A Differential Fault Attack Method for Lightweight Authentication Encryption Algorithms

Abstract

This invention discloses a lightweight authentication encryption algorithm differential fault attack method, relating to the fields of cryptography and information security technology; it initializes the AEGIS encryption algorithm and injects a random single-bit fault, with plaintext P as input. i The method involves encrypting the AEGIS encryption algorithm after initialization to generate correct and incorrect ciphertexts and obtaining their output difference. The output difference between the correct and incorrect ciphertexts is then XORed, and the location of the fault is determined using the XOR result. Byte state recovery is then performed based on the XOR result, and the word state recovery process is repeated. Finally, the inverse round function formula and encryption formula are applied to restore the complete internal state. This invention employs a lightweight authentication encryption algorithm differential fault attack method, which can efficiently extract key features from complex high-dimensional time-series data and accurately identify potential fault modes.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and information security, and in particular to a differential fault attack method for a lightweight authentication encryption algorithm. Background Technology

[0002] Currently, differential fault attacks have been applied to the analysis of some lightweight encryption algorithms. Researchers used a bit-based fault model in the LBLOCK algorithm and successfully recovered the key. Others have injected five fault operations in the LBLOCK algorithm in half-byte units, which can recover the master key.

[0003] Since its inception, AEGIS has been extensively studied. Some studies have analyzed the linearity deviation in the AEGIS algorithm keystream, finding a deviation of [missing information - likely a value] in the AEGIS-256 keystream. A linear mask was obtained, and a discriminator was constructed to... The encryption complexity recovers some plaintext information. Given the threat of fault attacks to lightweight algorithms and the importance of AEGIS, some researchers have found that injecting faults into fixed single-bit units can restore the state of the AEGIS algorithm. Restoring the intermediate state requires 384 fixed single-bit faults. Therefore, the number of rounds required by the existing technology is relatively complex, the number of faults required to restore the master key is huge, the attack range and actual attack efficiency are not significantly improved, and it requires extremely high costs. Summary of the Invention

[0004] The purpose of this invention is to provide a lightweight authentication encryption algorithm differential fault attack method, which significantly simplifies the complex round design, makes the input-output relationship of S-box replacement intuitive and clear, greatly reduces the number of faults required to recover the master key, thereby saving a lot of manpower and time costs, effectively expanding the attack range, and improving the actual effectiveness of the attack.

[0005] To achieve the above objectives, this invention provides a lightweight authentication encryption algorithm differential fault attack method, which, when used legally, includes the following steps:

[0006] S1. Initialize the AEGIS encryption algorithm and inject a random single-bit error fault;

[0007] S2, Input plaintext The AEGIS encryption algorithm after S1 processing is used to encrypt and generate correct and incorrect ciphertext, and the output difference between the two is obtained;

[0008] S3. Calculate the XOR result based on the output difference between the correct ciphertext and the incorrect ciphertext in S2;

[0009] S4. Determine the location of the fault by XORing the result of S3;

[0010] S5. After determining the location of the fault, perform byte state recovery based on the XOR result and repeat the recovery process to perform word state recovery.

[0011] S6. Based on the word recovered in S5, apply the inverse operation formula of the round function and the encryption formula to restore the complete internal state.

[0012] Preferably, the specific process of S1 is as follows:

[0013] S11, Let , , , , For the first The sub-state at the start of the round, , The five sub-states constitute the internal state of the AEGIS encryption algorithm and are positive integers.

[0014] S12, Towards If a random single-bit fault is injected, the random single-bit fault will propagate to... That is The internal state of the wheel;

[0015] S13, each Rotate to update state, new state , , , , The calculation process is as follows:

[0016]

[0017]

[0018]

[0019]

[0020]

[0021] in, This is represented as an XOR operation. This is the round function expression.

