A method, device, equipment and storage medium for testing performance of a cryptographic algorithm

Abstract

The application discloses a kind of methods, devices and storage medium to the performance test of cryptographic algorithm.The method comprises: in response to S-box operation instruction, determine at least one S-box input data;Wherein, S-box input data includes the key to be used and the corresponding plaintext to be used determined based on estimated fault information in S-box;At least one S-box input data is respectively encrypted based on the cryptographic algorithm to be tested and standard cryptographic algorithm, and the ciphertext to be compared and the corresponding standard ciphertext are obtained;Based on the ciphertext to be compared and the corresponding standard ciphertext, determine the ciphertext error attribute of the cryptographic algorithm to be tested;Based on each ciphertext error attribute and preset error threshold, determine the test result of the test of the cryptographic algorithm to be tested.Solve the problem that the performance of cryptographic algorithm is tested based on the way of chip dissection in the prior art, and the operability is poor, and the efficiency is low, and the effect of improving the accuracy, convenience and speed of cryptographic algorithm test is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer processing, and in particular to a method and device for testing the performance of a cryptographic algorithm, equipment and a storage medium. BACKGROUND

[0002] With the development of the Internet, digital security is increasingly valued, and cryptographic technology is increasingly widely used. In order to ensure the security of cryptographic algorithms, cryptographic devices running cryptographic algorithms are usually subjected to security evaluation to ensure the effectiveness of data security and, to some extent, the security of intelligent products in an open network environment.

[0003] Currently, the security testing of cryptographic algorithms usually involves dissecting a chip, and logically judging and analyzing the circuit by reverse analysis. However, this method is difficult to operate, has a long cycle, and is not feasible. SUMMARY

[0004] The present application provides a method and device for testing the performance of a cryptographic algorithm, equipment and a storage medium to improve the accuracy, convenience and speed of cryptographic algorithm testing.

[0005] According to an aspect of the present application, a method for testing the performance of a cryptographic algorithm is provided, which comprises:

[0006] In response to an S-box operation instruction, at least one S-box input data is determined, wherein the S-box input data includes a to-be-used key and a corresponding to-be-used plaintext determined based on estimated fault information in an S-box.

[0007] The at least one S-box input data is encrypted based on the to-be-tested cryptographic algorithm and the standard cryptographic algorithm, respectively, to obtain to-be-compared ciphertext and corresponding standard ciphertext.

[0008] Based on the to-be-compared ciphertext and the corresponding standard ciphertext, the ciphertext error properties of the to-be-tested cryptographic algorithm are determined.

[0009] Based on the ciphertext error properties and a preset error threshold, the test result of the to-be-tested cryptographic algorithm is determined.

[0010] According to another aspect of the present application, a device for testing the performance of a cryptographic algorithm is provided, which comprises:

[0011] An S-box input data determination module is configured to determine at least one S-box input data in response to an S-box operation instruction, wherein the S-box input data includes a to-be-used key and a corresponding to-be-used plaintext determined based on estimated fault information in an S-box.

[0012] a ciphertext obtaining module configured to obtain to-be-compared ciphertexts and corresponding standard ciphertexts by respectively encrypting the at least one S-box input data based on the to-be-tested cryptographic algorithm and the standard cryptographic algorithm;

[0013] an attribute determining module configured to determine a ciphertext error attribute of the to-be-tested cryptographic algorithm based on the to-be-compared ciphertexts and the corresponding standard ciphertexts;

[0014] a test result determining module configured to determine a test result of the to-be-tested cryptographic algorithm based on the ciphertext error attribute and a preset error threshold.

[0015] According to another aspect of the present application, an electronic device is provided, and the electronic device comprises:

[0016] at least one processor; and

[0017] a memory connected to the at least one processor in communication; wherein

[0018] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the method for testing the performance of a cryptographic algorithm according to any one of the embodiments of the present application.

[0019] According to another aspect of the present application, a computer readable storage medium is provided, and the computer readable storage medium stores computer instructions for enabling a processor to implement the method for testing the performance of a cryptographic algorithm according to any one of the embodiments of the present application when the processor executes the computer instructions.

[0020] The technical scheme of the embodiment of the present application comprises the following steps: in response to an S-box operation instruction, at least one S-box input data is determined; wherein the S-box input data comprises a to-be-used key and corresponding to-be-used plaintext determined based on estimated fault information in the S-box; based on a to-be-tested cryptographic algorithm and a standard cryptographic algorithm, at least one S-box input data is encrypted to obtain to-be-compared ciphertext and corresponding standard ciphertext; based on the to-be-compared ciphertext and the corresponding standard ciphertext, a ciphertext error attribute of the to-be-tested cryptographic algorithm is determined; based on each ciphertext error attribute and a preset error threshold, a test result of the test on the to-be-tested cryptographic algorithm is determined, thereby solving the problems of poor operability and low efficiency in the prior art of testing the performance of a cryptographic algorithm based on the way of circuit restoration through chip dissection, constructing the to-be-used key and the corresponding to-be-used plaintext based on the estimated fault information in the known S-box, taking the to-be-used key and the corresponding to-be-used plaintext as the input of the to-be-tested cryptographic algorithm and the standard cryptographic algorithm, improving the controllability and operability of the cryptographic algorithm test, comparing the two kinds of ciphertext output, improving the speed and convenience of the test, determining the error condition of the encryption algorithm based on the compared ciphertext error attribute and the preset error threshold, obtaining the test result of the test on the to-be-tested cryptographic algorithm, and ensuring the accuracy of the test result.

[0021] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent through the following description. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0023] Figure 1 is a flow chart of a method for testing the performance of a cryptographic algorithm according to the first embodiment of the present application;

[0024] Figure 2 is a schematic diagram of a method for testing the performance of a cryptographic algorithm according to the first embodiment of the present application;

[0025] Figure 3 is a schematic diagram for representing the relationship between a ciphertext error attribute and a round output parameter according to the first embodiment of the present application;

[0026] Figure 4 is a schematic diagram of a method for testing the performance of a cryptographic algorithm according to the second embodiment of the present application;

[0027] Figure 5 is a structural schematic diagram of a device for testing performance of a cryptographic algorithm according to an embodiment of the present application;

[0028] Figure 6 is a structural schematic diagram of an electronic device for implementing a method for testing performance of a cryptographic algorithm according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the personnel in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work should belong to the scope of protection of the present application.

[0030] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment one

[0032] Figure 1 is a flowchart of a method for testing performance of a cryptographic algorithm according to an embodiment of the present application. The embodiment can be applicable to the case of testing a cryptographic algorithm. The method can be executed by a device for testing performance of a cryptographic algorithm. The device for testing performance of a cryptographic algorithm can be realized in the form of hardware and / or software. The device for testing performance of a cryptographic algorithm can be configured in a computing device. As shown in the figure, the method comprises: Figure 1

[0033] S110, in response to the S-box operation instruction, determining at least one S-box input data.

