[go: up one dir, main page]

CN108111301B - Method and system for implementing SSH protocol based on post-quantum key exchange - Google Patents

Method and system for implementing SSH protocol based on post-quantum key exchange Download PDF

Info

Publication number
CN108111301B
CN108111301B CN201711326036.9A CN201711326036A CN108111301B CN 108111301 B CN108111301 B CN 108111301B CN 201711326036 A CN201711326036 A CN 201711326036A CN 108111301 B CN108111301 B CN 108111301B
Authority
CN
China
Prior art keywords
client
server
key
trusted
temporary session
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201711326036.9A
Other languages
Chinese (zh)
Other versions
CN108111301A (en
Inventor
刘伟
刘镝
陶冶
寇金锋
王笑帝
刘明辉
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China United Network Communications Group Co Ltd
Original Assignee
China United Network Communications Group Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China United Network Communications Group Co Ltd filed Critical China United Network Communications Group Co Ltd
Priority to CN201711326036.9A priority Critical patent/CN108111301B/en
Publication of CN108111301A publication Critical patent/CN108111301A/en
Application granted granted Critical
Publication of CN108111301B publication Critical patent/CN108111301B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852—Quantum cryptography
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/08—Protocols specially adapted for terminal emulation, e.g. Telnet
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Electromagnetism (AREA)
  • Theoretical Computer Science (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明属于信息技术领域，具体涉及基于后量子密钥交换实现SSH协议的方法及系统。该方法包括：客户端和服务器分别计算公私密钥对；计算客户端临时会话公钥，并将客户端公钥和客户端临时会话公钥发送至服务器；服务器对客户端进行身份验证；计算服务器临时会话公钥；计算服务器临时会话变量以及临时会话消错变量，以及服务器共享密钥初始种子；服务器利用后量子算法生成此次会话的最终服务器共享密钥；客户端根据服务器公钥对服务器进行身份验证；客户端通过服务器的身份认证，计算客户端临时会话变量和客户端共享密钥初始种子；客户端利用后量子算法生成此次会话的最终客户端共享密钥。该方法及其系统能有效抵抗量子计算机攻击，保证网络安全。

Figure 201711326036

The invention belongs to the field of information technology, and in particular relates to a method and a system for realizing SSH protocol based on post-quantum key exchange. The method includes: the client and the server respectively calculate a public and private key pair; calculate the client's temporary session public key, and send the client's public key and the client's temporary session public key to the server; the server authenticates the client; calculating the server Temporary session public key; calculate the server temporary session variable and temporary session error correction variable, and the initial seed of the server shared key; the server uses the post-quantum algorithm to generate the final server shared key for this session; Authentication; the client calculates the client's temporary session variable and the initial seed of the client's shared key through the server's identity authentication; the client uses the post-quantum algorithm to generate the final client's shared key for this session. The method and its system can effectively resist quantum computer attacks and ensure network security.