[0022] Preferably, the specific workflow of S2 is as follows:

[0023] S21. Obtain plaintext according to the encryption formula. Encryption yields both correct and incorrect ciphertext, using the following encryption formula:

[0024] ,

[0025] in, For the generated ciphertext, To encrypt intermediate operations, For operation;

[0026] Correct ciphertext as follows:

[0027]

[0028] in, For the first i+1 The explicit text of the wheel, For the first i + k The first round t An intermediate state ;

[0029] Error ciphertext as follows:

[0030]

[0031] in, For the injection fault, the first i + k The first round t An intermediate state;

[0032] S22. Calculate the output difference between the correct ciphertext and the incorrect ciphertext. The formula is as follows:

[0033] .

[0034] Preferably, the specific process of S3 is as follows:

[0035] S31. Assuming the fault occurs in the last byte, we get... as follows:

[0036]

[0037] in, The first input for the S box k Line number t List a byte, The fourth row and fourth column byte is where the fault is injected;

[0038] S32, after S box replacement SubBytes row shift ShiftRows Confusion between columns MixColumns after, from get, The results of the S-box replacement are as follows:

[0039] ;

[0040] in, The byte replacement k Line number n List a byte, , This refers to the fourth row and fourth column of bytes after byte substitution following the injected fault.

[0041] pass ShiftRows The results are as follows:

[0042] ;

[0043] Finally, through MixColumns The result after mixing is as follows:

[0044]

[0045] ;

[0046] S33. Based on the output difference of S22 and the round function of S32, the XOR result between the correct ciphertext and the incorrect ciphertext is as follows:

[0047]

[0048]

[0049]

[0050] .

[0051] Preferably, the process of determining the specific location of the fault in S4 is as follows:

[0052] S41, according to The value determines whether a fault exists. If a fault exists, the relative position of the faulty row is calculated using the following formula:

[0053]

[0054] in, For the first i+1 The first XOR result of the round-coded text k Line number n List of bytes;

[0055] S42. Based on the formula for the relative position of the faulty line, the faulty line is obtained as follows:

[0056]

[0057] in, Indicates the row where the fault occurs. The number of rows;

[0058] In S43 and S42, there must be four consecutive non-zero bytes, and the remaining bytes must be zero. Furthermore, two of the four non-zero bytes must be identical. This yields the output difference for S-box substitution. as follows:

[0059]

[0060] in, For the first i+ The first round of XOR results of the ciphertext Line number n List a byte, For the first i+ The first round of XOR results of the ciphertext Line number n List a byte, ;

[0061] S44. Based on the differential output of S43, determine the location of the fault line, and then according to... ShiftRows The inverse transform yields the row where the fault is located. r Rotate it to the right r The column retrieves the location of the faulty byte.

[0062] Preferably, the specific process for restoring the byte state in S5 is as follows:

[0063] S51. Based on the differential characteristics and output difference of S-box replacement in the AEGIS algorithm... Obtain the input difference Quantity;

[0064] S52. Based on the number of input differences in S51 and the corresponding input differences of the output differences, list the candidate value groups of the input differences;

[0065] S53. Obtain the output difference corresponding to all candidate values ​​by inputting the candidate value group of the difference in S52;

[0066] S54. By repeatedly taking the intersection of multiple candidate values ​​through C++ code operations, a unique input difference is selected to restore the state of the entire character.

[0067] Preferably, the specific process described in S6 is as follows:

[0068] S61. Obtain the word after recovery state based on S5. , , , ,pass The function inverse operation yields the correct and unique result. The value of is calculated as follows:

[0069] Depend on and recover :

[0070]

[0071] Depend on , , recover and :

[0072]

[0073] Depend on and , recover :

[0074]

[0075] Depend on and recover :

[0076]

[0077] Depend on and , recover :

[0078]

[0079] S62, Remaining exist The data was not recovered; it was obtained according to the encryption formula. :

[0080]

[0081] S63, Based on what was obtained and , The restoration of all five characters completes the restoration of the internal state.

[0082] Therefore, the lightweight authentication encryption algorithm differential fault attack method of the present invention, which adopts the above-mentioned content, has the following advantages compared with the prior art:

[0083] 1. This application proposes a differential fault attack based on a random bit model, which can accurately determine the fault location. By using the round functions of AES and AEGIS, the fault location of the input byte, the output difference, and the fault word location are determined, ensuring the complete randomness of the attack model.

