a public key encryption communication method according to the present invention;

2 is a flowchart of Embodiment 2 of a public key encryption communication method according to the present invention;

3 is a flowchart of Embodiment 3 of a public key encryption communication method according to the present invention;

4 is a schematic diagram of processing of an alternative embodiment of step 300 in the method of FIG. 3;

[0081] FIG. 5 is a schematic diagram of processing of an alternative embodiment of step 301 in the method of FIG. 3;

6 is a schematic diagram of processing of an optional implementation manner of step 303 and step 304 in the method shown in FIG. 3;

7 is a schematic structural diagram of Embodiment 1 of a public key encryption communication device according to the present invention;

8 is a schematic structural diagram of Embodiment 2 of a public key encryption communication device according to the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. The embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

1 is a flowchart of Embodiment 1 of a public key encryption communication method according to the present invention. As shown in FIG. 1, the method in this embodiment may include:

[0087] SlO1, the first device encrypts the random information according to the first public key to obtain a first ciphertext; the first device encrypts the plaintext information according to the second public key to obtain a second ciphertext; The plaintext information is unencrypted data to be sent by the first device to the second device; the first public key is represented by a polynomial form, and the first public key is calculated on a truncated polynomial ring according to system parameters; The second public key is represented in a polynomial form, and the second public key is randomly selected on the truncated polynomial ring; the random information is randomly selected on the truncated polynomial ring.

[0088] S102. The first device sends the first ciphertext and the second ciphertext to a second device.

[0089] In various embodiments of the public key encryption communication method provided by the present invention, the devices at the transmitting end and the receiving end of the public key communication may be referred to as a first device and a second device, respectively, and the first device in the public key communication is to be The unencrypted data sent to the second device may be referred to as plaintext information. The first public key and the second public key may be generated by a key generation device of the public key communication, and the key generation device may be a second device or other trusted third party device, where the Acquiring, by the device, the first public key and the first public key required for performing encrypted communication with the second device from the key generation device before preparing to send the encrypted data to the second device, that is, the a public key certificate of the second device, the key generation device simultaneously generating a first private key, a second private key, and a third private key paired with the first public key and the second public key. The public key information is stored in a public key certificate issued by a public key infrastructure (PKI).

[0090] The first public key may be represented in a polynomial form, and the first public key may be calculated on a truncated polynomial ring according to system parameters.

[0091] The system parameter refers to a set of parameters preset by the key generation device, the first device at the transmitting end, and the first device at the receiving end in consideration of security and computational efficiency in the process of public key communication. A truncated polynomial ring is a collection of univariate NI polynomials whose coefficients are integers. The truncated polynomial ring used to calculate the first public key can be determined according to the system parameters used in the current public key communication.

[0092] The second public key may be represented in a polynomial form, and the second public key is randomly selected on the truncated polynomial ring.

[0093] The truncated polynomial ring used to select the second public key may be determined according to system parameters used in the current public key communication. The random information may be randomly selected by the first device on the truncated polynomial ring according to the requirements of security and encryption efficiency, that is, the random information may be any univariate polynomial. The coefficients of the univariate polynomial may constitute a vector, and the norm magnitude of the vector of the coefficients is inversely proportional to the encryption efficiency. Therefore, the first device may prefer the univariate polynomial with the smallest norm of the vector of the coefficients as The random information.

[0094] the first ciphertext obtained by the first device encrypting the random information by using the first public key, and the first device, according to the second public key and the random information, The second ciphertext obtained by encrypting the plaintext information is a pair of polynomials.

[0095] the first device encrypts the random information according to the first public key to obtain the first ciphertext, similar to the communication party first performing a shared key negotiation, and embedding the shared key into a class of one-way trapdoor function And performing the probabilistic encryption, and obtaining the random information by using an encryption manner of the first ciphertext, where the random information is equivalent to a shared key of the communication parties. The first device encrypts the plaintext information according to the second public key to obtain a second ciphertext, which is similar to using the shared key to implement one-time encryption, and the second ciphertext carries the plaintext information to obtain the first The encryption mode of the second ciphertext does not reveal the plaintext information. The mathematical method can prove that the public key communication method of the present invention has higher security than the prior art NTRU algorithm. A security evaluation method can be described as follows: In a certain attack mode, the attacker randomly selects two plaintext HidPm2, and the cryptographic algorithm randomly selects one of the plaintext mbs to obtain the ciphertext c, b is 1 or 2, if the attacker can From c to the non-negligible probability to determine b = l or b = 2, which is equivalent to the attacker correctly guessing which plaintext is encrypted to obtain ciphertext c, the attacker successfully breaks the semantic security of the encryption algorithm. Applying the above method to verify the security of the encryption method of the present invention, since the present invention performs two encryptions by constructing two polynomial-based one-way trapdoor functions, the probability of the attacker breaking the semantic security of the algorithm is negligible. However, the probability that the prior art NTRU encryption algorithm is compromised in semantic security is not negligible, and therefore, the present invention can be evaluated by mathematical methods to have higher security than the prior art.

