A quantum differential analysis method for SPECK symmetric cryptography

Abstract

The present invention discloses a quantum differential analysis method for SPECK symmetric cipher, comprising: step 1: constructing a quantum encryption circuit of the SPECK algorithm based on the key expansion function of the SPECK algorithm and the round encryption function of the SPECK algorithm; step 2: obtaining a quantum decryption circuit of the SPECK algorithm based on the quantum encryption circuit of the SPECK algorithm; step 3: constructing a Grover algorithm based on the quantum encryption circuit of the SPECK algorithm and the quantum decryption circuit of the SPECK algorithm to find a plaintext pair quantum circuit that meets the differential path and guess the round key quantum circuit of the rth round of the SPECK algorithm; step 4: performing quantum differential analysis based on the constructed quantum circuit to complete the security analysis of the SPECK algorithm. The present invention can effectively overcome the disadvantage of limited computing power of traditional computers, and can more efficiently analyze the security of existing block cipher algorithms.

Description

Technical Field

[0001] The present invention relates to the technical field of security analysis of block cipher algorithms, and in particular to a quantum differential analysis method for SPECK symmetric ciphers. Background Art

[0002] The SPECK block cipher algorithm is a lightweight block cipher algorithm proposed by Ray Beaulieu et al. in 2013. The algorithm consists of simple basic operations. The block length of the SPECK lightweight block cipher is 32, 48, 64, 96 or 128 bits, and the key length is 64, 72, 96, 128, 144, 192 or 256 bits, that is, the block length and key length are not fixed. Therefore, the SPECK series of block cipher algorithms can select the appropriate block length and key length according to specific security requirements, performance requirements, application environment, etc., which has strong flexibility and a wide range of application prospects.

[0003] Since the SPECK series of algorithms were proposed, many researchers of block cipher algorithms have analyzed their security, mainly in the areas of differential analysis, linear analysis, and zero-correlation linear analysis. Typical analysis methods include boomerang attack, rectangle attack, differential analysis, and improved differential analysis.

[0004] Differential cryptanalysis is one of the most important classical cryptanalysis methods since its inception. It is applicable to multiple pairs of plaintexts and their corresponding ciphertexts with the same specific difference, and analyzes the impact of the plaintext difference on the resulting ciphertext difference. Although some modern block ciphers such as AES are not vulnerable to this technique, its quantum implementation can help quantize more complex and mature classical attacks. This can then more efficiently analyze the security of existing block cipher algorithms. However, differential cryptanalysis is currently mostly performed using traditional computers, which have limited computing power. Summary of the invention

[0005] In view of the problem that the computing power is limited when performing differential cryptanalysis based on traditional computers, which affects the efficiency of security analysis, the present invention proposes a quantum differential analysis method for SPECK symmetric cipher, which can effectively overcome the disadvantage of limited computing power of traditional computers.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A quantum differential analysis method for SPECK symmetric cryptography, including:

[0008] Step 1: Based on the SPECK algorithm key expansion function and the SPECK algorithm round encryption function, construct the SPECK algorithm quantum encryption circuit;

[0009] Step 2: Obtain the SPECK algorithm quantum decryption circuit based on the SPECK algorithm quantum encryption circuit;

[0010] Step 3: Based on the quantum encryption circuit of the SPECK algorithm and the quantum decryption circuit of the SPECK algorithm, the Grover algorithm is constructed to find the plaintext pair quantum circuit that conforms to the differential path and guess the round key quantum circuit of the rth round of the SPECK algorithm;

[0011] Step 4: Perform quantum differential analysis based on the constructed quantum circuit to complete the SPECK algorithm security analysis.

[0012] Furthermore, the SPECK algorithm key expansion function in step 1 is:

[0013]

[0014] Among them l i Indicates the array needed to generate the secret key for round i, k i represents the secret key of the i-th round, Represents modulo 2 n addition, Indicates bitwise exclusive OR, S -α Indicates that the input vector is shifted right by α bits in binary cycle, S β It means to shift the input vector left by β bits in binary cycle.

[0015] Furthermore, in step 1, the SPECK algorithm round encryption function is:

[0016]

[0017] Where R i Indicates the high-order grouping of the i-th round input, L i Indicates the low-order group of the i-th round input, k i represents the secret key of the i-th round, Represents modulo 2 n addition, Indicates bitwise exclusive OR, S -α Indicates that the input vector is shifted right by α bits in binary cycle, S β It means to shift the input vector left by β bits in binary cycle.

