Feistel-2* key recovery attack method based on multi-equation quantum claw search algorithm

Abstract

The present invention relates to a Feistel‑2* key recovery attack method based on a multi-equation quantum claw search algorithm, comprising the following steps: designing an equation f based on a Feistel‑2* structure i and g i ; Connection equation f i and g i , constructor F(c||x); prepare the initial state: #imgabs0# where s b , f b , t b , a b are registers, b = 1, 2, with r(u+1), rvw, u+1, u+1+vw qubits respectively; in register s b and f b The following unitary operator Q is executed on F ; If F(j1)=F(j2), then flip the phase; execute the quantum walk algorithm; repeat the phase flipping and quantum walk algorithm #imgabs1# times; measure the register (s1,s2) to obtain (S1,S2); if (j1,j2)∈S1×S2, then output the quantum claw (x1,x2), otherwise there is no solution; search for all subkeys based on the output quantum claw (x1,x2) and the Grover algorithm.

Description

Technical Field

[0001] The invention relates to a Feistel-2* key recovery attack method based on a multi-equation quantum claw search algorithm, and belongs to the technical field of quantum computing and quantum security. Background Art

[0002] With the rapid development of quantum computing, classical cryptography is gradually threatened. In 1994, the Grover algorithm was proposed by Peter Shor, which was the world's first famous quantum attack, destroying the most commonly used public key systems such as the RSA cryptosystem and elliptic curve cryptography. However, quantum attacks on symmetric key systems mainly use the Grover algorithm to speed up searches, so they are generally not paid much attention.

[0003] It was not until 2010 that Kuwakado et al. proposed a quantum 3-round discriminator based on the Feistel structure of the Simon algorithm, which reduced the time complexity of key recovery from O(2n) to O(n). This also makes it possible to evaluate more and more specific structures. Kaplan divides these quantum attacks into two attack models, namely the Q1 model and the Q2 model, according to the ability of the adversary. In the Q1 model, the adversary queries the oracle through classical methods and can use a quantum computer to process the data. For the Q2 model, the adversary queries the oracle through online quantum superposition and can use a quantum computer to process the data. It can be seen that the adversary in the Q1 model is more real than the adversary in the Q2 model. This means that if the attacker is not allowed to access the quantum cryptography oracle, the attack in the Q2 model will not work. Recently, Ito et al. proposed a quantum attack based on the Feistel-2* structure of the Q2 model. However, this is unrealistic because the quantum oracle needs to be accessed by the adversary and the data complexity is high. Summary of the invention

[0004] In order to solve the problems existing in the above-mentioned prior art, the present invention proposes a quantum full subkey recovery attack scheme based on a multi-equation quantum claw search algorithm. The scheme uses a more realistic Q1 model as the scenario, and only requires 3 plaintext and ciphertext pairs to quickly crack the 6-round Feistel-2* structure.

[0005] The technical solution of the present invention is as follows:

[0006] On the one hand, the present invention proposes a Feistel-2* key recovery attack method based on a multi-equation quantum claw search algorithm, comprising the following steps:

[0007] Based on Feistel-2* structural design equation f i :{0,1} u →{0,1} v and gi :{0,1} u →{0,1} v , where 1≤i≤w;

[0008] Connection equation f i and g i , we get f(x)=f1(x)||f2(x)||...||f i (x) and g(x)=g1(x)||g2(x)||...||g i (x);

[0009] Constructor

[0010] Prepare the initial state:

[0011]

[0012] Among them, s b , f b , t b , a b are registers, b=1, 2, s b There are r(u+1) qubits, f b There are rvw qubits, t b There are u+1 quantum bits, a b There are u+1+vw quantum bits; N=2 u , J1={0,1,...,N-1}, J1={N,N+1,...,2N-1};

[0013] In register s b and f b The following unitary operator is executed on it:

[0014]

[0015] Right now

[0016] Perform phase inversion. If F(j1)=F(j2), perform phase inversion as shown below:

[0017]

[0018] in, h1, h2 registers are the combined registers of multiple registers, h1 = (s1, f1, t1), h2 = (s2, f2, t2);

[0019] Execute the quantum walk algorithm;

[0020] Repeated execution of the phase flip and quantum walk algorithm Second-rate;

[0021] Measure register (s1, s2) to get (S1, S2);

[0022] If (j1,j2)∈S1×S2, then output the quantum claw (x1,x2), otherwise there is no solution;

[0023] Find all subkeys based on the output quantum claw (x1, x2) and Grover algorithm.