[0034] ​It should be noted that the technical solutions provided in the embodiment can be applied to the scene of testing the performance of the cryptographic algorithm. The cryptographic algorithm can run in a cryptographic device, and the cryptographic device can be an encryption machine, a dynamic password, a password keyboard, etc. The cryptographic algorithm can be an AES (Advanced Encryption Standard) algorithm, a DES (Data Encryption Standard) algorithm, or a Midori-128 algorithm. The cryptographic algorithm involves a large number of S-box (Substitution-box) operations. The S-box is a nonlinear structure for performing substitution calculation in the cryptographic algorithm, and the quality of the S-box index directly determines the quality of the cryptographic algorithm. For example, a persistent fault can be injected into the S-box table before the key generation and encryption / decryption operation of the cryptographic algorithm is performed. The running results of the cryptographic algorithm before and after the fault injection are collected, and the test results of the performance test of the cryptographic algorithm are determined by comparing and analyzing the running results. The persistent fault is a fault that exists in the multiple rounds of encryption process of the algorithm and disappears after the cryptographic device is reset or restarted. It should be further noted that for the S-box of the cryptographic algorithm, the S-box is mostly bijective. For example, in the AES algorithm, the output is one-to-one mapped with the output. For each 8-bit input, there is a unique 8-bit output. After the persistent fault is injected into the S-box table, there can be two or more different inputs with the same output. For example, the position of the injected fault in the S-box is u, and the fault result value v after the fault injection * , * , The original corresponding position of u * is u * , which means that u and u * appear the same fault result value v * after the fault injection, S(u * )=v * , S(u)=v * , and S represents the S-box operation. The original corresponding position of u * after the fault injection can be used as the estimated fault information, that is, the estimated fault information refers to the position information of the fault result value after the fault injection. Based on the position information, the occurrence of the S-box operation fault is guided.

[0035] The S-box operation instruction can be a program or code used to indicate the execution of the S-box operation. The S-box input data includes a to-be-used key and a corresponding to-be-used plaintext determined based on the estimated fault information in the S-box. The S-box is a nonlinear structure in the to-be-tested cryptographic algorithm, and the to-be-tested cryptographic algorithm refers to the cryptographic algorithm that needs to be tested for performance. The to-be-used key refers to a parameter input in the algorithm for converting plaintext into ciphertext or converting ciphertext into plaintext. The plaintext refers to unencrypted text or a string.

[0036] In the embodiment, the S-box input data can be predetermined and stored in a preset position, and the S-box input data can be obtained from the preset position based on an interface when the S-box operation is to be performed by the cryptographic algorithm; or the S-box input data can be generated in real time based on the estimated fault information when the S-box operation instruction is received, so that the to-be-used key and the corresponding to-be-used plaintext in the S-box input data are used as the input parameters of the S-box operation, and the cryptographic algorithm is enabled to encrypt the plaintext and output the ciphertext.

[0037] To improve the accuracy of the performance test of the cryptographic algorithm, a large number of encryptions can be performed by constructing special plaintexts and initial keys, and the round keys affecting the S-box operation input can be transformed by adjusting the initial keys to restore the complete S-box table, so that the performance of the cryptographic algorithm is evaluated.

[0038] Optionally, the at least one S-box input data is determined by: dividing the preset initial key into at least one group, adjusting each initial value corresponding to a first group to a first preset value based on the estimated fault information to obtain a to-be-processed key, adjusting each initial value in a second group to a second preset value based on a preset adjustment parameter to obtain at least one to-be-used key, determining a to-be-used plaintext corresponding to the at least one to-be-used key, and determining the at least one S-box input data based on the at least one to-be-used key and the corresponding to-be-used plaintext.

[0039] The division of the at least one group is based on the position transformation relationship of each byte in the key during the key expansion operation. The key expansion operation refers to an operation of generating round keys based on an initial key. In the operation process, operations such as row shifting, column mixing, and byte substitution can be included. In the operation process, each byte in the key can change in value and can also change in position. For example, the second byte in the second row can be moved one position forward. The preset initial key can include 16 bytes, and each byte can store an 8-bit unsigned number. The stored value range is 0-255. To more effectively generate the to-be-used key, the 16 bytes of the preset initial key K can be set to 0 to construct the to-be-used key based on the preset initial key. The first preset value can be the preset fault information, that is, u * The preset adjustment parameter is in a preset adjustment range. For example, the preset adjustment range can be [0x00, 0xFF], the preset adjustment parameter Δ k ∈ [0x00, 0xFF], and Δ k has 256 value results.

[0040] In the embodiment, the 16 bytes of the key K can be set to 0 to construct the preset initial key K. At this time, the 16 bytes of K are all 0, such as the values of the 0th byte to the 15th byte are 0. According to the key expansion process, the first round key K 1 has the first four bytes The generation of K involves S-box operations. To ensure K... 1 To ensure the correctness of S-box operations during generation, bytes 12, 13, 14, and 15 of K can be used as the first group. The initial values ​​in this first group can be adjusted to a first preset value, such as changing 0 to u. * Considering that the 12th byte of the result from the byte substitution (SubWord) operation in the key expansion process will be XORed with 0x01, to simplify the first round key's 0th byte... The value of can be set to 0x01 for the 0th byte k0. Correspondingly, the initial value of the 0th byte in the preset initial key can be adjusted to 0x01, i.e., 1, to obtain the key to be processed. Furthermore, in order to obtain an initial key with more possible values, the 0th, 1st, 2nd, and 3rd bytes of K can be used as a third group. By using preset adjustment parameters, the initial values ​​in the key to be processed and the second group can be adjusted to the second preset values. For example, each value within the preset adjustment range [0x00, 0xFF] can be used as the second preset value. The initial values ​​in the second group can be adjusted to 0x00 to obtain a key to be used. The initial values ​​in the second group can be adjusted to 0x01 to obtain another key to be used. Correspondingly, multiple keys to be used can be obtained. Based on the values ​​within the preset adjustment range [0x00, 0xFF], 256 keys to be used can be obtained. Furthermore, in order to determine the corresponding plaintext from the constructed key to be used, for example, the XOR result of the key and the plaintext at the same byte position can be made the same. Each key and its corresponding plaintext can be used as an S-box input data, resulting in multiple S-box input data.

[0041] For example, given S(u) * ) = v * In this case, the values ​​of bytes 12, 13, 14, and 15 of the preset initial key K, which consists of 16 bytes all set to 0, can be set to u. * , i.e., k i ,i∈{12,13,14,15}set=u * 'i' represents the nth byte. The 0th byte of the preset initial key K can be set to 1 (i.e., 0x01) to obtain the adjusted initial key as the key to be used. The key to be used K is as follows:

[0042]

[0043] Furthermore, the construction of the key K to be used can be adjusted as follows:

[0044]

[0045] wherein, Δ k is a preset adjustment parameter, Δ k ∈[0x00, 0xFF]. Δ k is traversed, and correspondingly, K has 256 value conditions.

[0046] In this embodiment, the implementation manner of determining the to-be-used plaintext corresponding to the at least one to-be-used key can be: for the at least one to-be-used key, determining the plaintext element value based on the values corresponding to the third group in the current to-be-used key; and determining the to-be-used plaintext corresponding to the current to-be-used key based on the plaintext element value.

[0047] It should be noted that the manner of determining the to-be-used plaintext corresponding to each to-be-used key is the same, and any to-be-used key can be taken as the current to-be-used key for illustration.

