Method for detecting resistance of saturnin cryptographic algorithm to impossible differential fault attack
By introducing faults and compressing the key search space using a set of differential relation equations, the impossible differential fault attack problem of the SATURNIN cryptographic algorithm is solved, thereby improving its security detection and defense capabilities.
Patent Information
- Application Number
- CN202211393374.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-11-08
- Publication Date
- 2026-01-30
- Estimated Expiration
- 2042-11-08
AI Technical Summary
Existing technologies are insufficient to effectively detect and defend against impossible differential fault attacks on the SATURNIN cryptographic algorithm, thus affecting its security.
By randomly generating plaintext messages, importing faults and simulating error outputs, and using a set of differential relation equations to compress the key search space, the correct key K is derived.
It enables fast and accurate detection and defense against impossible differential fault attacks, thus improving the security of the SATURNIN cryptographic algorithm.
Smart Images
Figure CN115714641B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of information security, in particular to a method for detecting SATURNIN cryptographic algorithm against impossible differential fault attack. BACKGROUND
[0002] With the rapid development of modern computer technology, information security problems have gradually emerged, network attacks, illegal intrusion and other behaviors are increasing every year, which has brought great security risks to people in the process of using the Internet. SATURNIN algorithm is a lightweight cryptographic algorithm proposed in the International Journal of Symmetric Cryptology in 2020, which adopts substitution permutation network structure, and the block length and key length of the algorithm are both 256 bits. SATURNIN cryptographic algorithm has high security while maintaining high efficiency and lightness, and is widely used in various small devices, so it is of great significance to analyze its security. SUMMARY
[0003] The technical problem to be solved by the present application is to provide a method for detecting SATURNIN cryptographic algorithm against impossible differential fault attack, which can evaluate the security of products packaged with SATURNIN cryptographic algorithm.
[0004] The technical solution adopted by the present application to solve its technical problem is: providing a method for detecting SATURNIN cryptographic algorithm against impossible differential fault attack, comprising the following steps:
[0005] Randomly generating a plaintext message M to be processed;
[0006] Processing the plaintext message M by using the SATURNIN cryptographic algorithm to obtain a correct output ciphertext Y;
[0007] Processing the plaintext message M by using the SATURNIN cryptographic algorithm, and introducing faults at the specified position of the fourth last super round to obtain an error output ciphertext
[0008] According to the correct output ciphertext Y and the error output ciphertext The intermediate state values of the first last super round are derived respectively And According to the intermediate state values of the first last super round, the intermediate state values of the second last super round are derived And Wherein, MC -1 (·) represents column confusion inverse operation, represents horizontal slice row displacement inverse operation, C RSR represents the round constant of the Rth round slice (·) represents a longitudinal slice row displacement operation, SC(·) represents an S-box substitution operation, K rot represents a key K after being shifted;
[0009] Calculate the difference value of the intermediate state value and Calculate the difference value of the intermediate state value Use A set of impossible differential relation equations is obtained, the key search space is further compressed, the fault is repeatedly introduced and the analysis process is repeated, and finally the correct key K is derived.
[0010] The impossible differential relation equation set is:
[0011]
[0012] When the fault is introduced at the specified position of the penultimate super round, the fault is introduced by changing the bitwise inversion at the specified position.
[0013] The fault adopts a random half-byte fault model.
[0014] The fault is introduced by a software simulation method, laser, electromagnetic and / or voltage interference.
[0015] Advantages
[0016] Compared with the prior art, the present application has the following advantages and positive effects: the present application obtains incorrect ciphertext by introducing faults, and then establishes a set of impossible differential relation equations according to the difference value of the intermediate state value of the correct ciphertext and the incorrect ciphertext, thereby further compressing the key search space, repeatedly introducing faults and analyzing the process, and finally deriving the correct key K. The method provided by the present application is easy to implement, fast and accurate, and has important significance for the security research of the SATURNIN password algorithm. BRIEF DESCRIPTION OF DRAWINGS
[0017] Figure 1 is a flowchart of the embodiment of the present application;
[0018] Figure 2 is a fault propagation diagram for impossible differential fault analysis in the process of SATURNIN password algorithm processing information M;
[0019] Figure 3 is a SATURNIN password algorithm analysis diagram;
[0020] Figure 4 is a schematic diagram of the experimental environment in the embodiment of the present application. DETAILED DESCRIPTION
[0021] The application will be further described below in connection with specific embodiments. It should be understood that these embodiments are only used to illustrate the application and not used to limit the scope of the application. Furthermore, it should be understood that after reading the content of the application, those skilled in the art can make various modifications or changes to the application, and these equivalent forms also fall within the scope defined by the appended claims.
[0022] The symbols used in the embodiments of the application are explained as follows:
[0023] M: plaintext;
[0024] Y: output correct message ciphertext;
[0025] output incorrect message ciphertext;
[0026] C R : round constant of the Rth round;
[0027] K: key;
[0028] K rot : key obtained by shifting the key K;
[0029] R: round number of the super round of the SATURNIN algorithm;
[0030] SC: S-box substitution;
[0031] SR slice : vertical slice row displacement, independent row displacement is performed on each vertical slice of the intermediate state value;
[0032] SR sheet : horizontal slice row displacement, row displacement is performed on the horizontal slice of the intermediate state value;
[0033] MC: column confusion transformation;
[0034] inverse operation of the row displacement operation SR slice ;
[0035] inverse operation of the row displacement operation SR sheet ;
[0036] MC -1 : column confusion inverse operation;
[0037] intermediate state value after the SC operation of the Rth round;
[0038] intermediate state value after the SC operation of the Rth round after introducing a fault;
[0039] the intermediate state value after the MC operation of the R-1th round;
[0040] the intermediate state value after the MC operation of the R-1th round after the fault is introduced;
[0041] XOR operation.
[0042] Embodiments of the present application relate to a method for detecting that a SATURNIN cryptographic algorithm resists impossible differential fault attacks, as shown in the following steps: Figure 1
[0043] Step 1: randomly generate a plaintext message to be processed, denoted as M;
[0044] Step 2: process the plaintext message M using the SATURNIN cryptographic algorithm to obtain a correct output ciphertext Y; the process of the SATURNIN cryptographic algorithm is shown in Figure 3 .
[0045] Step 3: process the plaintext message M using the SATURNIN cryptographic algorithm and introduce a fault at a specified position of the penultimate super round to obtain an incorrect output In this step, the fault is introduced by changing the bitwise inversion at the specified position. The introduced fault adopts a random nibble fault model, and the fault size is nibble. The fault can be realized by a software simulation method, or by processing the real hardware through technical means such as laser, electromagnetic, voltage interference, etc.
[0046] In the process of processing the plaintext message M using the SATURNIN cryptographic algorithm in steps 2 and 3, in order to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled (see Figure 4 ), so as to obtain the corresponding output. Among them, the computer is used to generate the input message M of the cryptographic algorithm, and the output result of the information M after the SATURNIN cryptographic algorithm is processed and analyzed; the device encapsulating the SATURNIN cryptographic algorithm is used to process the input information and obtain the corresponding output result; the fault introduction device is used to perform the fault introduction action, which will perform the fault introduction action during the operation of the SATURNIN cryptographic algorithm, and then obtain the output of the incorrect information. The specific operation method is as follows:
[0047] Experimental environment 1: input message M, control the experimental environment not to be disturbed by other unrelated transactions, so that the SATURNIN cryptographic algorithm can be accurately and correctly processed, thereby obtaining the correct output result, which is denoted as Y;
[0048] Experimental Environment 2: Re-input message M and encrypt it again using the SATURNIN cipher algorithm. Simultaneously, at a designated location, induce a fault to interfere with the SATURNIN cipher algorithm's processing. Record the output after introducing the fault as...
[0049] Step 4: Based on the obtained correct ciphertext Y and incorrect ciphertext Derive the intermediate state values of the penultimate super wheel, and denote them as follows: The intermediate state value of the penultimate super wheel can be derived from the intermediate state value of the penultimate super wheel. and and for:
[0050]
[0051] The above derivation process is based on Figure 2 The diagram shows the failure propagation of the SATURNIN cryptographic algorithm during the processing of information M, where differential fault analysis is not possible.
[0052] Step 4: Calculate intermediate state values and The difference value is denoted as use A set of impossible difference relation equations can be obtained. Where 0≤i≤3 and 0≤j≤3, the key search space is further compressed. The fault import and analysis process is repeated, and finally the correct key K can be derived.
[0053] The impossible difference relation equation system is as follows:
[0054]
[0055] In the above system of equations and They are respectively:
[0056]
[0057] Where 0≤i≤3, 0≤j≤3.
[0058] Using the aforementioned impossible difference relation equations as constraints, we traverse all possible candidate subkey values, select subkeys that meet the requirements, and finally obtain the original key K according to the key arrangement algorithm.
[0059] By using the analysis method, the simulation import fault and SATURNIN password algorithm processing process are simulated by using the IDEA development tool on a computer with an Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz 2.70GHz 8GB memory, and the experiment is repeated for 3000 times, and the experimental results show that the detection method is accurate.
[0060] It can be found that the error ciphertext is obtained by the import fault, and a set of impossible differential relation equations is established according to the difference value of the intermediate state values of the correct ciphertext and the error ciphertext, so that the key search space is further compressed, the import fault and the analysis process are repeated, and finally the correct key K can be deduced. The method provided by the application is easy to implement, fast and accurate, and has important significance for the security research of the SATURNIN password algorithm.
Claims
1. A method of detecting resistance of a SATURNIN cryptographic algorithm to impossible differential fault attacks, characterized in that, The method comprises the following steps: Randomly generating a plaintext message M to be processed; Processing the plaintext message M by using a SATURNIN cryptographic algorithm to obtain a correct output ciphertext Y; The plaintext message M is processed using the SATURNIN cipher algorithm and an error is introduced at a specified position in the penultimate super-round to obtain an erroneous output ciphertext According to the correct output ciphertext Y and the error output ciphertext Y The intermediate state value of the first round super round is derived And The intermediate state value of the second round super round is derived according to the intermediate state value of the first round super round And Wherein, MC -1 denotes a column permutation inverse operation, denotes a transverse slice row displacement inverse operation, C R denotes a round constant of the Rth round, SR slice denotes a longitudinal slice row displacement operation, SC(·) denotes an S-box substitution operation, K rot denotes a key K after shifting; computing the intermediate state values and the difference values using obtain a set of impossible differential relation equations, further compress the key search space, repeat the fault introduction and analysis process, and finally deduce the correct key K; the impossible differential relation equation set is:
2. A method of detecting resistance of the SATURNIN cipher algorithm to impossible differential fault attacks according to claim 1, characterized in that, When the fault is introduced at the specified position of the fourth-to-last super round, the fault is introduced by changing the bitwise XOR at the specified position.
3. The method of claim 1, wherein the SATURNIN cryptographic algorithm is resistant to impossible differential fault attack, characterized in that, The fault adopts a random nibble fault model.
4. The method of claim 1, wherein the SATURNIN cryptographic algorithm is resistant to impossible differential fault attack, characterized in that, The fault is introduced by a software simulation method, laser, electromagnetic and / or voltage interference.