[0024] As a preferred implementation, the quantum walk algorithm specifically includes the following steps:

[0025] In the combined register h b Execute the unitary operator D1 on (b) :

[0026]

[0027] Using the unitary operator Q F Query F(z b ):

[0028]

[0029] In the combined register h b Execute the unitary operator on

[0030]

[0031] Using the unitary operator Q F Query F(z b ):

[0032]

[0033] On the other hand, the present invention also proposes a Feistel-2* key recovery attack system based on a multi-equation quantum claw search algorithm, comprising:

[0034] Multi-equation design module for designing structures based on Feistel-2* equations f i :{0,1} u →{0,1} v and g i :{0,1} u →{0,1} v , where 1≤i≤w;

[0035] Multi-equation connection module, used to connect equations f i and g i, we get f(x)=f1(x)||f2(x)||...||f i (x) and g(x)=g1(x)||g2(x)||...||g i (x);

[0036] Function construction module, used for constructors

[0037] Initial state preparation module, used to prepare the initial state:

[0038]

[0039] Among them, s b , f b , t b , a b are registers, b=1, 2, s b There are r(u+1) qubits, f b There are rvw qubits, t b There are u+1 quantum bits, a b There are u+1+vw quantum bits; N=2 u , J1={0,1,...,N-1}, J1={N,N+1,...,2N-1};

[0040] Transformation module, used to register s b and f b The following unitary operator is executed on it:

[0041]

[0042] Right now

[0043] The phase flip module is used to perform phase flipping. If F(j1)=F(j2), the phase flipping is performed as shown below:

[0044]

[0045] in, h1, h2 registers are composite registers of multiple registers, h1 = (s1, f1, t1), h2 = (s2, f2, t2);

[0046] Quantum walk module, used to execute quantum walk algorithm;

[0047] Repeated execution of the phase flip and quantum walk algorithm Second-rate;

[0048] The measurement module is used to measure the register (s1, s2) to obtain (S1, S2);

[0049] Output module, used to output quantum claw (x1,x2) when (j1,j2)∈S1×S2, otherwise output no solution;

[0050] The full subkey search module is used to find all subkeys based on the output quantum claw (x1, x2) and the Grover algorithm.

[0051] As a preferred implementation, the quantum walk module specifically includes:

[0052] The first unitary conversion unit is used to convert the register h b Execute the unitary operator D1 on (b) :

[0053]

[0054] The first query unit is used to use the unitary operator Q F Query F(z b ):

[0055]

[0056] The second unitary conversion unit is used to convert the register h b Execute the unitary operator on

[0057] The second query unit uses the unitary operator Q F Query F(z b ):

[0058]

[0059] On the other hand, the present invention also proposes a physical device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the Feistel-2* key recovery attack method based on the multi-equation quantum claw search algorithm as described in any embodiment of the present invention is implemented.

[0060] On the other hand, the present invention also proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the Feistel-2* key recovery attack method based on the multi-equation quantum claw search algorithm as described in any embodiment of the present invention.

[0061] The present invention has the following beneficial effects:

[0062] The Feistel-2* key recovery attack method based on a multi-equation quantum claw search algorithm of the present invention meets the needs of multi-equation quantum claw search calculations in a quantum environment and the purpose of performing a full subkey recovery attack on a block cipher compared to a quantum attack proposed by Ito et al.; compared to a classical attack, it can simultaneously reduce the time complexity and the memory complexity through a quantum mechanics mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 A schematic diagram of a method flow of an embodiment of the present invention;

[0064] Figure 2 This is a schematic diagram of the structure of a 6-round Feistel-2* according to an embodiment of the present invention. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] It should be understood that the step numbers used in this document are only for convenience of description and are not intended to limit the order in which the steps are executed.