[0096] In the public key encryption communication mode, the first device encrypts the random information according to the first public key to obtain the first ciphertext, and encrypts the plaintext information according to the second public key to obtain the second secret. The plaintext information is unencrypted data to be sent by the first device to the second device; the first public key is represented by a polynomial form, and the first public key is in a truncated polynomial ring according to system parameters. Calculated on the second public key in a polynomial form, the second public key is randomly selected on the truncated polynomial ring; the random information is randomly selected on the truncated polynomial ring; the first device will Sending a ciphertext and the second ciphertext to the second device is equivalent to using the random information as a shared key and encrypting the random information once, and then encrypting the plaintext information by using the public key and the random information, thereby realizing A more secure public key encryption communication method.

[0097] Optionally, the method embodiment 1 shown in FIG. 1 includes an optional implementation manner, which is different from the method shown in FIG. 1 :

[0098] The random information in SlOl may include a first random polynomial and a second random polynomial.

[0099] Correspondingly, the first device in the S101 is encrypted according to the first public key and the random information, to obtain the first ciphertext, which may specifically include:

[0100] sioi-i, the first device calculates, according to the first public key, the first random polynomial, and the second random polynomial, on a first truncated polynomial ring of a first system parameter of a module The first ciphertext.

[0101] The plaintext information in Sioi may be represented as a polynomial on a second truncated polynomial ring of the second system parameter.

[0102] Correspondingly, the first device in the S1101 encrypts the plaintext information according to the second public key to obtain the second ciphertext, which may specifically include:

[0103] S101-2, the first device, according to the second public key, the first random polynomial, the second random polynomial, and the plaintext information, in a second parameter of the second system parameter The second ciphertext is calculated on the truncated polynomial ring.

[0104] The first public key in S101-1 may be calculated by the key generation device on the first truncated polynomial ring according to the first system parameter, the third random polynomial, and the fourth random polynomial. get. The third random polynomial and the fourth random polynomial may be randomly selected by the key generation device, and the value range of the third random polynomial should satisfy the first truncation of the first system parameter in the module. The third truncated polynomial ring of the polynomial ring and the third system parameter has an inverse element at the same time; the fourth random polynomial ranges from a polynomial having an inverse element on the first truncated polynomial ring.

[0105] The second public key in S101-2 may be randomly selected by the key generation device, and the value range of the second public key is an arbitrary polynomial on the second truncated polynomial ring.

[0106] For example, the first public key may be based on

Calculated on the first truncated polynomial ring, wherein hi is the first public key, p is the third system parameter, and f is the third random polynomial,

An inverse of the third random polynomial on a first truncated polynomial ring of the first system parameter of the modulo, wherein g is the fourth random polynomial, and the first truncated polynomial ring is

[0107] The first ciphertext in the S10-1-1 may be calculated on the first truncated polynomial ring according to Cl = rihi+r2, where the hi is the first public key, and the ^ For the first random polynomial, the ^ is the second random polynomial, and the first truncated polynomial ring is

Said as said first system parameter.

[0108] The second ciphertext in the S101-2 may be calculated according to C2=rih2+r2+M on a second truncated polynomial ring, where the ^ is the second public key, and the The first random polynomial, the r2 is the second random polynomial, and the second truncated polynomial ring is

The q2 is the second parameter of the system.

[0109] In the above embodiment, the first system parameter in S101-1, the second system parameter in S101-2, and the fourth system parameter N may all be determined by the key generation device according to security. The performance requirements for key generation and key generation are preset. Optionally, for the highest level of security, the fourth system parameter N may be selected 503. Preferably, the first system parameter and the second system parameter are two odd prime numbers, and the second system parameter is equal to the first system parameter plus 2, ie, q2 = qi+2, for example, qi is 239, and q2 is 241. Or, qi*269, q2 is 271.

[0110] It should be noted that the truncated polynomial ring refers to a set of univariate NI polynomials whose coefficients are integers, which can be generally expressed as

The first truncated polynomial ring of the first system parameter of the mode described in

L is a truncated polynomial ring obtained by the first system parameter of the truncated polynomial ring mode, and similarly, the third truncated polynomial ring Zp [X]/Xn-I of the third system parameter of the mode refers to the truncation A truncated polynomial ring obtained by the polynomial ring mode of the third system parameter. In addition, the operation of the modular polynomial is a polynomial divided by a modular polynomial. The result of the modular polynomial is the residual polynomial obtained by dividing the polynomial by the modular polynomial. For example, the operation result of a polynomial modular polynomial Xn-I is the polynomial divided by The remainder polynomial of the polynomial Xn-I.

[0111] Further, in order to reduce the amount of calculation, the modulo operation of the present invention only takes the modulo operation result in the absolute minimum complete residual system, for example, the operation result in a minimum complete residual system of a natural digital modulo 3 is _1, 0. , 1, instead of 0, 1, 2. Correspondingly, when the first random polynomial and the second random polynomial are selected, a polynomial with a coefficient of +1 or -1 or 0 can be selected on the truncated polynomial ring Z[X] / Xn-I, wherein the coefficient The number of items that are +1 is about N/3, the number of items with a coefficient of -1 is about N/3-1, and the coefficient of the remaining items is 0.

