后量子时代轻量级1-out-n遗忘传输协议研究

188 浏览量更新于2024-08-28 收藏 1.11MB PDF 举报

"这篇研究论文探讨了一种后量子时代的轻量级1-out-n遗忘传输协议，旨在提升物联网(IoT)环境中的数据安全性和隐私保护。遗忘传输协议允许发送者在不泄露任何额外信息的情况下，向多个接收者之一传输一个秘密，而其他接收者无法获取该秘密。该文关注的是在量子计算可能破坏当前加密技术的背景下，如何设计出一种既高效又安全的解决方案。" 正文：在计算机和电气工程领域，随着物联网(IoT)的快速发展，安全和隐私问题变得越来越重要。尤其是考虑到未来可能面临的量子计算威胁，传统的加密算法如RSA和AES等可能会变得不再安全。因此，研究人员正在探索后量子安全的解决方案，即能够在量子计算机环境下依然保持安全性的加密技术。这篇论文提出了一种名为“后量子轻量级1-out-n遗忘传输协议”的新方法，它结合了遗忘传输(Oblivious Transfer)的概念与NTRU(Number Theoretic Transform Utilized)公钥加密系统。遗忘传输是一种通信协议，允许发送者向多个接收者之一传递一个消息，而接收者中除了被选中的一个外，其余都不知道是否收到了消息，更别提消息的内容。这在保护敏感信息方面具有显著优势，尤其适用于物联网环境中大量的设备交互。 NTRU是一种基于数论的加密算法，相比基于大数分解或离散对数问题的传统公钥加密，它在处理速度和资源消耗上更加高效，因此适合于资源有限的物联网设备。论文中，作者将NTRU与遗忘传输协议相结合，以实现后量子安全的轻量级解决方案，旨在降低计算和存储需求，同时提供强大的安全性。论文还强调了隐私保护和普遍可组合性(Universal Composability)的重要性。普遍可组合性是密码学中的一个概念，它允许安全协议在不损害整体安全性的情况下被组合使用。在物联网环境中，设备之间的通信往往是多层面和相互关联的，因此，普遍可组合的协议能够确保在整个网络中的信息安全。经过一系列的安全分析和性能评估，该协议显示出了良好的安全性和效率。从收到初始稿件到最终接受发表，文章经过了几轮修订，这表明作者们对这个主题进行了深入的研究，并对提出的协议进行了严谨的验证。关键词包括遗忘传输、NTRU、隐私保护、后量子安全和普遍可组合性，这些关键词揭示了研究的核心内容和目标。这篇论文为物联网环境下的安全通信提供了一个有前景的框架，尤其是在面临量子计算挑战的未来。

92 B. Mi, D. Huang and S. Wan et al. / Computers and Electrical Engineering 75 (2019) 90–100

During the encryption phase, the message is represented as a N -dimensional vector m , whose elements are integers

within [ −p/ 2 , p/ 2] . After a stochastic polynomial r ∈ J (d , d ) is generated, the ciphertext can be obtained:

e = pr ∗ h + m (mod q ) . (3)

In order to decrypt the ciphertext e , the receiver should ﬁrst calculate

a = f ∗ e (mod q ) (4)

and lift all its elements to the ring R . Then, one can recover the plaintext by multiplying the result with the latter part of

his/her private key, such that

m = f

∗ a (mod p) . (5)

According to the following lemma, it can be concluded that once the parameters p, q, N and d are properly chosen, any

plaintext can be correctly restored from its corresponding ciphertext in NTRU.

Lemma 1. The receiver can accurately decode any NTRU cipher, if

q > p(6 d + 1) . (6)

Proof. Since both r and g are sampled from J (d , d ) , the maximum elements of r ∗ g will not exceed 2 d as a result of

convolutional multiplication. Similarly, the absolute value of elements in f ∗ m is p(2 d + 1) / 2 because f ∈ J (d + 1 , d) and m

are composed of integers belonging to [ −p/ 2 , p/ 2] . Considering that

a = f ∗ e (mod q ) = p r ∗ g + f ∗ m (mod q ) , (7)

its elements will be limited to interval [0 , p(6 d + 1)] after central lifting. That means if the condition q > p(6 d + 1) holds,

no information will be lost in ring R and the message can thus be resumed as m = f

∗ a (mod p) . 