[0048] Specifically, in the process of S-box operation, the input parameters of S-box operation are processed through a series of S-box operation to obtain a processing result, and the processing result is processed through bit shifting and column mixing, and based on the operation process, it can be known that the 0th byte, the 5th byte, the 10th byte and the 15th byte in the processing result will be transformed into the first four bytes, and the 0th byte, the 5th byte, the 10th byte and the 15th byte can be taken as the third group of bytes of the key. When determining the to-be-used plaintext, the values corresponding to the third group and the corresponding plaintext values can be processed through XOR operation, so that the XOR results are consistent, and the plaintext corresponding to each byte in the third group is obtained as the plaintext element value. After obtaining the plaintext element value corresponding to each byte in the third group, the plaintext element value can be filled into the corresponding position of the preset plaintext to obtain the to-be-used plaintext corresponding to the current to-be-used key. For example, the plaintext p i (i∈{0,5,10,15}) can be fixed, so that the XOR result of the plaintext and the to-be-used key is equal when i∈{0,5,10,15}.

[0049] S120, based on the to-be-tested cryptographic algorithm and the standard cryptographic algorithm, respectively, encrypts the at least one S-box input data to obtain the to-be-compared ciphertext and the corresponding standard ciphertext.

[0050] The to-be-tested cryptographic algorithm and the standard cryptographic algorithm are both run in the corresponding cryptographic device. The two cryptographic devices can be the same cryptographic product, and the difference lies in that the S-box elements in the cryptographic device running the to-be-tested cryptographic algorithm can be damaged, and the S-box elements in the cryptographic device running the standard cryptographic algorithm are intact. The to-be-compared ciphertext refers to the encryption result of the S-box input data processed by the to-be-tested cryptographic algorithm, and the standard ciphertext refers to the encryption result of the S-box input data processed by the standard cryptographic algorithm.

[0051] In the embodiment, the encryption processing of the same S-box input data by the to-be-tested cryptographic algorithm and the standard cryptographic algorithm respectively can be used to simulate the encryption processing of the same S-box input data by the cryptographic algorithm before and after the fault injection. The to-be-compared ciphertext output by the to-be-tested cryptographic algorithm and the standard ciphertext output by the standard cryptographic algorithm for the S-box input data can be obtained. Correspondingly, the output corresponding to each S-box input data (including the to-be-compared ciphertext and the corresponding standard ciphertext) can be obtained.

[0052] To accurately induce the generation of the fault, at least one S-box input data is encrypted based on the to-be-tested cryptographic algorithm to obtain the to-be-compared ciphertext. For the at least one S-box input data, the current S-box input data is used as the input of the first round S-box operation in the to-be-tested cryptographic algorithm to obtain a round output parameter. The key expansion processing is performed on the to-be-used key in the current S-box input data to obtain a round key. Based on the round key and the round output parameter, a second round input parameter is determined. The second round input parameter is used as the input of the second round S-box operation of the to-be-tested cryptographic algorithm to obtain the to-be-compared ciphertext.

[0053] It should be noted that the encryption processing of each S-box input data by the to-be-tested cryptographic algorithm is the same. Any S-box input data can be used as the current S-box input data for description. In the embodiment, the current S-box input data is used as the input of the first round S-box operation in the to-be-tested cryptographic algorithm. The S-box operation is performed based on the current S-box input data. After the operation is completed, the output of the first round is obtained as the round output parameter. The key expansion processing can also be performed on the to-be-used key in the current S-box input data to obtain a round key, for example:

[0054] to-be-used key K after key expansion K 1 which is the round key. Further, each byte in the round output parameter can be XORed with the byte at the corresponding position in the round key to obtain a plurality of XOR results. The composition of each XOR result can be used as the second round input parameter. Further, the second round input parameter can be used as the input of the second round S-box operation of the to-be-tested cryptographic algorithm. After the plurality of rounds of S-box operations, the to-be-compared ciphertext can be obtained.

[0055] In order to further induce the generation of faults, the value of some bytes of the first round S-box operation input can be controlled to encrypt, and the fault elements taken by the specific S-box input in the second round are induced, so that the encryption process is always wrong. Optionally, the current S-box input data is taken as the input of the first round S-box operation of the password algorithm to be tested to obtain a round output parameter, including: XOR processing the byte value of the to-be-used key in the current S-box input data with the element value of the to-be-used plaintext in the corresponding position to obtain a round input parameter; inputting the round input parameter into the first round S-box operation of the password algorithm to be tested to obtain a round output parameter.

[0056] In the embodiment, the byte value of the to-be-used key in the current S-box input data can be XOR processed with the element value of the to-be-used plaintext in the same position, such as XOR processing the 0th byte of the to-be-used key with the 0th element value of the to-be-used plaintext, XOR processing the 5th byte of the to-be-used key with the 5th element value of the to-be-used plaintext, and XOR processing the 15th byte of the to-be-used key with the 15th element value of the to-be-used plaintext to obtain a plurality of XOR results, for example, the XOR result can be Due to the characteristics of the to-be-used key and the to-be-used plaintext, when i∈{0,5,10,15} are the same, which can be denoted as m. After the first round encryption SubBytes operation, the i∈{0,5,10,15} bytes will obtain the same output S(m), which can be denoted as n. Further, after the row shift operation of the password algorithm, the four values n of i∈{0,5,10,15} will be moved to the positions of the first four bytes, and then the first four bytes after the column mixing operation are all n. Further, each n and the round key K 1 of the initial key obtained through key expansion will be operated by the round key addition operation, and the four n will be operated as intermediate results with the first four bytes of K 1 . If is equal to u, then the SubBytes operation of the 0th byte in the second round encryption will take the fault result value v * , thereby affecting the encryption process of the subsequent several rounds to cause the ciphertext to be always wrong, so that the output to-be-compared ciphertext is different from the standard ciphertext, so that the subsequent comparison of the ciphertext is used to determine whether the encryption is wrong.

[0057] S130, determining the ciphertext error property of the password algorithm to be tested based on the to-be-compared ciphertext and the corresponding standard ciphertext.

[0058] The ciphertext error attribute can be used to represent the performance (such as security) of the to-be-tested cryptographic algorithm, and can also represent the difference between the to-be-compared ciphertext and the corresponding standard ciphertext, and can be represented by a probability value such as a score, a fraction, or a percentage. For example, if the ciphertext error attribute is larger, it means that the difference between the to-be-compared ciphertext and the corresponding standard ciphertext is larger, and the performance of the to-be-tested cryptographic algorithm is worse; on the contrary, if the ciphertext error attribute is smaller, it means that the difference between the to-be-compared ciphertext and the corresponding standard ciphertext is smaller, and the performance of the to-be-tested cryptographic algorithm is better.

[0059] In this embodiment, the to-be-compared ciphertext and the standard ciphertext corresponding to the same S-box input data are compared, the similarity and difference of the ciphertext are analyzed, the greater the similarity, the smaller the ciphertext error attribute, and the greater the difference, the greater the ciphertext error attribute. The ciphertext error attribute of the to-be-tested cryptographic algorithm is obtained, so as to determine which element in the S-box fails based on the ciphertext error attribute.

[0060] S140, based on each ciphertext error attribute and a preset error threshold, determining a test result of testing the to-be-tested cryptographic algorithm.

[0061] The preset error threshold can be preset, for example, it can be 0.99, or it can be 1, which can be determined by a technician according to actual working conditions, and the technical solution is not limited.

[0062] In this embodiment, the ciphertext error attribute and the preset error threshold are compared and analyzed, and the ciphertext error attribute greater than the preset error threshold is found out. If the number of ciphertext error attributes greater than the preset error threshold is greater than the preset number, the fault element of the S-box can be found out based on the ciphertext error attribute, and the test result is obtained.

