Method for quickly improving differential path probability of SPN type block cipher

Abstract

The present invention discloses a method for rapidly improving the probability of differential paths of SPN type block ciphers. The method is specifically as follows: step 1, accurately constructing a group of inequalities containing the differential distribution pattern of the S-box containing the probability; step 2, accurately describing the differential diffusion of the row shift SR and the column mixing operation MC; step 3, describing the round function, because the key addition operation does not cause differential changes and can be ignored; sequentially calling the inequalities corresponding to the S-box, SR and MC, and modifying the corresponding variable X according to the round number r i , Y i , Z i , W i and P i , and statistically calculate the differential propagation probability; step 4, obtain the differential distinguisher with the highest probability in the above r rounds; step 5, analyze the DDT in step 1 to find certain patterns and improve the probability of the differential distinguisher in the r rounds; the method for rapidly improving the differential path probability of an SPN type block cipher of the present invention can improve the differential path probability of an SPN type block cipher and evaluate the ability of the SPN type block cipher to resist differential analysis.

Description

Technical Field

[0001] The invention relates to a method for rapidly improving the probability of a differential path of an SPN type block cipher, and belongs to the technical field of an SPN type block cipher algorithm. Background Art

[0002] Block ciphers are widely used in the field of information security. SPN-type block ciphers are an important component of block ciphers. AES algorithm, ARIA algorithm and 3D algorithm are typical representatives of this type of ciphers. Therefore, the research on SPN-type block ciphers has important theoretical value and practical significance. Among them, finding a high-probability differential path for SPN-type block ciphers has always been a difficult problem in differential analysis. Different S-boxes have different differential distributions, and the difficulty of finding them is also different. Generally speaking, we first draw a differential distribution table based on the S-box, and the probability of differential transfer can be seen from the differential distribution table. As mentioned earlier, the probability of the differential path is equal to the product of the differential transfer probability of each iteration, so we look for the differential path with the highest probability in the differential distribution table. It has been concluded that there must be uneven differential distribution in n rounds of S-box iterations, but whether it can be found effectively is a difficult problem. Summary of the Invention

[0003] To solve the above problems, the present invention proposes a method for quickly improving the differential path probability of SPN type block ciphers, which can improve the differential path probability of SPN type block ciphers, evaluate the ability of SPN type block ciphers to resist differential analysis, and provide an auxiliary reference for designing better block ciphers.

[0004] The method of the present invention for rapidly improving the probability of differential paths of SPN type block ciphers is as follows:

[0005] Step 1: Accurately construct the inequality group of the differential distribution pattern of the S-box containing the probability, and record the differential distribution table of the S-box as DDT, and the input difference and output difference of the S-box as X i and Y i , according to all the propagation situations of non-zero differentials in DDT, increase the corresponding probability. If the number of non-zeros in DDT is n, then increase n-1 variables P i ; We can get a (m+n-1)-dimensional vector, and through SageMath we can get a set of inequalities that accurately describe the differential distribution pattern of the S-box containing probabilities;

[0006] Step 2: Accurately describe the differential diffusion of row shift SR and column mixing operation MC. The input differential and output differential of SR are denoted as Y i and Z i , the input differential and output differential of MC are respectively denoted as Z i and W i,These two operation parts are linear, so they can be completed by simple assignment equations and multiple XOR operations;

[0007] Step 3: Characterize the round function. Since the key addition operation does not cause differential changes, it can be ignored. Call the inequalities corresponding to the S-box, SR and MC in sequence, and modify the corresponding variable X according to the round number r. i , Y i , Z i , W i and P i The subscript of , and statistically calculate the probability of differential propagation;

[0008] Step 4: Using optimization solvers such as COPT, Cplex, and Gurobi, the highest probability differential classifier for the above r rounds can be obtained;

[0009] Step 5: Analyze the DDT in step 1 to find some patterns and improve the probability of r-round differential distinguisher.

[0010] Furthermore, the XOR operation in step 2 is: the XOR operation of 2-bit variables can be characterized by 4 inequalities, the XOR operation of 3-bit variables can be characterized by 8 inequalities, and so on.

[0011] Furthermore, the step 5 is specifically as follows:

[0012] (1) If the first round differential pattern of the distinguisher is α1→β, and α2→β can be found, the start of the distinguisher can be set from {α1} to {α1, α2}, which increases the probability of the distinguisher extending forward in rounds;

[0013] (2) If the difference pattern of the two rounds in the discriminator is α→β 1→ γ, and we can find α→β2→γ, we can set the differential mode of the two rounds in the discriminator from α→β1→γ to α→{β1, β2}→γ.

