A key leakage detection method of SM3 hash algorithm

Abstract

The application relates to a key leakage detection method of an SM3 hash algorithm, which comprises the following steps: firstly, generating a to-be-processed message at random, taking the to-be-processed message as the input of the SM3 algorithm, introducing a random 4-byte fault by adopting a 4-byte random fault model, obtaining an error output hash value, calculating the corresponding value path of 32 bits of the last-but-one round 4-byte register by an exhaustive method, obtaining an intermediate meeting array, obtaining the intermediate state value of the last-but-one round 4-byte register by extending the message group by the exhaustive method, matching the intermediate state value with the intermediate meeting array, and using a statistical method to obtain the partial value of the correct message group, repeatedly introducing the fault and analyzing the process to obtain the correct message group, and finally deducing the correct to-be-processed message. The method provided by the application is easy to implement, fast and high in accuracy, and can provide an important analysis basis for the security research of the SM3 hash algorithm.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method for detecting key leakage using the SM3 hash cryptography algorithm. Background Technology

[0002] With the rapid development of information technology and computer networks, technologies such as the Internet of Things (IoT) are gradually being applied to smart homes, smart manufacturing, and smart healthcare, bringing great convenience to people. However, while the IoT brings convenience, its vulnerabilities in areas such as information security are also increasingly attracting attention. Based on real-world scenarios, how to ensure information security has become a hot topic of research and concern. The SM3 hash cryptography algorithm, employing the Merkle-Damgard structure, is widely used in data integrity checks, message authentication, and digital signatures.

[0003] Meeting-in-the-middle statistical failure analysis is a cryptanalysis technique that exploits deliberately introduced failures (such as hardware malfunctions) during the execution of cryptographic algorithms to analyze and attack them. This method does not require the attacker to possess internal information about the algorithm; instead, it infers weaknesses in the key or algorithm by observing the algorithm's behavior when failures occur. Currently, there are no reports assessing the SM3 hash algorithm's ability to resist meeting-in-the-middle statistical failure attacks, leaving a security vulnerability in products using SM3 hash algorithms. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a key leakage detection method for the SM3 hash algorithm, which can evaluate the ability of the SM3 hash algorithm to resist intermediate encounter statistical failure analysis.

[0005] The technical solution adopted by this invention to solve its technical problem is: to provide a key leakage detection method for the SM3 hash cryptography algorithm, comprising the following steps:

[0006] Step S1: Randomly generate messages to be processed;

[0007] Step S2: The message is encrypted using the SM3 algorithm, and a random 4-byte fault is introduced in the penultimate round to obtain an error output hash value;

[0008] Step S3, by exhaustively enumerating the third-to-last round of 4-byte register H 61 32 bits and extended message blocks The 32-bit, second-to-last 4-byte register E in the calculation process of the SM3 algorithm compression function. 62 The corresponding 32-bit value path is used to obtain the intermediate encounter array;

[0009] Step S4: Based on the error output hash value, enumerate the expanded message groups. and Use the 64 bits to obtain the intermediate state value of the penultimate 4-byte register;

[0010] Step S5: Match the intermediate state value of the penultimate round 4-byte register with the intermediate encounter array to obtain the intermediate state value of the corresponding penultimate round 4-byte register;

[0011] Step S6: Calculate the Hamming weight of the intermediate state value of the penultimate round 4-byte register, and calculate its Hamming distance from the theoretical value. Select the intermediate state value of the penultimate round 4-byte register corresponding to the minimum Hamming distance, and generate the extended message packet corresponding to the intermediate state value of the penultimate round 4-byte register. The value of is used as part of the value of the correct message group;

[0012] Step S7: Repeat steps S2 to S6, making the import position of the fault different each time, to obtain all expanded message packets, and calculate the correct message packets according to the message expansion algorithm;

[0013] Step S8: Restore the message group based on the obtained correct message group.

[0014] Between steps S2 and S3, the following is also included:

[0015] Determine whether the number of erroneous output hash values ​​has reached a preset number;

[0016] If the number of erroneous output hash values ​​does not reach the preset number, return to step S1;

[0017] If the number of erroneous output hash values ​​reaches a preset number, proceed to step S3.