[0067] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0068] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0069] The term "and / or" means and includes any and all possible combinations of one or more of the associated listed items.

[0070] Embodiment 1:

[0071] See also Figure 1 ,The present invention proposes a Feistel-2* key recovery attack method based on a multi-equation quantum claw search algorithm, and proposes a multi-equation quantum claw search algorithm;

[0072] The input of the multi-equation quantum claw search algorithm is: equation f i :{0,1} u →{0,1} v and g i :{0,1} u →{0,1} v , where 1≤i≤w;

[0073] The output is: If there is a claw (x1, x2) ∈ {0, 1} u ×{0,1} u ,satisfy Then f i (x1) = g i (x2) Output, otherwise reject.

[0074] The complexity of the multi-equation quantum claw search algorithm is:

[0075] The overall key recovery attack method specifically includes the following steps:

[0076] S101. First, according to the structure of the target Feistel-2* and the known plaintext and ciphertext, design equation f i :{0,1} u →{0,1} v and g i :{0,1} u →{0,1} v , where 1≤i≤w;

[0077] S102, connection equation f i and g i , we get f(x)=f1(x)||f2(x)||...||f i (x) and g(x)=g1(x)||g2(x)||...||g i (x); The essence of connecting two equations is to connect two binary strings in parallel to form a new string;

[0078] S200, Constructor F:{0,1} u+1 →{0,1} vw , c is used to control the selection of functions f and g;

[0079] S300, prepare for initial state:

[0080]

[0081] For convenience, we divide the registers into s b , f b , t b , ab , (b=1,2), where s b There are r(u+1) qubits, f b There are rvw qubits, t b There are u+1 quantum bits, a b There are u+1+vw quantum bits; N=2 u , J1={0,1,...,N-1}, J1={N,N+1,...,2N-1};

[0082] S400, respectively in register s b and f b The following unitary operator is executed on it:

[0083]

[0084] Right now

[0085] S500, if F(j1)=F(j2), then perform the phase inversion as shown below:

[0086]

[0087] in, h1, h2 registers are the combined registers of multiple registers, h1 = (s1, f1, t1), h2 = (s2, f2, t2);

[0088] S600, executing quantum walk algorithm;

[0089] S700, repeat the above steps S500 and step Second-rate;

[0090] S800, measure register (s1, s2) to obtain (S1, S2);

[0091] S901. If (j1, j2)∈S1×S2, then output the quantum claw (x1, x2), otherwise there is no solution;

[0092] S902, searching for all subkeys according to the output quantum claw (x1, x2) and Grover quantum search algorithm.

[0093] As a preferred implementation of this embodiment, in step S600, the quantum walk algorithm specifically includes the following steps:

[0094] S601, in the combination register h b Execute the unitary operator D1 on (b) :

[0095]

[0096] S602, using unitary operator Q F Query F(z b ):

[0097]

[0098] S603, in the combination register h b Execute the unitary operator on

[0099]

[0100] S604, using unitary operator Q F Query F(z b ):

[0101]

[0102] Based on the above embodiments, compared with the quantum attack proposed by Ito et al., the present invention meets the needs of multi-equation quantum claw search calculations in a quantum environment and meets the purpose of performing a full subkey recovery attack on block ciphers; compared with classical attacks, it can reduce both time complexity and memory complexity through quantum mechanics mechanisms.

[0103] In order to help those skilled in the art further understand the technical solution of this embodiment, a specific application example is provided below:

[0104] See Figure 2 , Figure 2 Shown is a 6-wheel Feistel-2* structure;

[0105] Assume that three pairs of plaintext and ciphertext in the 6-round Feistel-2* structure are selected in this example in 1≤i≤3, let The attacker wants to know all subkeys K1-K6. The specific process is as follows:

[0106] (i) According to the express Calculation from the encryption direction 1≤i≤3, we get the formula

[0107] (ii) for step (i) and XOR

[0108] and step (i) and XOR

[0109] (iii) Based on the ciphertext and Calculate from the decryption direction 1≤i≤3, we get

[0110] (iv) for step (iii) and XORing it gives:

[0111]

[0112] For L4 in step (iii) (1) and L4 (3) XORing it gives:

[0113]

[0114] (v) Design functions f1, f2, g1, g2

[0115]

[0116]

[0117]

[0118]

[0119] At this time, the encryption direction is calculated Calculated from the decryption direction

[0120] (vi) Input functions f1, f2, g1, g2 into the multi-equation quantum claw search algorithm.

