【作者】 刘胜利；

【导师】 王育民；

【作者基本信息】 西安电子科技大学 ， 密码学， 1999， 博士

【摘要】 目前的密钥系统无论是单钥体制还是公钥体制都建立在计算安全的模型上。原则上讲，利用穷举密钥法总可以将上述的密码系统逐个攻破。本文的研究工作针对信息理论安全即无条件安全展开。假定敌手拥有无限的时间、设备和资金，对敌手的计算能力不做任何限制，那么即使敌手能在很短的时间内将所有的密钥都遍历一遍的话，基于信息理论安全模型的密码系统也不会被攻破。随着科技的迅猛发展，具有无限计算能力的量子计算机及DNA计算机的实现也不是梦想，故无条件安全模型的建立有着非常现实的意义。 通过适当地修改Shannon的完善保密模型，可以使之成为一个更加接近于实际而且是可证明安全的无条件安全密码体制。第一个修改就是放松Shannon对明文和密文毫不相关的限制，使明文和密文有任意小的相关性；第二个修改是去除敌手能够接受与合法用户一样的信息这一假设。目前所提出的最典型的两个实现就是量子信道和有扰信道。 无论是量子信道还是有扰信道，都可以抽象为这样一个模型：通信双方Alice和Bob及敌手Eve分别得到概率分布为P_XYZ的X,Y,Z三个随机变量，之后他们在公共信道上进行无条件安全的秘密钥协商。一般可以分优先提取，信息协商和保密增强三个阶段来进行。 在这一研究领域，作者的主要研究成果如下： 1.在认证信道上的协商中，研究了Alice和Bob间的信息协调所产生的边信息 对Eve的Renyi的熵影响，揭示了信息协调与保密增强间的联系。 2.在无条件安全密钥协商中，假定通信双方通过相互独立的无记忆二元对称 信道来接收二元对称信源所传送的信息作为初始信息，在这种条件下，本 文提出了一种利用他们之间的初始相关信息对公共信道上的消息进行认证 的具体方案，从而使得无条件安全密钥协商具有抗主动攻击的能力。 3.根据一种基于纠错码的无条件认证码的构造原理，有效地解决了通信双方 间有认证密钥的条件下保密增强中防主动攻击的问题。 4.对S.Wolf在文献[Wol98]中所提出的强保密增强协议进行了改进，只要敌手 所知的有关于通信双方的共享串S的二阶Renyi熵超过串长n的一半而不 是2/3，则当n充分大时，就有可能在不安全且非认证信道上实现保密增强。 5.提出了一种在没有认证密钥的情况下利用通信双方间的部分保密的共享信 息对公共信道上的消息进行认证的方法。该方法下的保密增强能以一定的 概率抗击主动攻击。更多还原

【Abstract】 Both the symmetric key systems and public key systems currently used are based on the model of computational security. In principle, all of them can be broken by trying the possible keys in sequence. This thesis focuses on information-theoretic security, i.e. unconditional security. In information-theoretic security, we can assume that adversaries have the infinite computing power, and the cryptographic systems based on the model of information-theoretic security will not be broken down even if the adversaries can try all the possible keys in sequence in short time. With the development of science and technology, quantum computers and DNA computers with infinite computing power will be available. Therefore, it is significant for us to focus our attention on the research of information-theoretic security.Shannon抯 model can be modified to make practical provably secure cryptosystems possible. The first modification is to relax the requirement that perfect security means complete independence between the plaintext and the adversary抯 knowledge and to allow an arbitrarily small correlation. The second, crucial modification removes the assumption that the adversary receives exactly the same information as the legitimate users. The most realistic mechanisms proposed so far for limiting the information available to the adversary are quantum channels and noisy channels.Such a scenario can be abstracted from quantum channels and noisy channels: two communicants. Alice and Bob, and an adversary, Eve, receive three variables X, Y, Z which are distributed according to some probability distribution P~. Then Alice and Bob begin secret-key agreement over a public channel. Such a secret key agreement over a public channel usually consists of three phases, advantage distillation, information reconciliation and privacy amplification.The main work in this thesis is as follows:1.Demonstrate the effect of side information introduced by the communication over the public channel on Eve抯 Renyi entropy and show the relationship between information reconciliation and privacy amplification.2.When two communicants and an adversary obtain correlated information through independent binary symmetric channels from a random source, and the adversary抯 channel is noisier than those of communicants, an authentication scheme which uses the correlated information between the two communicants is proposed based on the coding theory to make possible information theoretic secret key agreement against active attacks.3With the help of the unconditional secure authentication codes constructed from error-correcting codes, privacy amplification secure against active attacks is possibleif the two communicants share some authentication key.4.An improvement is made to the strong protocol which is proposed by S.WolfJWol98] and implemented with help of interactive authentication. The improved strong protocol makes the privacy amplification by communication over an insecure and non-authentic channel possible for sufficiently large n ,the size of common string S shared by the two parties, when the adversary抯 R閚yi entropy about S exceeds only n12 rather than 2n13 which is required in [Wo198].5.Another authentication scheme is proposed which uses the common string between the two communicants to authenticate the messages over the public channel. Such an authentication scheme can make privacy amplification secure against active attack with some probability under the condition that the two communicants have no authentication key.更多还原