[0014] Furthermore, it also includes steps 6 and 7, wherein step 6 is to further analyze step 5 (1). If the differential mode is Indicates that its probability is p1, and we can find Then the start of the distinguisher is set from {α1} to {α1, α2}, and the probability of the distinguisher is still p1, so the probability of the forward expansion is doubled, and the probability is increased from the original 2 -m Increase to 2 -m+1 ; Step 7 is: further analyze step 5 (2), if the differential mode is The probability of the two rounds is p1·p2, and we can find Then the differential pattern of the two rounds in the discriminator is set from α→β1→γ to α→{β1, β2}→γ, and its probability is increased from p1·p2 to (p1+p3)·p 2 .

[0015] Furthermore, the steps 6 and 7 are applied to the DDT of the Midori64 algorithm, wherein the process of step 6 is as follows: in the DDT of the Midori64 algorithm, at the same time Then set the start of the distinguisher from {1} to {1, 4}, and we get But the differential expansion probability of the discriminator forward expansion is 2 -4 Increase to 2 -3 ; Step 7 process is as follows: In the DDT of Midori64 algorithm, At the same time and have to The difference pattern of the two rounds is set from 2→1→2 to 2→{1, 4, 9, C}→2, and its probability is changed from 2 -2 2 -2 =2 -4 Increase to (4.2 -2 )·2 -2 =2 -2 .

[0016] Compared with the prior art, the method of the present invention for rapidly improving the probability of differential paths of SPN-type block ciphers has the following advantages:

[0017] 1. The differential discriminator obtained in the present invention is a compact discriminator with the highest probability;

[0018] 2. The present invention can intelligently search for the maximum probability of the differential distinguisher of any round of SPN type block cipher;

[0019] 3. The present invention can always find the diffusion pattern from different differentials to the same differential in any DDT, thereby improving the probability of the above-mentioned distinguisher;

[0020] 4. The present invention can evaluate the ability of SPN-type block ciphers to resist differential analysis, provide auxiliary reference for designing better block ciphers, and has good application prospects and high practical value. DETAILED DESCRIPTION

[0021] The method of the present invention for rapidly improving the probability of differential paths of SPN type block ciphers is as follows:

[0022] Step 1: Accurately construct the inequality group of the differential distribution pattern of the S-box containing the probability, and record the differential distribution table of the S-box as DDT, and the input difference and output difference of the S-box as X iand Y i , according to all the propagation situations of non-zero differentials in DDT, increase the corresponding probability. If the number of non-zeros in DDT is n, then increase n-1 variables P i ; We can get a (m+n-1)-dimensional vector, and through SageMath we can get a set of inequalities that accurately describe the differential distribution pattern of the S-box containing probabilities;

[0023] Step 2: Accurately describe the differential diffusion of row shift SR and column mixing operation MC. The input differential and output differential of SR are denoted as Y i and Z i , the input differential and output differential of MC are respectively denoted as Z i and W i ,These two operation parts are linear, so they can be completed by simple assignment equations and multiple XOR operations;

[0024] Step 3: Characterize the round function. Since the key addition operation does not cause differential changes, it can be ignored. Call the inequalities corresponding to the S-box, SR and MC in sequence, and modify the corresponding variable X according to the round number r. i , Y i , Z i , W i and P i The subscript of , and statistically calculate the probability of differential propagation;

[0025] Step 4: Using optimization solvers such as COPT, Cplex, and Gurobi, the highest probability differential classifier for the above r rounds can be obtained;

[0026] Step 5: Analyze the DDT in step 1 to find some patterns and improve the probability of r-round differential distinguisher.

[0027] The XOR operation in step 2 is: the XOR operation of 2-bit variables can be characterized by 4 inequalities, the XOR operation of 3-bit variables can be characterized by 8 inequalities, and so on.

[0028] The step 5 is specifically as follows:

[0029] (1) If the first round differential pattern of the discriminator is α1→β, and α2-β can be found, the start of the discriminator can be set from {α1} to {α1, α2}, which increases the probability of the discriminator extending forward in rounds;

[0030] (2) If the differential pattern of two rounds in the discriminator is α→β1→γ, and α→β2→γ can be found, the differential pattern of the two rounds in the discriminator can be set from α→β1→γ to α→{β1, β2}→γ.