Proposed 1-out- n OT protocol

The proptocol is designed to achieve the following two goals.

1. Quantum computing attack resilience, even in the presence of an active adaptive adversary.

2. Eﬃcient and suitable for deployment in resource-constraint settings, even when the number of message entries scale up

considerably (e.g., by pre-computing and distributing all encrypted messages in real-time).

As discussed earlier, we use NTRUEncrypt as the main building block, as well as a symmetric cryptosystem (E, D) and a

hash function H. In the protocol, we assume that the sender has n messages denoted as m

, m

n −1

, while the receiver

expects to obliviously retrieve τ th of these messages. We will now describe the various phases of the protocol.

3.1. Initialization phase

For each message m

, we represent its subscript as a binary string i = (i

, i

, ··· , i

N−1

) , where N =  log

n  is ex-

actly the length of any plaintext identity to be retrieved. In the beginning, the sender picks a random Cartesian vector

α = ((α

, α

) , (α

, α

) , ··· , (α

N−1

, α

N−1

)) from {{0, 1} × {0, 1}}

and a reversible vector β over R

whose elements belong

to [ −q/ 2 , q/ 2] . Based on the vector α, (s)he can trivially calculate

α = ((α

, α

) , (α

, α

) , ··· , (α

N−1

, α

N−1

)) to achieve a

N-dimensional vector relating to {−1 , 0 , 1 }

. In order to encrypt message m

, (s)he needs to sample a corresponding irre-

versible vector ϕ

∈ J (d , d ) over R

stochastically and multiply it with β as

= ϕ

∗ β

−1

(mod q ) . Then, (s)he computes the

symmetric key k

= H (ϕ

∗ (−α

)(mod p)) , where α

= (α

, α

, ··· , α

N−1

) , so as to achieve the ciphertext c

= E

) .

It is clear that all encrypted messages are independent of any receiver or temporary parameter; thus, the sender performs

such computation only once. After all ciphertexts are obtained, they can be stored or delivered. Meanwhile, the sender

should also distribute all

, where i = 0 , 1 , ··· , n − 1 .

3.2. Retrieval phase

a. Assuming that the key pairs are (h

, (f

, f

)) and h

, (f

, f

) respectively for the sender and receiver in NTRU cryp-

tosystem, the decryption key can be obliviously transferred as follows.

(1) The sender randomly samples r

∈ J (d , d ) to encrypt as

= pr

∗ h

α(mod q ) , (8)

which will be subsequently transmitted to the receiver.

(2) In order to retrieve the key corresponding to message m

, the receiver should represent its index τ to be

τ =

( ¯τ

, ¯τ

, ··· , ¯τ

N−1

) where

¯τ



1 , τ

= 0

−1 , τ

= 1

(9)

for i = 0 , 1 , ··· , N − 1 .

剩余10页未读，继续阅读

weixin_38645133

粉丝: 7
资源: 964

后量子时代轻量级1-out-n遗忘传输协议研究

1-out-of-n:JavaScript中n分之一的遗忘传输协议

遗忘算法介绍

基于NTRU遗忘传输的高效LBS安全保护

量子信息计算库--matlab

量子计算和量子信息-量子计算部分

通过具有库伦点-铅耦合的量子点传输

开发技术-硬件-量子态隐形传输辅助克隆及重构的理论研究.zip

在rf-SQUID磁通量子比特中因Landau-Zener转变引起的量子干涉

广义Klein-Gordon方程和量子引力校正对Kerr-Newman黑洞中标量粒子隧穿的影响

计算机行业科创板系列二（国盾量子）：量子保密通信行业龙头-0411-中泰证券-23页.pdf

最新资源