[0121] (vii) Output claws K′2 and K6.

[0122] (viii) When K′2 and K6 are known, use Grover’s algorithm to find subkeys K1, K2, K3, K4, K5, K6. At this time, the attacker obtains all subkeys.

[0123] Embodiment 2:

[0124] This embodiment proposes a Feistel-2* key recovery attack system based on a multi-equation quantum claw search algorithm, including:

[0125] Multi-equation design module for designing structures based on Feistel-2* equations f i :{0,1} u →{0,1} v and g i :{0,1} u →{0,1} v , where 1≤i≤w; this module is used to implement the function of step S101 in the first embodiment, which will not be described in detail here;

[0126] Multi-equation connection module, used to connect equations f i and g i , we get f(x)=f1(x)||f2(x)||...||f i (x) and g(x)=g1(x)||g2(x)||...||g i (x); This module is used to implement the function of step S102 in the first embodiment, which will not be described in detail here;

[0127] Function construction module, used for constructors This module is used to implement the function of step S200 in the first embodiment, which will not be described in detail here;

[0128] Initial state preparation module, used to prepare the initial state:

[0129]

[0130] Among them, s b , f b , t b , a b are registers, b=1, 2, s b There are r(u+1) qubits, f b There are rvw qubits, t b There are u+1 quantum bits, a b There are u+1+vw quantum bits; N=2 u , J1 = {0, 1, ..., N-1}, J1 = {N, N+1, ..., 2N-1}; this module is used to implement the function of step S300 in the first embodiment, which will not be described in detail here;

[0131] Transformation module, used to register s b and f b The following unitary operator is executed on it:

[0132]

[0133] Right now This module is used to implement the function of step S400 in the first embodiment, which will not be described in detail here;

[0134] The phase flip module is used to perform phase flipping. If F(j1)=F(j2), the phase flipping is performed as shown below:

[0135]

[0136] in, The h1 and h2 registers are the combined registers of multiple registers, h1 = (s1, f1, t1), h2 = (s2, f2, t2); this module is used to implement the function of step S500 in the first embodiment, and will not be repeated here;

[0137] A quantum walk module, used to execute the quantum walk algorithm; this module is used to implement the function of step S600 in the first embodiment, which will not be described in detail here;

[0138] Repeated execution of the phase flip and quantum walk algorithm This module is used to implement the function of step S700 in the first embodiment, which will not be described in detail here;

[0139] A measurement module, used to measure the register (s1, s2) to obtain (S1, S2); this module is used to implement the function of step S901 in the first embodiment, which will not be described in detail here;

[0140] An output module, used to output the quantum claw (x1, x2) when (j1, j2)∈S1×S2, otherwise output no solution; this module is used to implement the function of step S100 in the first embodiment, which will not be repeated here;

[0141] The full subkey search module is used to search for all subkeys according to the output quantum claw (x1, x2) and the Grover algorithm; this module is used to implement the function of step S902 in the first embodiment and will not be described in detail here.

[0142] As a preferred implementation of this embodiment, the quantum walk module specifically includes:

[0143] The first unitary conversion unit is used to convert the register h b Execute the unitary operator D1 on (b) :

[0144]

[0145] The first query unit is used to use the unitary operator Q F Query F(z b ):

[0146]

[0147] The second unitary conversion unit is used to convert the register h b Execute the unitary operator on

[0148] The second query unit uses the unitary operator Q F Query F(z b ):

[0149]

[0150] Embodiment three:

[0151] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any embodiment of the present invention when executing the program.

[0152] Embodiment three:

[0153] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in any embodiment of the present invention is implemented.

[0154] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can be represented by: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, c can be single or multiple.

[0155] Those of ordinary skill in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented in a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0156] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0157] In several embodiments provided in the present application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), disk or optical disk and other media that can store program codes.