[0084] 2. This application provides an intermediate state recovery attack for AEGIS, which provides a complete internal state recovery process based on the logical relationship between the five sub-state branches of AEGIS.

[0085] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0086] Figure 1 This is an overall flowchart of the present invention;

[0087] Figure 2 This is a flowchart of the AEGIS status update process of the present invention;

[0088] Figure 3 This is a flowchart of the recovery strategy of AEGIS in this invention. Detailed Implementation

[0089] In the description of this invention, it should be noted that the terms "upper," "lower," "inner," "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of this invention is usually placed when in use. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention.

[0090] Example

[0091] like Figures 1 - 3 As shown, a lightweight authentication encryption algorithm differential fault attack method of the present invention, used under legitimate circumstances, includes the following steps:

[0092] S1. Initialize the AEGIS encryption algorithm and inject a random single-bit error fault;

[0093] S11, Let , , , , For the first The sub-state at the start of the round, , The five sub-states constitute the internal state of the AEGIS encryption algorithm and are positive integers.

[0094] S12, Towards If a random single-bit fault is injected, the random single-bit fault will propagate to... That is The internal state of the wheel;

[0095] S13, each Rotate to update state, new state , , , , The calculation process is as follows:

[0096]

[0097]

[0098]

[0099]

[0100]

[0101] in, This is represented as an XOR operation. This is a round function expression;

[0102] S2, Input plaintext The AEGIS encryption algorithm after S1 processing is used to encrypt and generate correct and incorrect ciphertext, and the output difference between the two is obtained;

[0103] S21. Obtain plaintext according to the encryption formula. Encryption yields both correct and incorrect ciphertext, using the following encryption formula:

[0104] ,

[0105] in, For the generated ciphertext, To encrypt intermediate operations, For operation;

[0106] Correct ciphertext as follows:

[0107]

[0108] in, For the first i+1 The explicit text of the wheel, For the first i + k The first round t An intermediate state ;

[0109] Error ciphertext as follows:

[0110]

[0111] in, For the injection fault, the first i + k The first round t An intermediate state;

[0112] S22. Calculate the output difference between the correct ciphertext and the incorrect ciphertext. The formula is as follows:

[0113] ;

[0114] S3. Calculate the XOR result based on the output difference between the correct ciphertext and the incorrect ciphertext in S2;

[0115] S31. Assuming the fault occurs in the last byte, we get... as follows:

[0116]

[0117] in, The first input for the S box k Line number t List a byte, The fourth row and fourth column byte is where the fault is injected;

[0118] S32, after S box replacement SubBytes row shift ShiftRows Confusion between columns MixColumns after, from Get it, get it The results of the S-box replacement are as follows:

[0119] ;

[0120] in, The byte replacement k Line number n List a byte, , This refers to the fourth row and fourth column of bytes after byte substitution following the injected fault.

[0121] pass ShiftRows The results are as follows:

[0122] ;

[0123] Finally, through MixColumns The result after mixing is as follows:

[0124]

[0125] ;

[0126] S33. Based on the output difference of S22 and the round function of S32, the XOR result between the correct ciphertext and the incorrect ciphertext is as follows:

[0127]

[0128]

[0129]

[0130] ;

[0131] S4. Determine the location of the fault by XORing the result of S3;

[0132] S41, according to The value determines whether a fault exists. If a fault exists, the relative position of the faulty row is calculated using the following formula:

[0133]

[0134] in, For the first i+1 The first XOR result of the round-coded text k Line number n List of bytes;

[0135] S42. Based on the formula for the relative position of the faulty line, the faulty line is obtained as follows:

[0136]

[0137] in, Indicates the row where the fault occurs. The number of rows;

[0138] In S43 and S42, there must be four consecutive non-zero bytes, and the remaining bytes must be zero. Furthermore, two of the four non-zero bytes must be identical. This yields the output difference for S-box substitution. as follows:

[0139]

[0140] in, For the first i+ The first round of XOR results of the ciphertext Line number n List a byte, For the first i+ The first round of XOR results of the ciphertext Line number n List a byte, ;

[0141] Table 1 List of rows where the fault is located

[0142]

[0143] Based on the above information and Table 1, the specific location of the fault is determined: the fault occurs in the 3rd row. By simply moving 3 columns to the right, the fault byte can be found in the 3rd row and 3rd column, that is, the (3,3)th byte is the fault byte.