[0031] It also includes steps 6 and 7, wherein step 6 is to further analyze step 5 (1). If the differential mode is Indicates that its probability is p1, and we can find Then the start of the distinguisher is set from {α1} to {α1, α2}, and the probability of the distinguisher is still p1, so the probability of the forward expansion is doubled, and the probability is increased from the original 2 -m Increase to 2 -m+1 ; Step 7 is: further analyze step 5 (2), if the differential mode is The probability of the two rounds is p1·p2, and we can find Then the differential pattern of the two rounds in the discriminator is set from α→β1→γ to α→{α1, β2}→γ, and its probability is increased from p1·p2 to (p1+p3)·p2.

[0032] The steps 6 and 7 are applied to the DDT of the Midori64 algorithm, wherein the process of step 6 is as follows: In the DDT of the Midori64 algorithm, at the same time Then set the start of the distinguisher from {1} to {1, 4}, and we get But the differential expansion probability of the discriminator forward expansion is 2 -4 Increase to 2 -3 ; Step 7 process is as follows: In the DDT of Midori64 algorithm, At the same time and have to The difference pattern of the two rounds is set from 2→1→2 to 2→{1, 4, 9, C}→2, and its probability is changed from 2 -2 2 -2 =2 -4 Increase to (4.2 -2 )·2 -2 =2 -2 .

[0033] Example 1:

[0034] The method of the present invention for rapidly improving the probability of differential paths of SPN type block ciphers is as follows:

[0035] Taking the 4-bit S-box of Midori64 as an example, other encryption algorithms are similar, and the first four steps are conventional implementations of the round function using MILP.

[0036] Step 1: Generate the DDT table of the S-box.

[0037] Table 1 Midori64 S-box DDT

[0038] 0 1 2 3 4 5 6 7 8 9 A B C D E F 0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 2 4 0 2 2 2 0 2 0 0 0 0 0 2 0 2 0 4 0 0 4 0 0 0 0 4 0 0 4 0 0 0 3 0 0 0 0 2 0 4 2 2 2 0 0 0 2 0 2 4 0 2 4 2 2 2 0 0 2 0 0 2 0 0 0 0 5 0 2 0 0 2 0 0 4 0 2 4 0 2 0 0 0 6 0 2 0 4 0 0 0 2 2 0 0 0 2 2 0 2 7 0 0 0 2 0 4 2 0 0 0 0 2 0 4 2 0 8 0 2 0 2 2 0 2 0 0 2 0 2 2 0 2 0 9 0 0 4 2 0 2 0 0 2 2 0 2 2 0 0 0 A 0 0 0 0 0 4 0 0 0 0 4 0 0 4 0 4 B 0 0 0 0 2 0 0 2 2 2 0 4 0 2 0 2 C 0 0 4 0 0 2 2 0 2 2 0 0 2 0 2 0 D 0 0 0 2 0 0 2 4 0 0 4 2 0 0 2 0 E 0 2 0 0 0 0 0 2 2 0 0 0 2 2 4 2 F 0 0 0 2 0 0 2 0 0 0 4 2 0 0 2 4

[0039] According to the above DDT, 97 10-dimensional vectors can be used to fully describe the differential distribution of the S-box;

[0040] Step 2, for shift SR, 64 equations Y can be used i =Z j Characterization, where i, j∈{0, 1, 2, 3...63}; for MC transformation, etc.

[0041] Step 3: Integrate the contents of Step 1 and Step 2, that is, implement the MILP model that fully describes the number of rounds using a set of inequalities, and calculate the probability of differential diffusion based on the non-zero numbers in the DDT;

[0042] Step 4: In step 3, the subscripts of the variables are gradually expanded according to the number of rounds, and a MILP model with r rounds can be obtained. The optimizer can be used to obtain a differential discriminator with a higher probability.

[0043] Step 5: Find the diffusion pattern in DDT. The pattern search is carried out in three steps, as follows:

[0044] Step 5.1: Only retain the differential pattern with the highest probability; find the maximum number of occurrences in the DDT, considering only the case of differential input, and retain only the maximum number of occurrences, i.e. the maximum probability. Set those less than the maximum value to 0;

[0045] Step 5.2: Count the maximum number of output difference sets SET_IN[] with the same input difference. Traverse the DDT to obtain the maximum number of output difference sets with the same input difference.

[0046] Step 5.3: Count the maximum number of input difference sets SET_OUT[] that have the same output difference. Traverse the DDT to obtain the maximum number of input difference sets that have the same output difference.

[0047] Step 6: Further, using the results of step 5.3, the head of the differential classifier can be set to a set, which increases the probability of the number of rounds before the classifier. In particular, if the head of the classifier is differential A after passing through the S-box, the head of the classifier can be set to {5, A, D, F}. The probability of the classifier remains unchanged, but the probability of the number of rounds of the classifier extending forward is increased by 4 times. Therefore, the complexity of the differential analysis using this classifier can be reduced.