[0063] It should be noted that after the fault element of the S-box is obtained, more elements in the S-box table can be recovered by continuously adjusting the to-be-used key and the corresponding to-be-used plaintext. The more elements recovered, the worse the performance of the cryptographic algorithm, and the accuracy of the performance test is improved. Alternatively, based on each ciphertext error attribute and a preset error threshold, a test result of testing the to-be-tested cryptographic algorithm is determined, including: determining to-be-used S-box input data with a ciphertext error attribute greater than the preset error threshold; determining a fault element based on a round input parameter and a round key corresponding to the to-be-used S-box input data; updating the to-be-used key and the corresponding to-be-used plaintext in at least one S-box input data based on the fault element, and re-executing the determination of the to-be-compared ciphertext corresponding to the to-be-tested cryptographic algorithm and the standard ciphertext corresponding to the standard cryptographic algorithm, and the ciphertext error attribute based on the updated S-box input data, so as to determine the test result of testing the to-be-tested cryptographic algorithm based on the ciphertext error attribute and the preset error threshold.

[0064] The fault element refers to a destroyed element in the S-box. The more fault elements that are destroyed, the worse the performance of the cryptographic algorithm.

[0065] In this embodiment, when comparing and analyzing each ciphertext error attribute and the preset error threshold, the ciphertext error attributes greater than the preset error threshold are found, and the S-box input data corresponding to the found ciphertext error attributes are determined. The determined S-box input data can be used as the to-be-used S-box input data. Further, the round input parameter and the round key generated in the process of S-box operation based on the to-be-used S-box input data can be used to deduce the fault element. Based on the round input parameter and the round key corresponding to the to-be-used S-box input data, the implementation of the fault element can be: determining the fault injection position of the S-box table of the to-be-tested cryptographic algorithm based on the round input parameter corresponding to the to-be-used S-box input data; and determining the fault element based on the fault injection position and the round key. Specifically, after the to-be-used S-box input data is determined, the round input parameter corresponding to the to-be-used S-box input data is found, and the round key corresponding to the to-be-used S-box input data is found. Based on the round input parameter and the round key, the fault injection position of the S-box table of the to-be-tested cryptographic algorithm is determined. Further, the fault element is determined based on the fault injection position and the round key. That is, m, i ∈ {0, 5, 10, 15}. The ciphertext error attribute greater than the preset error threshold indicates that the encryption is wrong. The error reason is that the 0th byte of the first round SubBytes operation input is wrong and the 0th byte of the second round SubBytes operation input is wrong. The m values other than can be used as the fault injection position u. Further, the fault injection position u and the first byte of the round key can be processed by exclusive OR, and the exclusive OR result can be used as the fault element.

[0066] For example, the following can be seen Figure 2 , Figure 2 The method for testing the performance of the cryptographic algorithm can be represented as a schematic diagram. The p i The four bytes corresponding to the to-be-used key k i are processed by exclusive OR, and the exclusive OR result When i ∈ {0, 5, 10, 15} are equal, and m is recorded as . m can be used as the input of the first round S-box operation. After the first round encryption SubBytes operation, the same output S(m) is obtained. S(m) can be recorded as n. The to-be-compared ciphertext can be obtained. The to-be-compared ciphertext and the corresponding standard ciphertext are compared to obtain the ciphertext error attribute. Correspondingly, each m value corresponds to a ciphertext error attribute. There are 256 m values, and there are 256 ciphertext error attributes. Further, the following can be seen Figure 3 , Figure 3The cipher error rate is the cipher error attribute, and the one-round output parameter contains m, (23, 1) indicates that when m = 23, the cipher error rate is 1, (109, 1) indicates that when m = 109, the cipher error rate is 1, and the cipher error rate is 1 corresponds to two m values, wherein m = u corresponds to the case that the 0th byte of the input of the first round SubBytes operation is equal to u, and the other m actually corresponds to the case that the 0th byte of the input of the second round SubBytes operation is equal to u. The value of m with which the cipher error rate is 1 can be taken as the fault position u. After the fault position u is determined, n can be deduced based on the fault position u. Continue to refer to Figure 2 After the first round encryption SubBytes operation, the output S(m) = n, after the row shift (ShiftRows) operation of the cryptographic algorithm, the four n, i ∈ {0, 5, 10, 15}, will be moved to the positions of the first four bytes, and then after the column mixing (MixColumns) operation, the first four bytes are all n, the first byte n is exclusive-OR with , the first byte n is exclusive-OR with , the first byte n is exclusive-OR with , and the first byte n is exclusive-OR with , equals the fault position u, and and u are exclusive-OR, and n is obtained, that is, n can be taken as the fault element.

[0067] It should be noted that in actual application, the condition that the 0th byte of the input of the second round S-box operation is equal to u can be used to inversely deduce the output results of some byte positions in the first round S-box operation, and then a fault element of the S-box table of the block cipher algorithm is recovered. To obtain more value conditions of the output of the first round S-box operation of the algorithm, in addition to the output of the first round S-box operation, the influencing factor of the value of the 0th byte of the input of the second round S-box operation should also have other known and controllable factors. In the case of successful fault induction, by controlling the transformation of other factors, different first round S-box operation outputs can be inversely deduced. Combining the operation characteristics that each round function of the cryptographic algorithm participates in the operation of the round key, the round key affecting the value of the 0th byte of the input of the second round S-box operation is changed. By inducing faults to occur, different first round S-box operation output results are reversely deduced, and more elements of the S-box table are recovered. Taking the AES-128 algorithm as an example, after the output of the first round S-box operation is subjected to the row shift and column mixing operations, the round key K 1 of the first round is subjected to round key addition operation, and the exclusive-OR result is the input of the second round S-box operation. Here, K 1 is the known and controllable influencing factor. Different K is obtained by constructing different initial keys.1 , n is also different under the condition of u, so that the different elements of the S-box table are recovered. The traversal affects the input value of the 0th byte of the second round S-box operation , all value conditions of are obtained, more n values are obtained, more elements are recovered, and the complete S-box table of the algorithm is reversely constructed.

[0068] In this embodiment, considering the actual situation that the key cannot be successfully recovered in some Δ k value conditions, the reason is that: these Δ k corresponding K uses the fault injection position u in the key expansion SubWord. According to the item "after injecting the fault, the key expansion, encryption and decryption process will be affected by the operation of the S-box", if there is an S-box operation in the key expansion of the cryptographic algorithm, and the fault value is taken, it will cause the K r error of a round, causing the subsequent encryption process under the key to be wrong, and unable to separate the constant error of the ciphertext, thereby failing to recover. For this situation, after determining the fault element, the S-box input data can be considered to be transformed to construct a new to-be-used key and to-be-used plaintext, and the operation is performed again to generate a new fault element result set. The existing fault element result set can be checked for missing elements and supplemented until all elements are recovered. An element can be randomly taken from the existing fault element result set, and the to-be-used key is adjusted.

[0069] For example, the to-be-used key K can be represented as: After key expansion, a round key K is obtained Again traverse the 256 conditions of Δ k , take the newly determined to-be-used key and the corresponding to-be-used plaintext as the input of the first round S-box operation, and obtain another fault element result set. The result set and the existing result set are taken and operated to recover more fault elements. The to-be-used key value is adjusted multiple times until the complete S-box table is recovered.

