﻿<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"><channel><title>C++博客-&lt;table border="0" cellspacing="0" cellpadding="0" style="margin-left:5%;display:inline;height:30px;"&gt;&lt;tr&gt;&lt;td style="font-weight:bolder; font-size:16px; line-height:30px;"&gt;一年十二月&amp;nbsp&amp;nbsp谁主春秋&lt;/td&gt;&lt;/tr&gt;&lt;tr&gt;&lt;td style="font-size:14px; line-height:30px;"&gt;关注：基础系统工程 密码学 人工智能&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;</title><link>http://www.cppblog.com/qinqing1984/</link><description /><language>zh-cn</language><lastBuildDate>Sat, 11 Apr 2026 07:56:26 GMT</lastBuildDate><pubDate>Sat, 11 Apr 2026 07:56:26 GMT</pubDate><ttl>60</ttl><item><title>SM4的解密验证及S盒代数性质分析</title><link>http://www.cppblog.com/qinqing1984/archive/2026/04/08/230530.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Wed, 08 Apr 2026 05:33:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2026/04/08/230530.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230530.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2026/04/08/230530.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230530.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230530.html</trackback:ping><description><![CDATA[<div>本文解释SM4算法解密时轮密钥为什么要反序，给出S盒的复现构造、代数性质分析，以及相关sage代码（SageMath版本为10.7）。关于SM4算法的标准，具体参考文献[1]<br />
<br />
<div><strong style="font-size: 12pt;">解密验证</strong></div>
<div>&nbsp;依文献[1] 解密变换与加密变换使用相同的结构，仅是轮密钥顺序不同，解密时使用轮密钥序（<em>rk</em><sub>31</sub>，<em>rk</em><sub>30</sub>，&#8230;，<em>rk</em><sub>0</sub>）。先从数学上证明如下<br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/sm4_decrypt_round_key_reverse_proof.jpg" alt="" /><br />
<div>&nbsp;<br />
&nbsp;再看GMSSL对SM4的实现，验证解密时是否作了反序处理。下面代码从<a href="https://github.com/guanzhi/GmSSL/blob/master/src/sm4.c" target="_blank">https://github.com/guanzhi/GmSSL/blob/master/src/sm4.c</a> 处拷贝</div>
<div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 50%;word-break:break-all"><span style="color: #0000ff;">void</span>&nbsp;<strong>sm4_set_encrypt_key</strong>(SM4_KEY&nbsp;*key,&nbsp;<span style="color: #0000ff;">const</span>&nbsp;uint8_t&nbsp;user_key[16])<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;uint32_t&nbsp;X0,&nbsp;X1,&nbsp;X2,&nbsp;X3,&nbsp;X4;<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">int</span>&nbsp;i;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;X0&nbsp;=&nbsp;GETU32(user_key&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;)&nbsp;^&nbsp;FK[0];<br />
&nbsp;&nbsp;&nbsp;&nbsp;X1&nbsp;=&nbsp;GETU32(user_key&nbsp;&nbsp;+&nbsp;4)&nbsp;^&nbsp;FK[1];<br />
&nbsp;&nbsp;&nbsp;&nbsp;X2&nbsp;=&nbsp;GETU32(user_key&nbsp;&nbsp;+&nbsp;8)&nbsp;^&nbsp;FK[2];<br />
&nbsp;&nbsp;&nbsp;&nbsp;X3&nbsp;=&nbsp;GETU32(user_key&nbsp;+&nbsp;12)&nbsp;^&nbsp;FK[3];<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;(i&nbsp;=&nbsp;0;&nbsp;i&nbsp;&lt;&nbsp;32;&nbsp;i++)&nbsp;{<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X4&nbsp;=&nbsp;X1&nbsp;^&nbsp;X2&nbsp;^&nbsp;X3&nbsp;^&nbsp;CK[i];<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X4&nbsp;=&nbsp;S32(X4);<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X4&nbsp;=&nbsp;X0&nbsp;^&nbsp;L32_(X4);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="background-color: #ffff00;">&nbsp;key</span><span style="background-color: #ffff00;">-&gt;</span><span style="background-color: #ffff00;">rk[i]&nbsp;</span><span style="background-color: #ffff00;">=</span><span style="background-color: #ffff00;">&nbsp;X4;</span><br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X0&nbsp;=&nbsp;X1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X1&nbsp;=&nbsp;X2;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X2&nbsp;=&nbsp;X3;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X3&nbsp;=&nbsp;X4;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
}<br />
<br />
<span style="color: #0000FF; ">void</span>&nbsp;<strong>sm4_set_decrypt_key</strong>(SM4_KEY&nbsp;*key,&nbsp;<span style="color: #0000FF; ">const</span>&nbsp;uint8_t&nbsp;user_key[16])<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;uint32_t&nbsp;X0,&nbsp;X1,&nbsp;X2,&nbsp;X3,&nbsp;X4;<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">int</span>&nbsp;i;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;X0&nbsp;=&nbsp;GETU32(user_key&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;)&nbsp;^&nbsp;FK[0];<br />
&nbsp;&nbsp;&nbsp;&nbsp;X1&nbsp;=&nbsp;GETU32(user_key&nbsp;&nbsp;+&nbsp;4)&nbsp;^&nbsp;FK[1];<br />
&nbsp;&nbsp;&nbsp;&nbsp;X2&nbsp;=&nbsp;GETU32(user_key&nbsp;&nbsp;+&nbsp;8)&nbsp;^&nbsp;FK[2];<br />
