Lightweight password-oriented multi-round key genetic algorithm side channel analysis method

Abstract

The invention relates to the field of multi-round keys, in particular to a lightweight cipher-oriented multi-round key genetic algorithm side channel analysis method, which comprises the following steps of: respectively constructing triples of round keys K1 and KT-1, and searching triples corresponding to a round key K0 and the round key K1 and triples corresponding to KT-2 and KT-1 in parallel by using a genetic algorithm; wherein the round key is a sub-key which is generated by the main key through a key expansion algorithm in the block cipher algorithm and is used for each round of operation; t is the encryption round number of the block cipher algorithm; k0 refers to a first round secret key; k1 refers to a second round of round key; kT-2 refers to a round key of the last but one round; kT-1 refers to the last round of round key; the triple is a set which is used for representing a specific round key and contains three elements, and the bit number of each element is the same as that of the round key. And when the lightweight block cipher algorithm which is realized in parallel is analyzed, the calculation complexity is lower and the recovery success rate is higher.

Description

Technical Field

[0001] The present disclosure relates to the field of multi-round keys, and more specifically, to a multi-round key genetic algorithm side channel analysis method for lightweight cryptography. Background Art

[0002] With the rapid development of Internet of Things technology, lightweight cryptographic algorithms have been proposed to meet the needs of data encryption operations in resource-constrained scenarios. They are characterized by low resource usage and fast operation speed. They can reduce the amount of calculation while ensuring security, and have broad application prospects in Internet of Things terminal devices. Lightweight block ciphers are quite different from classical block ciphers, and their physical security has also received widespread attention from cryptographic researchers.

[0003] Classical cryptanalysis technology analyzes the structure of cryptographic algorithms and collects plaintext and ciphertext information leaked through standard channels to recover keys. However, due to the high complexity of cryptographic operations and the extremely long nature of keys, traditional cryptanalysis technology is difficult to effectively crack in practical applications. In 1996, Kocher et al. proposed side channel analysis technology, which uses various types of physical side information such as energy and electromagnetics leaked from devices to capture intermediate value data directly or indirectly, and then recover the key with lower computational complexity.

[0004] Correlation energy analysis is a side channel analysis method proposed by Brier et al. based on differential energy analysis and combined with the improvement of the Hamming weight model. The core point of CPA is to calculate the correlation coefficient between the energy consumption value and the intermediate value of the cryptographic device when performing cryptographic operations, so as to crack the key information inside the device.

[0005] Since artificial intelligence technology was introduced into the field of side channel analysis in 2011, it has provided a new perspective and ideas for side channel analysis, with remarkable results. However, the current side channel technology based on artificial intelligence still has certain shortcomings, such as it is difficult for some analysis scenarios to provide sufficient training data to meet the training needs of supervised learning algorithms, and unsupervised learning algorithms are prone to fall into local optimality and existing methods.

[0006] As a core concept in the field of artificial intelligence, heuristic algorithms are effective tools for solving complex optimization problems. Genetic algorithms are a type of heuristic search algorithm. Inspired by the idea of ​​"evolution" in the biological world, they simulate the evolution of species to find the optimal solution to the problem, thereby effectively reducing the key search space and having a good effect in key guessing in the side channel field. In 2015, a related energy analysis method based on genetic algorithms was proposed to analyze the parallel DES algorithm and recover the complete key with less energy waveform than the traditional CPA, which significantly improved the analysis efficiency. However, existing research mainly focuses on the situation where the master key is only distributed in a single round of encryption, and lacks relevant discussions on cryptographic algorithms where the master key is distributed in multiple rounds of operations. At the same time, the genetic algorithm itself has limitations, and there may be problems where the local optimum cannot be jumped out, which in turn leads to errors in some of the recovered key bytes. Summary of the invention

[0007] The purpose of the present invention is to solve the technical problem that the existing genetic algorithm-based side channel method cannot analyze the cryptographic algorithm in which the master key participates in multi-round encryption operations and is prone to local convergence when recovering the key, and proposes a multi-round key genetic algorithm side channel analysis method for lightweight cryptography. This method realizes the energy analysis of lightweight block ciphers implemented in parallel and improves the key recovery success rate.

[0008] In order to achieve the above object, the present invention adopts the following technical scheme.

[0009] A multi-round key genetic algorithm side channel analysis method for lightweight cryptography, comprising the following steps: Step 1: Construct the triplets of round keys K1 and KT-1 respectively, and use the genetic algorithm to search in parallel the triplets corresponding to round keys K0 and K1 and the triplets corresponding to KT-2 and KT-1.

[0010] Among them, the round key is the subkey used for each round of operation generated by the master key through the key expansion algorithm in the block cipher algorithm; T is the number of encryption rounds of the block cipher algorithm; K0 refers to the first round round key; K1 refers to the second round round key; KT-2 refers to the second to last round round key; KT-1 refers to the last round round key; a triplet is a set of three elements used to represent a specific round key, and the number of bits of each element is the same as the round key.

[0011] Specifically, step 1 includes the following steps: Step 1.1: The random number generator randomly generates the initial key, that is, the individuals of the population, and the randomly generated individuals are used as the initial population of evolution; Among them, an individual refers to a complete guessed key, including the triples corresponding to the previous round key and the next round key; Step 1.2: Calculate the fitness of individuals in the population, including the following steps: Step 1.2.1: Collect the energy traces generated during the encryption operation of the cryptographic algorithm; Step 1.2.2: Calculate the correlation coefficient between the energy mapping of the intermediate value corresponding to the guessed key represented by each individual and the collected energy waveform; Among them, the intermediate value refers to the value containing key-related information during the encryption process of the cryptographic algorithm; Among them, the correlation coefficient is the fitness of the individual; Step 1.3: Perform three operations of selection, crossover and mutation on the individuals in the population to obtain the next generation population; Among them, selection refers to picking out individuals with higher fitness in the population; Among them, crossing means randomly selecting a crossing point on an individual and exchanging the bits of the two guessed keys after the crossing point; Among them, mutation refers to flipping the bit at a random position of the guessed key represented by the individual, and only one bit is mutated each time; Step 1.4: Repeat steps 1.2 to 1.3 until the iteration limit is reached; The upper limit of iterations ranges from 150 to 250 times.

[0012] Step 1.5: The value of the triple corresponding to the round keys K1 and KT-1 is equal to the individual with the highest fitness in the population.

[0013] Step 2: Fix the candidate keys of K1 and KT-1, and use the genetic algorithm to search for K0 and KT-2.

[0014] Among them, the candidate key refers to the key guess value that is currently closest to the correct key; Specifically, step 2 includes the following steps: Step 2.1: Based on the triples obtained in step 1, derive the candidate keys of K1 and KT-1; Step 2.2: According to the method described in steps 1.1 to 1.5, the energy mapping of the intermediate values ​​corresponding to the keys of two adjacent rounds is summed, and the correlation coefficient is calculated with the energy waveform as the individual fitness to obtain the final guess results of K0 and KT-2.

[0015] Step 3: Fix the values ​​of K0 and KT-2, and use the genetic algorithm to search for K1 and KT-1 according to the method described in step 2.2.

[0016] Step 4: Derive the master key based on the first and last two round keys recovered in steps 2 and 3.

[0017] This application at least has the following beneficial effects: 1. Compared with the existing related energy analysis method based on genetic algorithm, the method provided by this application can analyze the cryptographic algorithm in which the master key is distributed in multiple rounds of encryption; 2. Compared with other side channel methods based on genetic algorithms, the method provided by this application has lower computational complexity and higher recovery success rate when analyzing lightweight block cipher algorithms implemented in parallel.

[0018] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The above and other purposes, features and advantages of the embodiments of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0020] Figure 1 A schematic diagram of the overall process provided for the embodiment of the present application; Figure 2 An energy waveform diagram provided for an embodiment of the present application; Figure 3 A schematic diagram of a single-round encryption process provided in an embodiment of the present application; Figure 4 A schematic diagram of the first two rounds of encryption process provided in an embodiment of the present application; Figure 5 A genetic algorithm flow chart provided for an embodiment of the present application; Figure 6 Schematic diagram of individual structures provided for embodiments of the present application. DETAILED DESCRIPTION

[0021] The technical solutions in the embodiments of the present disclosure will be described clearly and completely below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0022] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme of the present application is further elaborated in detail below in conjunction with the accompanying drawings and embodiments. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the following description, it is related to "optional implementation method", which describes a subset of all possible embodiments, but it can be understood that the "optional implementation method" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. The term "first / second" involved is only to distinguish similar objects, and does not represent a specific order for the object. It can be understood that "first / second" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of the present application. The terms used herein are only for the purpose of describing the present application and are not intended to limit the present application.

[0023] The embodiment of the present application provides a multi-round key genetic algorithm side channel analysis method for lightweight cryptography, the overall process is as follows: Figure 1 shown.

[0024] Taking SIMON, a lightweight block cipher algorithm with a block length of 32 bits, a key length of 64 bits, and 32 encryption rounds, as an example, the SIMON algorithm is implemented on the SAKURA-G development board, the key is fixed, 200,000 random plaintexts are generated, and the collected energy waveform is analyzed to recover the master key. The waveform is shown in the figure. Figure 2 shown. Figure 3 This is a schematic diagram of the single-round encryption process of the SIMON algorithm, where (Li, Ri) is the input of the i-th round, Ki is the round key, Sj represents the left shift of loop j, and & is the logical AND operator.

[0025] The length of the master key is four times that of the round key, and is distributed in the first four rounds of operations, denoted as (K0, K1, K2, K3). Since the key expansion process is a linear transformation, the master key and any round key can be derived from each other, so correctly recovering the first and last two round keys, that is, the values ​​of K0, K1, KT-2, KT-1, is equivalent to recovering the master key. The energy mapping of the intermediate value corresponding to the round key Ki is the Hamming distance from Li to Li+1, that is, the Hamming weight of Li⊕Li+1.

[0026] The specific process of key recovery is as follows: Construct the triples of the next round keys K1 and KT-1 respectively as follows: Taking the construction of the triple of K1 as an example, the general process of constructing the next-round key triple is explained.

[0027] Figure 4 For the first two rounds of the round key encryption process, tmp represents the value before XOR with the key K0 in the first round, a represents the value of the key K0 after cyclic left shift by 1 bit, b represents the value of the key K0 after cyclic left shift by 8 bits, and C represents the value of the key K0 after cyclic left shift by 2 bits. Let d = (a∧b)⊕c⊕K1. Use a, b, d to replace K1 as the recovery target and construct the triple (a, b, d). When restoring K0 and K1 in parallel, we are actually restoring K0 and a, b, d.

[0028] Get the triplet guess value corresponding to the next round key as follows: Taking the parallel recovery of the triples corresponding to K0 and K1 as an example, the general process of obtaining the triples corresponding to the next round of keys is explained, as follows: Figure 5 shown.

[0029] First, initialize the population.

[0030] Define an individual as a complete guess key containing K0 and a, b, d, which is constructed as follows Figure 6 As shown. The initial key, that is, the individual of the population, is randomly generated by a random number generator, and the randomly generated individuals are used as the initial population of evolution.

[0031] Then, the fitness of individuals in the population is calculated.

[0032] The fitness is defined as the correlation coefficient between the energy mapping of the intermediate value corresponding to the guessed key represented by each individual and the collected energy waveform. Calculate HW (L0⊕L1) + HW (L1⊕L2) to get the energy mapping of the intermediate value. Collect the energy traces generated during the encryption operation of the cryptographic algorithm, perform leakage analysis, and find the leakage position on the waveform. Based on the intermediate value and the waveform, the correlation coefficient can be calculated.

[0033] Next, the selection operation, crossover operation, mutation operation and fitness calculation are performed in sequence, and after Ngen iterations, the individual with the highest fitness in the population is output. Among them, the crossover rate is Pc, the mutation rate is Pm, and the fitness calculation is the same as the above method.

[0034] Finally, the optimal individual K'0‖a'‖b'‖d' is output, and (a', b', d') is the corresponding triple guess value. Similarly, the triple guess value corresponding to KT-1 can be obtained.

[0035] Get the final guess result of the front wheel key as follows: Taking fixing K1 and adjusting K0 as an example, the general process of obtaining the final guess result of the front-round key is explained.

[0036] First, based on the previously obtained K'0 and the triple (a', b', d'), the guessed key K'1 that is currently closest to the correct key is calculated, K'1=((a'∧b')⊕c'⊕d').

[0037] Then, use the genetic algorithm to search for K0. Define the individual as a complete guess key containing K0 and K'1, where the value of K'1 is fixed and known. The fitness definition remains unchanged. Follow the above genetic algorithm to obtain the optimal individual K''0‖K'1, and K''0 is the final guess result of K0. Similarly, the final guess result of KT-2 can be obtained.

[0038] Get the final guess result of the rear round key as follows: Taking fixing K0 and adjusting K1 as an example, the general process of obtaining the final guess result of the rear-round key is explained.

[0039] Using the same method as above, we can search for K1 using a genetic algorithm. The individual definition and fitness definition remain unchanged. We can get the optimal individual K''0‖K''1. K''1 is the final guess of K1, which is the final guess of KT-1. Similarly, we can get the final guess of KT-1.

[0040] Based on the recovered first two round keys, the master key is derived as follows: The values ​​of K2 and K3 are calculated from the recovered first two rounds of keys K0 and K1, and the last two rounds of keys KT-2 and KT-1. By performing key expansion through a computer program, K0, K1, KT-2, KT-1 and K2, K3 can be expressed as the relationship between them as shown in formula (1): AK0+BK1+CK2+DK3= (1) Where A, B, C, and D are all constant matrices of size 128*64, so K2 and K3 can be expressed as formula (2): The master key can be expressed as K=K0‖K1‖K2‖K3.

[0041] The parameters in the above process are set to Ngen=200, Pc=0.5, Pm=0.006, and experiments are conducted to count the success rate and the number of required energy traces. The experimental results show that when the number of waveforms is 100,000, the key recovery success rate is 90%.

[0042] In comparison, when a simple genetic algorithm framework is used to recover the key from the same simulated energy traces, the key recovery success rate is only 38% when the number of waveforms is 100,000.

[0043] It should be noted that the object information (including but not limited to the object's device information, corresponding personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0044] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0045] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above-mentioned embodiments only express several implementation methods of the present application, and their descriptions are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of this application. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several deformations and improvements can be made, which all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be based on the attached claims.

Claims

1. A multi-round key genetic algorithm side channel analysis method for lightweight cryptography, characterized in that: The platform includes: step 1: constructing the triplets of round keys K1 and KT-1 respectively, and using a genetic algorithm to search in parallel the triplets corresponding to round keys K0 and K1 and the triplets corresponding to KT-2 and KT-1; Step 1 includes the following steps: Step 1.1: The random number generator randomly generates the initial key, that is, the individuals of the population, and the randomly generated individuals are used as the initial population of evolution; Step 1.2: Calculate the fitness of individuals in the population, including the following steps: Step 1.2.1: Collect the energy traces generated during the encryption operation of the cryptographic algorithm; Step 1.2.2: Calculate the correlation coefficient between the energy mapping of the intermediate value corresponding to the guessed key represented by each individual and the collected energy waveform; Among them, the intermediate value refers to the value containing key-related information during the encryption process of the cryptographic algorithm; Among them, the correlation coefficient is the fitness of the individual; Step 1.3: Perform three operations of selection, crossover and mutation on the individuals in the population to obtain the next generation population; Step 1.4: Repeat steps 1.2 to 1.3 until the iteration limit is reached; Among them, the value range of the iteration upper limit is 150 to 250 times; Step 1.5: The value of the triple corresponding to the round keys K1 and KT-1 is equal to the fitness of the individual in the population; Step 2: Fix the candidate keys of K1 and KT-1, and use genetic algorithm to search for K0 and KT-2; Among them, the candidate key refers to the key guess value that is currently closest to the correct key; Specifically, step 2 includes the following steps: Step 2.1: Based on the triples obtained in step 1, derive the candidate keys of K1 and KT-1; Step 2.2: According to the method described in steps 1.1 to 1.5, the energy mapping of the intermediate values ​​corresponding to the keys of two adjacent rounds is summed, and the correlation coefficient is calculated with the energy waveform as the individual fitness to obtain the final guess results of K0 and KT-2; Step 3: Fix the values ​​of K0 and KT-2, and use the genetic algorithm to search for K1 and KT-1 according to the method described in step 2.2; Step 4: Derive the master key based on the first and last two round keys recovered in steps 2 and 3.

2. The method for side channel analysis of a multi-round key genetic algorithm for lightweight cryptography according to claim 1, characterized in that: The round key in step 1 is a subkey for each round of operation generated by a master key through a key expansion algorithm in a block cipher algorithm; T is the number of encryption rounds of the block cipher algorithm; K0 refers to the first round key; K1 refers to the second round key; KT-2 refers to the second to last round key; KT-1 refers to the last round key; a triplet is a set of three elements used to represent a specific round key, and the number of bits of each element is the same as the round key.

3. The method for side channel analysis of a multi-round key genetic algorithm for lightweight cryptography according to claim 1, characterized in that: In step 1.1, the individual refers to a complete guessed key, including a triple corresponding to the front-round key and the rear-round key.

4. The method for side channel analysis of a multi-round key genetic algorithm for lightweight cryptography according to claim 1, characterized in that: In the step 1.3, selection refers to selecting individuals with higher fitness in the population; wherein, crossing refers to randomly selecting an intersection point on the individual and exchanging the bits of the two guessed keys after the intersection point; wherein, mutation refers to flipping the bits at a random position of the guessed key represented by the individual, and only mutating one bit each time.

Images