Figure 201711326036

Description

Method and system for realizing SSH protocol based on post-quantum key exchange
Technical Field
The invention belongs to the technical field of information, and particularly relates to a method for realizing an SSH protocol based on post-quantum key exchange and a system for realizing the SSH protocol based on the post-quantum key exchange.
Background
With the continuous development of computer networks, the network scale becomes larger and larger, and the demand of people for remote login functions, such as configuration and management of remote servers, is also promoted. SSH (secure shell) is one of the most widely used telnet protocols at present, and compared with other protocols providing telnet, SSH can provide various security services such as authentication of both communication parties, encrypted transmission of communication data, integrity check and the like.
The SSH protocol standard specifies a layered architecture of SSH, as shown in the SSH protocol architecture diagram shown in fig. 1, which includes three parts, namely a transport layer protocol, user authentication and a connection layer protocol, where the transport layer protocol is located at the bottom layer of SSH, can provide security services such as key agreement, data encryption, identity authentication, and the like, and is a basis for SSH to provide secure remote login. At present, the key negotiation part in the SSH transport layer is completed by a DH (Diffie-Hellman) algorithm, i.e. two communication parties negotiate a shared key on the public network by using the DH algorithm, and the shared key is used for encrypting and decrypting all data to be transmitted, thereby ensuring the security of the session. The key agreement algorithm plays a key role in the SSH protocol, and must have a sufficiently high security, and the security of the current DH algorithm depends on the difficulty of solving discrete logarithms. The discrete logarithm problem can only be solved in exponential time using today's computer files. However, with the advent of quantum computers and quantum algorithms, the discrete logarithm problem has proven to be solved in polynomial time with quantum computers, which means that DH algorithms are no longer as secure in the quantum era.
On one hand, in order to prevent the DH algorithm from being attacked by man-in-the-middle, SSH needs to support not only the DH algorithm but also RSA, SHA256, and the like in the key agreement phase, and the complexity is relatively high. On the other hand, the quantum cryptography technology has been developed rapidly. The research of these quantum cryptography techniques seriously threatens the current public key cryptography system depending on the digital theory, and brings a serious threat to the security of SSH, and the proposal of Shor algorithm makes the cryptographic algorithm depending on the discrete logarithm difficulty no longer so secure, and the DH algorithm also faces a huge challenge, if the DH algorithm cannot guarantee the security of the shared key negotiated by both communication parties, then the SSH provides security service. With the deep research of quantum algorithm, the problem of discrete logarithm is easy and convenient to solve, the shared secret key negotiated by the DH algorithm is easy to break, and the SSH provides security service and is seriously questioned.
In addition, a plurality of security holes are exposed in SSH at the present stage, and particularly, in the process of establishing connection by the SSH protocol, whether two communication parties are illegally invaded or controlled is not verified, the two communication parties cannot determine the credible state of the opposite end and cannot determine whether the opposite end is invaded or illegally controlled by an attacker, so that an attack opportunity is provided for the attacker. Although the existing SSH protocol has many advantages and many users, it still has some vulnerabilities and disadvantages, such as being easily attacked by ciphertext selection and SQL injection, and thus, the improvement of the existing problems becomes a technical problem to be solved.
Disclosure of Invention
The technical problem to be solved by the present invention is to provide a method for implementing an SSH protocol based on post-quantum key exchange and a system for implementing an SSH protocol based on post-quantum key exchange, which use quantum cryptography theory knowledge to achieve the purpose of resisting quantum computer attacks and ensure network security, in order to overcome the above-mentioned disadvantages in the prior art.
The technical scheme adopted for solving the technical problem of the invention is that the method for realizing the SSH protocol based on the post-quantum key exchange comprises a key exchange step, wherein the key exchange step comprises the following steps:
the client and the server randomly sample from the Gaussian distribution of the first parameter, and respectively calculate a public and private key pair of the client and a public and private key pair of the server;
the client randomly samples from the Gaussian distribution of the second parameter, calculates a client temporary session public key, and sends the client public key and the client temporary session public key to the server;
the server receives the client public key and the client temporary session public key, performs identity verification on the client, and if the verification fails, the server directly disconnects the link, otherwise performs the next step;
calculating a server temporal session public key from the random sampling on the gaussian distribution of the second parameter;
the server calculates a server temporary session variable and a temporary session error-eliminating variable according to the client temporary session public key, the client vector, the server temporary session public key, the server vector and the random sampling of the server on the Gaussian distribution of the first parameter and the second parameter, and further calculates a server shared key initial seed according to the server temporary session variable and the temporary session error-eliminating variable;
the server generates a final server shared key of the session by using a post-quantum algorithm according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error-eliminating variable and the initial seed of the server shared key;
the client performs identity authentication on the server according to the server public key;
the client side calculates a client side temporary session variable according to a client side temporary session public key, a client side vector, a server temporary session public key and random sampling of the client side on Gaussian distribution of a first parameter and a second parameter through identity authentication of a server, and further calculates a client side shared key initial seed according to the client side temporary session variable and a temporary session error-eliminating variable;
the client generates a final client shared key of the session by using a post-quantum algorithm according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error-eliminating variable and the client shared key initial seed;
and if the authentication of either the server or the client can not be passed, the key exchange is terminated.
Preferably, the server temporary session public key ksComprises the following steps:
ks＝(pcc+x)(ssd+rs)+2gs
wherein:
c＝H1(client, server, x), which is a client vector;
x＝arc+2fca client side temporary session public key;
Figure GDA0003047538210000031
rciand fciGaussian distribution χ of beta from second parameter for clientβQ is a positive integer;
d＝H1(server, client, y, x), which is a server vector;
y＝ars+2fsa server temporary session public key;
Figure GDA0003047538210000032
rsi，fsi，gsifor server from the Gaussian distribution χ with second parameter ββQ is a positive integer;
pc＝asc+2ecis a client public key;
Figure GDA0003047538210000033
sciand eciFrom the first parameter of the client to the alpha Gaussian distribution xαA random sampling value of (1), q is a positive integer, scStill the client private key;
and the temporary session error-elimination variable w is:
w＝Cha(ks)
wherein: cha () is a feature correlation function.
Preferably, according to (w, y, p)s) Server shared secret key initial seed sigmasComprises the following steps:
σs＝Mod2(ks,w)
wherein: mod2() Modulo-2 function, Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure GDA0003047538210000034
Unit matrix
Figure GDA0003047538210000035
v∈Mq，w∈{0,1}；
Server shared secret sksComprises the following steps:
sks＝H(client,server,x,y,w,σs)。
preferably, the client temporary session variable kcComprises the following steps:
kc＝(psd+y)(scc+rc)+2gc
wherein:
Figure GDA0003047538210000041
gcifor server from the Gaussian distribution χ with second parameter ββQ is a positive integer;
ps＝ass+2esis a server public key;
Figure GDA0003047538210000042
ssiand esiFor the server, from the first parameter of alpha Gaussian distribution xαA random sampling value of (1), q is a positive integer, ssStill the server private key.
Preferably, according to (w, y, p)s) Client sharing key initial seed sigmacComprises the following steps:
σc＝Mod2(kc,w)
wherein: mod2() Modulo-2 function, Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure GDA0003047538210000043
Unit matrix
Figure GDA0003047538210000044
v∈Mq，w∈{0,1}；
Client shared secret skcComprises the following steps:
skc＝H(client,server,x,y,w,σc)。
preferably, before the key exchanging step, the method further comprises: the step of verifying the credible states of the two communication parties comprises the following steps:
sending a request for verifying the credible state of the client to a server;
after receiving a request of a client, a server randomly generates a first random number with M bits, and sends the first random number and a request for verifying the self credibility state to the client, wherein M is a natural number;
after receiving the first random number and the verification request, the client correspondingly generates an M-bit second random number, measures the integrity of the trusted request, encrypts the first random number, the configuration register value and the measurement log SML, and sends an encryption result, the second random number and the TPM public key to the server;
after receiving the data, the server judges whether the client is the first client requesting to establish SSH connection, if so, checks whether a trusted certificate exists locally, and if so, directly performs the next step; otherwise, the integrity measurement is requested to the local machine credibility, then the second random number, the configuration register value of the second random number and the measurement log SML are encrypted, and the encryption result and the TPM public key are sent to the client side together;
the server verifies the credibility state of the client according to the data sent by the client, if the client passes the verification, a credibility verification passing certificate is generated, the certificate comprises the client IP, the unique identifier of the client, the IP and the identifier of the local server, the time for generating the certificate and the validity period of the certificate, the TPM public key sent by the client is used for encryption, and the encryption result and the verification passing information are sent to the client together;
after the client receives the data, the client verifies the credible state of the server, if the verification is passed, the client also generates a credible certificate, the content comprises the server IP, the unique identifier of the server, the IP and the identifier of the local client, the time for generating the certificate and the validity period of the certificate, the TPM public key sent by the server is used for encryption, and the encryption result and the verification passing information are sent to the server together;
after receiving the trusted voucher, the server decrypts the trusted voucher by using the TPM private key of the server and stores the trusted voucher in the local area, so that the trusted states of the server and the server pass verification, and otherwise, the server is directly disconnected.
A system for realizing SSH protocol based on post-quantum key exchange comprises a key exchange module, wherein the key exchange module comprises a first key unit, a second key unit, a first verification unit and a second verification unit, wherein:
the first key unit is located in the server and used for completing the following functions:
randomly sampling from the Gaussian distribution of the first parameter, and calculating a public and private key pair of the server;
after the first verification unit passes the identity authentication of the client, calculating a server temporary session public key from random sampling on Gaussian distribution of a second parameter;
calculating a server temporary session variable and a temporary session error-eliminating variable according to the client temporary session public key, the client vector, the client temporary server vector and the random sampling of the server on the Gaussian distribution of the first parameter and the second parameter;
calculating a server shared key initial seed according to the server temporary session variable and the temporary session error-eliminating variable;
generating a final server shared key of the session by using a post-quantum algorithm according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error-eliminating variable and the initial seed of the server shared key;
the first verification unit is positioned in the server and used for receiving the client public key and the client temporary session public key and verifying the identity of the client, if the verification cannot pass, the server directly disconnects the link, otherwise, the server performs subsequent authentication;
the second key unit is located at the client and used for completing the following functions:
randomly sampling from the Gaussian distribution of the first parameter, and calculating a public-private key pair of the client;
randomly sampling from the Gaussian distribution of the second parameter, calculating a client temporary session public key, and sending the client public key and the client temporary session public key to a server;
after the second verification unit passes the identity authentication of the server, calculating a client temporary session variable according to the client temporary session public key, the client vector, the server temporary session public key and the random sampling of the client on the Gaussian distribution of the first parameter and the second parameter, and further calculating a client shared key initial seed according to the client temporary session variable and the temporary session error-eliminating variable;
generating a final server shared key of the session by using a post-quantum algorithm according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error-eliminating variable and the client shared key initial seed;
and the second verification unit is positioned at the client and used for verifying the identity of the server according to the server public key, terminating the key exchange if the verification cannot pass, and otherwise, performing subsequent authentication.
Preferably, in the first key unit:
server temporary session public key ksComprises the following steps:
ks＝(pcc+x)(ssd+rs)+2gs
wherein:
c＝H1(client, server, x), which is a client vector;
x＝arc+2fca client side temporary session public key;
Figure GDA0003047538210000061
rciand fciGaussian distribution χ of beta from second parameter for clientβQ is a positive integer;
d＝H1(server, client, y, x), which is a server vector;
y＝ars+2fsa server temporary session public key;
Figure GDA0003047538210000062
rsi，fsi，gsifor server from the Gaussian distribution χ with second parameter ββQ is a positive integer;
pc＝asc+2ecis a client public key;
Figure GDA0003047538210000063
sciand eciFrom the first parameter of the client to the alpha Gaussian distribution xαA random sampling value of (1), q is a positive integer, scStill the client private key;
and the temporary session error-elimination variable w is:
w＝Cha(ks)
wherein: cha () is a feature correlation function;
according to (w, y, p)s) Server shared secret key initial seed sigmasComprises the following steps:
σs＝Mod2(ks,w)
wherein: mod2() Modulo-2 function, Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure GDA0003047538210000071
Unit matrix
Figure GDA0003047538210000072
v∈Mq，w∈{0,1}；
Server shared secret sksComprises the following steps:
sks＝H(client,server,x,y,w,σs)。
preferably, in the second key unit,
client temporary session variable kcComprises the following steps:
kc＝(psd+y)(scc+rc)+2gc
wherein:
Figure GDA0003047538210000073
gcifor server from the Gaussian distribution χ with second parameter ββQ is a positive integer;
ps＝ass+2esis a server public key;
Figure GDA0003047538210000074
ssiand esiFor the server, from the first parameter of alpha Gaussian distribution xαA random sampling value of (1), q is a positive integer, ssStill the server private key;