&nbsp;&nbsp;&nbsp;&nbsp;X3&nbsp;=&nbsp;GETU32(user_key&nbsp;+&nbsp;12)&nbsp;^&nbsp;FK[3];<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;(i&nbsp;=&nbsp;0;&nbsp;i&nbsp;&lt;&nbsp;32;&nbsp;i++)&nbsp;{<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X4&nbsp;=&nbsp;X1&nbsp;^&nbsp;X2&nbsp;^&nbsp;X3&nbsp;^&nbsp;CK[i];<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X4&nbsp;=&nbsp;S32(X4);<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X4&nbsp;=&nbsp;X0&nbsp;^&nbsp;L32_(X4);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="background-color: #ffff00;">&nbsp;key</span><span style="background-color: #ffff00;">-&gt;</span><span style="background-color: #ffff00;">rk[</span><span style="background-color: #ffff00;">31</span>&nbsp;<span style="background-color: #ffff00;">-</span><span style="background-color: #ffff00;">&nbsp;i]&nbsp;</span><span style="background-color: #ffff00;">=</span><span style="background-color: #ffff00;">&nbsp;X4;</span><br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X0&nbsp;=&nbsp;X1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X1&nbsp;=&nbsp;X2;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X2&nbsp;=&nbsp;X3;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X3&nbsp;=&nbsp;X4;<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
}</div>
<div>&nbsp;可以看到对比加密，在<strong>sm4_set_decrypt_key</strong>函数内做了反序处理。进一步可以发现sm4_set_decrypt_key被ECB和CBC操作模式调用了，<br />
&nbsp;比如在<a href="https://github.com/guanzhi/GmSSL/blob/master/src/sm4_cbc.c" target="_blank">https://github.com/guanzhi/GmSSL/blob/master/src/sm4_cbc.c</a> 中的sm4_cbc_decrypt_init函数内<br />
<div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 50%;word-break:break-all"><!--<br />
<br />
Code highlighting produced by Actipro CodeHighlighter (freeware)<br />
http://www.CodeHighlighter.com/<br />
<br />
--><span style="color: #0000FF; ">int</span>&nbsp;<strong>sm4_cbc_decrypt_init</strong>(SM4_CBC_CTX&nbsp;*ctx,&nbsp;<span style="color: #0000FF; ">const</span>&nbsp;uint8_t&nbsp;key[SM4_BLOCK_SIZE],&nbsp;<span style="color: #0000FF; ">const</span>&nbsp;uint8_t&nbsp;iv[SM4_BLOCK_SIZE])<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">if</span>&nbsp;(!ctx&nbsp;||&nbsp;!key&nbsp;||&nbsp;!iv)&nbsp;{<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;error_print();<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">return</span>&nbsp;-1;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="background-color: yellow;">sm4_set_decrypt_key(</span>&amp;ctx-&gt;sm4_key,&nbsp;key);<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;memcpy(ctx-&gt;iv,&nbsp;iv,&nbsp;SM4_BLOCK_SIZE);<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;memset(ctx-&gt;block,&nbsp;0,&nbsp;SM4_BLOCK_SIZE);<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ctx-&gt;block_nbytes&nbsp;=&nbsp;0;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">return</span>&nbsp;1;<br />
}</div>
<div><br />
<strong style="font-size: 12pt;">&nbsp;S盒的复现构造<br /></strong>&nbsp; &nbsp;基本思路是根据文献[2]给出的如下公式及矩阵、向量参数<br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/sm4_sbox_equation_and_specific_matrixs.jpg" alt="" /><br />
<div>&nbsp;脚本代码如下</div>
<div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 50%;word-break:break-all"><span style="color: #0000ff;">def</span>&nbsp;&nbsp;sm4_sbox(byte):<br />
&nbsp; &nbsp; v&nbsp;=&nbsp;vector(BF,&nbsp;[(byte&nbsp;&gt;&gt;&nbsp;i)&nbsp;&amp;&nbsp;1&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_M-1,&nbsp;-1,&nbsp;-1)])<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;v1&nbsp;=&nbsp;A1&nbsp;*&nbsp;v&nbsp;+&nbsp;C1<br />
&nbsp;&nbsp;&nbsp;&nbsp;r_byte&nbsp;=&nbsp;sum(int(v1[i])&nbsp;&lt;&lt;&nbsp;i&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_M-1,&nbsp;-1,&nbsp;-1))<br />
&nbsp;&nbsp;&nbsp;&nbsp;elem&nbsp;=&nbsp;byte_to_poly(r_byte)<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">if</span>&nbsp;elem&nbsp;!=&nbsp;0:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;inv_elem&nbsp;=&nbsp;elem^-1<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;inv&nbsp;=&nbsp;poly_to_byte(inv_elem)<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">else</span>:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;inv&nbsp;=&nbsp;0<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;v2&nbsp;=&nbsp;vector(BF,[(inv&nbsp;&gt;&gt;&nbsp;i)&nbsp;&nbsp;&amp;&nbsp;1&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_M)])&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;r&nbsp;=&nbsp;A2&nbsp;*&nbsp;v2&nbsp;+&nbsp;C2<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">return</span>&nbsp;sum(int(r[i])&nbsp;&lt;&lt;&nbsp;(S_M-1-i)&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_M))<br />
<br />
sm4_sbox_table&nbsp;=&nbsp;[sm4_sbox(i)&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_SIZE)]<br />
<br />
<span style="color: #0000FF; ">print</span>(f<span style="color: #800000; ">"</span><span style="color: #800000; ">const&nbsp;uint8_t&nbsp;sm4_sbox[{S_SIZE}]&nbsp;=&nbsp;{{</span><span style="color: #800000; ">"</span>)<br />
<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(0,&nbsp;S_SIZE,&nbsp;16):<br />
&nbsp;&nbsp;&nbsp;&nbsp;row&nbsp;=&nbsp;<span style="color: #800000; ">"</span><span style="color: #800000; ">,&nbsp;</span><span style="color: #800000; ">"</span>.join(f<span style="color: #800000; ">"</span><span style="color: #800000; ">0x{s:02X}</span><span style="color: #800000; ">"</span>&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;s&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;sm4_sbox_table[i:i+16])<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>(<span style="color: #800000; ">"</span><span style="color: #800000; ">&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #800000; ">"</span>&nbsp;+&nbsp;row&nbsp;+&nbsp;<span style="color: #800000; ">"</span><span style="color: #800000; ">,</span><span style="color: #800000; ">"</span>)<br />
