Linear path searching method for Sponge type cryptographic algorithm

Abstract

The invention discloses a linearization path searching method for a Sponge type cryptographic algorithm, and belongs to the technical field of information security and cryptographic analysis. The method comprises the following steps of: 1, deducing a linearized path dependency relationship; 2, constructing a mixed integer linear programming model; step 3, a target function setting and optimization solution step; 4, an optimal linearization path analysis and attack implementation step; and executing linearization path analysis and attack implementation according to an optimal solution result output by the optimization solver. According to the method, the branch and bound algorithm of the MILP solver is utilized, a theoretical global optimal path can be found in a full search space, an efficient attack path which is difficult to perceive manually can be found, and it can be ensured that an output attack scheme is executable under the actual computing power.

Description

Technical Field

[0001] This invention belongs to the field of information security and cryptanalysis technology, specifically relating to a lightweight cryptographic algorithm security evaluation technique based on mixed integer linear programming (MILP), and particularly an automated search method for guess-and-linearize attack paths for cryptographic algorithms with a sponge structure (such as Ascon, Keccak, etc.). Background Technology

[0002] With the widespread adoption of the Internet of Things (IoT), connected vehicles, and 5G communication technologies, lightweight cryptographic algorithms (such as Ascon) selected by the National Institute of Standards and Technology (NIST) employ a Sponge structure to achieve efficient encryption on resource-constrained devices. In the security analysis of such algorithms, guess-linearization attacks combined with algebraic analysis have attracted significant attention. Attackers attempt to guess some key state bits, causing the originally complex nonlinear iterative function to degenerate into a low-order or even linear system of equations at the output, and then use methods such as Gaussian elimination to quickly recover the remaining unknown information.

[0003] However, balancing the "guessing cost" and "linearization benefit" in a huge state space is a highly challenging combinatorial optimization problem. It requires a method that can jointly model the selection of the guess set and the construction of the linearization path, stably produce the globally optimal attack path, and be used for preimage attacks on hash functions, key recovery attacks on authentication encryption algorithms, etc., so as to evaluate the algorithm's ability to resist preimage attacks, key recovery attacks, etc.

[0004] This linearization path search technique for Sponge structures can be widely applied across various scenarios. In domestic and international cryptographic algorithm standardization processes (such as NISTLWC and ISO / IEC standards), this technique can be used to determine the security boundaries of candidate hash functions and authentication encryption algorithms. By automatically searching for the optimal linearization path, it can provide quantitative mathematical evidence for whether an algorithm meets the "security rounds" requirement, supporting standardization organizations in conducting scientific parameter selection and recommendation justification. In resource-constrained IoT devices, power consumption and area are core constraints. Chip designers often need to balance "reducing the number of encryption rounds to improve performance" and "maintaining sufficient security redundancy." This invention provides a quantifiable attack complexity assessment, helping designers clarify the security margin at a specific number of rounds, thereby guiding the pipeline stages and protection strategies in hardware prototype (FPGA / ASIC) design, avoiding resource waste due to over-design or security vulnerabilities due to under-design.

[0005] Simultaneously, this technology, as a core module of automated security auditing tools, is integrated into analysis software targeting IoT device firmware. When the firmware is detected to be using a specific lightweight hash algorithm, this method can be automatically run to assess whether its configuration parameters are sufficiently secure, preventing low-complexity attacks due to improper parameter settings. For commercial security products integrating Sponge-type algorithms (such as security chips, cryptographic machines, and operating system cryptographic modules), this technology can be used to generate security analysis reports tailored to specific implementations. When new attack variants emerge or compliance reviews are required, the ability of existing products to resist algebraic attacks can be quickly assessed, providing a basis for decision-making regarding emergency response and patch upgrades.

