Error sampling method for lattice public key password

Abstract

The invention discloses an error sampling method for a lattice public key password. The error sampling method comprises the following steps: step 1, receiving input parameters k1 and k2, and operatinga k1-time binomial distribution sampling module and a k2-time integer uniform sampling module for representing a result of a sampling algorithm; step 2, outputting an integer a conforming to binary distribution through a random number generated by an input 2-bit random source by using a binary distribution sampling module; step 3, repeating the binomial distribution sampling module k1 times, andcalculating the output sum A of the binomial distribution sampling module k1 times; step 4, an integer uniform sampling module is used; outputting a structure B conforming to integer uniform samplingfor k2 times through a random number generated by an input bit random source (shown in the specification); and outputting the structure B conforming to the integer uniform sampling for k2 times through the random number generated by the input bit random source, and step 5, outputting a sampling result S = A + B mod q. According to the method, two different sampling algorithms are combined with each other, when the parameters k1 and k2 are selected properly, the good balance between the efficiency and the safety can be achieved, and meanwhile the flexibility is high.

Description

technical field [0001] The invention relates to the technical field of cryptography, in particular to an error sampling method for lattice public key cryptography. Background technique [0002] With the rapid development of quantum computing technology, the security of existing cryptographic systems has been greatly threatened. The study of cryptographic algorithm systems that can resist quantum computing attacks has received extensive attention. Among the many algorithm designs with potential anti-quantum capabilities, cryptographic algorithms based on lattice difficulties are the most competitive type of algorithm. [0003] In the design of cryptographic algorithms based on lattice difficulty problems, discrete error sampler is one of the core components. A discrete error sampler outputs an arbitrary number of sampling samples by running a sampling algorithm after inputting a set of system parameters. The distribution and output efficiency of these sampling samples are d...

AI Technical Summary

Problems solved by technology

[0009] Among them, there are various sampling methods of approximate discrete Gaussian distribution. Under any efficiency setting, the range of standard deviation is extremely large, but too large standard deviation will cause the equivalent standard deviation to be too small, which will reduce the security. At present, there is no Effective selection rules to achieve a balance between the two;

[0010] The size relationship between the standard deviation and the equivalent standard deviation in the binomial distribution sampling is clear, which can guarantee the final safety. At the same time, the sampling efficiency can also be directly derived from the standard deviation, but the disadvantage is that k can only take integers, and the selection range of sampling parameters is narrow. , it is difficult to meet the security requirements of the cryptographic scheme design;

[0011] For uniform integer distribution sampling, its efficiency is higher than that of the binomial distribution with different k, and its standard deviation is larger than that of the binomial distribution under the same efficiency, but the equivalent standard deviation is smaller, making its security in the Sub-binomial distribution under equal conditions

Images