and, according to (w, y, p)s) Client sharing key initial seed sigmacComprises the following steps:
σc＝Mod2(kc,w)
wherein: mod2() Modulo-2 function, Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure GDA0003047538210000075
Unit matrix
Figure GDA0003047538210000076
v∈Mq，w∈{0,1}；
Client shared secret skcComprises the following steps:
skc＝H(client,server,x,y,w,σc)。
preferably, the system further comprises a verification trusted module to verify the trusted status of the two communication parties, where the verification trusted module includes a first trusted unit located in the server and a second trusted unit located in the client, and is configured to perform the following functions:
the second trusted unit sending a request to verify a client trusted status to the first trusted unit;
after receiving a request of a client, the first trusted unit randomly generates an M-bit first random number, and sends the first random number and a request for verifying the trusted state of the first trusted unit to the second trusted unit, wherein M is a natural number;
after receiving the first random number and the verification request, the second trusted unit correspondingly generates an M-bit second random number, then requests the TPM for integrity measurement, encrypts the first random number, the configuration register value and the measurement log SML, and sends an encryption result, the second random number and the TPM public key to the first trusted unit;
after receiving the data, the first trusted unit judges whether the client is the first client requesting to establish SSH connection, if so, checks whether a trusted certificate exists locally, and if so, directly performs the next step; otherwise, the integrity measurement is requested to the local trust, then the second random number, the configuration register value of the second random number and the measurement log SML are encrypted, and the encryption result and the TPM public key are sent to the second trust unit;
the first trusted unit verifies the trusted state of the client according to the data sent by the second trusted unit, if the verification is passed, a trusted verification passing certificate is generated, the certificate comprises a client IP, a client unique identifier, an IP and an identifier of a local server, time for generating the certificate and a certificate validity period, and is encrypted by using a TPM public key sent by the client, and an encryption result and verification passing information are sent to the client together;
after the client receives the data, the trusted state of the server is verified, if the data passes the verification, the second trusted unit also generates a trusted certificate, the content comprises a server IP, a server unique identifier, an IP and an identifier of the local client, the time for generating the certificate and the certificate validity period, the TPM public key sent by the server is used for encryption, and the encryption result and the verification passing information are sent to the first trusted unit together;
and after receiving the trusted credential, the first trusted unit decrypts the trusted credential by using the TPM private key of the first trusted unit and stores the trusted credential in the local area, so that the trusted states of the first trusted unit and the trusted unit pass verification, and otherwise, the first trusted unit and the trusted unit are directly disconnected.
The invention has the beneficial effects that: according to the method for realizing the SSH protocol based on the post-quantum key exchange and the system for realizing the SSH protocol based on the post-quantum key exchange, the post-quantum key exchange protocol and the credible authentication method are used for solving some potential threats of the SSH protocol. The post-quantum key exchange protocol can solve the problem that the shared key at the key exchange stage in the current SSH protocol is possibly broken, and the trusted authentication can solve the problem that platforms of two parties using the SSH protocol for communication are not trusted.
Drawings
FIG. 1 is a schematic diagram of SSH protocol architecture;
FIG. 2 is a flow diagram of a prior art SSH protocol telnet;
fig. 3 is a flowchart of key exchange in a method for implementing an SSH protocol based on post-quantum key exchange according to embodiment 1 of the present invention;
fig. 4 is a flowchart of a trusted certification process in the method for implementing the SSH protocol based on post-quantum key exchange according to embodiment 1 of the present invention.
Detailed Description
In order to make those skilled in the art better understand the technical solution of the present invention, the following describes in detail a method for implementing an SSH protocol based on post-quantum key exchange and a system for implementing an SSH protocol based on post-quantum key exchange according to the present invention with reference to the accompanying drawings and the detailed description.
The technical idea of the invention is as follows: until now, the improvement of the SSH protocol at present is the improvement by using the modern cryptography technology, and the improvement by using the quantum cryptography technology is not involved. The present invention utilizes quantum cryptography to improve the above-mentioned technical problems. The quantum algorithm can solve the discrete logarithm problem in polynomial time, and ensures the states of two communication parties to be credible before SSH connection is established, so as to take the safety and credibility of the SSH protocol into account.
The invention provides an improved method for trusted SSH protocol authentication based on a post-quantum key exchange algorithm. After the trusted verification passes, SSH utilizes a post quantum key exchange algorithm to complete a key agreement stage and a two-party identity authentication stage between a client and a remote server, and the changed users do not need to care about a bottom layer implementation principle and change a previous login method. The method has the advantages of strong user transparency, high speed, simple and easily understood algorithm, and capability of providing the function of the post-quantum computer on the one hand, namely preventing the shared secret key generated by both communication parties from being broken by the quantum computer on the premise of not reducing the original SSH remote login security; on the other hand, the trusted status of both the client and the server can be verified.
Example 1:
the embodiment provides a method for realizing an SSH protocol based on post-quantum key exchange, which can effectively prevent a shared key generated by a communication client and a server from being broken by a quantum computer; on the other hand, the trusted status of both the client and the server can be verified.
The protocol structure of the improved SSH scheme is a three-layer architecture specified in the current SSH protocol, and the specific protocol architecture refers to fig. 1. The SSH comprises a transmission layer, user authentication and connection establishment from bottom to top in sequence, and the session establishment process comprises version negotiation, algorithm negotiation and key negotiation, user authentication and connection request.
Currently, the flow of telnet between two communicating parties using SSH protocol is shown in fig. 2.
First, version negotiation: the client and the server mutually send own protocol version number and software version number to carry out version negotiation so as to determine whether to continue the session, and the following steps are carried out after the version negotiation is successful. The information sent at this stage is transmitted in a plaintext mode;
and secondly, algorithm negotiation: the client and the server respectively send a public key algorithm list, an encryption algorithm list, a compression algorithm list and the like supported by the client and the server, and the client and the server negotiate various algorithms to be used finally in the session according to the algorithms supported by the client and the server. Wherein, although the key agreement algorithm can be agreed in theory, in practice, SSH must support DH algorithm only and only at present;
thirdly, key agreement: the client and the server negotiate a shared key using a DH key exchange algorithm. At this stage, the RSA algorithm and the SHA256 algorithm are required to assist, so that the probability of being broken is reduced;
fourthly, user authentication: the client sends the user password to the server in a ciphertext mode, and the server carries out validity authentication on the identity of the user;
step five, establishing connection: after the user authentication is successful, the client sends a session request, the server responds to the request type of the client, and the two parties establish connection for data transmission.
In the SSH protocol at the present stage, a DH algorithm is used for negotiating a key, and meanwhile, in order to prevent the key from being attacked by a man-in-the-middle, an RSA algorithm and an SHA256 algorithm are used for signature authentication so as to ensure the legality of the identities of two communication parties. The cooperative work of the algorithms ensures high security of the shared secret key. However, with the continuous approach of quantum era and the rapid development of computer technology, SSH will face huge challenges and risks.
Based on the above current situation, this embodiment provides an improved trusted SSH authentication scheme based on a post-quantum key exchange protocol, so that the SSH key exchange phase can resist attacks from a quantum computer, the security of SSH is improved, and the lifetime of SSH in the quantum era is extended. Particularly, based on the lattice theory of quantum cryptography, the complexity of the R-LWE (Ring-Learning With Errors) problem can be finally reduced to the lattice SVP (short Vectors Problem) problem, which has proven to be NP-difficult. Therefore, the authentication key exchange algorithm based on the R-LWE can well resist the attack of quantum computation, and has the advantages of high computation speed, easiness in understanding and the like.
In the method for implementing the SSH protocol based on post-quantum key exchange according to this embodiment, when the client establishes an SSH connection with the server, the two parties first send a Trusted certification request to the opposite end, then respectively send integrity measurement to their Trusted requests (TPM requests, Trusted Platform modules), and send related information to the opposite end and verify the Trusted status of the opposite end, and when both parties' Trusted statuses are verified, both parties start password negotiation. When key agreement is carried out, the two parties respectively carry out random sampling from Gaussian distribution with the same parameters, calculate own public and private key pairs, then send own public keys to the opposite terminal and receive the public keys of the opposite terminal, verify the identity of the opposite terminal, then calculate temporary public and private key pairs of the session and other needed variables, send data to the opposite terminal after calculation is finished, and simultaneously calculate own shared keys of the session. Therefore, the credible state of the terminal is ensured, the key negotiation process of resisting the quantum computer is realized, and the high-safety remote login process is provided.
As shown in fig. 3, the key exchange step in the method for implementing the SSH protocol based on post-quantum key exchange includes:
the client and the server randomly sample from the Gaussian distribution of the first parameter, and respectively calculate a public and private key pair of the client and a public and private key pair of the server;
the client randomly samples from the Gaussian distribution of the second parameter, calculates a client temporary session public key, and sends the client public key and the client temporary session public key to the server;
the server receives the client public key and the client temporary session public key, performs identity verification on the client, and if the verification fails, the server directly disconnects the link, otherwise performs the next step;
the server calculates a server temporary session public key from random sampling on Gaussian distribution of the second parameter through identity authentication of the client;
the server calculates a server temporary session variable and a temporary session error-eliminating variable according to the client temporary session public key, the client vector, the server temporary session public key, the server vector and the random sampling of the server on the Gaussian distribution of the first parameter and the second parameter, and further calculates a server shared key initial seed according to the server temporary session variable and the temporary session error-eliminating variable;
the server generates a final server shared key of the session by using a post-quantum algorithm according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error-eliminating variable and the initial seed of the server shared key;
the client performs identity authentication on the server according to the server public key;
the client side calculates a client side temporary session variable according to a client side temporary session public key, a client side vector, a server temporary session public key and random sampling of the client side on Gaussian distribution of a first parameter and a second parameter through identity authentication of a server, and further calculates a client side shared key initial seed according to the client side temporary session variable and a temporary session error-eliminating variable;
the client generates a final client shared key of the session by using a post-quantum algorithm according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error-eliminating variable and the client shared key initial seed;
and if the authentication of either the server or the client can not be passed, the key exchange is terminated.
On the server side, the server temporary session public key ksComprises the following steps:
ks＝(pcc+x)(ssd+rs)+2gs
wherein:
c＝H1(client, server, x) is a client vector, client is a client host, and server is a server host;
x＝arc+2fca client side temporary session public key;
Figure GDA0003047538210000121
rciand fciGaussian distribution χ of beta from second parameter for clientβQ is a positive integer (e.g., q is 5); here, multiple sampling is performed, and the sum of the results of the multiple sampling is used as a result to increase the randomness of the sampling.
d＝H1(server, client, y, x), which is a server vector;
y＝ars+2fsa server temporary session public key;
Figure GDA0003047538210000122
rsi，fsi，gsifor server from the Gaussian distribution χ with second parameter ββQ is a positive integer (e.g., q is 5);
pc＝asc+2ecis a client public key;
Figure GDA0003047538210000123
sciand eciFrom the first parameter of the client to the alpha Gaussian distribution xαQ is a positive integer (e.g., q is 5), and s is the random sample value of (1)cStill the client private key;
and the temporary session error-elimination variable w is:
w＝Cha(ks)
wherein: cha () is a feature correlation function;
according to (w, y, p)s) Server shared secret key initial seed sigmasComprises the following steps:
σs＝Mod2(ks,w)
wherein: mod2() Modulo-2 function, Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure GDA0003047538210000124
Unit matrix
Figure GDA0003047538210000125
v∈Mq，w∈{0,1}；
Server shared secret sksComprises the following steps:
sks＝H(client,server,x,y,w,σs)。
at the client level, a client temporary session variable kcComprises the following steps:
kc＝(psd+y)(scc+rc)+2gc
wherein:
Figure GDA0003047538210000126
gcifor server from the Gaussian distribution χ with second parameter ββThe random sample value of (a) above,q is a positive integer (e.g., q ═ 5);
ps＝ass+2esis a server public key;
Figure GDA0003047538210000131
ssiand esiFor the server, from the first parameter of alpha Gaussian distribution xαQ is a positive integer (e.g., q is 5), and s is the random sample value of (1)sStill the server private key;
according to (w, y, p)s) Client sharing key initial seed sigmacComprises the following steps:
σc＝Mod2(kc,w)
wherein: mod2() Modulo-2 function, Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure GDA0003047538210000132
Unit matrix
Figure GDA0003047538210000133
v∈Mq，w∈{0,1}；
Client shared secret skcComprises the following steps:
skc＝H(client,server,x,y,w,σc)。
preferably, before the key exchanging step, the method further comprises: the step of verifying the credible states of the two communication parties comprises the following steps:
sending a request for verifying the credible state of the client to a server;
after receiving a request of a client, a server randomly generates a first random number with M bits, and sends the first random number and a request for verifying the self credibility state to the client, wherein M is a natural number;