<span style="color: #0000FF; ">print</span>(<span style="color: #800000; ">"</span><span style="color: #800000; ">};</span><span style="color: #800000; ">"</span>,&nbsp;end=<span style="color: #800000; ">"</span><span style="color: #800000; ">\n\n</span><span style="color: #800000; ">"</span>)</div>
<div>&nbsp;<br />
&nbsp;运行输出如下<br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/sm4_sbox_generate_output_result.jpg" width="1010" height="426" alt="" /><br />
&nbsp;<font face="宋体"><span style="font-size: 10.5pt;">以上输出表格与文献[1] 给出的完全一致</span></font><br />
<br />
<div><strong style="font-size: 12pt;">S盒的代数性质</strong></div>
<div>&nbsp; 主要是平衡性、代数次数、非线性度、Walsh谱、差分均分度、SAC、扩散准则PC(k)，具体计算根据它们的定义。代码如下</div>
<div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 50%;word-break:break-all"><span style="font-size: 14px;">&nbsp;&nbsp;</span><span style="color: #008000;">#</span><span style="color: #008000;">##########################################################</span><br />
<span style="color: #0000FF; ">def</span>&nbsp;&nbsp;sbox_balance(S):<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;j&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_N):<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cnt&nbsp;=&nbsp;sum((S[i]&gt;&gt;j)&amp;1&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_SIZE))<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>(f<span style="color: #800000; ">"</span><span style="color: #800000; ">Output&nbsp;bit&nbsp;{j}:&nbsp;{cnt}&nbsp;ones</span><span style="color: #800000; ">"</span>)<br />
<br />
sbox_balance(sm4_sbox_table);&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>()<br />
<span style="color: #008000; ">#</span><span style="color: #008000; ">##########################################################</span><span style="color: #008000; "><br />
</span><span style="color: #0000FF; ">def</span>&nbsp;&nbsp;max_nonlinearity(n):<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">if</span>&nbsp;n&nbsp;%&nbsp;2&nbsp;==&nbsp;0:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">return</span>&nbsp;2^(n-1)&nbsp;-&nbsp;2^(n//2&nbsp;-&nbsp;1)<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">else</span>:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">return</span>&nbsp;2^(n-1)&nbsp;-&nbsp;2^((n-1)//2)<br />
<br />
<span style="color: #0000FF; ">def</span>&nbsp;&nbsp;sbox_boolfun_property(S):<br />
&nbsp;&nbsp;&nbsp;&nbsp;min_nl&nbsp;=&nbsp;infinity<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;j&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_N):<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;bf&nbsp;=&nbsp;BooleanFunction([(S[i]&gt;&gt;j)&amp;1&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_SIZE)])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;deg&nbsp;=&nbsp;bf.algebraic_degree()<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nl&nbsp;=&nbsp;bf.nonlinearity()<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;min_nl&nbsp;=&nbsp;min(min_nl,&nbsp;nl)<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;walsh_max&nbsp;=&nbsp;max(abs(w)&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;w&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;bf.walsh_hadamard_transform())<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>(f<span style="color: #800000; ">"</span><span style="color: #800000; ">Bit&nbsp;{j}:&nbsp;degree={deg},&nbsp;nonlinearity={nl},&nbsp;max|Walsh|={walsh_max}</span><span style="color: #800000; ">"</span>)<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>(f<span style="color: #800000; ">"</span><span style="color: #800000; ">the&nbsp;minimum&nbsp;nonlinearity&nbsp;is&nbsp;{min_nl},&nbsp;theory&nbsp;max&nbsp;nonlinearity&nbsp;is&nbsp;{max_nonlinearity(S_N)}</span><span style="color: #800000; ">"</span>)<br />
<br />
sbox_boolfun_property(sm4_sbox_table);&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>(<span style="color: #800000; ">""</span>)<br />
<span style="color: #008000; ">#</span><span style="color: #008000; ">##########################################################</span><span style="color: #008000; "><br />
</span><span style="color: #0000FF; ">def</span>&nbsp;&nbsp;sbox_differential_uniformity(S):<br />
&nbsp;&nbsp;&nbsp;&nbsp;ddt&nbsp;=&nbsp;{}<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;dx&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(1,&nbsp;S_SIZE):<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;x&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_SIZE):<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dy&nbsp;=&nbsp;S[x]&nbsp;^^&nbsp;S[x^^dx]<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ddt[(dx,&nbsp;dy)]&nbsp;=&nbsp;ddt.get((dx,&nbsp;dy),&nbsp;0)&nbsp;+&nbsp;1<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;delta&nbsp;=&nbsp;max(ddt.values())<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>(<span style="color: #800000; ">"</span><span style="color: #800000; ">Differential&nbsp;Uniformity&nbsp;=</span><span style="color: #800000; ">"</span>,&nbsp;delta)<br />
