A residual network-based sequential cipher register differential discriminator

Abstract

A serial cipher register differential discriminator based on residual networks includes the following steps: 1) Dataset generation: For serial cipher algorithms, training samples containing fixed differences (label 1) and random differences (label 0) are generated. The data is loaded into the state register using the key and initialization vector, and after a warm-up round, concatenated input data of length 2M is generated; 2) Feature extraction and preprocessing: Linear transformation and batch normalization are performed using embedding layers to reshape the data into a format suitable for convolutional processing, and initial features are extracted using a 1D convolutional neural network; 3) Residual network architecture: Multi-layer residual blocks are designed, employing different dilation rates (2 for odd positions and 1 for even positions) to capture multi-scale contextual information, supporting 1-10 configurable residual blocks; 4) Classification prediction: Binary classification is achieved through adaptive average pooling, fully connected layers, and the Softmax activation function, with a threshold of 0.51 used to determine true differences and random differences.

Description

Technical Field

[0001] This invention relates to the field of information security, specifically to a differential distinguisher for a stream cipher register based on a residual network. Background Technology

[0002] Differential cryptanalysis is a powerful cryptanalysis technique targeting symmetric encryption algorithms. Its core objective is to deduce the secret key used for encryption by studying the non-random statistical relationship between the plaintext difference (ΔP) and the ciphertext difference (ΔC). Systematically proposed and refined by Eli Biham and Adi Shamir in the early 1990s, this method has become one of the gold standards for evaluating the security of block ciphers.

[0003] Basic Principle: Attackers employ a chosen-plaintext attack model, actively constructing a large number of plaintext pairs (P, P') with specific differences (usually a fixed XOR value ΔP = P ⊕ P'), and submitting them to an encryption black box to obtain the corresponding ciphertext pairs (C, C'). By calculating the ciphertext difference ΔC = C ⊕ C' and performing massive statistical analysis, attackers search for paths (ΔP → ΔC) that occur with a significantly higher frequency than the probability of random guessing. These "high-probability difference features" reveal the non-random behavior within the encryption algorithm, particularly the predictability stemming from nonlinear components such as the S-box. Utilizing these features, attackers can trace the propagation of the difference throughout the encryption rounds and ultimately, through statistical analysis and key recovery techniques, reverse-engineer some or even all of the round keys.

[0004] For example, in the DES algorithm, researchers have found that input differences in certain S-boxes lead to output differences with a probability much higher than the theoretical average (e.g., in S-box 1, the probability of ΔX=001100 leading to ΔY=1101 is 14 / 64, instead of the ideal 4 / 64). This bias forms the basis for constructing effective differential attack paths. For 3 rounds of DES, a differential feature with a probability of approximately 1 / 16 is known, while in the completely random case, this probability is only 1 / 256, providing a key breakthrough for key recovery. While traditional differential analysis is theoretically powerful, it faces significant challenges:

[0005] High data requirements: A massive amount of plaintext-ciphertext pairs are needed to observe statistical significance.

[0006] Round Limitation: As the number of encryption rounds increases, the probability of differential features decreases sharply. Studies have shown that when the number of DES encryption rounds exceeds 19, exhaustive key search is more efficient than differential analysis.

[0007] Design Resistance: Modern cryptography (such as DES and AES) employs carefully designed S-boxes to achieve good differential uniformity, greatly enhancing their resistance to such attacks. Defense strategies include optimizing the S-box structure, increasing the number of encryption rounds, and introducing dynamic obfuscation mechanisms (such as using plaintext hash values ​​as initial parameters for chaotic systems) to disrupt the attacker's ability to construct stable differential paths.

[0008] A revolutionary advancement in neural network differential discriminators: In 2019, at Crypto, a top international cryptography conference, Gohr proposed the concept of differential neural cryptanalysis, marking a deep integration of artificial intelligence and cryptanalysis. He was the first to use deep neural networks (primarily convolutional neural networks, CNNs) as the underlying discriminator to replace traditional statistical models. This method trains neural networks to determine whether a ciphertext pair was encrypted from a plaintext pair with a specific difference, and its performance surpasses classical differential analysis on several lightweight cryptographic algorithms.

[0009] Subsequently, the field developed rapidly:

[0010] Interpretability Exploration (2021, EUROCRYPT): Benamira et al. pointed out that Gohr's neural network can actually approximate the difference distribution table of cryptographic algorithms very well and capture additional correlations that are difficult to find by traditional methods.