after receiving the first random number and the verification request, the client correspondingly generates an M-bit second random number, measures the integrity of the trusted request, encrypts the first random number, the configuration register value and the measurement log SML, and sends an encryption result, the second random number and the TPM public key to the server;
after receiving the data, the server judges whether the client is the first client requesting to establish SSH connection, if so, checks whether a trusted certificate exists locally, and if so, directly performs the next step; otherwise, the integrity measurement is requested to the local machine credibility, then the second random number, the configuration register value of the second random number and the measurement log SML are encrypted, and the encryption result and the TPM public key are sent to the client side together;
the server verifies the credibility state of the client according to the data sent by the client, if the client passes the verification, a credibility verification passing certificate is generated, the certificate comprises the client IP, the unique identifier of the client, the IP and the identifier of the local server, the time for generating the certificate and the validity period of the certificate, the TPM public key sent by the client is used for encryption, and the encryption result and the verification passing information are sent to the client together;
after the client receives the data, the client verifies the credible state of the server, if the verification is passed, the client also generates a credible certificate, the content comprises the server IP, the unique identifier of the server, the IP and the identifier of the local client, the time for generating the certificate and the validity period of the certificate, the TPM public key sent by the server is used for encryption, and the encryption result and the verification passing information are sent to the server together;
after receiving the trusted voucher, the server decrypts the trusted voucher by using the TPM private key of the server and stores the trusted voucher in the local area, so that the trusted states of the server and the server pass verification, and otherwise, the server is directly disconnected.
The following will describe in detail the process of establishing an SSH remote connection of the method for implementing an SSH protocol based on post-quantum key exchange in this embodiment, and the method is divided into six steps:
the first step is as follows: and (4) version negotiation.
Before version negotiation, the two parties firstly establish a TCP connection: a TCP request connection is sent by the client to the server.
After the TCP connection is successfully established, the client enters a waiting phase. The server sends a first message to the client, and the message content is an SSH protocol version number and a software version number. The protocol version number comprises a major version number and a minor version number, and the message content is as follows:
"SSH- < major protocol version number > < minor protocol version number > - < software version number > \\ n"
After receiving the message, the client returns a message to the server, the content is the relevant version number of the client, and the format of the content is consistent with that of the message sent by the server.
And after receiving the version number sent by the client, the server compares the version number with the version number of the server to determine whether the version number is compatible. If not, directly disconnecting TCP, if compatible, the server generates a number to identify the client as the host of the SSH connection with the client, and then enters the next stage.
The second step is that: and (5) verifying the credibility.
Trusted verification of both parties to the communication starts from system power-on start up until the last application, and each step in between measures and extends the measure values into a PCR (Platform configuration Register). Meanwhile, the two parties also store the measurement operation, the measurement result and the intermediate states of each step into a storage measurement log SML (storage Measure Log).
The detailed flow of verifying the trusted status of the two communication parties is shown in fig. 4, and is specifically described as follows:
1, a client firstly sends a request for verifying the trusted state of the client to a server;
2, after receiving a request from a client, the server randomly generates a first random number RandNum1 with M bits (M is a natural number and is generally 160), and then sends the first random number and a request for verifying the self-trusted state to the client;
3 after receiving the first random number and the verification request, the client side preferably generates a second random number RandNum2 with M bits randomly and correspondingly, then requests the TPM for integrity measurement, encrypts the first random number RandNum1, the PCR value and the measurement log SML, and finally sends the encryption result, the second random number RandNum2 and the TPM public key to the server;
4, after receiving the data, the server firstly judges whether the client is the first client requesting to establish SSH connection, if so, checks whether a trusted certificate exists locally, and if so, directly performs the next step; otherwise, the integrity measurement is requested to the local TPM, then the random number RandNum2, the PCR value of the random number RandNum2 and the measurement log SML are encrypted, and the encryption result and the TPM public key are sent to the client side;
the server verifies the credibility state of the client according to the data sent by the client, if the client passes the verification, a credibility verification passing certificate is generated, the certificate comprises the client IP, the unique identifier of the client, the IP and the identifier of the local server, the time for generating the certificate and the validity period of the certificate, the information is encrypted by using the TPM public key sent by the client, and the encrypted result and the verification passing information are sent to the client together;
after receiving the data, the client verifies the credibility state of the server, and similarly, if the verification is passed, the client also generates a credibility certificate, the content comprises the server IP, the unique identifier of the server, the IP and the identifier of the local client, the time for generating the certificate and the validity period of the certificate, the TPM public key sent by the server is used for encrypting the information, and the encrypted result and the information passing the verification are sent to the server together;
and 7, after receiving the trusted certificate, the server decrypts the trusted certificate by using the TPM private key of the server and stores the trusted certificate in the local. At this time, the trusted states of both parties pass the verification, and the following steps can be carried out, otherwise, the connection is directly disconnected.
The third step: and (4) negotiating an algorithm.
Due to the flexibility of SSH design, SSH can negotiate a wide variety of algorithms, such as data encryption algorithms, key exchange algorithms, compression algorithms, authentication algorithms, and integrity check algorithms. The client and the server send algorithm lists supported by the client and the server to the opposite terminal, the first algorithm of each algorithm type list is a preferred algorithm, and the server takes the algorithm priority of the client as consideration. If there is no algorithm in common for both parties of a certain algorithm type, the session will terminate.
The key agreement is completed by using the post-quantum authentication key exchange algorithm based on the R-LWE, so that the post-quantum authentication key exchange algorithm based on the R-LWE is set as a preferred algorithm of the key agreement.
The fourth step: and (4) key agreement.
The whole key exchange process is mainly divided into three steps, data is exchanged twice, and the flow can refer to fig. 3.
To facilitate the description of the entire process of key exchange, the following parameters are defined:
n is a safety parameter and must be a power of 2, and the function f (x) xn+1；
q is an odd prime number, with the definition of q 2w(logn)；
Definition of R ═ Z [ x]/< f (x) >, which is Z [ x ]]A ring of all polynomials modulo f (x) above, defining R analogouslyq＝Zq[x]/＜f(x)＞。
Function H1Is defined as shown in formula (1-1):
Figure GDA0003047538210000161
the function H can be seen from the formula (1-1)1Is operative to map a character string to
Figure GDA0003047538210000162
A sampling result χ ofγWhere γ is a positive real number. The function H is defined as H: {0,1}*→{0,1}kThe key generation function is a key generation function, generally a hash function, and different numbers of bits of keys can be obtained by using different hash functions.
The following is a detailed description of the overall process of key exchange:
1, the client firstly generates a public and private key pair of the client: from the first parameterIs alpha Gaussian distribution χαUp-sampling randomly to obtain scAnd ecThen calculate pc＝asc+2ecAfter the calculation is successful, s is calculatedcAnd pcAs their own private and public keys, respectively, i.e. client-side private key scAnd client public key pcAnd both are stored locally. It should be understood here that the present embodiment adopts gaussian distribution to achieve the purpose of resisting quantum computer attack, and the following calculation formulas correspond to gaussian distribution.
2, the server firstly generates a public-private key pair of itself: gaussian distribution χ of α from the same first parameter as the clientαUp-random sampling and calculating to obtain ssAnd esAnd calculate ps＝ass+2esAfter the calculation is successful, s is calculatedsAnd psAs their own private and public keys, respectively, i.e. server private key ssAnd server public key psAnd stores both locally. This phase may be performed simultaneously with the client.
3 after the client successfully generates the own public and private key pair, the second parameter is the Gaussian distribution χ of betaβR is obtained by up-random multiple sampling calculationcAnd fcCalculating client-side temporary session public key x ═ arc+2fcFinally, the calculation results, namely the client temporary session public key x and the client public key pcAre sent to the server together. And the server enters a waiting stage after calculating the public and private key pair of the server.
4 after receiving the data sent by the client, the server firstly sends the client public key p sent by the clientcAnd comparing the identity of the client host with the local database of the client host, and verifying the identity of the client host. If the local database does not have the client public key p corresponding to the clientcIf the connection is the first connection, the public key p of the client is usedcIP, and the client's name are saved to a local database. In general, there is no possibility that the identity is not passed, and the first connection only needs to store the data sent by the other party and then continue the connection.
If the second parameter is beta, and the client identity authentication is passed, the Gaussian distribution x is also obtained when the second parameter is betaβUp-sampling randomly and calculating to obtain rs、fsAnd gsComputing server temporary session public key y ═ ars+2fs。
While computing a server temporary session variable k according to equation (1-2)s：
ks＝(pcc+x)(ssd+rs)+2gs (1-2)
Wherein: client vector c ═ H1(client, server, x), server vector d ═ H1(server, client, y, x), the temporary session variable is a temporary public key generated only for the session, and the temporary public key is automatically deleted after the session is ended, so as to ensure higher security.
Subsequently, the server calculates a temporary session error-free variable w, preferably according to equation (1-3), in order to remove the error.
w＝Cha(ks) (1-3)
Wherein: cha () is a feature correlation function, defined as follows:
let q mod 2n equal to 1,
Figure GDA0003047538210000171
unit matrix
Figure GDA0003047538210000172
Defining a feature correlation function Cha () calculation formula as shown in (1-4):
Figure GDA0003047538210000173
wherein: v is an element of MqI.e. v is MqOf (1).
After the server successfully calculates the data, the calculation result (w, y, p) is calculateds) Sent to the client together. After the data is sent out, the server calculates the initial seed sigma of the server shared key by using the formula (1-5)s。
σs＝Mod2(ks,w) (1-5)
Wherein: mod2() For the modulo-2 function, the following is defined:
let q mod 2n equal to 1,
Figure GDA0003047538210000174
unit matrix
Figure GDA0003047538210000175
The calculation formula for defining the modulo function Mod2 is shown in (1-6):
Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2 (1-6)
wherein v ∈ MqW is equal to {0,1 }. For MqIt can be proved by simple calculation that u ═ v + cha (v) · (q-1)/2 mod q is an element in E.
It should be understood here that the shared key initial seed, although to some extent it may be considered as the finally negotiated shared key, may be calculated by an attacker according to the information exchanged by the two parties for security reasons, and therefore cannot be directly used for the shared key, where a hash function is used for additional processing.
Finally, the server calculates the server shared key by using the data calculated above, and the calculation formula is shown as (1-7):
sks＝H(client,server,x,y,w,σs) (1-7)
wherein: the H () function is typically a hash function, such as a SHA256 hash function.
The server shared key sk at this timesThe shared key is finally calculated by the key agreement algorithm and is used for encrypting data to be transmitted subsequently and ensuring the security of the session.
5 the client receives the data (w, y, p) sent by the servers) Then, firstly, identity authentication is carried out, and the server public key p is usedsData associated with a locally stored server public keyComparing the libraries, if the local database does not have the relevant information of the server, the public key p of the server is comparedsIP, and name are stored in a local database. If the second parameter is present and the identity authentication is passed, the second parameter is a Gaussian distribution χ of betaβUp-random sampling gcCalculating a client temporary session variable k according to the formula (1-8)c：
kc＝(psd+y)(scc+rc)+2gc (1-8)
Similarly, the definition c ═ H1(client,server,x)，d＝H1(server,client,y,x)
Finally, the client calculates the client shared key initial seed sigmacSharing the secret key sk with the clientcThe calculation formulas are respectively shown in formulas (1-9) and (1-10):
σc＝Mod2(kc,w) (1-9)
skc＝H(client,server,x,y,w,σc) (1-10)
skcnamely the client shared key generated in the client key negotiation stage.
After successfully calculating the own shared key, the client and the server send an SSH2_ MSG _ NEWKEYS message to the opposite end to tell the opposite end that the own shared key is generated, and the key agreement phase is ended. The next step can be performed.
The above calculation process will be verified first:
as can be seen from equations (1-7) and (1-10), the client shares the key skcSharing the secret key sk with the serversHas the same calculation function and basically the same function parameter type, only sigmacAnd σsAre different and thus want to prove skcAnd sksEquality, one can translate into a proof of σcAnd σsAre equal. SigmacAnd σsAre respectively shown in formulas (1-11) and (1-12):
σc＝Mod2(kc,w) (1-11)
σs＝Mod2(ks,w) (1-12)
as can be seen from equations (1-11) and (1-12), σcAnd σsAll using the function Mod2(k, v) and the second input parameter w of the function is also the same, in other words, σcAnd σsWhether or not to be equal is determined by a first input parameter kcAnd ksTo decide. Then sigma is judgedcAnd σsWhether they are equal can be converted to a decision kcAnd ksWhether or not they are the same. Client and server computing kcAnd ksAre shown in equations (1-13) and equations (1-14), respectively.
Figure GDA0003047538210000191
Figure GDA0003047538210000192
Wherein:
Figure GDA0003047538210000193
while
Figure GDA0003047538210000194
Combining equations (1-13) and equations (1-14) and
Figure GDA0003047538210000195
and
Figure GDA0003047538210000196
equations (1-15) can be obtained:
Figure GDA0003047538210000197
Figure GDA0003047538210000198
when it is, then k is considerediAnd kjAre equal. Therefore, in practical application, when selecting parameters, it is ensured that k is ensured that the selected parameters can satisfy the conditioncAnd ksAre equal. Thus, the simultaneous equations (1-11) -equation (1-15), σcAnd σsAre equal, so skcAnd sksAre equal.