<br />
sbox_differential_uniformity(sm4_sbox_table);&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>()<br />
<span style="color: #008000; ">#</span><span style="color: #008000; ">##########################################################</span><span style="color: #008000; "><br />
</span><span style="color: #0000FF; ">def</span>&nbsp;&nbsp;sbox_fixed_points(S):<br />
&nbsp;&nbsp;&nbsp;&nbsp;fps&nbsp;=&nbsp;[]<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;x&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_SIZE):<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">if</span>&nbsp;S[x]&nbsp;==&nbsp;x:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fps.append(hex(x))<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">return</span>&nbsp;fps<br />
<br />
fps&nbsp;=&nbsp;sbox_fixed_points(sm4_sbox_table)<br />
<span style="color: #0000FF; ">print</span>(f<span style="color: #800000; ">"</span><span style="color: #800000; ">has&nbsp;{len(fps)}&nbsp;fixed&nbsp;points:&nbsp;{fps}</span><span style="color: #800000; ">"</span>,&nbsp;end=<span style="color: #800000; ">"</span><span style="color: #800000; ">\n\n</span><span style="color: #800000; ">"</span>)<br />
<span style="color: #008000; ">#</span><span style="color: #008000; ">##########################################################</span><span style="color: #008000; "><br />
</span><span style="color: #0000FF; ">def</span>&nbsp;&nbsp;flip_bit(x,&nbsp;i):<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">return</span>&nbsp;x&nbsp;^^&nbsp;(1&nbsp;&lt;&lt;&nbsp;i)<br />
<br />
<span style="color: #0000FF; ">def</span>&nbsp;&nbsp;sbox_sac(S):<br />
&nbsp;&nbsp;&nbsp;&nbsp;sac_matrix&nbsp;=&nbsp;matrix(QQ,&nbsp;S_M,&nbsp;S_N,&nbsp;0)<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;x&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_SIZE):<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_M):&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;xp&nbsp;=&nbsp;flip_bit(x,&nbsp;i)<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dx&nbsp;=&nbsp;S[xp]&nbsp;^^&nbsp;S[x]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;j&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_N):&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">if</span>&nbsp;(dx&nbsp;&gt;&gt;&nbsp;j)&nbsp;&amp;&nbsp;1:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;sac_matrix[i,&nbsp;j]&nbsp;+=&nbsp;1<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #008000; ">#</span><span style="color: #008000; ">&nbsp;Normalize&nbsp;to&nbsp;probability</span><span style="color: #008000; "><br />
</span>&nbsp;&nbsp;&nbsp;&nbsp;sac_matrix&nbsp;=&nbsp;sac_matrix&nbsp;/&nbsp;S_SIZE<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">return</span>&nbsp;sac_matrix<br />
<br />
<span style="color: #0000FF; ">print</span>(sbox_sac(sm4_sbox_table));&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>()<br />
<br />
<span style="color: #0000FF; ">def</span>&nbsp;&nbsp;sbox_check_pck(S,&nbsp;k):<br />
&nbsp;&nbsp;&nbsp;&nbsp;bool_funcs&nbsp;=&nbsp;[]<br />
&nbsp;&nbsp;&nbsp;&nbsp;bf_satisfy_pcks&nbsp;=&nbsp;[]<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_N):<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;bf&nbsp;=&nbsp;BooleanFunction([(S[x]&nbsp;&gt;&gt;&nbsp;i)&nbsp;&amp;&nbsp;1&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;x&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(S_SIZE)])<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;bool_funcs.append(bf)<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;bf_satisfy_pcks.append(True)<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;i,&nbsp;f&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;enumerate(bool_funcs):<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;w&nbsp;=&nbsp;f.walsh_hadamard_transform()<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">for</span>&nbsp;a&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(1,&nbsp;&nbsp;S_SIZE):<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">if</span>&nbsp;bin(a).count(<span style="color: #800000; ">'</span><span style="color: #800000; ">1</span><span style="color: #800000; ">'</span>)&nbsp;&lt;=&nbsp;k:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">if</span>&nbsp;w[a]&nbsp;!=&nbsp;0:<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #008000; ">#</span><span style="color: #008000; ">&nbsp;D&nbsp;=&nbsp;f.derivative(a)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="color: #008000; "><br />
</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #008000; ">#</span><span style="color: #008000; ">&nbsp;if&nbsp;not&nbsp;D.is_balanced():</span><span style="color: #008000; "><br />
</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;bf_satisfy_pcks[i]&nbsp;=&nbsp;False<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">break</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;r&nbsp;=&nbsp;bf_satisfy_pcks[i]<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>(f<span style="color: #800000; ">"</span><span style="color: #800000; ">bf[{i}]&nbsp;satify&nbsp;PC({k}):{r}</span><span style="color: #800000; ">"</span>)<br />