[0006] Ascon, as a lightweight cryptographic standard of NIST, is based on SPN-structured permutations and uses a Sponge structure for iterative operation. Its state update function includes constant addition, S-box substitution (non-linear layer), and a linear diffusion layer. The key challenge in preimage attacks or state recovery lies in the extremely tight interaction between the S-box and the linear diffusion layer of the Sponge structure. Simple guessing strategies often result in excessively high algebraic equations that are difficult to solve, or an excessive number of guesses leading to an exponential complexity explosion. Existing technologies mainly suffer from the following drawbacks:

[0007] 1) Limitations of manual analysis methods;

[0008] Traditional methods rely on the intuition and experience of cryptanalysts to manually search for guessing paths. Due to the complex interactions between the diffusion layers and S-boxes in the Sponge structure, the search space grows exponentially, making it difficult for manual analysis to cover all possibilities. This can easily lead to overlooking more efficient linearization paths, resulting in inaccurate assessments of the algorithm's security.

[0009] 2) Local optima problem;

[0010] Existing automated tools typically employ a two-step strategy: first, a pre-defined guessing pattern is fixed, and then the linearization benefit under that pattern is calculated. This approach, which separates the "selection of guessing variables" from the "evaluation of linearization effects," ignores the dynamic coupling between the two. The pre-defined guess set often only leads to a locally optimal solution and cannot balance the "guessing cost" and "solution benefit" globally, resulting in a final attack path with a non-minimum complexity.

[0011] Therefore, there is an urgent need for an automated search method that can jointly model and globally optimize the guess set and the linearized set in order to accurately assess the actual safety boundary of such algorithms. Summary of the Invention

[0012] This invention aims to solve the technical problems in existing algebraic attack analysis of Sponge-type cryptographic algorithms, such as low efficiency of manual search, susceptibility of automated tools to local optima, and difficulty in balancing the cost of guessing and the benefits of solving in a huge state space.

[0013] This invention proposes a linearization path search method for Sponge-type cryptographic algorithms, transforming the problem of finding the optimal "guess-linearization" strategy into a mixed-integer linear programming problem. This method constructs a constraint model describing the algebraic characteristics of the algorithm and uses a solver to automatically search for the globally optimal solution that maximizes the number of linearized bits. The method includes the following steps:

[0014] 1) Step 1: Derivation of linearized path dependencies;

[0015] For the internal permutation function of the target Sponge-class cryptographic algorithm, construct the linear dependency between the output state bits and the input state bits. The goal of this step is to determine: to make the output state... The Bit linearization must be performed in the input state. We need to guess which bits are involved. We define this set of bits that must be guessed as the candidate guess set. (Input status) (Guess the set of bit indices).

[0016] First, the nonlinear layer (S-box) and linear diffusion layer of the permutation function in each round of the algorithm are represented by the algebraic normal form (ANF) to obtain the Boolean algebraic expression of each bit of the output state with respect to the bits of the input state.

[0017] Secondly, regarding the output state The The algorithm analyzes whether the corresponding algebraic expression of the output bit contains a nonlinear term in the form of a product. When the algebraic expression of the output bit contains a nonlinear term, the condition for linearization is determined according to the linearization rule, namely: if the expression contains a high-order product term (nonlinear term, such as...). At least one factor must be guessed to degenerate the term into a linear term or a constant. This occurs when multiple product terms share the same variable (e.g., ...). China Shared First, guess the shared variable. This is because guessing the shared variable can eliminate multiple nonlinear terms simultaneously, thus achieving maximum linearization with minimal guessing cost. Example: For the expression... According to the rules, guess first. .at this time The product term degenerates into a constant and becomes a constant. Combined with the original By simply linearizing these three terms, the entire expression becomes... Linearization successful. If it is decided to guess a certain intermediate variable, and this variable is obtained by linear or nonlinear calculation of the state variable in the previous round, then all the forward input variables that constitute this variable will be added to the guess set.

[0018] Finally, using the above rules, the output state is derived bit by bit from the input state to generate the output state. The The candidate guess set corresponding to bit linearization ,in This represents the set of bit indices for the guessed input state.

[0019] 2) Step Two: Construction steps of the mixed-integer linear programming model;

[0020] After obtaining the candidate guess set, a mixed-integer linear programming model is constructed to jointly optimize the guess cost and linearization benefit.

[0021] First, define the decision variables. , indicating input status The Whether a bit belongs to the guess set (1 indicates a guess, 0 indicates no guess); , indicating the output status The Whether the bit was successfully linearized (1 indicates linearization, 0 indicates non-linearization).

[0022] Secondly, construct logical constraints. This involves converting the output states from step one... The The bit-linearized dependencies are transformed into linear inequalities. For any output state The The bit, if it is marked as linearized ( Then its dependency set All bits in the output state must be guessed. For each bit of the output state, the following linear constraints are constructed: This ensures that the corresponding output bit is allowed to be marked as linear only when all relevant input bits in the candidate guess set have been guessed.

[0023] Finally, attack complexity constraints are constructed. To ensure that the generated attack paths are computationally feasible, a total complexity constraint is introduced. The total time complexity of the attack is typically determined by the cost of guessing (…). The cost of solving linear equations, along with the cost of solving them, simplifies the process by limiting the total number of bits involved to a preset safety threshold. (For example, for algorithms targeting 64-bit messages, it is possible to set...) ): .

[0024] 3) Step Three: Objective Function Setting and Optimization Solution Steps;

[0025] After constructing the mixed-integer linear programming model, the optimization solution step is executed. The objective function is set to maximize the profit, i.e., maximize the number of linearized equations: The decision variables, linear constraints, and objective function defined in step two are input into the MILP solver for solving. Under the premise of satisfying all constraints, the global optimal solution is searched and output.

[0026] 4) Step Four: Optimal Linearization Path Analysis and Attack Implementation Steps;

[0027] Based on the optimal solution output by the optimizer, linearized path parsing and attack implementation are performed.

[0028] First, analyze the optimal solution vector returned by the solver and extract all... The indexes form the optimal guess set. Extract all The indices form the optimal linearized set. .

[0029] Secondly, exhaustive guessing is performed on the bits in the optimal guess set, and the guessed values ​​are substituted into the permutation function of the target Sponge-type cryptographic algorithm. After the guessed values ​​are fixed, the expression corresponding to the optimal linearization set of the output state is degenerated into a linear equation, and a system of linear equations is constructed based on the optimal linearization set.

[0030] Finally, the unknown state bits are solved using linear equation solving methods, and the solution is verified by combining the algorithm output results, thereby completing the preimage recovery or state recovery attack on the target algorithm.

[0031] 1. The effects that this invention can achieve:

[0032] 1) Global optimality of joint optimization;

[0033] This invention breaks away from the traditional approach of "first making a guess, then observing the effect" and focuses on a local perspective. It treats "whether to guess" and "whether to linearize" as optimization variables at the same level, utilizing the branch and bound algorithm of the MILP solver to find the theoretically global optimal path across the entire search space, often uncovering highly efficient attack paths that are difficult for humans to detect.

[0034] 2) Controllable complexity boundary;

[0035] By explicitly introducing complexity constraints ( This method directly eliminates invalid paths that, while having many linearized bits, result in excessive guessing costs, or those with low guessing costs but insufficient linearized bits, making them unsolvable. This ensures that the output attack scheme is executable under realistic computing power.

[0036] 3) High degree of automation and versatility;

[0037] This invention provides a standardized modeling process. For different Sponge algorithms, only the algebraic dependency rules in step 1 need to be updated, without modifying the core optimization logic. This significantly reduces the threshold and time cost of assessing the safety of new algorithms.

[0038] 4) Efficient solution;

[0039] High-performance MILP solvers, such as Gurobi, can solve large-scale MILP models in a reasonable amount of time, and can find the optimal solution that satisfies all constraints even in complex multi-round scenarios. Attached Figure Description

[0040] Figure 1 This is a diagram of a two-round attack structure.

[0041] Figure 2 It is a linearized path bit propagation graph Detailed Implementation

[0042] The present invention will be further described in detail below with reference to specific embodiments (two-round preimage attack of Ascon-XOF128), but the present invention is not limited to the following embodiments.

[0043] Ascon-XOF128 is a hash function based on the Sponge structure. Its internal state width is 320 bits, divided into five 64-bit words. Its Sponge structure consists of a rate component ( ) and capacity section ( )Sure. Bits are used for message absorption and output; Bits are used for security guarantees. The absorption phase injects the rate portion of the message block using a bitwise XOR operation, leaving the remaining capacity portion unchanged; the extrusion phase outputs the first 64 bits of the state as a set of hash values ​​until a hash value of the desired length is obtained. An internal permutation function is called between each absorption or extrusion operation. This internal permutation function consists of several rounds of iteration. Each round of the permutation function includes a constant increment (...). ), S-box replacement ( ) and linear diffusion layer ( ).

[0044] This preimage attack uses a guess-linearization attack combined with algebraic analysis, with the structure as follows: Figure 1As shown. The goal is to guess. (That is, a portion of the bits in message M) are searched for a linearized path in two rounds. The linear equation generated by the hash value leak is solved to obtain the unguessed bits in message M, thereby recovering the preimage corresponding to the hash value. This invention can be used to search for a two-round linearization path.

[0045] Implementation steps:

[0046] 1. Linearization path derivation and preprocessing;

[0047] The input to this two-round linearization path is The output is The goal of this step is to deduce the output state. The Bit linearization, required input state The bit index is guessed from the data.

[0048] ;

[0049] Based on the constructed linearization path derivation rules and the algebraic expressions of each part in the Ascon permutation function, the output state after two rounds of permutations is deduced in reverse. For input state The dependency relationship generates the output state. Candidate guess set corresponding to bit linearization .

[0050] 2. MILP model construction;

[0051] Define 64 binary variables Corresponding to 64-bit input state The guessing state; define 64 binary variables. Corresponding to 64-bit output status The linearized state. Based on the candidate guess set. Construct constraints for each output bit traverse its corresponding Inequality constraints are constructed respectively. Since the output of this Ascon-XOF128 is 64 bits, the brute-force complexity of the preimage attack is 2^32. 64 The safety threshold is set to Add constraints This constraint ensures that we obtain a sufficient number of linear equations to solve the unpredicted variables, guaranteeing the effectiveness of the attack. Simultaneously, we define the objective function as maximizing the number of linearized equations: .

[0052] The model was built and solved using Gurobi to obtain the optimal guess set. (32 bits) and linearized set (32 bits), objective function value That is, by guessing the 32 bits in the message, a maximum of 32 linear equations for hash value leakage can be obtained.

[0053] 3. Attack Implementation

[0054] 1) Exhaustive guessing: Traversing the set of guesses All 2s corresponding to the subscript 32 One possibility.

[0055] 2) For each guess, substitute the message into Ascon's two rounds of permutations. At this point, since the key nonlinear term has been fixed as a constant by the guessed value, the originally complex output... The problem degenerates into a system of linear equations concerning the unknown bits in the message. This system of equations is solved using Gaussian elimination.

[0056] 3) Verify whether the complete message obtained can generate the target hash value.

[0057] 4) Repeat the operation until the exhaustive guessing ends, and return the message corresponding to the target hash value.

[0058] Through this embodiment, the attacker only needs 2 32 This single operation can recover a 64-bit message, significantly improving attack efficiency compared to the complexity of brute-force enumeration. The discovery and implementation of this linearized path verifies the effectiveness of this invention in automating the search for linearized paths and finding optimal security boundaries. The bit propagation diagram of the Ascon-XOF1282-round linearized path is shown below. Figure 2 As shown.

Claims

1. A linearized path search method for Sponge-type cryptographic algorithms, characterized in that, The method includes the following steps: Step 1: Linearize the path dependency derivation; For the internal permutation function of the target Sponge-type cryptographic algorithm, a linear dependency relationship is constructed between the output state bits and the input state bits; in order to make the output state The Bit linearization must be performed in the input state. Guess which bits must be guessed; define this set of bits that must be guessed as the candidate guess set. Input status Guess the set of bit indices; Step 2: Constructing a mixed-integer linear programming model; After obtaining the candidate guess set, a mixed-integer linear programming model is constructed to jointly optimize the guess cost and linearization benefit; Step 3: Setting and Optimizing the Objective Function; After completing the construction of the mixed-integer linear programming model, the optimization solution step is executed; the objective function is set to maximize the profit, that is, maximize the number of linearized equations; the decision variables, linear constraints and objective function defined in step two are input into the MILP solver for solution, and the global optimal solution is searched and output under the premise of satisfying all constraints; Step 4: Optimal linearization path analysis and attack implementation; Based on the optimal solution output by the optimizer, linearized path parsing and attack implementation are performed.

2. The linearized path search method for Sponge-type cryptographic algorithms according to claim 1, characterized in that, In step one, firstly, the nonlinear S-box layer and the linear diffusion layer of the permutation function in each round of the algorithm are represented by the algebraic norm ANF to obtain the Boolean algebraic expression of each bit of the output state with respect to the bits of the input state. Secondly, regarding the output state The For each bit, analyze whether its corresponding algebraic expression contains a nonlinear term in the form of a product term; when the algebraic expression of the output bit contains a nonlinear term, determine the condition for linearization according to the linearization rules, that is: if there is a high-order product term in the expression, at least one factor must be guessed to make the term degenerate into a linear term or a constant; when multiple product terms share the same variable, the shared variable is guessed first. Finally, using the above rules, the output state is derived bit by bit from the input state to generate the output state. The The candidate guess set corresponding to bit linearization ,in This represents the set of bit indices for the guessed input state.

3. The linearized path search method for Sponge-type cryptographic algorithms according to claim 1, characterized in that, In step two, firstly, the decision variables are defined; , indicating input status The Whether a bit belongs to the guess set, 1 indicates a guess, 0 indicates no guess; , indicating the output status The Whether the bit was successfully linearized, 1 indicates linearization, and 0 indicates non-linearization; Secondly, construct logical constraints; and convert the output state from step one... The The bit-linearized dependencies are transformed into linear inequalities; for any output state The The bit, if it is marked as linearized Then its dependency set All bits in the output state must be guessed; for each bit of the output state, the following linear constraint is constructed to ensure that the corresponding output bit is allowed to be marked as linearized only when all relevant input bits in the candidate guess set are guessed. Finally, attack complexity constraints are constructed. To ensure that the generated attack paths are computationally feasible, a total complexity constraint is introduced. The total time complexity of an attack is typically determined by the cost of guessing and the cost of solving a system of linear equations. This is simplified to limiting the total number of bits involved to no more than a preset security threshold. .

4. The linearized path search method for Sponge-type cryptographic algorithms according to claim 1, characterized in that, In step four, firstly, the optimal solution vector returned by the solver is analyzed, and all... The indexes form the optimal guess set. Extract all The indices form the optimal linearized set. ; Secondly, exhaustively guess the bits in the optimal guess set and substitute the guessed values ​​into the permutation function of the target Sponge-type cryptographic algorithm; After the guessed value is fixed, the expression corresponding to the optimal linearization set of the output state is degenerated into a linear equation, and a system of linear equations is constructed based on the optimal linearization set. Finally, the unknown state bits are solved using linear equation solving methods, and the solution is verified by combining the algorithm output results, thereby completing the preimage recovery or state recovery attack on the target algorithm.

Images