The security of this key exchange algorithm depends on the difficulty of the R _ LWE search type problem. I.e., in the R-LWE distribution, given aiAnd biSolving can satisfy equation bi＝＜ai,s＞+eiThe vector s is very difficult, even if a quantum computer is used for calculation, the solution can be carried out only in exponential time, and the identity authentication of both communication parties is also completed in the key exchange stage under the condition that other identity authentication algorithms are not required to be supported, man-in-the-middle attack is prevented, and the safety of an SSH transmission layer is improved.
Furthermore, SSH supports multiple encryption algorithms, such as DES, 3DES, AES, etc., which require different numbers of key bits, and not necessarily 256 bits, but for example, if the shared key finally generated in this scheme is 256 fixed bits, it is necessary to continue processing the shared key in order to use the key well. When the required key is less than 256 bits, it is convenient, and only the previously required bits need to be taken out, for example, the encryption algorithm needs a 128-bit key, and then the first 128 bits of data of the shared key are taken out as the encryption key. But when the required key is larger than 256 bits, additional operations are required. The specific calculation method is shown as (1-16) - (1-18):
k1＝SHA256(sk||session_id) (1-16)
k2＝SHA256(sk||k1) (1-17)
k3＝SHA256(sk||k1||k2) (1-18)
when the required key is greater than 256 bits, k is calculated according to equation (1-16)1The encryption key K is sk K1；
If the key required is greater than 512 bits, k is calculated according to equation (1-17)2The encryption key K is sk K1||k2；
If the required key length is calculated according to equations (1-17) or is not sufficient, k is calculated according to equations (1-18)3The encryption key K is sk K1||k2||k3。
And the like until the key is lengthened to the required key length according to the method.
In this way, after the client and the server successfully calculate the shared key, the ID of the session is calculated by using the version numbers of the client and the server and the shared key as the input of the hash value, and the session ID will not change in the whole session. The calculation formula is shown as (1-19):
Hash＝SHA256(C_V||S_V||pc||y||w||ps||x||sk) (1-19)
wherein, C _ V and S _ V are version number character strings of the client and the server respectively, sk is a shared secret key, and | is a connector.
The fifth step: and (4) user authentication.
After successfully negotiating out the shared key, the two parties enter into the authentication phase. Firstly, the client sends a user authentication request to a request server, after receiving the request, the server returns an authentication mode list supported by the server to the client, and simultaneously checks the configuration information of the server on authentication overtime and authentication frequency upper limit. And then the client selects a preferred authentication method from an authentication list supported by the server, sends information required by the authentication method to the server for authentication, and if the authentication is successful, the client and the server enter the next stage. Otherwise, the connection is disconnected.
SSH mainly supports two authentication approaches: a host-based authentication approach and a password-based authentication approach. However, the key agreement part authenticates the identities of the client and the server, so that the user authentication mode at this stage does not suggest the use of a host-based authentication mode any more, and the use of a password-based authentication mode is recommended, because the authentication of the identity of the communication host is completed, the identity of the user can be authenticated, and the security strength of communication is further improved.
And a sixth step: a connection is requested.
After the authentication is successful, the client sends a session request, and the server receives the client request and then processes the client request in time. Session requests include the following categories: requesting a pseudo terminal, opening a shell, executing a command, starting X forwarding, starting TCP/IP port forwarding, applying for compressed data, starting an authentication agent and the like.
In summary, the method for implementing the SSH protocol based on post-quantum key exchange provides a trusted SSH improvement method based on the R-LWE post-quantum authentication key exchange algorithm: when the client and the server use SSH to carry out remote connection, the two parties firstly send information such as own protocol version number, software version number and the like to the opposite end to carry out version negotiation. After the version negotiation is successful, the two parties respectively send a credible certification request to the opposite end and verify the credible state of the other party, and when the credible states of the two parties are verified, the two parties start algorithm negotiation and key negotiation. In the key agreement stage, both parties sample from discrete Gaussian distribution of the same parameter, calculate own public and private key pairs and other necessary intermediate variables, then send own public keys and other data to the opposite end, complete identity authentication and generation of a shared key, and the shared key is generated by a back quantum algorithm, so that quantum attack can be resisted, the security in the key agreement stage is improved, and the shared key is prevented from being cracked by a third party. After the shared key is generated, the two parties encrypt the data to be transmitted by using the key to complete the user authentication and connection request part.
It can be seen that, the method for implementing the SSH protocol based on the post-quantum key exchange improves the SSH scheme by using the post-quantum authentication key exchange algorithm based on R-LWE and the trusted computing technology at the stage of the SSH transmission layer, firstly, the trusted computing technology is used to verify the trusted states of both communication parties before SSH algorithm negotiation, so as to prevent the situation that one party is possibly attacked by hackers and the other party is completely unknown, secondly, the post-quantum authentication key exchange algorithm based on R-LWE is used to complete key negotiation and identity authentication, then, the negotiated shared key is used to encrypt and transmit data, and finally, the remote security service process is completed. Therefore, a post-quantum authentication key exchange algorithm based on R-LWE and a trusted computing technology are integrated into an SSH protocol, an SSH key negotiation stage is simplified, connection establishment speed is increased, a shared key is prevented from being cracked by a quantum computer, and the capability of SSH for resisting quantum computing attack is improved. Meanwhile, the credible state of the host is verified, the SSH session security is improved, and the possibility that one communication party is illegally controlled by the other communication party is greatly reduced.
Example 2:
the embodiment provides a system for realizing an SSH protocol based on post-quantum key exchange, which can effectively prevent a shared key generated by a communication client and a server from being broken by a quantum computer; on the other hand, the trusted status of both the client and the server can be verified.
The system for realizing the SSH protocol based on the post-quantum key exchange comprises a key exchange module, wherein the key exchange module comprises a first key unit, a second key unit, a first verification unit and a second verification unit, and the key exchange module comprises:
the first key unit is positioned at the server and used for completing the following functions:
randomly sampling from the Gaussian distribution of the first parameter, and calculating a public and private key pair of the server;
after the first verification unit passes the identity authentication of the client, calculating a server temporary session public key from random sampling on the Gaussian distribution of the second parameter;
calculating a server temporary session variable and a temporary session error-eliminating variable according to the client temporary session public key, the client vector, the client temporary server vector and the random sampling of the server on the Gaussian distribution of the first parameter and the second parameter;
calculating a server shared key initial seed according to the server temporary session variable and the temporary session error-eliminating variable;
generating a final server shared key of the session by using a post-quantum algorithm according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error-eliminating variable and the initial seed of the server shared key;
the first verification unit is positioned in the server and used for receiving the client public key and the client temporary session public key and verifying the identity of the client, if the verification cannot pass, the server directly disconnects the link, otherwise, the server performs subsequent authentication;
the second key unit is positioned at the client and used for completing the following functions:
randomly sampling from the Gaussian distribution of the first parameter, and calculating a public-private key pair of the client;
randomly sampling from the Gaussian distribution of the second parameter, calculating a client temporary session public key, and sending the client public key and the client temporary session public key to a server;
after the second verification unit passes the identity authentication of the server, calculating a client temporary session variable according to the client temporary session public key, the client vector, the server temporary session public key and the random sampling of the client on the Gaussian distribution of the first parameter and the second parameter, and further calculating a client shared key initial seed according to the client temporary session variable and the temporary session error-eliminating variable;
generating a final server shared key of the session by using a post-quantum algorithm according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error-eliminating variable and the client shared key initial seed;
and the second verification unit is positioned at the client and used for verifying the identity of the server according to the server public key, terminating the key exchange if the verification cannot pass, and otherwise, performing subsequent authentication.
In a first key unit:
server temporary session public key ksComprises the following steps:
ks＝(pcc+x)(ssd+rs)+2gs
wherein:
c＝H1(client, server, x), which is a client vector;
x＝arc+2fca client side temporary session public key;
Figure GDA0003047538210000221
rciand fciGaussian distribution χ of beta from second parameter for clientβQ is a positive integer (e.g., q is 5);
d＝H1(server, client, y, x), which is a server vector;
y＝ars+2fsa server temporary session public key;
Figure GDA0003047538210000222
rsi，fsi，gsifor server from the Gaussian distribution χ with second parameter ββQ is a positive integer (e.g., q is 5);
pc＝asc+2ecis a client public key;
Figure GDA0003047538210000231
sciand eciFrom the first parameter of the client to the alpha Gaussian distribution xαQ is a positive integer (e.g., q is 5), and s is the random sample value of (1)cStill the client private key;
and the temporary session error-elimination variable w is:
w＝Cha(ks)
wherein: cha () is a feature correlation function;
according to (w, y, p)s) Server shared secret key initial seed sigmasComprises the following steps:
σs＝Mod2(ks,w)
wherein: mod2() Modulo-2 function, Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure GDA0003047538210000232
Unit matrix
Figure GDA0003047538210000233
v∈Mq，w∈{0,1}；
Server shared secret sksComprises the following steps:
sks＝H(client,server,x,y,w,σs)。
in the second key unit, the first key unit,
client temporary session variable kcComprises the following steps:
kc＝(psd+y)(scc+rc)+2gc
wherein:
Figure GDA0003047538210000234
gcifor server from the Gaussian distribution χ with second parameter ββQ is a positive integer (e.g., q is 5);
ps＝ass+2esis a server public key;
Figure GDA0003047538210000235
ssiand esiFor the server, from the first parameter of alpha Gaussian distribution xαQ is a positive integer (e.g., q is 5), and s is the random sample value of (1)sStill the server private key;
and, according to (w, y, p)s) Client sharing key initial seed sigmacComprises the following steps:
σc＝Mod2(kc,w)
wherein: mod2() Modulo-2 function, Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure GDA0003047538210000241
Unit matrix
Figure GDA0003047538210000242
v∈Mq，w∈{0,1}；
Client shared secret skcComprises the following steps:
skc＝H(client,server,x,y,w,σc)。
preferably, the system for implementing the SSH protocol based on post-quantum key exchange further includes a verification Trusted Module to verify Trusted statuses of both communication parties, and since the verification Trusted Module is added, it is required that each communication host has a built-in TPM (Trusted Platform Module) chip. The verification trusted module comprises a first trusted unit located at the server and a second trusted unit located at the client, and is used for completing the following functions:
the second trusted unit sends a request for verifying the trusted status of the client to the first trusted unit;
after receiving a request of a client, a first trusted unit randomly generates an M-bit first random number, and sends the first random number and a request for verifying the trusted state of the first trusted unit to a second trusted unit, wherein M is a natural number;
after receiving the first random number and the verification request, the second trusted unit correspondingly generates an M-bit second random number, then requests the TPM for integrity measurement, encrypts the first random number, the configuration register value and the measurement log SML, and sends an encryption result, the second random number and the TPM public key to the first trusted unit;
after receiving the data, the first trusted unit judges whether the client is the first client requesting to establish SSH connection, if so, checks whether a trusted certificate exists locally, and if so, directly performs the next step; otherwise, the integrity measurement is requested to the local trusted unit, then the second random number, the configuration register value of the second random number and the measurement log SML are encrypted, and the encryption result and the TPM public key are sent to the second trusted unit;
the first trusted unit verifies the trusted state of the client according to the data sent by the second trusted unit, if the data passes the verification, a trusted verification passing certificate is generated, the certificate comprises a client IP, a client unique identifier, an IP and an identifier of a local server, the time for generating the certificate and the certificate validity period, and is encrypted by using a TPM public key sent by the client, and the encrypted result and verification passing information are sent to the client together;
after the client receives the data, the trusted state of the server is verified, if the data passes the verification, the second trusted unit also generates a trusted certificate, the content comprises a server IP, a unique identifier of the server, an IP and an identifier of the local client, the time for generating the certificate and the validity period of the certificate, the TPM public key sent by the server is used for encryption, and the encryption result and the verification passing information are sent to the first trusted unit;
after receiving the trusted credential, the first trusted unit decrypts the trusted credential by using the TPM private key of the first trusted unit and stores the trusted credential locally, so that the trusted states of the first trusted unit and the trusted unit pass verification, and otherwise, the first trusted unit is directly disconnected.
In the trusted SSH protocol improvement method based on the post-quantum key exchange algorithm, when a user uses the improved SSH protocol to remotely log in a server, the SSH firstly verifies whether hosts of two communication parties are trusted, and then completes a key negotiation stage and a two-party identity authentication stage between a client and the remote server by using the post-quantum key exchange algorithm. The method has the advantages of strong user transparency, high speed, simple and easily understood algorithm, capability of providing credible certification and post-quantum computer functions on the premise of not reducing the original SSH remote login security, and further enhancement of the SSH security.
It will be understood that the above embodiments are merely exemplary embodiments taken to illustrate the principles of the present invention, which is not limited thereto. It will be apparent to those skilled in the art that various modifications and improvements can be made without departing from the spirit and substance of the invention, and these modifications and improvements are also considered to be within the scope of the invention.