<br />
<span style="color: #0000FF; ">for</span>&nbsp;k&nbsp;<span style="color: #0000FF; ">in</span>&nbsp;range(1,&nbsp;4):<br />
&nbsp;&nbsp;&nbsp;&nbsp;sbox_check_pck(sm4_sbox_table,&nbsp;k);&nbsp;&nbsp;<span style="color: #0000FF; ">print</span>()<br />
<span style="color: #008000; ">#</span><span style="color: #008000; ">##########################################################</span></div>
<div>&nbsp;<strong>sbox_check_pck</strong>函数内注释部分为用布尔函数导数的方法，结果与使用Walsh谱的方法一致。当k=1时等价于SAC。运行脚本，输出如下<br />
<br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/sm4_sbox_algebraic_property_output.png" width="731" height="1329" alt="" /><br />
&nbsp;可以看出S盒不严格满足PC(k)，SAC则是接近满足。其它指标良好。<br />&nbsp;完整代码下载：<a href="https://github.com/cq12yue/sm4_analysis">https://github.com/cq12yue/sm4_analysis</a><br />
<br />
&nbsp;<strong style="font-size: 11pt;">参考文献</strong></div>
<div>&nbsp; [1] GB/T32907&#8212;2016 信息安全技术 SM4分组密码算法</div>
<div>&nbsp; [2] Algebraic Cryptanalysis of SMS4: Gr&#168;obner Basis Attack and SAT Attack Compared<br />
</div>
</div>
</div>
</div>
</div>
</div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230530.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2026-04-08 13:33 <a href="http://www.cppblog.com/qinqing1984/archive/2026/04/08/230530.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>再谈RSA的安全设计</title><link>http://www.cppblog.com/qinqing1984/archive/2026/03/17/230525.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Tue, 17 Mar 2026 15:03:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2026/03/17/230525.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230525.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2026/03/17/230525.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230525.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230525.html</trackback:ping><description><![CDATA[<div><span style="font-size: 12pt;"><strong>从数学上考虑，主要是如下几点</strong></span></div>
<div>&nbsp; 1. 模数N的两个素因子p、q之间的距离（差的绝对值）要够大。这是为了防费马因子分解法，详见《<a target="_blank" href="http://www.cppblog.com/qinqing1984/archive/2023/09/28/230110.html">浅淡密码学几点安全性分析</a>》第一点</div>
<div>&nbsp; 2. p-1 和q-1 要有大的素因子，即它们的素因子分解中最小的素数都得够大。这是为了防Pollard p-1 因子分解法、重复加密攻击&nbsp;</div>
<div>&nbsp; 3. 解密指数d要比较大。这是为了防连分数方法攻击求解d。详见《<a target="_blank" href="http://www.cppblog.com/qinqing1984/archive/2024/04/04/230326.html">简单连分数攻击RSA的迭代次数分析</a>》</div>
<div>&nbsp; 4. N的选取应考虑它难以找到二次剩余即x<sup>2</sup>&#8801;y<sup>2</sup> mod N。这是为了防Dixon分解法、二次筛法</div>
<div></div>
<div><br />
<strong style="font-size: 12pt;">从工程上考虑，有以下几点</strong></div>
<div>&#8203;&nbsp; 5. RSA系统生成N不要重复。这是为了防共模攻击恢复明文</div>
<div>&nbsp; 6. 不同的N用不同的加密指数e，或不要加密相同的消息，或被加密的多个消息避免有仿射线性关系</div>
<div>&nbsp; 7. 避免暴露N的欧拉函数值。不然解一元二次方程可得到p、q</div>
<div>&nbsp; 8. 随机填充。给明文按一定规则填充随机串后加密，一定程度上可抗击选择明文与选择密文攻击<br />
<br />
<div><strong style="font-size: 12pt;"><br />进一步提升安全性的考虑</strong></div>
<div>&nbsp; 密钥生成KeyGen(&#954;):</div>
<div>&nbsp; &nbsp; &nbsp; (N, e, d) &#8592; GenRSA(&#954;);&nbsp;</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp;pk = (N, e), sk = (N, d)</div>
<div>&nbsp; <br />&nbsp; 加密过程E<sub>pk</sub> (M)、解密过程D<sub>sk</sub> (C<sub>1</sub>, C<sub>2</sub>)：</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp;与抗攻击的安全性有关</div>
<div>&nbsp; <br />&nbsp; H：抗碰撞哈希函数<br />
</div>
<div></div>
<div>&nbsp;<br />&nbsp;为抗选择明文攻击，利用H来改造</div>
<div>&nbsp; &nbsp; &nbsp; E<sub>pk</sub>(M)：</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; r &#8592;<sub>R</sub> Z<sub>N</sub><sup>*</sup></div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;输出（r<sup>e</sup> mod N，H(r)&#8853;M）</div>
<div>&nbsp; &nbsp; &nbsp; <br />&nbsp; &nbsp; &nbsp; D<sub>sk</sub> (C<sub>1</sub>, C<sub>2</sub>)：</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; r = C<sub>1</sub><sup>d</sup> mod N</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;输出H(r)&#8853;C2</div>
<div>&nbsp; <br />&nbsp;为抗选择密文攻击（攻击利用RSA的乘法同态性），利用H与IND-CCA安全的私钥加密方案&lt;PrivGen, Enc, Dec&gt;来改造：</div>
<div>&nbsp; &nbsp; &nbsp; E<sub>pk</sub> (M)：</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; r &#8592;<sub>R</sub> Z<sub>N</sub><sup>*</sup></div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; h = H(r)</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 输出（r<sup>e</sup> mod N，Enc<sub>h</sub> (M)）</div>
<div>&nbsp; &nbsp; &nbsp; <br />&nbsp; &nbsp; &nbsp; D<sub>sk</sub> (C<sub>1</sub>, C<sub>2</sub>)：</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; r = C<sub>1</sub><sup>d</sup> mod N</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; h = H(r)</div>
<div>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 输出Dec<sub>h</sub>(C<sub>2</sub>)</div>
<div><br />&nbsp;以上改造后的两种RSA方案，是可证明安全的。但第一种不支持IND-CCA</div>
</div>