[0048] Step 7: Find multiple high-probability paths of two rounds of S-boxes from a certain α->X->SET_OUT in SET_IN, and obtain the set SET_MID of elements β1, β2... that meet the conditions; for Midori64, select one of the SET_MIDs {1, 4, 9, C}. For ordinary differential paths, SET_MID is a certain value, let it be 4, then the differential diffusion probability of the two rounds of 2->4->2 is 2 -4 SET_MID is the set {1,4,9,C}, then the differential diffusion probability of the two rounds of 2->{1,4,9,C}->2 is 2 -2 , which increases the probability by 4 times. Therefore, this algorithm greatly increases the probability.

[0049] The above embodiments are only preferred implementations of the present invention. Therefore, any equivalent changes or modifications made according to the structures, features and principles described in the scope of the patent application of the present invention are included in the scope of the patent application of the present invention.

Claims

1. A method for rapidly improving the probability of differential paths in SPN-type block ciphers, characterized in that: The method is specifically as follows: Step 1: Accurately construct the inequality group of the differential distribution pattern of the S-box containing the probability, and record the differential distribution table of the S-box as DDT, and the input difference and output difference of the S-box as X i and Y i , according to all the propagation situations of non-zero differentials in DDT, increase the corresponding probability. If the number of non-zeros in DDT is n, then increase n-1 variables P i ; we can get (m+n - 1)-dimensional vector, SageMath can be used to obtain a set of inequalities that accurately describe the differential distribution pattern of S-boxes containing probabilities; Step 2: Accurately describe the differential diffusion of row shift SR and column mixing operation MC. The input differential and output differential of SR are denoted as Y i and Z i , the input differential and output differential of MC are respectively denoted as Z i and W i ,These two operation parts are linear, so they can be completed by simple assignment equations and multiple XOR operations; Step 3: Characterize the round function. Since the key addition operation does not cause differential changes, it can be ignored. Call the inequalities corresponding to the S-box, SR and MC in sequence, and modify the corresponding variable X according to the round number r. i , Y i , Z i , W i and P i The subscript of , and statistically calculate the probability of differential propagation; Step 4: Using COPT, Cplex, and Gurobi optimization solvers, the highest probability differential discriminator for the above r rounds can be obtained; Step 5: Analyze the DDT in step 1 to find the diffusion law and improve the probability of the r-round differential distinguisher; The step 5 is specifically as follows: (1) If the first round differential pattern of the distinguisher is α1→β, and α2→β can be found, the start of the distinguisher can be set from {α1} to {α1, α2}, which increases the probability of the distinguisher extending forward in rounds; (2) If the differential pattern of the two rounds in the discriminator is α→β1→γ, and α→β2→γ can be found, the differential pattern of the two rounds in the discriminator can be set from α→β1→γ to α→{β1, β2}→γ; It also includes steps 6 and 7, wherein step 6 is to further analyze step 5 (1). If the differential mode is Indicates that its probability is p1, and we can find Then the start of the distinguisher is set from {α1} to {α1, α2}, and the probability of the distinguisher is still p1, so the probability of the forward expansion is doubled, and the probability is increased from the original 2 -m Increase to 2 -m+1 ; Step 7 is: further analyze step 5 (2), if the differential mode is The probability of the two rounds is p1·p2, and we can find Then the differential pattern of the two rounds in the discriminator is set from α→β1→γ to α→{β1, β2}→γ, and its probability is increased from p1·p2 to (p1+p3)·p2.

2. The method for rapidly improving the probability of differential paths in an SPN-type block cipher according to claim 1, wherein: The XOR operation in step 2 is: the XOR operation of 2-bit variables can be characterized by 4 inequalities, the XOR operation of 3-bit variables can be characterized by 8 inequalities, and so on.

3. The method for rapidly improving the probability of differential paths in an SPN-type block cipher according to claim 1, wherein: The steps 6 and 7 are applied to the DDT of the Midori64 algorithm, wherein the process of step 6 is as follows: In the DDT of the Midori64 algorithm, at the same time Then set the start of the distinguisher from {1} to {1, 4}, and we get But the differential expansion probability of the discriminator forward expansion is 2 -4 Increase to 2 -3 ; Step 7 process is as follows: In the DDT of Midori64 algorithm, At the same time and have to The difference pattern of the two rounds is set from 2→1→2 to 2→{1,4,9,C}→2, and its probability is changed from 2 -2 2 -2 =2 -4 Increase to (4.2 -2 )·2 -2 =2 -2 .

Images