[0011] Model Improvements (2021-2022): Researchers optimized the model from multiple aspects. Chen et al. proposed using multiple encrypted pairs as input to enhance information; Zhang et al. improved the Inception module to enhance the network's ability to extract deep features; Hou et al. systematically studied the impact of network parameters on performance, confirming the effectiveness of pre-trained high-quality discriminators, but also pointed out the problem of excessive training time.

[0012] Input optimization (2022): Yang Xiaoxue et al. explored changing the input data format (such as the representation of difference pairs) to further improve model accuracy.

[0013] This paper proposes a differential path model that differs from traditional plaintext-ciphertext differential paths, constructing a differential path model for a stream cipher register. A dataset is built by obtaining the true differential path and random differential path of the stream cipher register. By improving the preheating rounds of the stream cipher, a critical preheating round at which the true differential path and random differential path cannot be distinguished is found. Summary of the Invention

[0014] Traditional differential cryptanalysis primarily focuses on the differential paths of plaintext-ciphertext pairs. However, for stream ciphers, the differential characteristics of their internal register states are a better indicator of algorithm security. Existing methods struggle to effectively identify the true and random differential paths in stream cipher registers and lack accurate mechanisms for determining critical warm-up rounds. This invention proposes a stream cipher register differential analysis method based on residual networks.

[0015] The technical solution to achieve the objective of this invention is:

[0016] A differential analysis method for stream cipher registers based on residual networks includes the following steps:

[0017] 1. Generate the dataset.

[0018] For stream cipher algorithm C, given the number of samples is... Random key and initialization vector (IV) The initialization vector (IV) is generated by a fixed bit difference ∆ for data with a label of 1 or 0. For data with a label of 0, the initialization vector (IV) is generated by a random bit difference ∆. ). The key and initialization vector (IV) The input data is loaded into the state register of the stream cipher algorithm C and generated after a warm-up cycle R. (The superscript distinguishes IV) The input data includes the IV and the merged different samples, with the subscript indicating the sample number. The length of the input data depends on the length of the register (state), which is set to M here. Similarly, the key and the initialization vector (IV) are also included. The input data is loaded into the state register of the stream cipher algorithm C and generated after a warm-up cycle R. , and Perform splicing to generate new sample input data =[ , New sample input data The length is and Twice that. Input data Label A sample that makes up the dataset, and the overall dataset has a shape of (N, 2M+1).

[0019] 2. Data preprocessing and initial feature extraction.

[0020] The input data from step 1) is cleaned and normalized to remove noise from the data and reduce its impact on target classification prediction. The training data is first fed into the embedding layer, which consists of linear transformation, batch normalization, and ReLU activation function, mapping the input data to a feature space of the same dimension.

[0021] The data is then reshaped into a format suitable for convolutional processing: (batch_size, word_size, num_blocks), where word_size and num_blocks are the optimal decomposition factors calculated based on the input dimension. The initial convolutional layer uses a 1D convolutional neural network with a kernel size of 3 and the number of output channels equal to the configured number of filters. Initial features are extracted after batch normalization and ReLU activation, denoted as output 1.

[0022] 3. Residual Network Feature Learning

[0023] Output 1 is fed into the residual layer, which consists of multiple residual blocks connected in series. Each residual block contains: 1) two 1D convolutional layers (with a kernel size of 3); 2) a batch normalization layer; 3) an activation function (LeakyReLU); and 4) a residual connection (shortcut connection).

[0024] The residual blocks employ different dilation rates: odd-position residual blocks have a dilation rate of 2, while even-position residual blocks have a dilation rate of 1. This helps capture contextual information at different scales. When the number of input and output channels differs, 1×1 convolutions are used for dimension matching. The number of residual blocks can be configured from 1 to 10, and the output is denoted as Output 2.

[0025] 4. Classification prediction head

[0026] Output 2 is processed by a classification prediction head. The prediction head structure includes: 1) an adaptive average pooling layer (AdaptiveAvgPool1d);

[0027] 2) Flatten layer; 3) Fully connected layer (input dimension is the number of filters, output dimension is the number of configured neurons); 4) Batch normalization and ReLU activation; 5) Final classification layer (output dimension is the number of categories, using Softmax activation). The model output is the probability distribution of each category, and the final classification result is determined by the argmax operation. When the probability is greater than a set threshold, it means that the neural network can distinguish between true differences and random differences; otherwise, it is determined that it cannot distinguish between true differences and random differences (the threshold set in this tool is 0.51).

[0028] This technical solution has the following advantages compared to existing technologies:

[0029] 1) Innovative Differential Analysis Perspective: Starting from the stream cipher register state, rather than the traditional plaintext-ciphertext differential analysis, this approach can identify higher-order real and random differential paths, thus providing the boundary of the warm-up rounds that need to be considered when designing stream ciphers to resist differential analysis; 2) Critical Point Identification: It can accurately find the critical warm-up rounds where real and random differential paths cannot be distinguished; 3) Efficient Feature Extraction: The improved ResNet network can effectively extract deep features of register states; 4) Wide Applicability: It supports differential analysis of various stream cipher algorithms; 5) Practical Security Assessment: It provides quantitative indicators for the security assessment of stream ciphers. Attached Figure Description

[0030] Figure 1 This is a flowchart illustrating the implementation of this method;

[0031] Figure 2 This is a flowchart illustrating the initialization and preparation phases of the dataset extraction system in this method.

[0032] Figure 3 This is a flowchart illustrating the core data generation and processing stages of the dataset in this method.

[0033] Figure 4 This is a flowchart of the dataset quality control and output stages in this method;

[0034] Figure 5 This is a diagram of the overall neural network architecture used in this method;

[0035] Figure 6 Enter the sequence password interface for the front end of this method;

[0036] Figure 7 The results are shown for single preheating wheels 216, 217, and 218 in the embodiment (taking grain128a as an example).

[0037] Figure 8 The image shows the results of the multi-preheating wheels 216-218 in the embodiment (taking grain128a as an example). Detailed Implementation

[0038] The present invention will be further described below with reference to the accompanying drawings and embodiments, but this is not intended to limit the scope of the invention.

[0039] Example:

[0040] This method is configured with a front-end interface that allows users to submit different sequence password algorithms for verification, which provides convenience in use.

[0041] Reference Figure 1 This paper presents a stream cipher register differential discriminator based on residual networks. This example method is a random difference to true difference discrimination algorithm for stream cipher algorithms. After inputting a generated stream cipher register dataset, the dataset is loaded into a configured residual neural network for training. After training, a graph is generated, and the program analyzes the results based on a defined threshold. The steps include:

[0042] 1. Enter the sequence password. Enter the sequence password information on the front-end interface. Figure 6 As we can see, the information to be filled in includes the class name of the sequence cipher, the byte length of the key and IV, the number of warm-up rounds (users can choose to test multiple warm-up rounds or a single warm-up round; multiple warm-up rounds allow for a better view of the critical warm-up rounds between the real and random difference paths, while a single warm-up round allows for better observation of accuracy details), the total number of training samples (filled in according to user needs; generally, it is recommended to have more than 30,000 samples to ensure sufficient samples, but more than 60,000 will better stabilize training results), the length of the state register, the name of the state register, and the implementation of the corresponding sequence cipher (the sequence cipher implemented according to the corresponding template). After filling in the information, click "Sample Collection" (divided into single warm-up rounds and multiple warm-up rounds; if you fill in a single warm-up round, collect a single warm-up round; if you select multiple warm-up rounds, click "Collect Multiple Warm-up Rounds"), and wait for the collection to complete after a period of time.

[0043] 2. Dataset Acquisition: After data collection, the resulting datasets are real and random difference register datasets. The real difference data samples are generated using a set initial vector (IV0) and a set initial vector for the difference (IV1), while the random difference data samples are generated using a set initial vector (IV2). It is generated by the initial vector (IV1) of the random difference;

[0044] 3. Model Training: 1) Dataset Partitioning: Divide the dataset, with 80% used for model training and 20% used to validate the model's performance; 2) Model Hyperparameter Configuration: Number of Filters: 64 convolutional filters to provide ample feature extraction capabilities; Network Depth: 30 residual blocks to ensure deep feature learning; Kernel Size: 3×1 convolutional kernels to balance receptive field and computational efficiency; Fully Connected Layer Neurons: 512 neurons for feature fusion; Batch Size: 100 samples / batch to balance memory usage and gradient stability; Maximum Training Equinoxes: 200 epochs to ensure sufficient training while avoiding overfitting; Learning Rate: 0.003061 (high learning rate for fast convergence); 3) Callback Function: Early Stopping Mechanism: Automatically stop training when accuracy shows no improvement after 50 consecutive epochs to prevent overfitting and save computational resources; Visualization Output: Automatically generate training process graphs (loss curve, accuracy curve).