<div></div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230525.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2026-03-17 23:03 <a href="http://www.cppblog.com/qinqing1984/archive/2026/03/17/230525.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>关于格的行列式之解释</title><link>http://www.cppblog.com/qinqing1984/archive/2026/03/04/230518.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Wed, 04 Mar 2026 08:41:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2026/03/04/230518.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230518.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2026/03/04/230518.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230518.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230518.html</trackback:ping><description><![CDATA[<div>先摘自文献[1]中Lattice-based Cryptography章节引用的结论<br />
<p>&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/lattice_crypto_preliminaries_1.png" alt="" /><br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/lattice_crypto_preliminaries_2.png" alt="" /><br />
&nbsp; <br />
再对上文三个结论稍作证明如下&nbsp;</p>
<div>
&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/lattice_determent_conclusion_proof1.jpg" alt="" /><br />
<br />
&nbsp; <img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/lattice_determent_conclusion_proof2.jpg" alt="" />&nbsp;<br />
&nbsp;&nbsp;<br />
<div><span style="font-size: 11pt;"><strong>参考文献</strong></span></div>
<div>&nbsp; [1]&nbsp; Post-Quantum Cryptography</div>
<div>&nbsp; [2]&nbsp; 算法数论&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;裴定一 祝跃飞&nbsp;</div>
<div>&nbsp; [3]&nbsp; 高等代数&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;丘维声</div>
</div>
</div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230518.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2026-03-04 16:41 <a href="http://www.cppblog.com/qinqing1984/archive/2026/03/04/230518.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>NTRU格密码一处恒等式的证明</title><link>http://www.cppblog.com/qinqing1984/archive/2026/01/27/230509.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Tue, 27 Jan 2026 10:00:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2026/01/27/230509.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230509.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2026/01/27/230509.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230509.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230509.html</trackback:ping><description><![CDATA[<div><span style="font-size: 12pt;">先摘取文献[1]的NTRU密码算法描述</span>&nbsp;
<p>&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/ntru-lattice-crypto-tidentical-equation_pkc-algo.png" width="470" height="556" alt="" /><br />
&nbsp;<br />
&nbsp;<span style="font-size: 12pt;">矩阵T及T</span><sup style="font-size: 12pt;">*</sup><span style="font-size: 12pt;">的定义如下</span>&nbsp;</p>
<p>&nbsp; &nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/ntru-lattice-crypto-tidentical-equation_matrix-def1.png" width="469" height="252" alt="" /><br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/ntru-lattice-crypto-tidentical-equation_matrix-def2.png" width="468" height="207" alt="" /><br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/ntru-lattice-crypto-tidentical-equation_matrix-def3.png" width="482" height="337" alt="" />&nbsp;<br />
<br />
<span style="font-size: 12pt;">&nbsp;再给出证明过程</span>&nbsp;</p>
&nbsp; &nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/ntru-lattice-crypto-tidentical-equation_proof.jpg" alt="" /><br />
<br />
<br />
<span style="font-size: 11pt;"><br />
参考文献</span><br />
&nbsp; &nbsp;[1]&nbsp; Post-Quantum Cryptography</div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230509.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2026-01-27 18:00 <a href="http://www.cppblog.com/qinqing1984/archive/2026/01/27/230509.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>关于线性码的主要结论及应用</title><link>http://www.cppblog.com/qinqing1984/archive/2026/01/25/230508.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Sun, 25 Jan 2026 12:30:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2026/01/25/230508.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230508.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2026/01/25/230508.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230508.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230508.html</trackback:ping><description><![CDATA[<strong style="font-size: 12pt;">符号定义</strong><br />
<p>&nbsp; &nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/linearcode_conclusions_symbol-define.png" width="586" height="150" alt="" /><br />
<br />
<strong style="font-size: 12pt;">主要结论<br />
</strong></p>
<p>&nbsp; &nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/linearcode_conclusions_theorem-proof1.jpg" width="574" height="715" alt="" /><br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/linearcode_conclusions_theorem-proof2.jpg" alt="" /><br />
<strong style="font-size: 12pt;"><br />
在密码学中的应用</strong><br />
</p>
<p>&nbsp; &nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/linearcode_conclusions_mceliece-pkc.png" width="466" height="422" alt="" /><br />
</p>
<div>&nbsp; &nbsp; 上述McEliece公钥算法成立的关键之一是<strong>G</strong><sup>pub</sup>=<strong>SGP</strong>。由前面的<strong>定理1</strong>可得出G<sup>pub</sup>与G等价，<br />
&nbsp;但隐藏了码结构，另由于矩阵分解G<sup>pub</sup>得到S和P是困难的，因为P随机且LU分解变形不唯一，<br />&nbsp;当n和t较大时，Goppa码的生成矩阵是天文数字。从而增加了密码分析的难度<br />
<br />
&nbsp; &nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/linearcode_conclusions_syndrome-of-codeword.png" width="465" height="491" alt="" /><br />