[0018] Furthermore, the step 4 comprises:

[0019] Step 4.1: Plaintext pair collection phase

[0020] Step 4.1.1: Initialize an empty list C = φ;

[0021] Step 4.1.2: Construct a plaintext pair that satisfies the difference β0

[0022] Step 4.1.3: Based on the constructed Grover algorithm, find the plaintext that meets the differential path. Find the quantum circuit that satisfies the differential β after r rounds of encryption. r All ciphertext pairs Save to list C;

[0023] Step 4.2: Round key guessing phase

[0024] Step 4.2.1: Based on the constructed guessing of the round key quantum circuit of the SPECK algorithm, search so that the ciphertext Decrypted Satisfy the difference β r-1 The round key with the highest probability is taken as the correct round key k obtained after searching and decrypting in the rth round r-1 ;

[0025] Step 4.2.2: Exploitation and β r-2 Repeat the method in step 4.2.1 to obtain the correct round key k obtained after searching and decrypting in the r-1th round r-2 ;

[0026] Step 4.3: Key recovery phase

[0027] The master key is obtained by reverse calculation using two consecutive rounds of subkeys k2 and k3 through the SPECK key generation algorithm.

[0028] Furthermore, after step 4, the method further includes:

[0029] Perform quantum resource analysis in the plaintext collection phase and the round key guessing phase.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] The present invention first constructs a quantum encryption circuit of the SPECK algorithm based on the key expansion function of the SPECK algorithm and the round encryption function of the SPECK algorithm; then obtains the quantum decryption circuit of the SPECK algorithm based on the quantum encryption circuit of the SPECK algorithm; constructs the Grover algorithm based on the quantum encryption circuit of the SPECK algorithm and the quantum decryption circuit of the SPECK algorithm to find the plaintext pair quantum circuit that meets the differential path and guess the round key quantum circuit of the rth round of the SPECK algorithm; finally, quantum differential analysis is performed based on the constructed quantum circuit to complete the security analysis of the SPECK algorithm. The present invention can effectively overcome the disadvantages of limited computing power of traditional computers, and can more efficiently analyze the security of existing block cipher algorithms. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1This is a basic flow chart of a quantum differential analysis method for SPECK symmetric cryptography according to an embodiment of the present invention;

[0033] Figure 2 The quantum circuit of the SPECK key expansion algorithm when m=2 in the embodiment of the present invention;

[0034] Figure 3 The quantum circuit of the SPECK key expansion algorithm when m=3 in the embodiment of the present invention;

[0035] Figure 4 The quantum circuit of the SPECK key expansion algorithm when m=4 in the embodiment of the present invention;

[0036] Figure 5 A quantum circuit for a round of SPECK encryption in an embodiment of the present invention;

[0037] Figure 6 It is the quantum circuit of the SPECK algorithm of the embodiment of the present invention;

[0038] Figure 7 This is a schematic diagram of the differential analysis process of an embodiment of the present invention;

[0039] Figure 8 A schematic diagram of a quantum circuit for searching for plaintext pairs that conform to a differential path using the Grover algorithm according to an embodiment of the present invention;

[0040] Fig. 9 Schematic diagram of the quantum circuit for guessing the round key of the rth round of the SPECK algorithm using the Grover algorithm according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0042] like Figure 1 As shown, a quantum differential analysis method for SPECK symmetric cryptography includes:

[0043] Step 1: Based on the SPECK algorithm key expansion function and the SPECK algorithm round encryption function, construct the SPECK algorithm quantum encryption circuit;

[0044] Step 2: Obtain the SPECK algorithm quantum decryption circuit based on the SPECK algorithm quantum encryption circuit;

[0045] Step 3: Based on the quantum encryption circuit of the SPECK algorithm and the quantum decryption circuit of the SPECK algorithm, the Grover algorithm is constructed to find the plaintext pair quantum circuit that conforms to the differential path and guess the round key quantum circuit of the rth round of the SPECK algorithm;

[0046] Step 4: Perform quantum differential analysis based on the constructed quantum circuit to complete the SPECK algorithm security analysis.

[0047] Specifically, the method includes:

[0048] (a) Explanation of symbols

[0049] Table 1 lists some basic quantum gates that will be used in building quantum circuits later.