[0070] On the basis of the above scheme, in order to avoid the situation that the corresponding S-box table element is recovered due to the error of the key expansion process, and to reduce the waste of algorithm resources, u * and Δ k are determined , i represents the first byte, and r represents the round key. If , the corresponding fault element cannot be recovered. Therefore, k 13 is set to u * , and k is randomly selected to reduce The probability of error in the key expansion process is reduced, and the efficiency of reverse recovery of the S-box table is improved. Thus, the form of the to-be-used key K can be: After key expansion, one round of key can be: where ran1, ran2, and ran3 are random numbers in the range of [0x00, 0xFF]. Based on the new to-be-used key and one round of key, in the process of a large number of operations in a set of encryption cases, only is fixed, is random in each operation, ensuring that only the operation of the second round S-box byte 0 can successfully induce a fault in a set of encryption cases. At this time, it is not necessary to require that the first four bytes of the column mixing operation result in the first round of the round function remain consistent, and it is not necessary to require that have the same value when constructing plaintext. To avoid the interference of on reverse recovery and ensure the correctness of as an input value participating in S-box operation, can be set to Meanwhile, let have a value of m, and the output S(m) after the first round of byte substitution operation is denoted as n. After the row shift operation of the cryptographic algorithm, will be moved to the position of the first four bytes, and the first byte value after the column mixing operation is n. By continuously adjusting the S-box input data, 256 value conditions of can be traversed to find the constant error condition in the encryption process, and a fault element can be recovered using the formula After traversing the 256 conditions of k , 256 fault elements can be recovered.

[0071] The technical scheme of the embodiment is that, in response to an S-box operation instruction, at least one S-box input data is determined; wherein the S-box input data includes a to-be-used key and corresponding to-be-used plaintext determined based on estimated fault information in the S-box; based on a to-be-tested cryptographic algorithm and a standard cryptographic algorithm, at least one S-box input data is encrypted to obtain to-be-compared ciphertext and corresponding standard ciphertext; based on the to-be-compared ciphertext and the corresponding standard ciphertext, a ciphertext error attribute of the to-be-tested cryptographic algorithm is determined; based on each ciphertext error attribute and a preset error threshold, a test result of testing the to-be-tested cryptographic algorithm is determined, which solves the problem of poor operability and low efficiency in testing the performance of the cryptographic algorithm based on the circuit restoration mode of chip dissection in the prior art, improves the controllability and operability of the cryptographic algorithm test by constructing the to-be-used key and the corresponding to-be-used plaintext based on the estimated fault information in the known S-box and taking the to-be-used key and the corresponding to-be-used plaintext as the input of the to-be-tested cryptographic algorithm and the standard cryptographic algorithm, and then comparing the two kinds of ciphertext output, improves the speed and convenience of the test, determines the error condition of the encryption algorithm based on the compared ciphertext error attribute and the preset error threshold, and obtains the test result of testing the to-be-tested cryptographic algorithm, thereby ensuring the accuracy of the test result.

[0072] Embodiment two

[0073] As an optional embodiment of the above embodiment, Figure 4 A schematic diagram of a method for testing the performance of a cryptographic algorithm is provided in the embodiment two of the present application. Specifically, the specific content described below can be referred to.

[0074] Referring to Figure 4 The technical scheme provided in the embodiment constructs plaintext and keys in S-box input data based on estimated fault information, controls the value of some bytes in the first round S-box operation input, and if the value of a byte in the second round S-box operation input affected by the output of the S-box operation corresponding to the byte is exactly equal to the fault position u, the affected byte input will obtain the output v after the second round S-box operation due to the injected fault. *instead of the normal value v. Using the wrong intermediate value to perform the subsequent encryption operation, the resulting ciphertext result must be wrong. Therefore, a persistent fault can be injected into the S-box table of the cryptographic algorithm, and a specific S-box input data is constructed using the known algorithm structure to perform the encryption operation. By transforming the value of some bytes of the first round S-box operation input, the fault is induced in the S-box operation of the 0th byte of the second round, resulting in an error in the encryption process. The operation of the first round S-box operation input with the same byte value can be regarded as a group of encryption, and 256 byte values mean 256 groups of encryption. In each group of encryption, multiple operations are performed, and the S-box input data (including the to-be-used key and the to-be-used plaintext) are used as the input of the cryptographic device before fault injection (running the standard cryptographic algorithm) and the cryptographic device after fault injection (running the cryptographic algorithm to be tested). The ciphertext results after the operation of the same S-box input data before and after fault injection are collected to obtain the to-be-compared ciphertext and the corresponding standard ciphertext. By comparing the two ciphertexts, the error rate of each group of encryption after the fault injection is analyzed, and the group of encryption with constant ciphertext error is found, that is, the encryption condition of the 0th byte of the second round S-box operation input is u, and the fault position u is found. In the case where the rest of the algorithm structure is known, the byte value of the first round S-box operation output that directly affects the 0th byte of the second round S-box operation input is calculated by the fault position u. In the case where the S-box input data is known, the first round S-box operation input is known, and an element of the S-box table is recovered.

[0075] Further reference can be made to Figure 2 , and the method for testing the performance of the cryptographic algorithm is described in detail taking the AES-128 algorithm as an example. Special S-box input data is constructed to control the input of the first round byte substitution operation of the AES-128 algorithm. For the construction of the initial key, the 16 bytes of the initial key K are all set to 0. According to the key expansion process of the standard AES-128 algorithm, the first round key K 1 is generated. The generation of the first four bytes involves the S-box operation. To ensure the correctness of the S-box operation in the generation of K 1 , under the premise that S(u * ) = v * , wherein v * is the fault result value, u * is the position originally corresponding to v * , that is, the preset fault information, k i , i ∈ {12, 13, 14, 15} is set to u * . In the key expansion process Rcon[r] operation, the 12th byte value of the SubWord operation output will be XORed with 0x01. To simplify the value of k , k0 is set to 0x01. Thus, the initial key is adjusted to the to-be-used key A round key is obtained through key expansion. Furthermore, plaintext to be used can be generated based on the key to be used, and the plaintext p can be fixed. i These 4 bytes (i∈{0,5,10,15}) make the XOR result of the plaintext and the key to be used... They are equal when i∈{0,5,10,15}. Let this be denoted as m. After the first round of encrypted SubBytes operations, the same output S(m) will be obtained, denoted as n. Then, after the row shift operation of the standard AES-128 algorithm, These four values ​​'n' will be shifted to the first four bytes. After the column mixing operation, the first four bytes will all be 'n'. This will then be combined with the key K obtained through key expansion. 1 When performing round key addition, these four 'n's will be used as the first four bytes of the intermediate result in the computation. If If it is exactly equal to u, then the SubBytes operation of the 0th byte in the second round of encryption will obtain the faulty result value v. * Instead of v, this affects subsequent rounds of encryption, leading to constant errors in the ciphertext. To obtain more possible values ​​for the key to be used, the construction of K can be adjusted as follows: Where Δ k ∈[0x00,0xFF]. Traverse Δ k 256 possible values, There are 256 possible values ​​for m, corresponding to 256 possible values ​​for n. By finding the corresponding value for m in each case, more elements can be recovered. This allows for continuous adjustment of the plaintext and traversal... Among all possible values, we find the case where the encryption process consistently fails, which is the case where the 0th byte of the input in the second round of the SubBytes operation equals u. We record the value of m at this point, and then use the formula... Derive the value of n and recover the faulty element n. When determining the encryption error among the 256 possible values ​​of m, find the value of m corresponding to a ciphertext error rate of 1. See [link to relevant documentation]. Figure 3 When the ciphertext error rate is 1, it corresponds to the value of 2m, where m = u corresponds to the case where the 0th byte of the input in the first round of SubBytes operation of the algorithm is equal to u, while the other m truly corresponds to the case where the 0th byte of the input in the second round of SubBytes operation of the algorithm is equal to u.

[0076] To fully recover the elements in the S-box table, we can leverage the characteristic that each round function of the cryptographic algorithm involves a round key, and change the round key that affects the value of the 0th byte of the input to the second round of the S-box operation. By inducing a fault, we can reverse-engineer different output results of the first round of the S-box operation, thereby recovering more elements of the S-box table. Taking the AES-128 algorithm as an example, after row shifting and column mixing operations, the output of the first round of the S-box operation will be combined with the first round round key K. 1 The round key is added, and the result of the XOR operation is the input for the second round of S-box operation. Here, K 1 It is that known and controllable influence factor. Different K are obtained by constructing different initial keys. 1 Given a fixed u, the value of n will also be different, thus recovering the distinct elements of the S-box table. Traversal affects the value of the 0th byte of the input in the second round of S-box operations. By considering all possible values ​​of n, more n values ​​are obtained, and more elements are recovered, thus enabling the algorithm to construct a complete S-box table in reverse. However, in reality, there are certain Δ... k The reason why recovery fails under certain values ​​is that these Δ values... k The corresponding K uses u in the key expansion SubWord. Based on the principle that "after an injection failure, all operations involving S-boxes during key expansion and encryption / decryption will be affected," if an S-box operation exists in the key expansion of a cryptographic algorithm and happens to receive a faulty value, it will lead to a certain round of K... r An error occurred, causing subsequent encryption processes using this key to fail, making it impossible to separate the ciphertext containing the error, thus leading to recovery failure. In this situation, changing the key k to be used could be considered. i For i∈{12,13,14,15}, construct a new key to be used and perform another operation to generate a new set of faulty elements. Compare this set with the existing result set to check for omissions and fill in the gaps until all elements are recovered. Alternatively, you can arbitrarily select an element from the existing result set, let a = i, then b = S(i) = y. i Adjust the key to be used. Obtained through key expansion Iterate through Δ again k From the 256 possible cases, another set of faulty elements is obtained. By performing a union operation on this result set and the existing result set, more elements can be recovered. This process is repeated by adjusting the initial key value multiple times until the complete S-box table is recovered. To further improve the efficiency of recovering the complete S-box table and reduce computational resource waste, u can be determined during the key expansion process of the standard AES-128 algorithm. * and Δ k Then, make the key There is a specific value 'r' representing the round number of the key. If... Then the corresponding failure element cannot be recovered. To this end, consider setting k 13 as u * , and randomly selecting

[0077] randomized value, reducing the probability of error in the key expansion process, and improving the reverse recovery efficiency of the S-box table. Therefore, the construction form of the to-be-used key K can be: After key expansion, a round key can be: Where ran1, ran2 and ran3 are random numbers in the range of [0x00, 0xFF]. Based on the new to-be-used key and the round key, in the process of a large number of operations under a group of encryption conditions, only the value is fixed, the value is random in each operation, ensuring that only the operation of the second round S-box 0th byte can successfully induce failure under a group of encryption conditions. At this time, it is not necessary to require that the first four bytes of the column mixing operation result in the first round function remain consistent, and it is not necessary to require to take the same value when constructing the plaintext. To avoid the interference of to the reverse recovery, and to ensure the correctness of as an input value participating in the S-box operation, can be At the same time, let the value be m, and the output S(m) after the first round byte substitution operation be n. After the row shift operation of the cryptographic algorithm, will be moved to the position of the first four bytes, and the first byte value after the column mixing operation will be n. By continuously adjusting the S-box input data, 256 value conditions of can be traversed to find the constant error condition in the encryption process, and a failure element can be recovered using the formula After traversing 256 conditions of k , 256 failure elements can be recovered.

[0078] The technical solution provided by the embodiment can inject a persistent failure into a device or chip running a cryptographic algorithm. Assuming that due to the injection of the failure, the element at the S-box table position u of the cryptographic algorithm changes from v to v * . During the execution of the cryptographic algorithm, if a certain byte value input into the first round S-box operation is u, the corresponding error byte output v *If the first round S-box operation does not take the fault value, the ciphertext result will only be wrong with a certain probability, because the S-box operation in the subsequent encryption process may take u, thereby affecting the encryption result. The same principle applies to the second round S-box operation of the cryptographic algorithm. Based on the analysis of different structures of the algorithm, the general process of using the method to reverse recover the S-box table of the block algorithm is abstracted. In the premise that u, v * , u * and the S-box input data are controllable, combined with the characteristics of the known operation structure of the algorithm, special S-box input data are constructed to complete multiple encryptions, aiming to weaken the confusion / diffusion effect of other basic operation components between the first and second round S-box operations, so that some byte values output by the first round S-box operation or their transformations can directly affect the 0th byte input of the second round S-box operation. The method for recovering a single element of the S-box table is as follows: 1. The specific S-box input of the first round of the algorithm will affect the value of the 0th byte input of the second round S-box. The operations with the same value of the specific S-box input of the first round are regarded as a group of encryptions. By comparing the encryption results before and after fault injection, the error rate of each group of ciphertexts after fault injection is analyzed. If a group of ciphertexts is always wrong, and the input value of the first round S-box operation is not equal to u, it is indicated that the 0th byte input of the second round S-box operation in this group of encryptions is u. 2. In the case that the 0th byte input of the second round S-box operation is u, and the round key affecting the value is known and controllable, the corresponding output value of the first round S-box operation or its transformation can be deduced by calculation, so that an element value y i of the S-box table is recovered. 3. In the case that the plaintext and the key are known in the S-box input data, the value of each byte input of the first round S-box operation can be obtained by calculation, so that the corresponding index i of the S-box table element y i can also be recovered. Based on this, the S-box input data of the algorithm is continuously adjusted, and the value of the round key affecting the input of the second round S-box is transformed. Under the condition that the 0th byte input of the second round S-box operation is u, more values of the first round S-box operation output can be deduced reversely. According to the S-box input data, the corresponding first round S-box operation input is found, so that more elements of the S-box table are recovered, until the complete S-box table is recovered.

[0079] In summary, the method provided in the embodiment can be used to reversely recover the S-box table of the password algorithm with various structures, because the process between the first two rounds of S-box operation is focused on, and after the structure of the algorithm is known except the S-box table, the special S-box input data is constructed to make some specific bytes output by the first round of S-box operation directly affect the value of the 0th byte input by the second round of S-box operation. No matter which structure is based on, what basic operation components are between the first two rounds of S-box operation of the algorithm, and what factors affect the 0th byte input by the second round of S-box operation, except the known controllable part, only the output value of the first round of S-box operation is left. Therefore, the method for reversely recovering the S-box table elements is independent of the specific structure of the algorithm and has universality. After the running results of the password algorithm before and after the fault injection are collected, the parameter information of the password algorithm is mined by comparison and analysis, and the speed and accuracy of the test result determination are improved.

[0080] The technical scheme of the embodiment, in response to the S-box operation instruction, determines at least one S-box input data; wherein the S-box input data includes the to-be-used key and the corresponding to-be-used plaintext determined based on the estimated fault information in the S-box; the at least one S-box input data is encrypted based on the to-be-tested password algorithm and the standard password algorithm respectively to obtain the to-be-compared ciphertext and the corresponding standard ciphertext; the ciphertext error attribute of the to-be-tested password algorithm is determined based on the to-be-compared ciphertext and the corresponding standard ciphertext; and the test result of the to-be-tested password algorithm is determined based on each ciphertext error attribute and a preset error threshold, which solves the problems of poor operability and low efficiency in the prior art that the performance of the password algorithm is tested based on the chip dissection and restoration of the circuit, improves the controllability and operability of the password algorithm test by constructing the to-be-used key and the corresponding to-be-used plaintext based on the known estimated fault information in the S-box and taking the to-be-used key and the corresponding to-be-used plaintext as the input of the to-be-tested password algorithm and the standard password algorithm, and then comparing the two kinds of ciphertext output, improving the speed and convenience of the test, determining the error condition of the encryption algorithm based on the compared ciphertext error attribute and the preset error threshold, obtaining the test result of the to-be-tested password algorithm, and ensuring the accuracy of the test result.

[0081] Embodiment Three

[0082] Figure 5 is a structural schematic diagram of a device for testing the performance of a password algorithm according to Embodiment Three of the present application. As shown in Figure 5 , the device includes an S-box input data determination module 510, a ciphertext acquisition module 520, an attribute determination module 530, and a test result determination module 540.

[0083] The S-box input data determination module 510 is configured to determine at least one S-box input data in response to an S-box operation instruction; the S-box input data includes a to-be-used key and corresponding to-be-used plaintext determined based on estimated fault information in an S-box; the ciphertext acquisition module 520 is configured to perform encryption processing on the at least one S-box input data based on a to-be-tested cryptographic algorithm and a standard cryptographic algorithm, to obtain to-be-compared ciphertext and corresponding standard ciphertext; the attribute determination module 530 is configured to determine a ciphertext error attribute of the to-be-tested cryptographic algorithm based on the to-be-compared ciphertext and the corresponding standard ciphertext; and the test result determination module 540 is configured to determine a test result of the test on the to-be-tested cryptographic algorithm based on each ciphertext error attribute and a preset error threshold.

[0084] The technical scheme of the embodiment determines at least one S-box input data in response to an S-box operation instruction; the S-box input data includes a to-be-used key and corresponding to-be-used plaintext determined based on estimated fault information in an S-box; performs encryption processing on the at least one S-box input data based on a to-be-tested cryptographic algorithm and a standard cryptographic algorithm, to obtain to-be-compared ciphertext and corresponding standard ciphertext; determines a ciphertext error attribute of the to-be-tested cryptographic algorithm based on the to-be-compared ciphertext and the corresponding standard ciphertext; and determines a test result of the test on the to-be-tested cryptographic algorithm based on each ciphertext error attribute and a preset error threshold, thereby solving the problems of poor operability and low efficiency in the prior art of testing the performance of a cryptographic algorithm based on the way of restoring a circuit through chip dissection, achieving the construction of a to-be-used key and corresponding to-be-used plaintext based on known estimated fault information in an S-box, taking the to-be-used key and the corresponding to-be-used plaintext as inputs of a to-be-tested cryptographic algorithm and a standard cryptographic algorithm, improving the controllability and operability of the test on the cryptographic algorithm, and then comparing the two kinds of ciphertext output, improving the speed and convenience of the test, determining the error condition of the encryption algorithm based on the compared ciphertext error attribute and the preset error threshold, and obtaining the test result of the test on the to-be-tested cryptographic algorithm, thereby ensuring the accuracy of the test result.

[0085] On the basis of the above-described apparatus, optionally, the S-box input data determination module 510 includes a to-be-processed key determination unit, a to-be-used key determination unit, a to-be-used plaintext determination unit, and an S-box input data determination unit.

[0086] The to-be-processed key determination unit is configured to divide a preset initial key into at least one group, and adjust each initial value corresponding to a first group to a first preset value based on the estimated fault information, to obtain a to-be-processed key; the division of the at least one group is based on a position transformation relationship of each byte in a key during a key expansion operation.

[0087] The to-be-used key determining unit is configured to adjust each initial value in the to-be-processed key corresponding to the second group to a second preset value based on a preset adjustment parameter to obtain at least one to-be-used key, wherein the preset adjustment parameter is within a preset adjustment range.

[0088] The to-be-used plaintext determining unit is configured to determine a to-be-used plaintext corresponding to the at least one to-be-used key.

[0089] The S-box input data determining unit is configured to determine the at least one S-box input data based on the at least one to-be-used key and the corresponding to-be-used plaintext.

[0090] On the basis of the above device, optionally, the to-be-used plaintext determining unit includes a plaintext element value determining subunit and a to-be-used plaintext determining subunit.

[0091] The plaintext element value determining subunit is configured to, for the at least one to-be-used key, determine a plaintext element value based on each value in the current to-be-used key corresponding to the third group.

[0092] The to-be-used plaintext determining subunit is configured to determine a to-be-used plaintext corresponding to the current to-be-used key based on the plaintext element value.

[0093] On the basis of the above device, optionally, the ciphertext obtaining module 520 includes a first-round output parameter determining unit and a second-round input parameter determining unit.

[0094] The first-round output parameter determining unit is configured to, for the at least one S-box input data, take the current S-box input data as an input of a first-round S-box operation in the to-be-tested cryptographic algorithm to obtain a first-round output parameter.

[0095] The second-round input parameter determining unit is configured to perform key expansion processing on the to-be-used key in the current S-box input data to obtain a first-round key, and determine a second-round input parameter based on the first-round key and the first-round output parameter, so as to take the second-round input parameter as an input of a second-round S-box operation in the to-be-tested cryptographic algorithm to obtain the to-be-compared ciphertext.

[0096] On the basis of the above device, optionally, the first-round output parameter determining unit includes a first-round input parameter determining subunit and a first-round output parameter determining subunit.

[0097] The first-round input parameter determining subunit is configured to perform XOR processing on a byte value in the to-be-used key in the current S-box input data and an element value of the to-be-used plaintext in the same position to obtain a first-round input parameter.

[0098] A first round output parameter determination subunit is configured to input the first round input parameter into a first round S-box operation of the to-be-tested cryptographic algorithm to obtain a first round output parameter.

[0099] On the basis of the above device, the test result determination module 540 comprises a to-be-used S-box input data determination unit, a fault element determination unit and an S-box input data updating unit.

[0100] The to-be-used S-box input data determination unit is configured to determine to-be-used S-box input data for which the ciphertext error attribute is greater than the preset error threshold.

[0101] The fault element determination unit is configured to determine a fault element based on the first round input parameter corresponding to the to-be-used S-box input data and the first round key.

[0102] The S-box input data updating unit is configured to update the to-be-used key and the corresponding to-be-used plaintext in the at least one S-box input data based on the fault element, and to re-execute determination of the to-be-compared ciphertext corresponding to the to-be-tested cryptographic algorithm, the standard ciphertext corresponding to the standard cryptographic algorithm and the ciphertext error attribute based on the updated S-box input data, so as to determine the test result of the to-be-tested cryptographic algorithm based on the ciphertext error attribute and the preset error threshold.

[0103] On the basis of the above device, the fault element determination unit comprises a fault injection position determination unit and a fault element determination unit.

[0104] The fault injection position determination unit is configured to determine a fault injection position of an S-box table of the to-be-tested cryptographic algorithm based on the first round input parameter corresponding to the to-be-used S-box input data.

[0105] The fault element determination unit is configured to determine a fault element based on the fault injection position and the first round key.

[0106] The device for testing the performance of a cryptographic algorithm provided in the embodiments of the present application can execute the method for testing the performance of a cryptographic algorithm provided in any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0107] Embodiment Four

[0108] Figure 6is a structural schematic diagram of an electronic device implementing the method for testing the performance of a cryptographic algorithm according to an embodiment of the present application. The electronic device is intended to represent a variety of forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections, and their functions, as well as the software implemented by the electronic device, are meant to be examples only, and are not intended to limit the present application as described and / or claimed herein.

[0109] As shown in Figure 6 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., connected in communication with the at least one processor 11, where the memory stores a computer program executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0110] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, a speaker, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunications networks.

[0111] The processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the method for testing the performance of a cryptographic algorithm.

[0112] In some embodiments, the method of testing the performance of a cryptographic algorithm can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 18. In some embodiments, portions of the computer program, or all of the computer program, can be loaded onto the electronic device 10 via, e.g., ROM 12 and / or communication unit 19. When the computer program is loaded onto RAM 13 and executed by processor 11, one or more steps of the method of testing the performance of a cryptographic algorithm as described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the method of testing the performance of a cryptographic algorithm by any other suitable means, e.g., by means of firmware.

[0113] The various implementations of the system and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0114] Computer programs used to implement the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as part of a standalone software package, or entirely on a remote machine or server.

[0115] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0116] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0117] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0118] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0119] It should be understood that the various forms of flow shown above can be used to reorder, add or delete steps. For example, each step described in the present application can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions of the present application can be achieved, which is not limited herein.

[0120] The above detailed description does not constitute a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for testing the performance of cryptographic algorithms, characterized in that, include: In response to an S-box operation instruction, at least one S-box input data is determined; wherein the S-box input data includes a key to be used and a corresponding plaintext to be used, determined based on predicted fault information in the S-box; determining at least one S-box input data includes: dividing a preset initial key into at least one group, and adjusting each initial value corresponding to the first group to a first preset value based on the predicted fault information to obtain a key to be processed; wherein the division of the at least one group is based on the position transformation relationship of each byte in the key during key expansion operation; adjusting each initial value in the key to be processed and the second group to a second preset value based on a preset adjustment parameter to obtain at least one key to be used; wherein the preset adjustment parameter is within a preset adjustment range; determining the plaintext to be used corresponding to the at least one key to be used; and treating each key to be used and its corresponding plaintext to be used as one S-box input data. The input data of the at least one S-box is encrypted based on the cryptographic algorithm to be tested and the standard cryptographic algorithm, respectively, to obtain the ciphertext to be compared and the corresponding standard ciphertext. Based on the ciphertext to be compared and the corresponding standard ciphertext, the ciphertext error attributes of the cryptographic algorithm to be tested are determined; Based on the ciphertext error attributes and preset error thresholds, the test results for the cryptographic algorithm under test are determined; wherein, the test results are determined based on the faulty elements of the S-box found by the ciphertext error attributes; the faulty elements refer to the corrupted elements in the S-box.

2. The method according to claim 1, characterized in that, The determination of the plaintext to be used corresponding to the at least one key to be used includes: For the at least one key to be used, the plaintext element value is determined based on the values ​​corresponding to the third group in the current key to be used; Based on the plaintext element value, determine the plaintext to be used corresponding to the currently used key.

3. The method according to claim 1, characterized in that, The encryption process of the at least one S-box input data based on the cryptographic algorithm to be tested, to obtain the ciphertext to be compared, includes: For the at least one S-box input data, the current S-box input data is used as the input for the first round of S-box operation in the cryptographic algorithm to be tested, and a round of output parameters is obtained; The key to be used in the current S-box input data is subjected to key expansion processing to obtain a first-round key. Based on the first-round key and the first-round output parameters, the second-round input parameters are determined so as to use the second-round S-box operation of the cryptographic algorithm to be tested as input to obtain the ciphertext to be compared.

4. The method according to claim 3, characterized in that, The step of using the current S-box input data as input for the first round of S-box operation in the cryptographic algorithm under test to obtain a round of output parameters includes: The byte value of the key to be used in the current S-box input data is XORed with the element value of the plaintext to be used at the same position to obtain a round of input parameters; The input parameters of the first round are input into the first round of S-box operation of the cryptographic algorithm to be tested to obtain the output parameters of the first round.

5. The method according to claim 1, characterized in that, The step of determining the test result for the cryptographic algorithm under test based on each of the ciphertext error attributes and a preset error threshold includes: The S-box input data to be used is determined to have the ciphertext error attribute greater than the preset error threshold; Based on the input parameters and key corresponding to the input data of the S-box to be used, the fault element is determined. Based on the fault element, update the key to be used and the corresponding plaintext to be used in the input data of at least one S-box, and re-execute the determination of the ciphertext to be compared corresponding to the cryptographic algorithm to be tested and the standard ciphertext and ciphertext error attributes corresponding to the standard cryptographic algorithm based on the updated S-box input data, so as to determine the test result of the cryptographic algorithm to be tested based on the ciphertext error attributes and the preset error threshold.

6. The method according to claim 5, characterized in that, The process of determining fault elements based on the input parameters and key corresponding to the input data of the S-box to be used includes: Based on the input parameters of one round corresponding to the input data of the S-box to be used, determine the fault injection position of the S-box table of the cryptographic algorithm to be tested; Based on the fault injection location and the first-round key, the fault element is determined.

7. An apparatus for testing the performance of cryptographic algorithms, characterized in that, include: The S-box input data determination module is used to determine at least one S-box input data in response to an S-box operation instruction; wherein the S-box input data includes a key to be used and a corresponding plaintext to be used, determined based on the estimated fault information in the S-box. The S-box input data determination module includes: The key determination unit is used to divide the preset initial key into at least one group, and adjust each initial value corresponding to the first group to a first preset value based on the estimated fault information to obtain the key to be processed; wherein, the division of the at least one group is based on the position transformation relationship of each byte in the key during the key expansion operation; The key to be used determination unit is used to adjust each initial value in the key to be processed and the second group to a second preset value based on a preset adjustment parameter, so as to obtain at least one key to be used; wherein the preset adjustment parameter is within a preset adjustment range; A plaintext determination unit is used to determine the plaintext to be used corresponding to the at least one key to be used; The S-box input data determination unit is used to treat each key to be used and its corresponding plaintext to be used as S-box input data respectively. The ciphertext acquisition module is used to encrypt the input data of the at least one S-box based on the cryptographic algorithm to be tested and the standard cryptographic algorithm, respectively, to obtain the ciphertext to be compared and the corresponding standard ciphertext. The attribute determination module is used to determine the ciphertext error attributes of the cryptographic algorithm to be tested based on the ciphertext to be compared and the corresponding standard ciphertext. The test result determination module is used to determine the test result of the cryptographic algorithm under test based on each of the ciphertext error attributes and a preset error threshold; wherein, the test result is determined based on the faulty element of the S-box found by the ciphertext error attributes; the faulty element refers to the corrupted element in the S-box.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to said at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method for testing the performance of cryptographic algorithms as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the method for testing the performance of a cryptographic algorithm as described in any one of claims 1-6.

Images