Claims (10)

1.一种基于后量子密钥交换实现SSH协议的方法，包括密钥交换步骤，其特征在于，密钥交换步骤包括：1. a method for realizing SSH protocol based on post-quantum key exchange, comprising key exchange step, is characterized in that, key exchange step comprises: 客户端和服务器从第一参数的高斯分布上随机采样，分别计算客户端的公私密钥对和服务器的公私密钥对；The client and the server randomly sample from the Gaussian distribution of the first parameter, and calculate the client's public-private key pair and the server's public-private key pair respectively; 客户端从第二参数的高斯分布上随机采样，计算客户端临时会话公钥，并将客户端公钥和客户端临时会话公钥发送至服务器；The client randomly samples from the Gaussian distribution of the second parameter, calculates the client's temporary session public key, and sends the client's public key and the client's temporary session public key to the server; 服务器接收客户端公钥和客户端临时会话公钥，对客户端进行身份验证，如果验证不能通过，服务器将直接断开链接，否则进行下一步；The server receives the client's public key and the client's temporary session public key, and authenticates the client. If the verification fails, the server will directly disconnect the link, otherwise, proceed to the next step; 从第二参数的高斯分布上的随机采样，计算服务器临时会话公钥；Calculate the server temporary session public key from random sampling on the Gaussian distribution of the second parameter; 服务器根据客户端临时会话公钥、客户端向量、服务器临时会话公钥、服务器向量、以及服务器在第一参数和第二参数的高斯分布上的随机采样，计算服务器临时会话变量以及临时会话消错变量，进而根据服务器临时会话变量以及临时会话消错变量计算服务器共享密钥初始种子；The server calculates the server temporary session variable and the temporary session error correction according to the client temporary session public key, the client vector, the server temporary session public key, the server vector, and the random sampling of the server on the Gaussian distribution of the first parameter and the second parameter variable, and then calculate the initial seed of the server shared key according to the server temporary session variable and the temporary session error cancellation variable; 服务器根据客户端向量、服务器向量、客户端临时会话公钥、服务器临时会话公钥、临时会话消错变量和服务器共享密钥初始种子，利用后量子算法生成此次会话的最终服务器共享密钥；The server uses the post-quantum algorithm to generate the final server shared key of the session according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error correction variable and the initial seed of the server shared key; 客户端根据服务器公钥对服务器进行身份验证；The client authenticates the server according to the server public key; 客户端通过服务器的身份认证，根据客户端临时会话公钥、客户端向量、服务器向量、服务器临时会话公钥、以及客户端在第一参数和第二参数的高斯分布上的随机采样，计算客户端临时会话变量，进而根据客户端临时会话变量以及临时会话消错变量计算客户端共享密钥初始种子；The client passes the identity authentication of the server, and calculates the client according to the client's temporary session public key, the client vector, the server vector, the server's temporary session public key, and the client's random sampling on the Gaussian distribution of the first parameter and the second parameter. terminal temporary session variable, and then calculate the initial seed of the client shared key according to the client temporary session variable and the temporary session error elimination variable; 客户端根据客户端向量、服务器向量、客户端临时会话公钥、服务器临时会话公钥、临时会话消错变量和客户端共享密钥初始种子，利用后量子算法生成此次会话的最终客户端共享密钥；Based on the client vector, server vector, client temporary session public key, server temporary session public key, temporary session error correction variable and client shared key initial seed, the client uses the post-quantum algorithm to generate the final client share of the session. key; 服务器或客户端任一身份验证不能通过，则密钥交换终止；If either server or client authentication fails, the key exchange is terminated; 在密钥交换步骤之前，所述方法还包括：验证通信双方的可信状态，所述验证通信双方的可信状态包括：预定步骤和可信状态验证步骤，所述预定步骤包括：Before the key exchange step, the method further includes: verifying the trusted status of the two communication parties, the verifying the trusted status of the two communication parties includes: a predetermined step and a trusted status verification step, and the predetermined step includes: 发送验证客户端可信状态的请求到服务器；Send a request to verify the client's trusted status to the server; 服务器收到客户端的请求后，随机生成一个M位的第一随机数，将第一随机数与验证自身可信状态的请求到客户端，其中M为自然数；After receiving the request from the client, the server randomly generates a first random number of M bits, and sends the first random number and the request for verifying its own trust status to the client, where M is a natural number; 客户端收到第一随机数与验证请求后，对应生成一个M位的第二随机数，然后向可信请求完整性度量，并将第一随机数和配置寄存器值、度量日志SML加密，将加密结果、第二随机数以及TPM公钥一起发送到服务器。After receiving the first random number and the verification request, the client generates a second random number of M bits, and then requests the trusted integrity measurement, encrypts the first random number, the configuration register value, and the measurement log SML. The encryption result, the second random number, and the TPM public key are sent to the server together. 2.根据权利要求1所述的基于后量子密钥交换实现SSH协议的方法，其特征在于，服务器临时会话公钥ks为：2. the method for realizing SSH protocol based on post-quantum key exchange according to claim 1, is characterized in that, server temporary session public key k s is: ks＝(pcc+x)(ssd+rs)+2gs k s =(p c c+x)(s s d+r s )+2g s 其中：in: c＝H1(client,server,x)，为客户端向量；c=H 1 (client, server, x), is the client vector; x＝arc+2fc，为客户端临时会话公钥；x=ar c +2f c , which is the client's temporary session public key;
Figure FDA0003047538200000021
Figure FDA0003047538200000021
 rci和fci为客户端从第二参数为β的高斯分布χβ上的随机采样值，q为正整数；r ci and f ci are the random sampling values of the client from the Gaussian distribution χ β whose second parameter is β, and q is a positive integer; d＝H1(server,client,y,x)，为服务器向量；d=H 1 (server, client, y, x), is the server vector; y＝ars+2fs，为服务器临时会话公钥；y=ar s +2f s , is the temporary session public key of the server;
Figure FDA0003047538200000022
Figure FDA0003047538200000022
 rsi，fsi，gsi为服务器从第二参数为β的高斯分布χβ上的随机采样值，q为正整数；r si , f si , and g si are random sampling values of the server from a Gaussian distribution χ β whose second parameter is β, and q is a positive integer; pc＝asc+2ec，为客户端公钥；p c =as c +2e c , is the client public key;
Figure FDA0003047538200000023
Figure FDA0003047538200000023
 sci和eci为客户端从第一参数为α高斯分布χα上的随机采样值，q为正整数，sc仍为客户端私钥；s ci and e ci are the random sampling values of the client from the α Gaussian distribution χ α as the first parameter, q is a positive integer, and s c is still the client private key; 以及，临时会话消错变量w为：And, the temporary session debug variable w is: w＝Cha(ks)w=Cha(k s ) 其中：Cha()为特征关联函数。Among them: Cha() is the feature association function. 3.根据权利要求2所述的基于后量子密钥交换实现SSH协议的方法，其特征在于，根据(w,y,ps)，服务器共享密钥初始种子σs为：3. the method for realizing SSH protocol based on post-quantum key exchange according to claim 2, is characterized in that, according to (w, y, p s ), server shared key initial seed σ s is: σs＝Mod2(ks,w)σ s =Mod 2 (k s ,w) 其中：Mod2()为模2函数，Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure FDA0003047538200000031
单位矩阵
Figure FDA0003047538200000032
v∈Mq，w∈{0,1}；Wherein: Mod 2 () is a modulo 2 function, Mod 2 (v,w)=(v+w·(q-1)/2)mod q mod 2, q mod 2n=1,
Figure FDA0003047538200000031
identity matrix
Figure FDA0003047538200000032
v∈M q , w∈{0,1}; 服务器共享密钥sks为：The server shared secret sk s is: sks＝H(client,server,x,y,w,σs)。sk s =H(client, server, x, y, w, σ s ). 4.根据权利要求2所述的基于后量子密钥交换实现SSH协议的方法，其特征在于，客户端临时会话变量kc为：4. the method for realizing SSH protocol based on post-quantum key exchange according to claim 2, is characterized in that, client temporary session variable k c is: kc＝(psd+y)(scc+rc)+2gc k c =(p s d+y)(s c c+r c )+2g c 其中：in:
Figure FDA0003047538200000033
Figure FDA0003047538200000033
 gci为服务器从第二参数为β的高斯分布χβ上的随机采样值，q为正整数；g ci is the random sampling value of the server from the Gaussian distribution χ β whose second parameter is β, and q is a positive integer; ps＝ass+2es，为服务器公钥；p s =as s + 2es , is the server public key;
Figure FDA0003047538200000034
Figure FDA0003047538200000034
 ssi和esi为服务器从第一参数为α高斯分布χα上的随机采样值，q为正整数，ss仍为服务器私钥。s si and es si are random sampling values of the server from a Gaussian distribution χ α whose first parameter is α, q is a positive integer, and s s is still the private key of the server. 5.根据权利要求4所述的基于后量子密钥交换实现SSH协议的方法，其特征在于，根据(w,y,ps)，客户端共享密钥初始种子σc为：5. the method for realizing SSH protocol based on post-quantum key exchange according to claim 4, is characterized in that, according to (w, y, p s ), client shared key initial seed σ c is: σc＝Mod2(kc,w)σ c =Mod 2 (k c ,w) 其中：Mod2()为模2函数，Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure FDA0003047538200000035
单位矩阵
Figure FDA0003047538200000036
v∈Mq，w∈{0,1}；Wherein: Mod 2 () is a modulo 2 function, Mod 2 (v,w)=(v+w·(q-1)/2)mod q mod 2, q mod 2n=1,
Figure FDA0003047538200000035
identity matrix
Figure FDA0003047538200000036
v∈M q , w∈{0,1}; 客户端共享密钥skc为：The client shared secret sk c is: skc＝H(client,server,x,y,w,σc)。sk c =H(client, server, x, y, w, σ c ). 6.根据权利要求1-5任一项所述的基于后量子密钥交换实现SSH协议的方法，其特征在于，所述可信状态验证步骤包括：6. The method for realizing SSH protocol based on post-quantum key exchange according to any one of claims 1-5, wherein the trusted state verification step comprises: 服务器收到数据后，判断此客户端是否是请求建立SSH连接的第一个客户端，如果是，检查本地是否存在可信凭证，如果本地存在可信凭证且该可信凭证仍然在有效期内，则直接进行下一步；否则，则需要先向本机可信请求完整性度量，然后将第二随机数和自己的配置寄存器值、度量日志SML加密，将加密结果和TPM公钥一起发送到客户端；After the server receives the data, it determines whether the client is the first client that requests to establish an SSH connection. If so, it checks whether there is a trusted certificate locally. If there is a trusted certificate locally and the trusted certificate is still within the validity period, Then proceed directly to the next step; otherwise, you need to first request the integrity measurement from the local trusted machine, and then encrypt the second random number with its own configuration register value and measurement log SML, and send the encryption result together with the TPM public key to the client. end; 服务器根据客户端发送的数据验证客户端的可信状态，如果验证通过，生成可信验证通过凭证，该凭证包含客户端IP、客户端唯一标识符、本机服务器的IP与标识符、生成该凭证的时间、凭证有效期，并使用客户端发送的TPM公钥进行加密，将加密结果与验证通过信息一起发送到客户端；The server verifies the trusted status of the client according to the data sent by the client. If the verification passes, it generates a credential that passes the credential verification, which includes the client IP, the unique identifier of the client, the IP and identifier of the local server, and the generated certificate The time and validity period of the certificate are encrypted, and the TPM public key sent by the client is used for encryption, and the encryption result is sent to the client together with the verification information; 客户端收到数据后，验证服务器的可信状态，如果验证通过后，客户端同样生成一个可信凭证，内容包括服务器IP、服务器唯一标识符、本机客户端的IP与标识符、生成该凭证的时间、凭证有效期，并使用服务器发送的TPM公钥进行加密，将加密结果与验证通过信息一起发送到服务器；After the client receives the data, it verifies the trusted status of the server. If the verification is passed, the client also generates a trusted certificate, which includes the server IP, the server unique identifier, the IP and identifier of the local client, and the generated certificate. The time and validity period of the certificate are encrypted, and the TPM public key sent by the server is used for encryption, and the encryption result is sent to the server together with the verification information; 服务器收到可信凭据后，使用自己的TPM私钥解密该可信凭据，并将其保存在本地，如此则双方的可信状态均以验证通过，否则直接断开连接。After the server receives the trusted credential, it decrypts the trusted credential with its own TPM private key and saves it locally. In this way, the trusted status of both parties is verified, otherwise the connection is directly disconnected. 7.