[0018] In step S3, the penultimate round of 4-byte register E 62 The corresponding value path for the 32 bits is:

[0019] ;

[0020] in, For the intermediate meeting array, This is the permutation function in the compression function. This is the second Boolean function in the penultimate round. These are the values ​​in the third-to-last 4-byte register, with TT2 and SS1 representing intermediate variables.

[0021] The formula for calculating the intermediate state value of the penultimate 4-byte register in step S4 is as follows:

[0022] ;

[0023] in, This is the inverse operation of the permutation function in the compression function, where TT1, TT2, SS1, and SS2 represent intermediate variables. For the extended first A message group, For the first The first Boolean function of the round, This is the inverse operation of the second Boolean function in the penultimate round. , , , , , , , Output a hash value for errors. , , This is the intermediate state value of the second-to-last 4-byte register. For circular right shift, This is an XOR operation.

[0024] In step S2, a random 4-byte fault is introduced by means of software simulation or by means of laser, electromagnetic and voltage interference.

[0025] Beneficial effects

[0026] Due to the adoption of the above technical solution, this invention has the following advantages and positive effects compared with the prior art: This invention first randomly generates a message to be processed of a preset length, and uses the message to be processed as the input of the SM3 algorithm. A 4-byte random fault model is used to introduce a random 4-byte fault in the penultimate round to obtain the error output hash value. This is achieved by exhaustively enumerating the 4-byte register H in the penultimate round. 61 and extended message group W 62 Calculate register E 62 The 32-bit corresponding value path is used to obtain the intermediate encounter array, and the message group is expanded by exhaustive search. and extended message groups 64 bits, get register The intermediate state value is matched with the intermediate encounter array to obtain the corresponding third-to-last 4-byte register. By analyzing intermediate state samples and using statistical methods to calculate Hamming distance, partial values ​​of the correct message group are obtained. The fault and analysis process is repeated, and finally, the correct message group can be derived. Finally, the correct message is derived based on the message filling steps. The method provided by this invention is easy to implement, fast, and highly accurate, providing important analytical basis for the security research of the SM3 hash algorithm. Attached Figure Description

[0027] Figure 1 Flowchart of steps for detecting whether the SM3 hash algorithm can resist differential statistics invalidity fault analysis;

[0028] Figure 2 A fault propagation diagram for statistical fault analysis of intermediate encounters during the SM3 algorithm encryption process;

[0029] Figure 3 Here is a diagram of the SM3 hash algorithm structure;

[0030] Figure 4 This is a schematic diagram of the experimental environment for this scheme. Detailed Implementation

[0031] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0032] Basic symbol explanation:

[0033] : Message, message length l<2 64 Bit;

[0034] The message after being filled in. ,in, l is the initial message length, and k is the number of '0's added in the padding step;

[0035] : The message group after filling , , , , ;

[0036] : Expanded message grouping , , , , , , ;

[0037] Error output, ;

[0038] Number of iteration rounds ;

[0039] The eight 4-byte registers in the r-th round. ,in, , This indicates the state of the register after being affected by a fault;

[0040] The first Boolean function, , , This indicates its inverse operation;

[0041] The second Boolean function, , , This indicates its inverse operation;

[0042] The initial value of the compression function register, IV=7380166f 4914b2b9 172442d7 da8a0600a96f30bc 163138aa e38dee4d b0fb0e4e;

[0043] The permutation function in the compression function. , This indicates its inverse operation. ;

[0044] : The substitution function in message expansion , This indicates its inverse operation. ;

[0045] : A constant that takes different values ​​as j changes. ;

[0046] mod: Modulo operation;

[0047] AND operation;

[0048] OR operation;

[0049] XOR operation;

[0050] NOT operation;

[0051] mod2 32 Arithmetic addition;

[0052] mod2 32 Arithmetic subtraction;

[0053] : Circular left shift;

[0054] : Circular right shift;

[0055] Left assignment operator.

[0056] Figure 1 This invention provides a flowchart of a key leakage detection method based on intermediate encounter statistical fault analysis using the SM3 hash algorithm, as part of an embodiment of the present invention. When processing random messages of different lengths using the SM3 cryptographic algorithm, by changing the experimental environment (normal conditions versus conditions affected by physical factors such as clock, voltage, humidity, radiation, pressure, light, and eddy currents), an attacker can obtain an erroneous output and deduce key information based on this erroneous output. An attacker can induce random faults during the execution of the SM3 algorithm, but the specific location of the fault initiation is unknown. Therefore, obtaining the location of the fault initiation is crucial. This embodiment uses a 4-byte random fault model, with the fault location being the penultimate round. The method specifically includes the following steps:

[0057] Step 1: Randomly generate a length l < 2 64 The pending message in bits is denoted as .

[0058] Step 2: Use message M as the SM3 algorithm (see...) Figure 3 The input is taken as the SM3 algorithm cryptographic system, and a fault is introduced during the operation of the system. A 4-byte random fault model is used, with the fault location being the penultimate round, to obtain the erroneous output hash value. And collect them.

[0059] Step 3: Determine the collected error output hash values If the number of errors has not reached the preset number, repeat steps 1 to 2 until enough error hashes are obtained. The preset quantity in this implementation method is 150; if this quantity is reached, proceed to step 4.

[0060] The present invention may select, for example Figure 4 The experimental environment shown includes a computer that generates the SM3 input message M and processes and analyzes the output of the input message after processing by the SM3 algorithm. A device encapsulating the SM3 algorithm is used to process the input message and obtain the corresponding output. A fault-introducing device is used to perform fault-introducing actions during the SM3 algorithm's operation, thereby obtaining an erroneous hash value. The fault-introducing device can be implemented through software simulation or by using techniques such as laser, electromagnetic, and voltage interference to manipulate the real hardware, causing interference to the SM3 algorithm and inducing faults during its operation, thus obtaining an erroneous hash value. .

[0061] Step 4: Calculate the intermediate encounter array. Exhaustively search the third-to-last 4-byte register H. 61 32-bit H 61 = Then exhaustively enumerate the expanded message groups W 62 The 32 bits. Then, according to the calculation process of the SM3 algorithm compression function, it can be known that the penultimate round of 4-byte register E... 62 The corresponding 32-bit value path, that is:

[0062] ;

[0063] TT2 and SS1 represent intermediate variables.

[0064] Based on the above formula, we can obtain a total of 2. 64 ( = 2 32 2 32 The mapping results are processed and the mapping matrix is ​​stored to obtain the intermediate encounter array.

[0065] Step 5: Calculate the intermediate state of the register. Assume the location of the random fault injection is as follows: Figure 2 As shown, by obtaining the error hash value Enumerate the expanded message groups and 64 bits, retrieve the penultimate round of 4-byte register The intermediate state value samples are calculated using the following formula:

[0066] ;

[0067] TT1, TT2, SS1, and SS2 represent intermediate variables.

[0068] Step 6: Matching in the middle, use the penultimate round of 4-byte registers. The intermediate state value samples are matched with the intermediate encounter array to obtain the corresponding third-to-last 4-byte register. The intermediate state value, that is: ;

[0069] Step 7: Obtain the third-to-last 4-byte register based on Step 6. For intermediate state values, statistical methods are used to calculate the Hamming weight of each state value and its Hamming distance from the theoretical value. The Hamming weight represents the number of '1's in the binary form of the intermediate state value, and the Hamming distance is the difference in the number of '1's in the binary representation of the two values. A smaller Hamming distance indicates a higher probability of a correct message. For example, when... , The binary representation of 139 is 10001011, and the binary representation of 150 is 10001100. Therefore, the third-to-last four-byte register... The weight of the Hamming is 4. The Hamming weight is 3, and the third-to-last round has a 4-byte register. and The Hamming distance is 1.

[0070] Step 8: Select the set of intermediate state values ​​with the smallest Hamming distance, and their corresponding expanded message group W 62 The value of is a partial value of the correct message group.

[0071] Step 9: Repeat steps 2 through 8, making sure the import location for each fault is different, so that all expanded message packets W can be obtained. t Then, the correct message group can be calculated based on the message expansion algorithm. .in, , , Where l is the initial message length and k is the number of '0's added during the padding step, the calculation formula is as follows:

[0072] .

[0073] Step 10: Recover message M by grouping it according to the obtained correct message, using the following formula:

[0074] ;

[0075] Where k is the number of '0's added in the padding step, satisfying... The smallest non-negative integer in mod512, where l is a 64-bit bit string and is the binary representation of the message length.

[0076] Using the above analysis method, this invention simulated the import failure and SM3 hash algorithm processing on a computer with an Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz / 1.99GHz and 8GB of memory using the IDEA development tool, repeating the process 2000 times. The experimental results show that the above detection method is accurate. The method provided by this invention is easy to implement, fast, and highly accurate, and is of great significance to the security research of the SM3 hash algorithm.

Claims

1. A method for detecting key leakage in the SM3 hash cryptosystem, characterized in that, Includes the following steps: Step S1: Randomly generate messages to be processed; Step S2: The message is encrypted using the SM3 algorithm, and a random 4-byte fault is introduced in the penultimate round to obtain an error output hash value; Step S3, by exhaustively enumerating the third-to-last round of 4-byte register H 61 32 bits and extended message blocks The 32-bit, second-to-last 4-byte register E in the calculation process of the SM3 algorithm compression function. 62 The corresponding 32-bit value path is used to obtain the intermediate encounter array; Step S4: Based on the error output hash value, enumerate the expanded message groups. and Use the 64 bits to obtain the intermediate state value of the penultimate 4-byte register; Step S5: Match the intermediate state value of the penultimate round 4-byte register with the intermediate encounter array to obtain the intermediate state value of the corresponding penultimate round 4-byte register; Step S6: Calculate the Hamming weight of the intermediate state value of the penultimate round 4-byte register, and calculate its Hamming distance from the theoretical value. Select the intermediate state value of the penultimate round 4-byte register corresponding to the minimum Hamming distance, and generate the extended message packet corresponding to the intermediate state value of the penultimate round 4-byte register. The value of is used as part of the value of the correct message group; Step S7: Repeat steps S2 to S6, making the import position of the fault different each time, to obtain all expanded message packets, and calculate the correct message packets according to the message expansion algorithm; Step S8: Restore the message group based on the obtained correct message group.

2. The key leakage detection method for the SM3 hash cryptosystem algorithm according to claim 1, characterized in that, Between steps S2 and S3, the following is also included: Determine whether the number of erroneous output hash values ​​has reached a preset number; If the number of erroneous output hash values ​​does not reach the preset number, return to step S1; If the number of erroneous output hash values ​​reaches a preset number, proceed to step S3.

3. The key leakage detection method for the SM3 hash cryptographic algorithm according to claim 1, characterized in that, In step S3, the penultimate round of 4-byte register E 62 The corresponding value path for the 32 bits is: ； in, For the intermediate meeting array, This is the permutation function in the compression function. This is the second Boolean function in the penultimate round. These are the values ​​in the third-to-last 4-byte register, with TT2 and SS1 representing intermediate variables.

4. The key leakage detection method for the SM3 hash cryptosystem algorithm according to claim 1, characterized in that, The formula for calculating the intermediate state value of the penultimate 4-byte register in step S4 is as follows: ； in, This is the inverse operation of the permutation function in the compression function, where TT1, TT2, SS1, and SS2 represent intermediate variables. For the extended first A message group, For the first The first Boolean function of the round, This is the inverse operation of the second Boolean function in the penultimate round. , , , , , , , Output a hash value for errors. , , This is the intermediate state value of the second-to-last 4-byte register. For circular right shift, This is an XOR operation.

5. The key leakage detection method for the SM3 hash cryptosystem algorithm according to claim 1, characterized in that, In step S2, a random 4-byte fault is introduced by means of software simulation or by means of laser, electromagnetic and voltage interference.

Images