[0144] S44. Based on the differential output of S43, determine the location of the fault line, and then according to... ShiftRows The inverse transform yields the row where the fault is located. r Rotate it to the right r The column indicates the location of the faulty byte;

[0145] S5. After determining the location of the fault, perform byte state recovery based on the XOR result and repeat the recovery process to perform word state recovery.

[0146] S51. Based on the differential characteristics and output difference of S-box replacement in the AEGIS algorithm... Obtain the input difference The quantity; the corresponding table is as follows:

[0147] Table 2: Number of possible input values ​​corresponding to the output difference

[0148]

[0149] S52. Based on the number of input differences in S51 and the corresponding input differences of the output differences, list the candidate value groups of the input differences; the corresponding table is as follows:

[0150] Table 3: Possible input values ​​corresponding to the S-box output difference

[0151]

[0152] S53. Obtain the output difference corresponding to all candidate values ​​by inputting the candidate value group of the difference in S52; the corresponding table is as follows:

[0153] Table 4. All possible output differences corresponding to the S-box input.

[0154]

[0155] S54. By repeatedly taking the intersection of multiple candidate values ​​through C++ code calculations, a unique input difference is selected to restore the state of the entire character.

[0156] The byte state recovery algorithm described above is shown in Table 5:

[0157] Table 5 Byte State Recovery Algorithm

[0158]

[0159] S6. Based on the word recovered in S5, apply the inverse operation formula of the round function and the encryption formula to recover the complete internal state;

[0160] S61. Obtain the word after recovery state based on S5. , , , ,pass The function inverse operation yields the correct and unique result. The value of is calculated as follows:

[0161] Depend on and recover :

[0162]

[0163] Depend on , , recover and :

[0164]

[0165] Depend on and , recover :

[0166]

[0167] Depend on and recover :

[0168]

[0169] Depend on and , recover :

[0170]

[0171] S62, Remaining exist The data was not recovered; it was obtained according to the encryption formula. :

[0172]

[0173] S63, Based on what was obtained and , The internal state is restored once all five characters are restored; the above process is shown in Table 6:

[0174] Table 6 Complete Internal State Recovery Algorithm

[0175]

[0176] In the specific implementation process:

[0177] (1) Select any plaintext M and encrypt it with the given key K to obtain the correct ciphertext C under normal encryption and the erroneous ciphertext C after the injection of a byte fault. ;

[0178] (2) Perform an XOR operation on the correct ciphertext and the incorrect ciphertext, and obtain the result. Determine the location of the fault injection;

[0179] (3) Calculate the correct input value of the S-box based on the output difference of the affected S-box and restore the single-byte state;

[0180] (4) By using four consecutive rounds of fault injection, combined with the state update function, the complete state can be restored.

[0181] Therefore, the present invention employs a lightweight authentication encryption algorithm differential fault attack method based on the above content, which significantly simplifies the complex round design, makes the input-output relationship of S-box replacement intuitive and clear, greatly reduces the number of faults required to recover the master key, thereby saving a lot of manpower and time costs, effectively expanding the attack range, and improving the actual effectiveness of the attack.

[0182] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A lightweight authentication encryption algorithm differential fault attack method, used under legitimate circumstances, characterized in that: Includes the following steps: S1. Initialize the AEGIS encryption algorithm and inject a random single-bit error fault; S11, Let , , , , For the first The sub-state at the start of the round, , The five sub-states constitute the internal state of the AEGIS encryption algorithm and are positive integers. S12, Towards If a random single-bit fault is injected, the random single-bit fault will propagate to... That is The internal state of the wheel; S13, each Rotate to update state, new state , , , , The calculation process is as follows: in, This is represented as an XOR operation. This is a round function expression; S2, Input plaintext The AEGIS encryption algorithm after S1 processing is used to encrypt and generate correct and incorrect ciphertext, and the output difference between the two is obtained; S3. Calculate the XOR result based on the output difference between the correct ciphertext and the incorrect ciphertext in S2; S4. Determine the location of the fault by XORing the result of S3; The specific process for determining the location of the fault is as follows: S41. Based on the XOR result of the correct ciphertext and the incorrect ciphertext. The value determines whether a fault exists. If a fault exists, the relative position of the faulty row is calculated using the following formula: in, For the first i+ The first round of XOR results of the ciphertext k Line number n List of bytes; S42. Based on the formula for the relative position of the faulty line, the faulty line is obtained as follows: in, Indicates the row where the fault occurs. The number of rows; In S43 and S42, there must be four consecutive non-zero bytes, and the remaining bytes must be zero. Furthermore, two of the four non-zero bytes must be identical. This yields the output difference for S-box substitution. as follows: in, For the first i+ The first round of XOR results of the ciphertext Line number n List a byte, For the first i+ The first round of XOR results of the ciphertext Line number n List a byte, ; S44. Based on the differential output of S43, determine the location of the fault line, and then according to... ShiftRows The inverse transform yields the row where the fault is located. r Rotate it to the right r The column indicates the location of the faulty byte; S5. After determining the location of the fault, perform byte state recovery based on the XOR result and repeat the recovery process to perform word state recovery. The specific process for restoring the byte state is as follows: S51. Based on the differential characteristics and output difference of S-box replacement in the AEGIS algorithm... Obtain the input difference Quantity; S52. Based on the number of input differences in S51 and the corresponding input differences of the output differences, list the candidate value groups of the input differences; S53. Obtain the output difference corresponding to all candidate values ​​by inputting the candidate value group of the difference in S52; S54. By repeatedly taking the intersection of multiple candidate values ​​through C++ code calculations, a unique input difference is selected to restore the state of the entire character. S6. Based on the word recovered in S5, apply the inverse operation formula of the round function and the encryption formula to restore the complete internal state.

2. The method for differential fault attack on a lightweight authentication encryption algorithm according to claim 1, characterized in that: The specific workflow of S2 is as follows: S21. Obtain plaintext according to the encryption formula. Encryption yields both correct and incorrect ciphertext, using the following encryption formula: ， in, For the generated ciphertext, To encrypt intermediate operations, For operation; Correct ciphertext as follows: in, For the first i+1 The explicit text of the wheel, For the first i+k The first round t An intermediate state ; Error ciphertext as follows: in, For the injection fault, the first i+k The first round t An intermediate state; S22. Calculate the output difference between the correct ciphertext and the incorrect ciphertext. The formula is as follows: 。 3. The method for differential fault attack on a lightweight authentication encryption algorithm according to claim 2, characterized in that: The specific process of S3 is as follows: S31. Assuming the fault occurs in the last byte, we get... as follows: in, The first input for the S box k Line number t List a byte, The fourth row and fourth column byte of the injected fault; S32, after S box replacement SubBytes row shift ShiftRows Confusion between columns MixColumns after, from Get it, get it The results of the S-box replacement are as follows: ； in, The byte replacement k Line number n List a byte, , This refers to the fourth row and fourth column of bytes after byte substitution following the injected fault. pass ShiftRows The results are as follows: ； Finally, through MixColumns The result after mixing is as follows: ； S33. Based on the output difference of S22 and the round function of S32, the XOR result between the correct ciphertext and the incorrect ciphertext is as follows: 。 4. The method for differential fault attack on a lightweight authentication encryption algorithm according to claim 1, characterized in that: The specific process described in S6 is as follows: S61. Obtain the word after recovery state based on S5. , , , ,pass The function inverse operation yields the correct and unique result. The value of is calculated as follows: Depend on and recover : Depend on , , recover and : Depend on and , recover : Depend on and recover : Depend on and , recover : S62, Remaining exist The data was not recovered; it was obtained according to the encryption formula. : S63, Based on what was obtained and , The restoration of all five characters completes the restoration of the internal state.

Images