<div>&nbsp;上述红色下划线处的结论，其根据是<strong>推论1<br />
</strong><br />
&nbsp; &nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/linearcode_conclusions_csd-cf-problems.png" width="459" height="490" alt="" /><br />
&nbsp; 这里的线性码下界定义本质跟<strong>定理7</strong>一样，从校验矩阵H的所有列向量中，选取0个向量（即向量<strong>0</strong>）生成的线性组合数 +<br /> 选取1个线性无关向量生成的线性组合数 + 选取2个无关向量生成的线性组合数 + &#8230; + <br />选取d<sub>0</sub>-1个无关向量生成的线性组合数，不超过r个无关向量生成的线性组合总数。下面解释了红色下划线处的结论<br />
&nbsp; &nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/linearcode_conclusions_apply-csd-cf-explain.jpg" width="480" height="26" alt="" /><br />
<br /><br />
<div><strong style="font-size: 11pt;">参考文献</strong>&nbsp;</div>
<div>&nbsp;[1]&nbsp;高等代数&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;丘维声</div>
<div>&nbsp;[2] Finite fields&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Rudolf Lidl&nbsp; Harald Niederreiter</div>
<div>&nbsp;[3] Post-Quantum Cryptography</div>
</div>
</div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230508.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2026-01-25 20:30 <a href="http://www.cppblog.com/qinqing1984/archive/2026/01/25/230508.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>关于LLL算法的补充证明</title><link>http://www.cppblog.com/qinqing1984/archive/2025/09/28/230467.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Sun, 28 Sep 2025 09:43:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2025/09/28/230467.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230467.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2025/09/28/230467.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230467.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230467.html</trackback:ping><description><![CDATA[<div>先摘录文献[1]中的LLL算法描述流程，及LLL约化基的定义&nbsp;<br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/LLL-algorithm1.png" width="497" height="133" alt="" /><br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/LLL-algorithm2.png" width="492" height="571" alt="" /><br />
<br />
<div>LLL约化基的定义如下（文献[1]定义13.12）<br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/LLL-Reduced-basis.png" width="438" height="90" alt="" /><br />
<br />
<div>再证明上图红色方框三行伪代码的正确性（其它部分文献[1]已讲得比较具体）<br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/LLL-algorithm-additional-proof.jpg" alt="" /><br />
<br />
<div><strong style="font-size: 12pt;"><br />
参考文献</strong>&nbsp;</div>
<div>&nbsp; [1] 算法数论&nbsp; &nbsp; &nbsp; &nbsp; 裴定一 祝跃飞</div>
<div>&nbsp; [2] 高等代数&nbsp; &nbsp; &nbsp; &nbsp; 丘维声&nbsp;</div>
</div>
</div>
</div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230467.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2025-09-28 17:43 <a href="http://www.cppblog.com/qinqing1984/archive/2025/09/28/230467.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>关于分圆域的一般结论</title><link>http://www.cppblog.com/qinqing1984/archive/2025/07/28/230452.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Mon, 28 Jul 2025 04:01:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2025/07/28/230452.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230452.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2025/07/28/230452.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230452.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230452.html</trackback:ping><description><![CDATA[<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/cyclotomic-field-general-conclusion1.jpg" width="622" height="955" alt="" /><br />
<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/cyclotomic-field-general-conclusion2.jpg" width="652" height="835" alt="" /><br />
<br />
<div><strong style="font-size: 11pt;"><br />参考文献</strong></div>
<div>&nbsp; [1]代数与数论&nbsp; &nbsp; &nbsp; &nbsp;李超&nbsp; &nbsp; &nbsp;周悦</div>
<div>&nbsp; [2]抽象代数II&nbsp; &nbsp; &nbsp; &nbsp;徐明曜&nbsp; 赵春来</div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230452.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2025-07-28 12:01 <a href="http://www.cppblog.com/qinqing1984/archive/2025/07/28/230452.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>一个欧拉数整除问题的两种证法</title><link>http://www.cppblog.com/qinqing1984/archive/2025/06/20/230447.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Fri, 20 Jun 2025 10:41:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2025/06/20/230447.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230447.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2025/06/20/230447.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230447.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230447.html</trackback:ping><description><![CDATA[<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/two-way-proofs-of-one-euler-number-proposition1.jpg" alt="" /><br />
<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/two-way-proofs-of-one-euler-number-proposition2.jpg" alt="" /><br />
<br />
<div><strong style="font-size: 11pt;"><br />
参考文献</strong></div>
<div>&nbsp; [1] 代数学基础与有限域&nbsp; &nbsp; &nbsp; &nbsp;林东岱</div>