[0045] 4. Visualization Results and Evaluation: 1) Single Preheating Wheel: The visualization results of a single preheating wheel return loss curves and accuracy curves. The program evaluates the results based on a preset threshold (0.51 accuracy). If the curve stabilizes above 0.51, the data is considered discriminative, and the algorithm fails the test. For example: Figure 7 As shown, grain128a of warm-up round 216 exhibits a distinguishable trend (exceeding the threshold of 0.51 as the training epoch increases), while grain128a of warm-up rounds 217 and 218 exhibits an indistinguishable trend (oscillating around 0.51 as the training epoch increases). 2) Multiple warm-up rounds: Multiple warm-up rounds return the accuracy results of multiple single warm-up rounds and plot the accuracy trend curve. The trend curve shows the critical round number the algorithm passed. At the critical round number, a mark will be displayed: "The data detected by the rxx warm-up round is indistinguishable, and the algorithm passes the detection." Figure 8 This is a trend chart of preheating cycles 216-218 of grain128a. From the chart, it can be concluded that preheating cycle 217 is the critical cycle (the indistinguishable start preheating cycle is the critical cycle).

Claims

1. A stream cipher register differential distinguisher based on residual networks, characterized in that, Includes the following steps: Step 1. Generate dataset For stream cipher algorithm C, given the number of samples is... Random key and initialization vector (IV) ), and the corresponding label (1 or 0). For data with label 1, the initial vector (IV) is... The difference is a fixed bit difference ∆, which generates the initial vector (IV). For data with label 0, the initial vector (IV) The difference is a random initialization vector (IV). ). The key and initialization vector (IV) The input data is loaded into the state register of the stream cipher algorithm C and generated after a warm-up cycle R. (The superscript distinguishes IV) and IV There are also different samples after merging, with subscripts indicating sample numbers, and the input data length depends on the length of the register (state), which is set to M here. Similarly, the key and initialization vector (IV) are... The input data is loaded into the state register of the stream cipher algorithm C and generated after a warm-up cycle R. , and Perform splicing to generate new sample input data =[ , New sample input data The length is and Twice that. Input data Label A sample that makes up the dataset, and the overall dataset has a shape of (N, 2M+1). Step 2. Data Preprocessing and Initial Feature Extraction The input data from step 1 undergoes data cleaning and normalization to remove noise that could affect target classification prediction. The training data, used as model input, is first fed into the embedding layer, which consists of linear transformation, batch normalization, and the ReLU activation function, mapping the input data to a feature space of the same dimension. The data is then reshaped into a format suitable for convolutional processing: (batch_size, word_size, num_blocks), where word_size and num_blocks are the optimal decomposition factors calculated based on the input dimension. The initial convolutional layer uses a 1D convolutional neural network with a kernel size of 3 and the number of output channels equal to the number of configured filters. After batch normalization and ReLU activation, initial features are extracted and denoted as output 1. Step 3. Residual Network Feature Learning Output 1 is fed into a residual layer, which consists of multiple residual blocks cascaded together. Each residual block contains: 1) two 1D convolutional layers (kernel size 3); 2) a batch normalization layer; 3) an activation function (LeakyReLU); and 4) a residual connection (shortcut connection). The residual blocks employ different dilation rates: odd-numbered positions have a dilation rate of 2, and even-numbered positions have a dilation rate of 1, which helps capture contextual information at different scales. When the number of input and output channels differs, 1×1 convolutions are used for dimension matching. The number of residual blocks can be configured from 1 to 10, and the output is denoted as output 2. Step 4. Classification prediction head Output 2 is processed by the classification prediction head. The prediction head structure includes: 1) Adaptive average pooling layer (AdaptiveAvgPool1d); 2) The model consists of four layers: 3) Flattened layer; 4) Fully connected layer (input dimension is the number of filters, output dimension is the number of neurons); 5) Batch normalization and ReLU activation; 6) Final classification layer (output dimension is the number of classes, activated using Softmax). The model output is the probability distribution of each class, and the final classification result is determined by the argmax operation. When the probability is greater than a set threshold, it means that the neural network can distinguish between true differences and random differences; otherwise, it is determined that it cannot distinguish between true differences and random differences (the threshold set in this tool is 0.51).

Images