一种基于后量子密钥交换实现SSH协议的系统，包括密钥交换模块和验证可信模块，其特征在于，所述密钥交换模块包括第一密钥单元、第二密钥单元和第一验证单元、第二验证单元，其中：7. a system based on post-quantum key exchange to realize SSH protocol, comprising key exchange module and verification trusted module, it is characterized in that, described key exchange module comprises the first key unit, the second key unit and The first verification unit, the second verification unit, wherein: 所述第一密钥单元，位于服务器，用于完成下述功能：The first key unit, located in the server, is used to complete the following functions: 从第一参数的高斯分布上随机采样，计算服务器的公私密钥对；Randomly sample from the Gaussian distribution of the first parameter, and calculate the public-private key pair of the server; 在所述第一验证单元通过客户端的身份认证后，从第二参数的高斯分布上的随机采样，计算服务器临时会话公钥；After the first verification unit passes the identity authentication of the client, calculate the server temporary session public key from random sampling on the Gaussian distribution of the second parameter; 根据客户端临时会话公钥、客户端向量、客户端临时服务器向量、以及服务器在第一参数和第二参数的高斯分布上的随机采样，计算服务器临时会话变量以及临时会话消错变量；According to the client temporary session public key, the client vector, the client temporary server vector, and the random sampling of the server on the Gaussian distribution of the first parameter and the second parameter, calculate the server temporary session variable and the temporary session error elimination variable; 以及，根据服务器临时会话变量以及临时会话消错变量计算服务器共享密钥初始种子；And, calculating the initial seed of the shared key of the server according to the temporary session variable of the server and the temporary session error cancellation variable; 根据客户端向量、服务器向量、客户端临时会话公钥、服务器临时会话公钥、临时会话消错变量和服务器共享密钥初始种子，利用后量子算法生成此次会话的最终服务器共享密钥；According to the client vector, server vector, client temporary session public key, server temporary session public key, temporary session error correction variable and server shared key initial seed, use post-quantum algorithm to generate the final server shared key of this session; 所述第一验证单元，位于服务器，用于接收客户端公钥和客户端临时会话公钥，对客户端进行身份验证，如果验证不能通过，服务器将直接断开链接，否则进行后续认证；The first verification unit, located at the server, is used for receiving the client public key and the client temporary session public key, and performing identity verification on the client, if the verification fails, the server will directly disconnect the link, otherwise, perform subsequent verification; 所述第二密钥单元，位于客户端，用于完成下述功能：The second key unit, located at the client, is used to complete the following functions: 从第一参数的高斯分布上随机采样，计算客户端的公私密钥对；Randomly sample from the Gaussian distribution of the first parameter, and calculate the client's public-private key pair; 从第二参数的高斯分布上随机采样，计算客户端临时会话公钥，并将客户端公钥和客户端临时会话公钥发送至服务器；Randomly sample from the Gaussian distribution of the second parameter, calculate the client's temporary session public key, and send the client's public key and the client's temporary session public key to the server; 在所述第二验证单元通过服务器的身份认证后，根据客户端临时会话公钥、客户端向量、服务器向量、服务器临时会话公钥、以及客户端在第一参数和第二参数的高斯分布上的随机采样，计算客户端临时会话变量，进而根据客户端临时会话变量以及临时会话消错变量计算客户端共享密钥初始种子；After the second verification unit passes the identity authentication of the server, according to the client's temporary session public key, the client vector, the server vector, the server's temporary session public key, and the client's Gaussian distribution on the first parameter and the second parameter Random sampling, calculate the client temporary session variable, and then calculate the client shared key initial seed according to the client temporary session variable and the temporary session error cancellation variable; 以及，根据客户端向量、服务器向量、客户端临时会话公钥、服务器临时会话公钥、临时会话消错变量和客户端共享密钥初始种子，利用后量子算法生成此次会话的最终服务器共享密钥；And, according to the client vector, the server vector, the client temporary session public key, the server temporary session public key, the temporary session error correction variable and the client shared key initial seed, the post-quantum algorithm is used to generate the final server shared secret of this session. key; 所述第二验证单元，位于客户端，用于根据服务器公钥对服务器进行身份验证，如果验证不能通过，终止密钥交换，否则进行后续认证；The second verification unit, located on the client side, is used to perform identity verification on the server according to the server public key, if the verification fails, terminate the key exchange, otherwise perform subsequent verification; 所述验证可信模块用于验证通信双方的可信状态，且，所述验证可信模块包括：位于服务器的第一可信单元和位于客户端的第二可信单元，用于完成下述功能：The verification trustworthy module is used to verify the trustworthy state of both parties in the communication, and the verification trustworthy module includes: a first trustworthy unit located at the server and a second trusted unit located at the client, for completing the following functions : 所述第二可信单元发送验证客户端可信状态的请求到所述第一可信单元；所述第一可信单元收到客户端的请求后，随机生成一个M位的第一随机数，将第一随机数与验证自身可信状态的请求到所述第二可信单元，其中M为自然数；The second trusted unit sends a request for verifying the trusted state of the client to the first trusted unit; after receiving the request from the client, the first trusted unit randomly generates a first random number of M bits, Send the first random number and the request for verifying its own trusted state to the second trusted unit, where M is a natural number; 所述第二可信单元收到第一随机数与验证请求后，对应生成一个M位的第二随机数，然后向TPM请求完整性度量，并将第一随机数和配置寄存器值、度量日志SML加密，将加密结果、第二随机数以及TPM公钥一起发送到所述第一可信单元。After receiving the first random number and the verification request, the second trusted unit correspondingly generates a second random number of M bits, and then requests the TPM for an integrity measurement, and combines the first random number with the configuration register value and the measurement log. SML encryption, the encryption result, the second random number and the TPM public key are sent to the first trusted unit together. 8.根据权利要求7所述的基于后量子密钥交换实现SSH协议的系统，其特征在于，在所述第一密钥单元中：8. The system for realizing SSH protocol based on post-quantum key exchange according to claim 7, characterized in that, in the first key unit: 服务器临时会话公钥ks为：The server temporary session public key k s is: ks＝(pcc+x)(ssd+rs)+2gs k s =(p c c+x)(s s d+r s )+2g s 其中：in: c＝H1(client,server,x)，为客户端向量；c=H 1 (client, server, x), is the client vector; x＝arc+2fc，为客户端临时会话公钥；x=ar c +2f c , which is the client's temporary session public key;
Figure FDA0003047538200000051
Figure FDA0003047538200000051
 rci和fci为客户端从第二参数为β的高斯分布χβ上的随机采样值，q为正整数；r ci and f ci are the random sampling values of the client from the Gaussian distribution χ β whose second parameter is β, and q is a positive integer; d＝H1(server,client,y,x)，为服务器向量；d=H 1 (server, client, y, x), is the server vector; y＝ars+2fs，为服务器临时会话公钥；y=ar s +2f s , is the temporary session public key of the server;
Figure FDA0003047538200000061
Figure FDA0003047538200000061
 rsi，fsi，gsi为服务器从第二参数为β的高斯分布χβ上的随机采样值，q为正整数；r si , f si , and g si are random sampling values of the server from a Gaussian distribution χ β whose second parameter is β, and q is a positive integer; pc＝asc+2ec，为客户端公钥；p c =as c +2e c , is the client public key;
Figure FDA0003047538200000062
Figure FDA0003047538200000062
 sci和eci为客户端从第一参数为α高斯分布χα上的随机采样值，q为正整数，sc仍为客户端私钥；s ci and e ci are the random sampling values of the client from the α Gaussian distribution χ α as the first parameter, q is a positive integer, and s c is still the client private key; 以及，临时会话消错变量w为：And, the temporary session debug variable w is: w＝Cha(ks)w=Cha(k s ) 其中：Cha()为特征关联函数；Among them: Cha() is the feature association function; 根据(w,y,ps)，服务器共享密钥初始种子σs为：According to (w, y, p s ), the initial seed σ s of the server shared key is: σs＝Mod2(ks,w)σ s =Mod 2 (k s ,w) 其中：Mod2()为模2函数，Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure FDA0003047538200000063
单位矩阵
Figure FDA0003047538200000064
v∈Mq，w∈{0,1}；Wherein: Mod 2 () is a modulo 2 function, Mod 2 (v,w)=(v+w·(q-1)/2)mod q mod 2, q mod 2n=1,
Figure FDA0003047538200000063
identity matrix
Figure FDA0003047538200000064
v∈M q , w∈{0,1}; 服务器共享密钥sks为：The server shared secret sk s is: sks＝H(client,server,x,y,w,σs)。sk s =H(client, server, x, y, w, σ s ). 9.根据权利要求8所述的基于后量子密钥交换实现SSH协议的系统，其特征在于，在所述第二密钥单元中，9. The system for realizing SSH protocol based on post-quantum key exchange according to claim 8, wherein, in the second key unit, 客户端临时会话变量kc为：The client temporary session variable k c is: kc＝(psd+y)(scc+rc)+2gc k c =(p s d+y)(s c c+r c )+2g c 其中：in:
Figure FDA0003047538200000065
Figure FDA0003047538200000065
 gci为服务器从第二参数为β的高斯分布χβ上的随机采样值，q为正整数；g ci is the random sampling value of the server from the Gaussian distribution χ β whose second parameter is β, and q is a positive integer; ps＝ass+2es，为服务器公钥；p s =as s + 2es , is the server public key;
Figure FDA0003047538200000071
Figure FDA0003047538200000071
 ssi和esi为服务器从第一参数为α高斯分布χα上的随机采样值，q为正整数，ss仍为服务器私钥；s si and es si are the random sampling values of the server from the α Gaussian distribution χ α as the first parameter, q is a positive integer, and s s is still the private key of the server; 以及，根据(w,y,ps)，客户端共享密钥初始种子σc为：And, according to (w, y, p s ), the initial seed σ c of the client shared secret key is: σc＝Mod2(kc,w)σ c =Mod 2 (k c ,w) 其中：Mod2()为模2函数，Mod2(v,w)＝(v+w·(q-1)/2)mod q mod 2，q mod 2n＝1，
Figure FDA0003047538200000072
单位矩阵
Figure FDA0003047538200000073
v∈Mq，w∈{0,1}；Wherein: Mod 2 () is a modulo 2 function, Mod 2 (v,w)=(v+w·(q-1)/2)mod q mod 2, q mod 2n=1,
Figure FDA0003047538200000072
identity matrix
Figure FDA0003047538200000073
v∈M q , w∈{0,1}; 客户端共享密钥skc为：The client shared secret sk c is: skc＝H(client,server,x,y,w,σc)。sk c =H(client, server, x, y, w, σ c ). 10.根据权利要求7-9任一项所述的基于后量子密钥交换实现SSH协议的系统，其特征在于，所述第一可信单元和所述第二可信单元，还用于完成下述功能：10. The system for implementing SSH protocol based on post-quantum key exchange according to any one of claims 7-9, wherein the first trusted unit and the second trusted unit are also used to complete The following functions: 所述第一可信单元收到数据后，判断此客户端是否是请求建立SSH连接的第一个客户端，如果是，检查本地是否存在可信凭证，如果本地存在可信凭证且该可信凭证仍然在有效期内，则直接进行下一步；否则，则需要先向本机可信请求完整性度量，然后将第二随机数和自己的配置寄存器值、度量日志SML加密，将加密结果和TPM公钥一起发送到所述第二可信单元；After the first trusted unit receives the data, it determines whether the client is the first client that requests the establishment of an SSH connection, and if so, checks whether there is a trusted credential locally, and if there is a trusted credential locally and the trusted credential exists. If the credential is still within the validity period, proceed directly to the next step; otherwise, you need to request the integrity measurement from the local trusted machine, and then encrypt the second random number, its own configuration register value, and measurement log SML, and encrypt the encryption result with TPM. send the public key together to the second trusted unit; 所述第一可信单元根据所述第二可信单元发送的数据验证客户端的可信状态，如果验证通过，生成可信验证通过凭证，该凭证包含客户端IP、客户端唯一标识符、本机服务器的IP与标识符、生成该凭证的时间、凭证有效期，并使用客户端发送的TPM公钥进行加密，将加密结果与验证通过信息一起发送到客户端；The first trusted unit verifies the trusted status of the client according to the data sent by the second trusted unit, and if the verification passes, generates a trusted verification pass certificate, the certificate includes the client IP, the unique identifier of the client, this certificate. The IP and identifier of the computer server, the time when the certificate was generated, and the validity period of the certificate, and encrypted with the TPM public key sent by the client, and the encryption result and the verification pass information are sent to the client; 客户端收到数据后，验证服务器的可信状态，如果验证通过后，所述第二可信单元同样生成一个可信凭证，内容包括服务器IP、服务器唯一标识符、本机客户端的IP与标识符、生成该凭证的时间、凭证有效期，并使用服务器发送的TPM公钥进行加密，将加密结果与验证通过信息一起发送到所述第一可信单元；After the client receives the data, it verifies the trusted status of the server. If the verification is passed, the second trusted unit also generates a trusted credential, the content including the server IP, the server unique identifier, the IP and identification of the local client character, the time when the certificate was generated, and the validity period of the certificate, and encrypted using the TPM public key sent by the server, and the encryption result and the verification pass information are sent to the first trusted unit; 所述第一可信单元收到可信凭据后，使用自己的TPM私钥解密该可信凭据，并将其保存在本地，如此则双方的可信状态均以验证通过，否则直接断开连接。After receiving the trusted credential, the first trusted unit decrypts the trusted credential with its own TPM private key, and saves it locally, so that the trusted status of both parties passes the verification, otherwise the connection is directly disconnected .
CN201711326036.9A 2017-12-13 2017-12-13 Method and system for implementing SSH protocol based on post-quantum key exchange Active CN108111301B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201711326036.9A CN108111301B (en) 2017-12-13 2017-12-13 Method and system for implementing SSH protocol based on post-quantum key exchange