[0112] In this embodiment, the first ciphertext and the second ciphertext are sent by the first device to the second device, so that the second device is configured according to the first ciphertext and the second device. The ciphertext and the first private key and the second private key and the third private key corresponding to the first public key and the second public key are decrypted to obtain plaintext information, which is equivalent to using the random information as a shared key and The random information realizes one encryption, and then uses the public key and the random information to encrypt the plaintext information, thereby realizing a more secure public key encryption communication method. Moreover, the encryption method of the present invention has a certain improvement in encryption speed, decryption speed, and ciphertext expansion ratio as compared with other encryption methods that can prove security.

2 is a flowchart of Embodiment 2 of a public key encryption communication method according to the present invention. As shown in FIG. 2, the method in this embodiment may include:

[0114] S201. The second device receives the first ciphertext and the second ciphertext sent by the first device.

[0115] S202. The second device calculates a second random polynomial according to the first private key, the second private key, the first system parameter, and the first ciphertext, and obtains the first random polynomial according to the third private key. The first private key is represented by a polynomial form, the first private key is randomly selected on a truncated polynomial ring; the second private key is represented by a polynomial form, and the second private key is the first private key The inverse element on the truncated polynomial ring; the third private key is represented by a polynomial form, and the third private key is calculated according to an inverse element of the system parameter and a polynomial having an inverse element on the truncated polynomial.

[0116] S203. The second device obtains plaintext information according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key; the plaintext information is the first The unencrypted data to be sent by the device to the second device; the second public key is represented in a polynomial form, and the second public key is randomly selected on the truncated polynomial ring.

[0117] The second device receives the first ciphertext and the second ciphertext sent by the first device as encrypted data, and the first ciphertext and the second ciphertext may be a pair. Polynomial.

[0118] The first private key may be represented by a polynomial form, and the first private key may be randomly selected on a truncated polynomial ring; the second private key may be represented by a polynomial form, and the second private key may be The first private key is an inverse element on the truncated polynomial ring; the third private key may be represented in a polynomial form, and the third private key may be calculated according to an inverse element of the system parameter and a polynomial having an inverse element on the truncated polynomial get.

[0119] The system parameter refers to a set of parameters preset by the key generation device, the first device of the transmitting end, and the first device of the receiving end in consideration of security and computational efficiency in the process of public key communication. A truncated polynomial ring is a collection of univariate NI polynomials whose coefficients are integers.

[0120] The truncated polynomial ring for selecting the first private key, the truncated polynomial ring for selecting the second private key, and the truncated polynomial ring for selecting the third private key may be respectively used according to the system adopted by the public key communication. The parameters are determined. The second device acquires private key information and public key information required for decryption from the key generation device of the public key communication before receiving the encrypted data sent by the first device. The key generation device may be a second device or other trusted third party device, and the first private key, the second private key, the third private key, and the second public key may be used by the public The key generation device of the key communication generates, and the first private key, the second private key, and the third private key generated by the key generation device match the first public key and the second public key.

[0121] the second device calculates a second random polynomial according to the first private key, the second private key, the first system parameter, and the first ciphertext, and obtains the first random polynomial according to the third private key, Similar to the communication partner negotiating the shared key, solving the second random polynomial corresponding to the one-way trapdoor function according to the first private key and the second private key, the first ciphertext, and solving the first random polynomial according to the third private key Corresponding to obtaining the shared key of both parties from the first ciphertext. The one-way trapdoor function is used when the first device encrypts data, and the system parameter is the same as that used by the first device when encrypting data.

[0122] Therefore, the second device is configured according to the one-way trapdoor function, the first private key, the second private key, the first system parameter, the third private key, and the first used by the first device in the encryption process. A ciphertext can calculate a second random polynomial and a first random polynomial. The second device may calculate the plaintext information according to the one-way trapdoor function, the first random polynomial, the second random polynomial, the second public key, and the second ciphertext used by the first device encryption process.

[0123] The security of the method shown in the embodiment of the present invention is the same as that of the method shown in FIG. 1. For details, refer to the security certification process in the first embodiment, and details are not described herein again.

[0124] Optionally, the method embodiment 2 shown in FIG. 2 includes an optional implementation manner, which is different from the method shown in FIG. 2:

[0125] The second device in S202 calculates a second random polynomial according to the first private key, the second private key, and the first ciphertext, and may specifically include:

[0126] S202-1, the second device calculates, according to the first ciphertext and the first private key, a process parameter on a first truncated polynomial ring of a first system parameter of the module.

[0127] S202-2. The second device obtains the second random polynomial on a third truncated polynomial ring of a third system parameter according to the process parameter and the second private key.

[0128] The obtaining the first random polynomial according to the third private key in S202 may specifically include:

[0129] S202-3. The second device calculates, according to the process parameter and the third private key, the first random polynomial on the first truncated polynomial ring of the first system parameter of the module. .

[0130] The second device in S203 obtains the plaintext information according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key, and may specifically include:

[0131] S203-1, the second device according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key, the second truncated polynomial of the second system parameter in the modulo The plaintext information is calculated on the ring.

[0132] wherein the first private key is a third random polynomial, and the second private key is an inverse element of the third random polynomial on a third truncated polynomial ring of the third system parameter of the module, where The third private key is calculated according to the inverse of the third system parameter and the inverse of the fourth random polynomial on the first truncated polynomial ring of the first system parameter of the module.

[0133] wherein the third random polynomial and the fourth random polynomial are randomly selected by the key generation device, and the third random polynomial ranges from the first truncated polynomial to the third third The third truncated polynomial ring of the system parameter has a polynomial of an inverse element at the same time; the fourth random polynomial has a value range of a polynomial having an inverse element on the first truncated polynomial ring of the first system parameter of the modulo.

[0134] It should be noted that the foregoing system parameters and their corresponding truncated polynomial rings and the result of the modulo operation are the same as those in the first embodiment, and are not described herein again.

[0135] For example, the process parameter in S202-1 may be calculated according to a first truncated polynomial ring of a first system parameter of the mode, where s is the process parameter and f is the first private key. C1 is the first ciphertext.

[0136] The second random polynomial in S202-2 may be calculated according to sP = s (mod p) and r2 = Sp / / on a third truncated polynomial ring of the third system parameter of the modulo, wherein r2 is a second random polynomial, p is the third system parameter,

For the second private key, s is the process parameter, and the third truncated polynomial ring is Zp [X] /Xn-I.

[0137] The first random polynomial in S202-3 may be calculated on the first truncated polynomial ring according to sP = s (mod p) and ri=(S-Sp) G, where s is the process parameter, In the first system parameter, p is the third system parameter, G is the third private key, and the first truncated polynomial ring is

[0138] wherein the third private key can be based on

Calculated on the first truncated polynomial ring of the first system parameter of the module, P4 is the inverse of the first system parameter of the third system parameter, qi is the first system parameter, and g is the Four random polynomials,

Is the inverse of the fourth random polynomial on the first truncated polynomial ring.

[0139] The plaintext information in S203-1 may be calculated according to M=C2-rih2_r2 on the second truncated polynomial ring, where (32 is the second ciphertext, and the ^ is the first a random polynomial, the r2 is the second random polynomial, the h2 is the second public key, and Tuen is the second system parameter.

[0140] In this embodiment, the first ciphertext and the second ciphertext sent by the first device are received by the second device, and according to the first private key, the second private key, the first system parameter, and the third private key. Calculating a second random polynomial and a first random polynomial with the first ciphertext, and obtaining plaintext information according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key . A public key cryptographic communication method that proves security is implemented. Moreover, the encryption method of the present application has a certain improvement in encryption speed, decryption speed, and ciphertext expansion ratio compared with other encryption methods that can prove security.

[0141] The technical solutions of the method embodiments shown in FIG. 1-2 are described in detail below by using several specific embodiments.

3 is a flowchart of Embodiment 3 of a public key encryption communication method according to the present invention. The first device of the transmitting end and the second device of the receiving end of the public key encrypted communication method according to FIG. 1-2 are used in this embodiment. The interaction process is described. As shown in FIG. 3, the method in this embodiment may include:

[0143] S301: The first device performs encryption according to the first public key and the random information to obtain a first ciphertext; and the first device encrypts the plaintext information according to the second public key to obtain a second ciphertext.

[0144] The plaintext information is unencrypted data to be sent by the first device to the second device; the random information is randomly selected on the truncated polynomial ring.

[0145] The first public key and the second public key are generated by a key generation device, and the key generation device may be a second device or other trusted third-party device, where the first public key is used. The polynomial form indicates that the first public key is calculated on the truncated polynomial ring according to system parameters; the second public key is represented by a polynomial form, and the second public key is randomly selected on the truncated polynomial ring.

[0146] Optionally, the plaintext information may be represented as a polynomial on a second truncated polynomial ring of the second system parameter.

[0147] S302. The first device sends the first ciphertext and the second ciphertext to the second device.

[0148] S303. The second device calculates a second random according to the first private key, the second private key, the first system parameter, and the first ciphertext, and obtains the first random polynomial according to the third private key.

[0149] The first private key, the second private key, and the third public key are generated by a key generation device, and the key generation device may be a second device or other trusted third-party device. The first private key may be represented by a polynomial form, and the first private key may be randomly selected on a truncated polynomial ring; the second private key may be represented by a polynomial form, and the second private key may be The first private key is an inverse element on the truncated polynomial ring; the third private key may be represented by a polynomial form, and the third private key may be calculated according to an inverse element of the system parameter and a polynomial having an inverse element on the truncated polynomial .

[0150] S304. The second device obtains plaintext information according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key.

[0151] Further, before step 301, the method further includes:

[0152] S300. The key generation device calculates a first public key, the second public key, a first private key, and a first system parameter according to the first system parameter, the second system parameter, the third system parameter, and the fourth system parameter. Two private keys and a third private key.

[0153] wherein the first public key may be represented by a polynomial form, the first public key is calculated on a truncated polynomial ring according to a system parameter; the second public key is represented by a polynomial form, and the second The public key is randomly selected on the truncated polynomial ring;

[0154] The first private key is represented by a polynomial form, the first private key is randomly selected on a truncated polynomial ring; the second private key is represented by a polynomial form, and the second private key is the first The private key is an inverse of the truncated polynomial ring; the third private key is represented by a polynomial form, and the third private key is calculated according to an inverse of the system parameter and a polynomial having an inverse element on the truncated polynomial.

[0155] Optionally, the first device may search for a public key of the second device by using a PKI.