[0158] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A Feistel-2* key recovery attack method based on a multi-equation quantum claw search algorithm, characterized in that: The following steps are involved: Based on Feistel-2* structural design equation f i :{0,1} u →{0,1} v and g i :{0,1} u →{0,1} v , where 1≤i≤w; Connection equation f i and g i , we get f(x)=f1(x)||f2(x)||...||f i (x) and g(x)=g1(x)||g2(x)||...||g i (x); Constructor Prepare the initial state: Among them, s b , f b , t b , a b are registers, b=1, 2, s b There are r(u+1) qubits, f b There are rvw qubits, t b There are u+1 quantum bits, a b There are u+1+vw quantum bits; J1={0,1,...,N-1}, J1={N,N+1,...,2N-1}; In register s b and f b The following unitary operator is executed on it: Q F :|j>|y>→|j>|y⊕F(j)>; Right now Perform phase inversion. If F(j1)=F(j2), perform phase inversion as shown below: in, h1, h2 registers are composite registers of multiple registers, h1 = (s1, f1, t1), h2 = (s2, f2, t2); Execute the quantum walk algorithm; Repeated execution of the phase flip and quantum walk algorithm Second-rate; Measure register (s1, s2) to get (S1, S2); If (j1,j2)∈S1×S2, then output the quantum claw (x1,x2), otherwise there is no solution; Find all subkeys based on the output quantum claw (x1, x2) and Grover algorithm.

2. A Feistel-2* key recovery attack method based on a multi-equation quantum claw search algorithm according to claim 1, characterized in that: The quantum walk algorithm specifically includes the following steps: In the combined register h b Execute the unitary operator on Using the unitary operator Q F Query F(z b ): In the combined register h b Execute the unitary operator on Using the unitary operator Q F Query F(z b ):

3. A Feistel-2* key recovery attack system based on a multi-equation quantum claw search algorithm, characterized in that: include: Multi-equation design module for designing structures based on Feistel-2* equations f i :{0,1} u →{0,1} v and g i :{0,1} u →{0,1} v , where 1≤i≤w; Multi-equation connection module, used to connect equations f i and g i , we get f(x)=f1(x)||f2(x)||...||f i (x) and g(x)=g1(x)||g2(x)||...||g i (x); Function construction module, used for constructors Initial state preparation module, used to prepare the initial state: Among them, s b , f b , t b , a b are registers, b=1, 2, s b There are r(u+1) qubits, f b There are rvw qubits, t b There are u+1 quantum bits, a b There are u+1+vw quantum bits; J1={0,1,...,N-1}, J1={N,N+1,...,2N-1}; Transformation module, used to register s b and f b The following unitary operator is executed on it: Q F :|j>|y>→|j>|y⊕F(j)>; Right now The phase flip module is used to perform phase flipping. If F(j1)=F(j2), the phase flipping is performed as shown below: in, h1, h2 registers are composite registers of multiple registers, h1 = (s1, f1, t1), h2 = (s2, f2, t2); Quantum walk module, used to execute quantum walk algorithm; Repeated execution of the phase flip and quantum walk algorithm Second-rate; The measurement module is used to measure the register (s1, s2) to obtain (S1, S2); Output module, used to output quantum claw (x1,x2) when (j1,j2)∈S1×S2, otherwise output no solution; The full subkey search module is used to find all subkeys based on the output quantum claw (x1, x2) and the Grover algorithm.

4. A Feistel-2* key recovery attack system based on a multi-equation quantum claw search algorithm according to claim 3, characterized in that: The quantum walk module specifically includes: The first unitary conversion unit is used to convert the register h b Execute the unitary operator on The first query unit is used to use the unitary operator Q F Query F(z b ): The second unitary conversion unit is used to convert the register h b Execute the unitary operator on The second query unit uses the unitary operator Q F Query F(z b ):

5. A physical device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the Feistel-2* key recovery attack method based on the multi-equation quantum claw search algorithm as described in any one of claims 1-2 is implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the Feistel-2* key recovery attack method based on the multi-equation quantum claw search algorithm as described in any one of claims 1 to 2 is implemented.

Images