<div>&nbsp; [2] 抽象代数&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;赵春来 徐明曜</div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230447.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2025-06-20 18:41 <a href="http://www.cppblog.com/qinqing1984/archive/2025/06/20/230447.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>有限域上的特征与指数和之扩展</title><link>http://www.cppblog.com/qinqing1984/archive/2025/06/05/230441.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Thu, 05 Jun 2025 01:30:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2025/06/05/230441.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230441.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2025/06/05/230441.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230441.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230441.html</trackback:ping><description><![CDATA[<div><strong style="font-size: 12pt;">符号含义</strong>&nbsp;<strong style="font-size: 12pt;"><br />
</strong><strong style="font-size: 12pt;">&nbsp; <img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/finite-fields-characters-expsum-symbol-list.png" alt="" /><br />
<br />
</strong>
<div><strong style="font-size: 12pt;">关于特征的结论</strong>&nbsp;<strong style="font-size: 12pt;"><br />
</strong><strong style="font-size: 12pt;">&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/finite-fields-characters-expsum-char-conclusion1.jpg" width="602" height="684" alt="" /><br />
&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/finite-fields-characters-expsum-char-conclusion2.jpg" width="603" height="1040" alt="" /><br />
&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/finite-fields-characters-expsum-char-conclusion3.jpg" width="619" height="1015" alt="" /><br />
<br />
</strong>
<div><strong style="font-size: 12pt;">关于指数和的结论</strong>&nbsp;<strong style="font-size: 12pt;"><br />
</strong><strong style="font-size: 12pt;">&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/finite-fields-characters-expsum-expsum-conclusion.jpg" width="638" height="995" alt="" /></strong><br />
<div><strong style="font-size: 11pt;">参考文献</strong><br />
</div>
<div>&nbsp; &nbsp;[1] 代数学基础与有限域&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;林东岱</div>
<div>&nbsp; &nbsp;[2] 代数与数论&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 李超 周悦</div>
<div>&nbsp; &nbsp;[3] 关于群的一些结论及应用&nbsp; &nbsp;本人</div>
</div>
</div>
</div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230441.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2025-06-05 09:30 <a href="http://www.cppblog.com/qinqing1984/archive/2025/06/05/230441.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>二元二次型的相似变换、正定性与正交分解</title><link>http://www.cppblog.com/qinqing1984/archive/2025/04/25/230436.html</link><dc:creator>春秋十二月</dc:creator><author>春秋十二月</author><pubDate>Fri, 25 Apr 2025 11:05:00 GMT</pubDate><guid>http://www.cppblog.com/qinqing1984/archive/2025/04/25/230436.html</guid><wfw:comment>http://www.cppblog.com/qinqing1984/comments/230436.html</wfw:comment><comments>http://www.cppblog.com/qinqing1984/archive/2025/04/25/230436.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.cppblog.com/qinqing1984/comments/commentRss/230436.html</wfw:commentRss><trackback:ping>http://www.cppblog.com/qinqing1984/services/trackbacks/230436.html</trackback:ping><description><![CDATA[<div>&nbsp; &nbsp;本文主要阐述用两种方法判断给定两个二元二次型是否相似，相似情况下的具体变换。<br />
相似变换如果确定了，也利于判断正定性，因为相似二次型的正定性相同。最后讲到了正交分解，<br />
给出怎么求相似的整数对角矩阵<br />
<br />
<div><span style="font-size: 12pt;"><strong>基本定义</strong></span></div>
<div>&nbsp; 下述定义来自文献[1] 12.1节，有所扩展&nbsp;<br />
&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/binary-quadric-form-basic-definition.png" alt="" /><br />
<strong><br />
<span style="font-size: 12pt;">变换求解</span></strong></div>
<div>&nbsp; 先来看运用解方程的方法&nbsp;<br />
&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/binary-quadric-form-similar-transform-solve-equation.jpg" width="555" height="919" alt="" /><br />
<br />
<div>&nbsp;<br />
&nbsp;再来看用矩阵的观点方法，求解变换。这种方法更适合求解到对角型的变换<br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/binary-quadric-form-similar-transform-matrix-method.jpg" alt="" /><br />
&nbsp;<br />
&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/binary-quadric-form-similar-transform-matrix-method-example.jpg" alt="" /><br />
<br />
<span style="font-size: 12pt;"><strong>正交分解</strong></span>&nbsp;<span style="font-size: 12pt;"><strong><br />
</strong></span>
<span style="font-size: 11pt;">&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/binary-quadric-form-orthogonal-decomposition-principle.jpg" alt="" /><br />
<br />
&nbsp;&nbsp;<img src="http://www.cppblog.com/images/cppblog_com/qinqing1984/binary-quadric-form-orthogonal-decomposition-example.jpg" width="515" height="906" alt="" /><br />
<br />
<strong>
参考文献</strong></span>&nbsp;
<div>&nbsp; &nbsp;[1] 华罗庚文集数论卷2</div>
<div>&nbsp; &nbsp;[2] 高等代数&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;丘维声</div>
</div>
</div>
</div><img src ="http://www.cppblog.com/qinqing1984/aggbug/230436.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.cppblog.com/qinqing1984/" target="_blank">春秋十二月</a> 2025-04-25 19:05 <a href="http://www.cppblog.com/qinqing1984/archive/2025/04/25/230436.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item></channel></rss>