[0050] Table 1 Functions and graphical representations of some basic quantum gates

[0051]

[0052] Among them, S α Operation, when α is a positive integer, it means that the input vector is shifted left by α bits according to binary cycle; then S -α In the above equation, -α is a negative integer, which means that the input vector is shifted right by α bits in binary cycle.

[0053] rc i The operation is to convert i into binary expression and then XOR it with the corresponding qubit. In the implementation process, if a bit in the binary representation of i is 1, it is necessary to invert the corresponding bit of the quantum circuit by using the X gate to achieve the XOR effect. For example, when n=4 and i=5, the binary representation of i is 0101, so it is necessary to use an X gate on a0 and a2 of the input qubits a0~a3 respectively.

[0054] In order to draw the circuit clearly and concisely, the simplified representation of some quantum modules is listed in Table 2, where (a) represents the quantum circuit of a round of key expansion, (c) represents the quantum circuit of a round of SPECK encryption, (c) and (d) represent the encryption and decryption circuits of the complete SPECK algorithm, and these modules will be introduced and used in turn. i Indicates the high-order grouping of the i-th round input, L i Represents the low-order grouping of the i-th round input.

[0055] Table 2 Simplified representation of quantum circuit module

[0056]

[0057] (b) Key extension quantum circuit

[0058] The algorithm of the SPECK algorithm key expansion function is as follows:

[0059]

[0060] Among them l i Indicates the array needed to generate the secret key for round i, k irepresents the secret key of the i-th round, Represents modulo 2 n addition, Represents bitwise exclusive OR.

[0061] Figure 2 , Figure 3 , Figure 4 The quantum circuits implementing part of the key expansion function of the SPECK algorithm when m=2, 3, and 4 are shown respectively.

[0062] (c) Round Encryption Quantum Circuit

[0063] The specific algorithm of the SPECK algorithm round encryption function is:

[0064]

[0065] Figure 5 This is the implementation of the round encryption function in the quantum circuit, where the KE module represents the quantum circuit of a round of key expansion.

[0066] (d) Complete SPECK algorithm quantum circuit

[0067] Using the key expansion function and round encryption function constructed above, we can give the complete SPECK algorithm quantum encryption circuit. Figure 6 , where the U module represents a round of encryption function circuit, and the KE module represents a round of key expansion quantum circuit.

[0068] You can Figure 6 The complete SPECK quantum encryption circuit is represented as the ENC encryption function. The inverse function of this function is to perform the inverse operations of all operations in the function in a backward order. This function is represented as DEC, and its function is the inverse process of encryption, that is, the decryption process. See (c) and (d) in Table 2 for the legend.

[0069] 1. Differential Analysis of Symmetric Ciphers

[0070] 1.1 Definitions and Assumptions

[0071] (1) Difference

[0072] set up Then X and X * The XOR difference is defined as Generally speaking, groups Any two elements X and X * The difference is defined as In this embodiment, the differential represents a differential pair (x, β) consisting of an input differential and an output differential of the encryption algorithm.

[0073] (2) Differential Path

[0074] An r-round differential signature of an iterative block cipher is a differential sequence: β0,β1,…,β r-1 ,β r . Where β0 is the plaintext pair Y0 and The difference, β i is the i-th round encryption result Y i and The difference.

[0075] (3) Differential Path Probability

[0076] The differential path of the r-wheel is Ω=(β0,β1,…,β r-1 ,β r ) is the probability DP(Ω) between plaintext Y0 and round keys k1, k2, …, k r When the values ​​are independent and evenly distributed, the plaintext has no effect on Y0 and Under the condition that the difference is β0, the difference of the encryption result of the i-th round is β i Similarly, the probability of the difference (x, β) can be expressed as

[0077] (4) Equivalent Key Assumption

[0078] It is assumed that for most keys, the probability of the round function and differential characteristics under a fixed key is approximately equal to the probability when the wheel keys are independently, uniformly, and randomly distributed.

[0079] (5) Cascading of differential features

[0080] For Ω 1 =(β0,β1,…,β s-1 ,β s ) and Ω 2 =(γ0,γ1,…,γ t-1 ,γ t ), if β s =γ0, then Ω=Ω 1 ||Ω 2 Ω 1 and Ω 2 cascade, at this time

[0081] DP(Ω)=DP(Ω 1 )·DP(Ω 2 )

[0082] According to the equivalent key assumption and the cascade property of differential features, the r-round differential feature Ω=(β0,β1,…,β r-1 ,β r ) is true with probability

[0083]

[0084] (6) Correctness of the plaintext for the differential pair

[0085] For the differential path Ω=(β0,β1,…,β r-1 ,β r ), if the input plaintext pair γ0 and Satisfy the conditions, Y0 and The difference is β0 and the i-th (1≤i≤r) round encryption result Y i and The difference is β i , then the plaintext pair Y0 and is a correct pair, otherwise the plaintext pair is called an incorrect pair.