[0156] The technical solutions and technical effects of this embodiment are the same as the public key encryption communication method shown in FIG. 1-2, and details are not described herein again.

[0157] In this embodiment, the first ciphertext and the second ciphertext are sent to the second device by using the first device, and the second device is configured according to the first ciphertext and the second ciphertext And decrypting the first private key and the second private key and the third private key corresponding to the first public key and the second public key to obtain plaintext information, and implementing a public key encrypted communication method capable of demonstrating security.

4 is a schematic diagram of a process of an optional implementation of step 300 in the method shown in FIG. 3. As shown in FIG. 4, the execution body of this embodiment is a key generation device, and the key generation device is shown in FIG. The method may be: the second device or the third-party device, and the method in this embodiment may include:

[0159] S401. Determine system parameters qi, q2, p, and N.

[0160] wherein, qi is the first system parameter, the q2 is the second system parameter, the p is the third system parameter, and the N is the fourth system parameter The system parameters are set according to security and encryption performance. Preferably, the system parameters 91, 924, 1 determined in S401 may preferably be 91 and 92 for two odd prime numbers and 92 = 91+2. For example, q! can be 239, q2 can be 241; or, qi can be 269, and q2 can be 271. Additionally, for the highest level of security, N may preferably be 503.

[0161] S402. Determine a first truncated polynomial ring according to system parameters q1, q2, p, and N.

Second truncated polynomial ring

And the third truncated polynomial ring Zp [X] / Xn-I.

[0162] wherein the first truncated polynomial ring is a set of truncated polynomials of a modulo q1, the second truncated polynomial ring is a set of truncated polynomials of a modulo q2, and the third truncated polynomial ring is a truncated polynomial of the modulo P Collection.

[0163] S403. Determine a value range Lf of the third random polynomial f and a value range Lg of the fourth random polynomial g.

[0164] The value range may be set according to the requirements of security and encryption performance. For example, to achieve higher security of the private key, when the polynomial f is selected, a polynomial with a coefficient of +1 or -1 or 0 can be selected on the truncated polynomial ring Z[X]/XN_1, where the coefficient is +1. The number of items is about N/3, the number of items with a coefficient of -1 is about N/3-1, and the coefficient of the remaining items is Oo.

[0165] S404, randomly selecting a third random polynomial fe Lf and a fourth random polynomial ge Lg, where f is in the third truncated polynomial ring 4〇(]/Xn−I and the first truncated polynomial ring

Inverse element

, g in the first truncated polynomial ring

Inverse element

[0166] wherein the third random polynomial f is the first private key,

Is the second private key.

[0167] S405. Calculate the first public key d on the first truncated polynomial ring.

[0168] S406. Calculate an inverse element p_1 of the p-module qi.

[0169] S407. Calculating a third private key on the first truncated polynomial ring

[0170] S408. Randomly select the second public key h2 on the second truncated polynomial ring.

[0171] After step 408, the key generation device announces (11, (12, ?, 1 where 111, 112 are the public keys of the second device).

[0172] The technical solutions and technical effects of this embodiment are the same as the public key encryption communication method shown in FIG. 1-3, and details are not described herein again.

5 is a schematic diagram of a process of an optional implementation of the step 301 in the method shown in FIG. 3. As shown in FIG. 5, the execution body of the embodiment is a first device, and the method in this embodiment may include :

[0174] S501. Determine a first truncated polynomial ring according to system parameters q1, q2, p, and N.

Second truncated polynomial ring

And the third truncated polynomial ring Zp [X] / Xn-I.

[0175] wherein, the qi is the first system parameter, the q2 is the second system parameter, the p is the third system parameter, and the N is the fourth system parameter, where The system parameters qi, q2, p, N can be obtained by the method shown in FIG. 4; the first truncated polynomial ring is a set of truncated polynomials of the modulo qi, and the second truncated polynomial ring is a set of truncated polynomials of the modular Tuen The third truncated polynomial ring is a set of truncated polynomials of the modulo P.

[0176] S502. Determine a range of values ​​of the first random polynomial ^ on the third truncated polynomial ring

And the range of values ​​of the fourth random polynomial r2

[0177] wherein the value range may be set according to the requirements of security and encryption performance.

[0178] S503, in the first truncated polynomial ring

Calculate the first ciphertext ci = nhi+r2.

[0179] wherein h is a first public key, and the Iu can be obtained by the method shown in FIG. 4.

[0180] S504, the plaintext information M is represented as a second truncated polynomial ring I

Polynomial on.

[0181] S505, in the second truncated polynomial ring

Calculate the second ciphertext C2 = rih2+r2+M.

[0182] wherein the h2 is a second public key, and the system parameter dagger can be obtained by the method shown in FIG. 4.

[0183] S506. Obtain a ciphertext C=(C1, C2) corresponding to the plaintext information M.

[0184] The technical solutions and technical effects of this embodiment are the same as the public key encryption communication method shown in FIG. 1-4, and details are not described herein again.

[0185] FIG. 6 is a schematic diagram of the processing of an optional implementation of the step 303 and the step 304 in the method shown in FIG. 3. As shown in FIG. 6, the execution body of the embodiment is a second device, which is the second embodiment of the present embodiment. Methods can include:

[0186] S601, determining a first truncated polynomial ring according to system parameters qi, q2, p, and N

Second truncated polynomial ring

And the third truncated polynomial ring 4 [X] /Xn-I.

[0187] wherein, qi is the first system parameter, the q2 is the second system parameter, the p is the third system parameter, and the N is the fourth system parameter, where The system parameters qi, q2, p, N can be obtained by the method shown in FIG. 4; the first truncated polynomial ring is a set of truncated polynomials of the modulo qi, and the second truncated polynomial ring is a set of truncated polynomials of the modular Tuen The third truncated polynomial ring is a set of truncated polynomials of the modulo P.

[0188] S602, calculating a process parameter s = fC1 on the first truncated polynomial ring, and calculating a remainder of the process parameter modulo p Sp = s (mod p) 〇

[0189] wherein, f is the first private key, and (^ is the first ciphertext, the f, (^ can be obtained by the method shown in FIG. 1-4.

[0190] S603. Calculating a second random polynomial on the third truncated polynomial ring

=

Wherein said

For the second private key, the

It can be obtained by the method shown in FIG.

[0192] S604. Calculate a first random polynomial ri=(S-Sp) G on the first truncated polynomial ring.

[0193] wherein the G is the third private key, and the G may be obtained by the method shown in FIG. 4 .

[0194] S605. Calculate the plaintext information M=C2-rih2_r2 on the second truncated polynomial ring.

[0195] wherein: 1! 2 is the second public key, and (: 2 is the second ciphertext, and the h2, (: 2 can be obtained by the method shown in FIG. 4).

[0196] The technical solutions and technical effects of this embodiment are the same as the public key encryption communication method shown in FIG. 1-5, and details are not described herein again.

[0197] Optionally, an embodiment of the present invention further provides an optional implementation manner, which is different from the method shown in FIG. 4-6, in which the step S405 in the method of FIG. 4 can be used by S405-1. Method implementation:

[0198] S405-1, calculating the first public key on the first truncated polynomial ring

Wherein said

And the third random element is an inverse element on the first truncated polynomial ring of the first system parameter of the module, where g is the fourth random polynomial, the first system parameter, the first truncated polynomial Ring is

[0200] Correspondingly, step S503 in the method shown in FIG. 5 can be implemented by using the method shown in S503-1:

[0201] S503-1, in the first truncated polynomial ring

Calculate the first ciphertext ci = pnhi+r2.

[0202] wherein h is a first public key, and the Iu can be obtained by the method shown in step S405-1.

[0203] The other steps of the technical solution of this embodiment are the same as the public key encryption communication method shown in FIG. 4-6, and details are not described herein again.

[0204] Moreover, in some resource-constrained scenarios, the encryption method provided by the present invention can still provide higher security. Compared with other existing security methods that can prove security, the encryption method of the present invention has certain advantages in terms of encryption speed, decryption speed and ciphertext expansion ratio, and the specific comparison is as follows:

[0205] The encryption speed of the public key encryption communication method of the present invention is superior to that of the NTRU algorithm. In order to facilitate the comparison of the calculation amount of the encryption work required by the present invention and the NTRU algorithm, the plaintext to be encrypted is set to be Nl〇g2pl〇g2q2 bits long. The present invention can encrypt the plaintext of Nlog2q2 bits long each time, so it is necessary to encrypt log2p times. In the present invention, each encryption requires a truncated polynomial ring in the modulo qi.

Calculate Cl = rihi+r2, and the amount of addition can be neglected. Therefore, it takes about one ring.

Polynomial multiplication on the second, then truncated polynomial ring in modulo q2

Calculate C2 = rih2+r2+M on it, so it also takes about one ring.

Polynomial multiplication on. And here q2 = qi+2, so it takes about twice the ring

Polynomial multiplication on. Therefore, the encrypted N log2plog2q2 bit long plaintext encryption, the solution of the present invention requires about 21 og2p rings

Polynomial multiplication on. The original NTRU algorithm can encrypt the plaintext of Nlog2p bit length each time, so the plaintext NTRU with Nlog2plog2q2 bit length is encrypted to encrypt log2q2~l〇g2qi times. Each NTRU encryption needs to be calculated on the ring Zq [X]/Xn-I

, the amount of calculation is about one ring

Polynomial multiplication on. Therefore, the plaintext NTRU that encrypts the Nlog2plog2q2 bit length requires about l〇g2qi subrings.

Polynomial multiplication on . Encrypting the plaintext of a given length, the ratio of the calculation amount of the present invention to the NTRU algorithm is approximately 21 og2p: log 2 qi, and the ratio is about 0.4 at the parameter selection p = 3, qi = 239, that is, the encryption speed of the present invention. It is about 2.5 times that of NTRU.

[0206] In addition, the decryption speed of the public key encryption communication method of the present invention is superior to that of the NTRU algorithm. In order to compare the calculation amount of the decryption work required by the present invention and the NTRU algorithm, the length of the plaintext information corresponding to the ciphertext to be decrypted is set to N1〇g2pl〇g2q2 bits. The invention requires l〇g2P decryption, and requires two rings for each decryption.

Multiplication on s = fci and ri= (S-Sp) G, primary ring

Multiplication on _

:,_ and about once ring

.Multiplication method M = C2_rih2_r2, and the first ring

The multiplication operation is equivalent to log22p: l〇g22qi~0.04 times (considering p = 3, qi = 239)

Multiplication on . Therefore, the decryption of the present invention (^2 port 18292 bit long plaintext corresponding ciphertext requires about 3.04 rings)

Multiplication on. Therefore, the ciphertext corresponding to the Nlog2plog2q2 bit length plaintext is decrypted, and the present invention requires about 3.041 og2p rings.

Multiplication on. The NTRU algorithm needs to run the Iog2q2^log2qi decryption algorithm to decrypt the ciphertext corresponding to the Nlog2plog2q2 bit long plaintext. Each time the NTRU decrypts, it takes a multiplication of the ring Zq [X]/Xn-I a = fc and a ring:

Multiplication operation

Therefore, NTRU needs about 1.04 rings per decryption.

Multiplication of I:. Therefore, the ciphertext corresponding to the NI 0g2P 10g2q2 bit length plaintext is decrypted, and the NTRU needs about I. 〇41og2qi secondary ring

: Multiplication on. The ratio of the calculation amount required by the present invention and the NTRU is 3.041 og2p: 1.041 (^291^=0.59 (considering p=3, qi=239), that is, decrypting the ciphertext corresponding to the Nlog2plog2q2 bit long plaintext, the present invention The decryption speed is approximately 1.70 times that of NTRU.

[0207] Moreover, the ciphertext extension ratio of the public key encryption communication method of the present invention is smaller than the NTRU algorithm. If the encrypted plaintext length of the present invention is expressed as Nlog2q2 bits, the encrypted ciphertext length is C^Nlog2qi bits long, C!*Nl〇g2q2 bits long, and the ciphertext extension of the present invention is N(l〇g2qi+l〇 G2q2) : ​​Nl〇g2q2<2:l. If the plaintext length of NTRU is expressed as Nlog2p bit length, the encrypted ciphertext is Nlog2q bit length, and the ciphertext extension is Nlog2q: Nlog2p=logPq: 1. In the case of parameter selection port = 3 4=128, 256, 512, the secret is dense. The text extensions are approximately 4.42:1, 5.05:1, 5.68:1, respectively. Therefore, the present invention has a smaller ciphertext extension than the NTRU.

7 is a schematic structural diagram of Embodiment 1 of a public key encryption communication device according to the present invention. The device in this embodiment may be a first device, that is, a transmitting end of public key communication, as shown in FIG. 7, the device in this embodiment. 1 may include: an encryption unit 11 and a transceiver unit 12, wherein the encryption unit 11 is configured to perform encryption according to the first public key and the random information to obtain the first ciphertext; and is further configured to encrypt the plaintext information according to the second public key. Obtaining a second ciphertext; the plaintext information is unencrypted data to be sent by the first device to the second device; the first public key is represented by a polynomial form, and the first public key is truncated according to system parameters Calculated on the polynomial ring; the second public key is represented by a polynomial form, the second public key is randomly selected on the truncated polynomial ring; the random information is randomly selected on the truncated polynomial ring; the transceiver unit 12 is used for The first ciphertext and the second ciphertext are sent to the second device.

[0209] Optionally, the random information includes a first random polynomial and a second random polynomial; the encryption unit 11 is specifically configured to:

[0210] calculating, according to the first public key, the first random polynomial, and the second random polynomial, the first ciphertext on a first truncated polynomial ring of a first system parameter of a modulus.

Correspondingly, the plaintext information is represented as a polynomial on a second truncated polynomial ring of the second system parameter; the encryption unit 11 is further specifically configured to:

[0212] calculating, according to the second public key, the first random polynomial, the second random polynomial, and the plaintext information, on the second truncated polynomial ring of the second system parameter of the modulo Two ciphers.

[0213] wherein the first public key is calculated according to the first system parameter, the third random polynomial, and the fourth random polynomial, on the first truncated polynomial ring of the first system parameter of the module, where the a three-random polynomial having an inverse element on the first truncated polynomial ring of the first system parameter of the modulus and a third truncated polynomial ring of the third system parameter of the modulus, the fourth random polynomial being in the first system parameter of the module The first truncated polynomial ring has an inverse element. The second public key is randomly selected on the second truncated polynomial ring.

[0214] Further, the encryption unit 11 is configured to calculate, on the first truncated polynomial ring of the modulus of the first system parameter, according to the first public key, the first random polynomial, and the second random polynomial Obtaining the first ciphertext, specifically for:

[0215] calculating the first ciphertext on the first truncated polynomial ring according to C1 = rihi+r2, the hi is the first public key, and the ^ is the first random polynomial, the ^ For the second random polynomial, the first truncated polynomial ring is

The as described is the first system parameter.

[0216] The encryption unit 11 is configured to, according to the second public key, the first random polynomial, the second random polynomial, and the plaintext information, a second truncated polynomial of the second system parameter in the modulo Calculating the second ciphertext on the ring, specifically for:

[0217] calculating, according to C2 = rih2+r2+M, the second ciphertext on the second truncated polynomial ring, the h2 is the second public key, and the ^ is the first random polynomial, Said ^ is the second random polynomial, the second truncated polynomial ring is

L, the edge is the second system parameter.

[0218] wherein the first public key is based on

Calculated on the first truncated polynomial ring, the P is the third system parameter, and the f is the third random polynomial,

An inverse of the third random polynomial on a first truncated polynomial ring of the first system parameter of the modulo, the g being the fourth random polynomial, Φ being the first system parameter, the A truncated polynomial ring is.

The second public key is randomly selected on the second truncated polynomial ring, and the second truncated polynomial ring is.

[0219] The device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 1-6, and the implementation principle and the technical effect are similar, and details are not described herein again.

[0220] FIG. 8 is a schematic structural diagram of Embodiment 2 of a public key encryption communication device according to the present invention. The device in this embodiment may be a second device, that is, a receiving end of public key communication, as shown in FIG. 2 may include: a transceiver unit 11 and a decryption unit 12, wherein the transceiver unit 11 is configured to receive the first ciphertext and the second ciphertext sent by the first device, and the decryption unit 12 is configured to use the first private key and the second private Calculating a second random polynomial according to the key and the first ciphertext, and obtaining a first random polynomial according to the third private key, wherein the first private key is represented by a polynomial form, and the first private key is randomly selected on the truncated polynomial ring The second private key is represented by a polynomial form, the second private key is an inverse element of the first private key on a truncated polynomial ring; the third private key is represented by a polynomial form, the third private The key is calculated according to an inverse element of the system parameter and a polynomial having an inverse element on the truncated polynomial; the decrypting unit 12 is further configured to: according to the first random polynomial, the second random polynomial, the second ciphertext, and Second public key, get The plaintext information is unencrypted data to be sent by the first device to the second device; the second public key is represented by a polynomial form, and the second public key is randomly selected on a truncated polynomial ring .

[0221] Optionally, the decryption unit 12 is specifically configured to:

[0222] calculating, according to the first ciphertext, the first private key, a process parameter on a first truncated polynomial ring of a first system parameter of the module;

[0223] obtaining the second random polynomial on a third truncated polynomial ring of a third system parameter according to the process parameter and the second private key.

[0224] The decryption unit 12 is further specifically configured to:

[0225] the second device calculates the first random polynomial on the first truncated polynomial ring of the first system parameter of the module according to the process parameter and the third private key.

[0226] The decryption unit 12 is further specifically configured to:

And [0227] calculating, according to the first random polynomial, the second random polynomial, the second ciphertext, and the second public key, the plaintext information on the second truncated polynomial ring in the second system parameter.

[0228] wherein, the first private key is a third random polynomial, and the second private key is an inverse element of the third random polynomial on a third truncated polynomial ring of the third system parameter of the module, where The third private key is calculated according to the inverse of the third system parameter and the inverse of the fourth random polynomial on the first truncated polynomial ring of the first system parameter of the module.

[0229] For example, the decryption unit 12 calculates the process parameters on the first truncated polynomial ring of the first system parameter according to the first ciphertext and the first private key, and may be specifically used to:

[0230] calculating the process parameter according to s = fC1 on the first truncated polynomial ring of the first system parameter of the module, where f is the first private key, and C1 is the first ciphertext.

[0231] The decryption unit 12 obtains the second random polynomial on the third truncated polynomial ring of the module of the third system parameter according to the process parameter and the second private key, and may be specifically used to:

[0232] according to Sp = s(mod p) and

Calculating the second random polynomial on the third truncated polynomial ring of the third system parameter, where P is the third system parameter.

For the second private key, s is the process parameter, and the third truncated polynomial ring is Zp [X] /Xn-I.

[0233] Correspondingly, the decryption unit 12 calculates the first random polynomial on the first truncated polynomial ring of the first system parameter of the module according to the process parameter and the third private key, Can be used specifically for:

[0234] calculating the first random polynomial on the first truncated polynomial ring according to Sp = S (mod P) and ri=(S-Sp) G, where s is the process parameter, and ! is the first a system parameter, P is the third system parameter, G is the third private key, and the first truncated polynomial ring is

[0235] Then, the decryption unit 12 is based on the first random polynomial, the second random polynomial, the second ciphertext and the second public key on the second truncated polynomial ring of the second system parameter The plaintext information is calculated and can be specifically used for:

[0236] calculating the plaintext information on the second truncated polynomial ring according to M=C2-rih2_r2, where C2 is the second ciphertext, and the ^ is the first random polynomial, The second random polynomial is described, and the 1! 2 is the second public key.

[0237] The device in this embodiment may be used to perform the technical solution of the method embodiment shown in FIG. 1-6, and the implementation principle and the technical effect are similar, and details are not described herein again.

[0238] It will be understood by those skilled in the art that all or part of the steps of implementing the foregoing method embodiments may be performed by hardware related to program instructions. The aforementioned program can be stored in a computer readable storage medium. When the program is executed, the steps including the foregoing method embodiments are performed; and the foregoing storage medium includes: a medium that can store program codes, such as R〇M, RAM, a magnetic disk, or an optical disk.

[0239] Finally, it should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not limited thereto; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should It is to be understood that the technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently substituted; and such modifications or substitutions do not detract from the essence of the corresponding technical solutions. The scope of the technical solution.