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201711326036.9A CN108111301B (en) 2017-12-13 2017-12-13 Method and system for implementing SSH protocol based on post-quantum key exchange

Publications (2)

Publication Number Publication Date
CN108111301A CN108111301A (en) 2018-06-01
CN108111301B true CN108111301B (en) 2021-06-15

Family

ID=62216657

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201711326036.9A Active CN108111301B (en) 2017-12-13 2017-12-13 Method and system for implementing SSH protocol based on post-quantum key exchange

Country Status (1)

Country Link
CN (1) CN108111301B (en)

Families Citing this family (38)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108964890B (en) * 2018-06-15 2021-06-04 南京南瑞国盾量子技术有限公司 Authenticable multi-party quantum key distribution method based on tree type hierarchical structure
CN109101811B (en) * 2018-08-10 2021-10-15 成都安恒信息技术有限公司 Operation, maintenance and audit method of controllable Oracle session based on SSH tunnel
CN109617686A (en) * 2019-01-10 2019-04-12 江苏理工学院 An Improved Lattice-Based Key Exchange Protocol Algorithm
CN109756500B (en) * 2019-01-11 2021-02-02 如般量子科技有限公司 Anti-quantum computation HTTPS communication method and system based on multiple asymmetric key pools
CN110176991B (en) * 2019-05-15 2023-09-05 如般量子科技有限公司 Anti-quantum computing application system near field energy-saving communication method and system based on signcryption, and computer equipment
US11343270B1 (en) 2019-09-10 2022-05-24 Wells Fargo Bank, N.A. Systems and methods for post-quantum cryptography optimization
US11626983B1 (en) 2019-09-10 2023-04-11 Wells Fargo Bank, N.A. Systems and methods for post-quantum cryptography optimization
US11240014B1 (en) 2019-09-10 2022-02-01 Wells Fargo Bank, N.A. Systems and methods for post-quantum cryptography optimization
US11477016B1 (en) 2019-09-10 2022-10-18 Wells Fargo Bank, N.A. Systems and methods for post-quantum cryptography optimization
CN110808829B (en) * 2019-09-27 2023-04-18 国电南瑞科技股份有限公司 SSH authentication method based on key distribution center
CN113141327B (en) * 2020-01-02 2023-05-09 中国移动通信有限公司研究院 An information processing method, device and equipment
CN111464289B (en) 2020-01-13 2021-07-27 华中科技大学 A method, device and system for realizing a post-quantum key exchange protocol
US11449799B1 (en) 2020-01-30 2022-09-20 Wells Fargo Bank, N.A. Systems and methods for post-quantum cryptography optimization
US11838410B1 (en) 2020-01-30 2023-12-05 Wells Fargo Bank, N.A. Systems and methods for post-quantum cryptography optimization
US11533175B1 (en) 2020-01-30 2022-12-20 Wells Fargo Bank, N.A. Systems and methods for post-quantum cryptography on a smartcard
US11322050B1 (en) 2020-01-30 2022-05-03 Wells Fargo Bank, N.A. Systems and methods for post-quantum cryptography optimization
CN111800467B (en) * 2020-06-04 2023-02-14 河南信大网御科技有限公司 Remote synchronous communication method, data interaction method, equipment and readable storage medium
CN111970270B (en) * 2020-08-14 2022-08-02 山东省计算中心（国家超级计算济南中心） SIP security authentication method and system based on-loop error learning problem
US11258617B1 (en) * 2020-12-04 2022-02-22 Salesforce.Com, Inc. Device identity using key agreement
CN114765531B (en) * 2020-12-30 2024-08-09 科大国盾量子技术股份有限公司 Authentication method, quantum key calling method, device and quantum password network
CN113094721B (en) * 2021-03-16 2022-06-24 中国科学院信息工程研究所 A Post-Quantum Password Authentication Key Exchange Method Based on Modulo Error Learning
US12267421B2 (en) 2021-10-18 2025-04-01 International Business Machines Corporation Post quantum secure ingress/egress network communication
CN114143031B (en) * 2021-11-01 2023-07-07 北京银盾泰安网络科技有限公司 Remote encryption platform based on Web and SSH
CN114124496B (en) * 2021-11-12 2023-11-24 福建汇思博数字科技有限公司 SSH remote login method based on server issued key and server
CN114095229B (en) * 2021-11-15 2024-09-17 中国电力科学研究院有限公司 Energy Internet data transmission protocol construction method, device and system
CN114024676B (en) * 2022-01-05 2022-03-22 华中科技大学 Identity-based post-quantum encryption and decryption method, system, device and medium
DE102022203725A1 (en) * 2022-04-13 2023-10-19 Robert Bosch Gesellschaft mit beschränkter Haftung Method for exchanging cryptographic keys between communication participants
CN114629646A (en) * 2022-05-06 2022-06-14 确信信息股份有限公司 Safe transmission method and system based on mixed quantum key encapsulation and negotiation
CN115549941A (en) * 2022-07-12 2022-12-30 成都量安区块链科技有限公司 A quantum security encryption application system, method and access device
US12200116B1 (en) 2022-11-18 2025-01-14 Wells Fargo Bank, N.A. Systems and methods for measuring one or more metrics of a cryptographic algorithm in a post-quantum cryptography system
CN115713339B (en) * 2023-01-09 2023-05-12 量子科技长三角产业创新中心 Data quantum computing management and control method, device, equipment and computer medium
CN118364496B (en) * 2024-06-19 2024-11-26 山东云海国创云计算装备产业创新中心有限公司 Encrypted file writing method and system, storage medium and electronic device
CN119089460B (en) * 2024-08-06 2025-04-08 未来基因(北京)人工智能研究院有限公司 Data transmission protection method and computer device
CN118659881B (en) * 2024-08-15 2024-12-20 中电信量子信息科技集团有限公司 Quantum-resistant security enhancement method for secure shell protocol
CN118764315B (en) * 2024-09-03 2024-12-31 北京格尔国信科技有限公司 SSH login authentication method based on cryptographic algorithm, communication system and storage medium
CN119766428B (en) * 2024-12-18 2025-09-19 北京海泰方圆科技股份有限公司 Key generation and decryption methods, devices, systems, and equipment resistant to quantum attacks
CN119766433A (en) * 2024-12-24 2025-04-04 本源量子计算科技（合肥）股份有限公司 Encryption communication method, device and system supporting post quantum algorithm
CN120128339B (en) * 2025-05-09 2025-10-28 三未信安科技股份有限公司 SSH communication method, equipment and medium based on quantum key

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101741842A (en) * 2009-12-07 2010-06-16 北京交通大学 A Method of Realizing Trusted SSH Based on Trusted Computing
CN101789939A (en) * 2010-01-25 2010-07-28 北京交通大学 Effective realization method for credible OpenSSH

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9516000B2 (en) * 2015-03-27 2016-12-06 International Business Machines Corporation Runtime instantiation of broadcast encryption schemes

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101741842A (en) * 2009-12-07 2010-06-16 北京交通大学 A Method of Realizing Trusted SSH Based on Trusted Computing
CN101789939A (en) * 2010-01-25 2010-07-28 北京交通大学 Effective realization method for credible OpenSSH

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
刘伟.基于抗量子密钥交换协议的SSH协议的研究与实现.《中国优秀硕士学位论文全文数据库，信息科技辑》.2017, *
可信SSH协议的设计与实现;张亚奇;《中国优秀硕士学位论文全文数据库，信息科技辑》;20170615;第I136-113页 *
基于抗量子密钥交换协议的SSH协议的研究与实现;刘伟;《中国优秀硕士学位论文全文数据库，信息科技辑》;20170615;I139-49页 *

Also Published As

Publication number Publication date
CN108111301A (en) 2018-06-01

Similar Documents

Publication Publication Date Title
CN108111301B (en) Method and system for implementing SSH protocol based on post-quantum key exchange
Agrawal et al. PASTA: password-based threshold authentication
CN107948189B (en) Asymmetric password identity authentication method and device, computer equipment and storage medium
CN107342859B (en) Anonymous authentication method and application thereof
CN112106322A (en) Password-based threshold token generation
CN114268439B (en) Identity-based authentication key negotiation method based on grid
WO2014166546A1 (en) Method and system for accessing device by a user
CN106341232A (en) Anonymous entity identification method based on password
KR20240135040A (en) Computer-implemented system and method for highly secure, high speed encryption and transmission of data
CN116056080B (en) Satellite switching authentication method for low-orbit satellite network
WO2025236608A1 (en) Information verification method and related device
CN116633530A (en) Quantum key transmission method, device and system
CN115694812B (en) Zero-knowledge-based threshold identity authentication method and device and cloud computing system
WO2023151427A1 (en) Quantum key transmission method, device and system
CN119402205A (en) A lightweight dynamic security authentication method and system based on PUF
CN114760026A (en) Identity authentication method and device
CN112733129B (en) Trusted access method for server out-of-band management
CN119276494B (en) Session key generation method and related device
CN114386020B (en) Quantum-safe fast secondary identity authentication method and system
CN114764492A (en) SDP access control method and system based on block chain
CN117914483A (en) Secure communication method, apparatus, device and medium
CN101789939B (en) Effective realization method for credible OpenSSH
CN110519219A (en) A kind of password authentication key exchange method and system based on lattice
CN110784305B (en) Single sign-on authentication method based on inadvertent pseudo-random function and signcryption
CN108390866A (en) Trusted remote method of proof based on the two-way anonymous authentication of dual-proxy

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant