Device and method for accurately recovering super polynomial of Atom algorithm

Abstract

The invention discloses a device and a method for accurately recovering a super polynomial of an Atom algorithm. The device comprises four modules, namely a model variable setting module, an Atom algorithm two-subset separability propagation model building module, a three-subset separability propagation model building module and a super polynomial algebraic property detection module. According to the method, a two-subset separability technology and a three-subset separability technology are combined, a propagation model constructed by the two-subset separability technology and a propagation model constructed by the three-subset separability technology are utilized, model variables are set for the propagation model, and finally solving is carried out. And meanwhile, constructing a super polynomial algebraic property detection module to accurately recover the super polynomial. According to the method, the efficiency of accurately recovering the super polynomial of the Atom algorithm can be improved, the time complexity is reduced, and the time cost is saved to a great extent.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a device and method for accurately recovering an Atom algorithm super polynomial. Background Art

[0002] The cubic attack was first proposed by Dinur, Shamir and others at the Eurocryptonomy Conference in 2009. It is now widely used in the security analysis of different cryptographic algorithms. These include the authenticated encryption algorithm based on Ascon, the stream cipher algorithm based on Trivium, and the hash function algorithm based on Keccak. The main idea is to use high-order differences and linear detection methods to recover the linear polynomial about the key, and then use these linear expressions to construct a system of equations, and recover part of the key by solving the constructed system of equations. This method enables the attacker to recover part of the key information with a lower time complexity than traditional brute force search, thereby reducing the overall time complexity of cracking the cryptographic algorithm. When the traditional cubic attack analyzes the stream cipher algorithm, the function expression of the stream cipher algorithm is regarded as a black box polynomial, and the structure of the super polynomial is recovered by linear or quadratic test methods. However, since the cubic attack is an attack method that analyzes the cryptographic algorithm through experiments, it faces many implementation problems. The main problem is resources. If the dimension of the selected cubic variable is large, such as a 50-dimensional cubic variable, it is difficult to use cubic attacks to analyze the security of cryptographic algorithms based on existing computing resources. Therefore, the size of the cubic variable selected by the attacker is generally less than 40 dimensions.

[0003] In 2016, Todo et al. proposed a new analysis method - separability analysis [1] . Separability is a general form of integral attack, which mainly exploits the properties hidden between the active word set and the balanced word set. In order to reduce the complexity required for searching the integral distinguisher for bit-level separability, Xiang et al. first proposed the MILP model that can describe the propagation of separability in 2016. At the same time, in order to better describe the propagation properties of separability, constructing a more accurate separability propagation model of cryptographic components has also been a focus of research in recent years, such as the construction method of the separability propagation model of the S-box and the modeling method of linear components. At the 2017 American Cryptography Conference, Todo et al. applied separability to the analysis of stream cipher algorithms for the first time and proposed a cubic attack method based on separability. [3],Using this method, on the one hand, the selection of cubic variables is no longer restricted, and the super polynomials corresponding to cubic variables of larger dimensions can be analyzed. On the other hand, the attacker can directly obtain which key variables are involved in the corresponding super polynomials and which key variables are not involved in the super polynomials through this method, further reducing the time complexity required to recover the super polynomials.

[0004] In order to carry out a key recovery attack, the attacker needs to accurately recover the specific form of the super polynomial. Wang et al. proposed a pruning technique and a fast propagation technique of three-subset separability based on the three-subset separability technique, and designed a method to recover the super polynomial based on the MILP model of three-subset separability propagation, but the results are still inaccurate.

[0005] Finally, Hao Yonglin and others completely solved the problem of inaccurate super polynomial recovery in 2020 [5] , which proposes a model with three-subset separability without unknown subsets, which can accurately recover the super polynomial within a reasonable time complexity.

[0006] Attacks against the Atom algorithm currently do not use a method based on a combination of two-subset separability and three-subset separability to solve the target cryptographic algorithm for the key variables and super polynomials contained in the super polynomial. Therefore, using a method based on a combination of two-subset separability and three-subset separability to solve the target cryptographic algorithm and accurately recover the super polynomial is a problem that needs to be solved.

[0007] References:

[0008] [1]Todo Y.,Morii M.(2016).Bit-Based Division Property and Application to Simon Family[C].In:Peyrin T.(eds)Fast Software Encryption 2016.LectureNotes in Computer Science,2016,vol 9783,pp.357–377;

[0009] [2]Xiang,Z.,Zhang,W.,Bao,Z.,Lin,D.(2016).Applying MILP Method toSearching Integral Distinguishers Based on Division Property for 6LightweightBlock Ciphers[C].In:Cheon,J.,Takagi,T.(eds)Advances in Cryptology–ASIACRYPT2016.Lecture Notes in Computer Science(),vol 10031.Springer,Berlin,Heidelberg.pp.648-678;

[0010] [3]Todo Y.,Isobe T.,Hao Y.,Meier W.Cube Attacks on Non-BlackboxPolynomials Based on Division Property.In:Katz J.,Shacham H.(eds)Advances inCryptology–CRYPTO 2017.Lecture Notes in Computer Science,2017,vol10403.pp.250-279;

[0011] [4]Wang,S.,Hu,B.,Guan,J.,Zhang,K.,Shi,T.(2019).MILP-aided Method ofSearching Division Property Using Three Subsets and Applications[C].In:Galbraith,S.,Moriai,S.(eds)Advances in Cryptology–ASIACRYPT 2019.LectureNotes in Computer Science,2019,vol 11923.Springer,Cham.pp.398–427;

[0012] [5]Hao, Y., Leander, G., Meier, W., Todo, Y., Wang, Q. Modeling for three-subset division property without unknown subset [C]. In: Canteaut A., Ishai Y. (eds) Advances in Cryptology–EUROCRYPT 2020, Lecture Notes in Computer Science, 2020, vol 12105. Springer, Cham. pp. 466–495. Summary of the invention

[0013] The purpose of the present invention is to propose a device and method for accurately recovering super polynomials of the Atom algorithm. The method combines the two-subset separability technology and the three-subset separability technology, uses the two-subset and three-subset separability technologies to respectively construct propagation models, then sets model variables for them, and finally solves them, and at the same time constructs a super polynomial algebraic property detection module to accurately recover the super polynomial. The method can improve the efficiency of accurately recovering super polynomials of the Atom algorithm, reduce time complexity, and save time cost to a great extent.

[0014] The present invention provides a device for accurately recovering the super polynomial of the Atom algorithm, such as Figure 1 As shown, the device is divided into four modules, including a model variable setting module, an Atom cryptographic algorithm two-subset separability propagation model construction module, an Atom cryptographic algorithm three-subset separability propagation model construction module and a super polynomial algebraic property detection module, and the functions of each module are:

[0015] (A) a model variable setting module, used to set variables corresponding to the Atom cryptographic algorithm, including key bits and public variable bits;

[0016] (B) A two-subset separability propagation model construction module of the Atom cryptographic algorithm, which splits the Atom algorithm operation into the basic operations of Copy, And, and Xor. According to the propagation properties of the two-subset separability, the separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model M of the Atom algorithm round function. Then, the separability propagation model M is iterated r times to generate a new separability propagation model M. r This module is used to construct a two-subset separable mixed integer linear programming model based on the structure of the Atom algorithm;

[0017] (C) Atom cryptographic algorithm three-subset separability propagation model construction module, which splits the Atom algorithm operation into Copy, And and Xor basic operations. According to the propagation properties of the three-subset separability, the separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model W of the Atom algorithm round function. Then, the separability propagation model W is iterated r times to generate a new separability propagation model W. r This module is used to construct a three-subset separable mixed integer linear programming model based on the structure of the Atom algorithm;

[0018] (D) a super polynomial algebraic property detection module, which includes a key detection module involved in the super polynomial, a super polynomial algebraic degree upper bound detection module, and a monomial detection module;

[0019] The key detection module involved in the super polynomial solves the key set involved according to the constructed two-subset separability propagation model; at the same time, when constructing the two-subset separability propagation model, the super polynomial algebraic degree upper bound detection module is added to obtain the highest algebraic degree of the super polynomial to calculate the time complexity and ensure that the key involved in the super polynomial corresponding to the selected cubic variable is meaningful; finally, the monomial detection module is constructed using the three-subset technology, and the algebraic degree upper bound and cubic variable set obtained using the two subsets are brought in to solve the model, and the super polynomial expression of the Atom cryptographic algorithm is accurately restored.

[0020] The present invention discloses a method for accurately recovering an Atom algorithm super polynomial, which combines a two-subset separability technique with a three-subset separability technique, adopts an Atom algorithm super polynomial device, and obtains an expression of the super polynomial. The method comprises the following steps:

[0021] (1) Through the model variable setting module, define an empty MILP model M in the register, and then set the key variable Key of the Atom algorithm to {key0, key1, ..., key 127} and initial variables IV={iv0,iv1,…,iv 127}Declare the corresponding MILP model variables, k={k0,k1,…,k 127} and v={v0,v1,…,v 127}, adding the MILP model variables to the model M;

[0022] (2) Through the two-subset separability propagation model of the Atom cryptographic algorithm, a mixed integer linear programming model M of the two-subset separability propagation of the Atom algorithm for r rounds is constructed. According to the propagation property of separability, the Atom algorithm operation is split into the basic operations of Copy, And and Xor, and the two-subset separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model M of the Atom algorithm round function. Then, the separability propagation model M is iterated r times to generate a new separability propagation model M. r ;

[0023] (3) Through the three-subset separability propagation model of the Atom cryptographic algorithm, a mixed integer linear programming model W for the three-subset separability propagation of the Atom cryptographic algorithm in round r is constructed. r According to the three-subset separability propagation property, the Atom algorithm operation is split into the basic operations of Copy, And and Xor, and the three-subset separability propagation models of these basic operations are constructed respectively to obtain the three-subset separability propagation model W of the Atom algorithm round function. Then, the separability propagation model W is iterated for r rounds to generate a new separability propagation model W. r ;

[0024] (4) The algebraic properties of the super polynomial are accurately detected by the super polynomial algebraic property detection module. The super polynomial involves a key detection module, a super polynomial algebraic degree upper bound detection module, and a monomial detection module. The detection steps include:

[0025] (4.1) The key detection module tests the key variables contained in the super polynomial. The subscript set of cubic variables is randomly selected and represented by I. If the subscript i exists in the selected cubic variable set I, in the separability propagation model M r Add constraints v i = 1, when i does not exist in the selected cubic variable set I, in the separability propagation model M r Add constraints v i = 0, and add constraints to the model

[0026] Set the set J to be an empty set, define an output variable called res1, and add an output constraint res1→1 to propagate the separability model M r Put it into the automated search tool Gurobi to solve the key involved in the super polynomial;

[0027] If the model M is detected r There is a feasible solution, and k i =1, then add the index i to the set J and add the restriction k i =0 to model M rRepeat this process until the model has no solution, and obtain the key variables involved in the super polynomial. The subscript set of the key variables involved in the super polynomial is J = {j0, j1, ..., j n-1}, n is an integer less than 128;

[0028] (4.2) Super polynomial algebraic degree upper bound detection module, solves the super polynomial algebraic degree upper bound, and based on the method in step (2), obtains the new two-subset separability model M of the Atom algorithm *r , select the same cubic variable set I as in step (4.1), when the subscript i exists in the selected cubic variable set I, in the separability propagation model M *r Add constraints v i = 1, when i does not exist in the selected cubic variable set I, in the separability propagation model M *r Add constraints v i =0, and set the objective function

[0029] Define another output variable called res2, and add an output constraint res2→1. Solve the model to obtain the upper bound d of the algebraic degree of the super polynomial.

[0030] (4.3) Monomial detection module, select the same cubic variables as in step (4.1), set restrictions on the model variables corresponding to the initial IV variables, if the subscript is in the cube set I, then the corresponding subscript variable is set to 1, and in the model W r Add relevant constraints v i =1(i∈I), the values ​​of the other variables corresponding to the model variables are set to 0, and in the model W r Add relevant constraints

[0031] Define another output variable as res3 and add the output constraint res3→1. Then define the super polynomial p=0 and transform the output obtained in steps (3) and (4) into the model W. r The restrictions in W r To solve, the specific operations are as follows:

[0032] Adding Constraints To Model W r , for model W r Solve and get the subscript set corresponding to the variables with component 1 in k, called J', and check the trajectory The number of items, where the symbol Represents a 128-bit vector, and only the position whose subscript is included in set I has a value of 1, and the other positions not included in set I have a value of 0. If the number of entries is an odd number, it means that J'={J'0,J'1,…,J'|J'|-1 The monomials about the key with} as subscripts are contained in the super polynomials corresponding to the cube variable set I, where |J'| is the number of elements in the set J';

[0033] Then add it to Otherwise, J'={J'0,J'1,…,J' |J'|-1} is the subscripted monomial about the key, which is not included in the super polynomial corresponding to the cube variable set I;

[0034] Then, set J' is set to the empty set and r Adding constraints Used to exclude the current solution and continue to solve the model W according to the above process r Solve until the model W r There is no solution, and we get the expression p of the final super polynomial.

[0035] Furthermore, the key variable key is a 128-bit vector, the initial variable IV is a 128-bit vector, the cube set is a positive integer set, the number of rounds is a positive integer, and the size of the cube set cannot exceed the size of the Atom algorithm key vector.

[0036] Furthermore, the mixed integer linear programming model of the Atom algorithm is solved to obtain relevant key bits and super polynomials involved in solving the super polynomial corresponding to the Atom algorithm, including placing the mixed integer linear programming model into an open source mixed integer linear programming solver, and running the mixed linear integer programming model based on the mixed integer linear programming solver to solve the relevant key bits and super polynomials that satisfy the Atom cryptographic algorithm.

[0037] The beneficial effects of the present invention are:

[0038] (1) The method of the present invention can solve the key involved in the super polynomial in the Atom algorithm and accurately recover the super polynomial of the Atom algorithm.

[0039] (2) The method of the present invention combines the two-subset technology and the three-subset technology, and brings the information obtained from solving the two-subset separability propagation model into the three-subset separability propagation model as a constraint condition, effectively improving the efficiency of solving the Atom super polynomial and reducing the space that needs to be searched for the three-subset separability.

[0040] (3) The method of the present invention applies separability and MILP (mixed integer linear programming model) to the Atom analysis algorithm, which has a certain effect on the security of Atom analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1A schematic diagram of a device for accurately recovering the super polynomial of the Atom algorithm according to the present invention;

[0042] Figure 2 Flow chart of the separability propagation model of the Atom algorithm of the present invention (the two subsets and the three subsets are the same);

[0043] Figure 3 A flow chart of a method for accurately solving a super polynomial to design a key in the method of the present invention;

[0044] Figure 4 A flow chart of a method for solving the upper bound of the algebraic degree of a super polynomial in the method of the present invention;

[0045] Figure 5 The present invention is a flowchart of a method for outputting a super polynomial through a monomial detection module in the method of the present invention. DETAILED DESCRIPTION

[0046] The contents of the present invention are further described below in conjunction with the drawings and embodiments, but are not intended to limit the present invention.

[0047] Embodiment In the hardware environment of Windows 11 operating system, Intel i9-12900 processor, 40GB DDR54800MHz memory, and LNVNB161216 motherboard, in combination with the software environment of python 3.11 and Gurobi 11.0.0 academic version, a model variable setting module, an Atom cryptographic algorithm two-subset separability propagation model construction module, an Atom cryptographic algorithm three-subset separability propagation model construction module, and a super polynomial algebraic property detection module are constructed in sequence, such as Figure 1 shown.

[0048] Example

[0049] Reference Figure 2-5 A method for accurately recovering the super polynomial of the Atom algorithm is implemented by using the constructed modules, and the method includes the following steps:

[0050] (1) Through the model variable setting module, refer to Figure 2 , define an empty MILP model M in the register. For the internal structure of the Atom algorithm, it has 128 key bits Key = {key0, key1, ..., key 127} and 128 initial variable bits IV={iv0,iv1,…,iv 127}, declare corresponding model variables for key and IV, respectively, denoted as k = {k0, k1, ... k 127} and v={v0,v1,…v 127}, and then add it to the model M as a model variable.

[0051] (2) Through the two-subset separability propagation model of the Atom algorithm, a mixed integer linear programming model M for the two-subset separability propagation of the Atom algorithm in round r is constructed. Figure 2 , according to the propagation property of divisibility, the Atom algorithm operation is split into basic operations such as Copy, And and Xor, and two subsets of separability propagation models of these basic operations are constructed respectively and added to the model M. The specific method is as follows:

[0052]

[0053]

[0054] Based on the structure of the Atom algorithm, the separability propagation model M of the Atom algorithm round function is obtained, and then the separability propagation model M is iterated r times to generate a new separability propagation model M r .

[0055] (3) Through the three-subset separability propagation model of the Atom algorithm, a mixed integer linear programming model W for the three-subset separability propagation of the Atom cryptographic algorithm in round r is constructed. r , refer to Figure 2 , according to the propagation properties of the three-subset separability, the Atom algorithm operation is split into basic operations such as Copy, And and Xor, and the separability propagation models of these basic operations are constructed respectively and added to W. The specific method is as follows:

[0056]

[0057] Based on the structure of the Atom algorithm, the separability propagation model W of the Atom algorithm round function is obtained, and then the separability propagation model W is iterated r times to generate a new separability propagation model W r .

[0058] (4) The algebraic properties of the super polynomial are accurately detected through the polynomial algebraic property detection module. The super polynomial involves a key detection module, a super polynomial algebraic degree upper bound detection module, and a monomial detection module. The detection steps are as follows:

[0059] (4.1) The key detection module involved in the super polynomial tests the key variables contained in the super polynomial, referring to Figure 3 , randomly select a set of subscripts of cubic variables and denote them by I. When the subscript i exists in the selected set of cubic variables I, in the separability propagation model M r Add constraints v i= 1, when i does not exist in the selected cubic variable set I, when i does not exist in the selected cubic variable set I, add constraint v in the separability propagation model i = 0, and use Gurboi to add constraints M in the model r .addConstr(quicksum(k))==1;

[0060] Set the initial set J to be empty, define an output variable called res1, and add an output constraint res1→1 to propagate the separability model M r Put it into the automated search tool Gurobi and use Gurobi's M r .optimize() function to solve the key involved in the super polynomial;

[0061] If the model M is detected r There is a feasible solution, and k i =1, use Gurobi's k[idx].Xn==1 to judge, add the subscript i to the set J, and then add the restriction k i =0 to model M r Repeat this process until the model has no solution, and obtain the key variables involved in the super polynomial. The subscript set of the key variables involved in the super polynomial is J = {j0, j1, ..., j n-1}, n is an integer less than 128;

[0062] (4.2) Super polynomial algebraic degree upper bound detection module, solve the super polynomial algebraic degree upper bound, refer to Figure 4 Based on the method in step (2), we get the new two-subset separability model M* of the Atom algorithm. r , select the same cubic variable set I as in step (4.1), when the subscript i exists in the selected cubic variable set I, in the separability propagation model M *r Add constraints v i = 1, when i does not exist in the selected cubic variable set I, add constraint v in the separability propagation model i = 0, and use Gurobi to set M in the model *r Objective function:

[0063] M *r .setObjective(quicksum(k),GRB.MAXIMIZE);

[0064] Define another output variable called res2 and add the output constraint res2→1. Use Gurobi’s M * r.optimize() function and M *r The .ObjVal() function solves the model and obtains the upper bound d of the algebraic degree of the super polynomial;

[0065] (4.3) Monomial detection module, refer to Figure 5 , select the same cubic variables as in step (4.1), set restrictions on the model variables corresponding to the initial IV variables, if the subscript is in the cube set I, then the corresponding subscript variable is set to 1, and in the model W r Add relevant constraints v i =1(i∈I), the values ​​of the other variables corresponding to the model variables are set to 0, and in the model W r Add relevant constraints

[0066] Define another output variable as res3 and add the output constraint res3→1. Then define the super polynomial p=0 and transform the output obtained in steps (3) and (4) into the model W. r The restrictions in W r To solve, the specific operations are as follows:

[0067] Adding Constraints To Model W r , for model W r Solve and get the subscript set corresponding to the variables with component 1 in k, which is called J'. Use Gurobi's W r .SolCount() function checks the trajectory The number of items, where the symbol Represents a 128-bit vector, where only the positions whose subscripts are included in set I have values ​​of 1, and the values ​​of the other positions not included in set I are 0;

[0068] Define the variable Tempnum to store the number of trajectories, and use Tempnum%2==1 to determine whether it is an odd number. If the number is an odd number, it means that J'={J'0, J'1, ..., J' |J'|-1 The monomials about the key with} as subscripts are contained in the super polynomials corresponding to the cube variable set I, where |J'| is the number of elements in the set J';

[0069] Then add it to Otherwise, J'={J'0,J'1,…,J' |J'|-1} is the subscripted monomial about the key, which is not included in the super polynomial corresponding to the cube variable set I;

[0070] Then, set J' is set to the empty set and r Adding constraints Used to exclude the current solution and use W in Gurobi r The .optimize() function continues to optimize the model W r Solve until the model W r There is no solution, and we get the expression p of the final super polynomial.

[0071] The method of the present invention solves the mixed integer linear programming model of the Atom algorithm to obtain relevant key bits and super polynomials involved in solving the super polynomial corresponding to the Atom algorithm, including putting the mixed integer linear programming model into an open source mixed integer linear programming solver, running the mixed linear integer programming model based on the mixed integer linear programming solver to solve the relevant key bits and super polynomials that satisfy the Atom cryptographic algorithm, and the obtained results have a certain effect on the security analysis of the Atom algorithm.

Claims

1. A device for accurately recovering the super polynomial of the Atom algorithm, characterized in that: The device comprises a model variable setting module, an Atom cryptographic algorithm two-subset separability propagation model construction module, an Atom cryptographic algorithm three-subset separability propagation model construction module and a super polynomial algebraic property detection module, which are sequentially arranged. The functions of each module are: (A) a model variable setting module, used to set variables corresponding to the Atom cryptographic algorithm, including key bits and public variable bits; (B) A two-subset separability propagation model construction module of the Atom cryptographic algorithm, which splits the Atom algorithm operation into the basic operations of Copy, And, and Xor. According to the propagation properties of the two-subset separability, the separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model M of the Atom algorithm round function. Then, the separability propagation model M is iterated r times to generate a new separability propagation model M. r This module is used to construct a two-subset separable mixed integer linear programming model based on the structure of the Atom algorithm; (C) Atom cryptographic algorithm three-subset separability propagation model construction module, which splits the Atom algorithm operation into Copy, And and Xor basic operations. According to the propagation properties of the three-subset separability, the separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model W of the Atom algorithm round function. Then, the separability propagation model W is iterated r times to generate a new separability propagation model W. r This module is used to construct a three-subset separable mixed integer linear programming model based on the structure of the Atom algorithm; (D) a super polynomial algebraic property detection module, which includes a key detection module involved in the super polynomial, a super polynomial algebraic degree upper bound detection module, and a monomial detection module; The key detection module involved in the super polynomial solves the key set involved according to the constructed two-subset separability propagation model; at the same time, when constructing the two-subset separability propagation model, the super polynomial algebraic degree upper bound detection module is added to obtain the highest algebraic degree of the super polynomial to calculate the time complexity and ensure that the key involved in the super polynomial corresponding to the selected cubic variable is meaningful; finally, the monomial detection module is constructed using the three-subset technology, and the algebraic degree upper bound and cubic variable set obtained using the two subsets are brought in to solve the model, and the super polynomial expression of the Atom cryptographic algorithm is accurately restored.

2. A method for accurately recovering the super polynomial of the Atom algorithm, characterized in that: Using the device of claim 1, the method comprises the following steps: (1) Through the model variable setting module, define an empty MILP model M in the register, and then set the key variable Key of the Atom algorithm to {key0, key1, ..., key 127 } and initial variables IV={iv0,iv1,…,iv 127 }Declare the corresponding MILP model variables, k={k0,k1,…,k 127 } and v={v0,v1,…,v 127 }, adding the MILP model variables to the model M; (2) Through the two-subset separability propagation model of the Atom cryptographic algorithm, a mixed integer linear programming model M of the two-subset separability propagation of the Atom algorithm for r rounds is constructed. According to the propagation property of separability, the Atom algorithm operation is split into the basic operations of Copy, And and Xor, and the two-subset separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model M of the Atom algorithm round function. Then, the separability propagation model M is iterated r times to generate a new separability propagation model M. r ; (3) Through the three-subset separability propagation model of the Atom cryptographic algorithm, a mixed integer linear programming model W for the three-subset separability propagation of the Atom cryptographic algorithm in round r is constructed. r According to the three-subset separability propagation property, the Atom algorithm operation is split into the basic operations of Copy, And and Xor, and the three-subset separability propagation models of these basic operations are constructed respectively to obtain the three-subset separability propagation model W of the Atom algorithm round function. Then, the separability propagation model W is iterated for r rounds to generate a new separability propagation model W. r ; (4) The algebraic properties of the super polynomial are accurately detected by the super polynomial algebraic property detection module. The super polynomial involves a key detection module, a super polynomial algebraic degree upper bound detection module, and a monomial detection module. The detection steps include: (4.1) The key detection module tests the key variables contained in the super polynomial. The subscript set of cubic variables is randomly selected and represented by I. If the subscript i exists in the selected cubic variable set I, in the separability propagation model M r Add constraints v i = 1, when i does not exist in the selected cubic variable set I, in the separability propagation model M r Add constraints v i = 0, and add constraints to the model Set the set J to be an empty set, define an output variable called res1, and add an output constraint res1→1 to propagate the separability model M. r Put it into the automated search tool Gurobi to solve the key involved in the super polynomial; If the model M is detected r There is a feasible solution, and k i =1, then add the index i to the set J and add the restriction k i =0 to model M r Repeat this process until the model has no solution, and obtain the key variables involved in the super polynomial. The subscript set of the key variables involved in the super polynomial is J = {j0, j1, ..., j n-1 }, n is an integer less than 128; (4.2) Super polynomial algebraic degree upper bound detection module, solves the super polynomial algebraic degree upper bound, and based on the method in step (2), obtains the new two-subset separability model M of the Atom algorithm *r , select the same cubic variable set I as in step (4.1), when the subscript i exists in the selected cubic variable set I, in the separability propagation model M *r Add constraints v i = 1, when i does not exist in the selected cubic variable set I, in the separability propagation model M *r Add constraints v i =0, and set the objective function Define another output variable called res2, and add an output constraint res2→1. Solve the model to obtain the upper bound d of the algebraic degree of the super polynomial. (4.3) Monomial detection module, select the same cubic variables as in step (4.1), set restrictions on the model variables corresponding to the initial IV variables, if the subscript is in the cube set I, then the corresponding subscript variable is set to 1, and in the model W r Add relevant constraints v i =1(i∈I), the values ​​of the other variables corresponding to the model variables are set to 0, and in the model W r Add relevant constraints Define another output variable as res3 and add the output constraint res3→1. Then define the super polynomial p=0 and transform the output obtained in steps (3) and (4) into the model W. r The restrictions in W r To solve, the specific operations are as follows: Adding Constraints To Model W r , for model W r Solve and get the subscript set corresponding to the variables with component 1 in k, called J', and check the trajectory The number of items, where the symbol Represents a 128-bit vector, and only the position whose subscript is included in set I has a value of 1, and the other positions not included in set I have a value of 0. If the number of entries is an odd number, it means that J'={J'0,J'1,…,J' |J'|-1 The monomials about the key with} as subscripts are contained in the super polynomials corresponding to the cube variable set I, where |J'| is the number of elements in the set J'; Then add it to Otherwise, J'={J'0,J'1,…,J' |J'|-1 } is the subscripted monomial about the key, which is not included in the super polynomial corresponding to the cube variable set I; Then, set J' is set to the empty set and W r Adding constraints Used to exclude the current solution and continue to solve the model W according to the above process r Solve until the model W r There is no solution, and we get the expression p of the final super polynomial.

3. The method for accurately recovering the Atom algorithm super polynomial as claimed in claim 2, characterized in that: The key variable key is a 128-bit vector, the initial variable IV is a 128-bit vector, the cube set is a positive integer set, the number of rounds is a positive integer, and the size of the cube set cannot exceed the size of the Atom algorithm key vector.

4. The method for accurately recovering the Atom algorithm super polynomial as claimed in claim 2, characterized in that: The mixed integer linear programming model of the Atom algorithm is solved to obtain relevant key bits and super polynomials involved in solving the super polynomial corresponding to the Atom algorithm, including placing the mixed integer linear programming model into an open source mixed integer linear programming solver, and running the mixed linear integer programming model based on the mixed integer linear programming solver to solve the relevant key bits and super polynomials that satisfy the Atom cryptographic algorithm.

Images