[0086] 1.2 Differential analysis steps

[0087] like Figure 7 As shown, the differential analysis process for symmetric encryption is as follows:

[0088] ① Find a difference (α, β) or differential feature (β0, β1…, β r ), β0=α,β r =β, so that the probability p′ of the difference can be maximized.

[0089] ② The output of the distinguisher determines the subkey k of the rth round of encryption to be restored r (or some of its bits). For each possible candidate key gk i ,0≤i≤2 l -1 sets a counter λ with an initial value of 0 i .

[0090] ③Uniformly randomly select plaintext M0 and calculate Find M0 and The ciphertext C obtained under the actual key encryption r and Select plaintext pair number

[0091] ④ According to the output of the distinguisher, filter the ciphertext obtained in ③ and retain the filtered ciphertext pair (C, C * ), using each guessed round key gk in round ② i Perform a round of decryption on it and calculate the difference of the decryption results. If the difference Δ=β r-1 , then the counter λ of the corresponding key i Add 1.

[0092] ⑤2 l The round key corresponding to the counter with the largest value among the counters is used as the round key of the rth round.

[0093] 2. Differential Analysis of SPECK Cipher

[0094] 2.1 Principle of differential analysis

[0095] For a password E, if there exists a difference (α, β) such that

[0096]

[0097] In this embodiment, N=2n. Select input M and calculate the input plaintext pair Since the selected high-probability difference will make the encrypted ciphertext C,C* satisfy the probability of 12p If the encryption process is perfectly random, the probability of finding such a plaintext pair is only Therefore, when searching for plaintext pairs that satisfy high-probability differences, the Grover quantum algorithm can be used to call the encryption machine less frequently to complete the search. According to the above analysis, the probability of finding a plaintext pair that meets the requirements of the above formula is The complexity of using Grover's algorithm to find plaintext pairs is Afterwards, since the round key is short, the complexity of using Grover's algorithm to find the round key that satisfies the differential path is For the SPECK algorithm, if the keys for m consecutive rounds are known, the master key can be simply calculated in reverse based on the key expansion process.

[0098] 2.2 Implementation of quantum differential analysis circuit

[0099] Grover Line Construction

[0100] (1) Plaintext collection phase

[0101] Figure 8 The quantum circuit implementation for finding plaintext pairs that satisfy the post-encryption differential function is demonstrated. ENC and DEC are the quantum encryption and decryption modules of the SPECK algorithm, which is the process of calling the encryption machine. =β′ is used to determine whether the differential result of two ciphertexts is β′.

[0102] The number of times Grover calls the encryption machine to directly find the master key in the process of finding the SPECK algorithm key is If the search space is set to all possible plaintext values ​​when searching for plaintext pairs that meet the high-probability differential path in the first step of differential analysis, then according to formula (3), using Grover search here will reduce the number of calls to the encryption machine to

[0103] (2) Round key guessing stage

[0104] Fig. 9 The process of finding the key for round r using a pair of names that satisfy the differential path is shown, where ENC and DEC are the quantum encryption and decryption modules of the SPECK algorithm, and ENC-r and DEC-r are the quantum encryption and decryption modules of the SPECK algorithm using the input key K. r The quantum module that performs one round of encryption or one round of decryption on the input, = β′ represents the quantum module that determines whether the difference between two ciphertexts is β′. Using Grover search here will call the encryption machine Second-rate.

[0105] 2.2 Quantum difference analysis

[0106] (1) Plaintext collection phase

[0107] ①Initialize the empty list C=φ.

[0108] ②Construct a plaintext pair that satisfies the difference β0

[0109] ③ Use the constructed Grover algorithm to find the plaintext that meets the differential path and the quantum circuit search that satisfies the differential β after r rounds of encryption. r All ciphertext pairs Save to list C.

[0110] (2) Round key guessing stage

[0111] ①Use the constructed quantum circuit search of the round key of the SPECK algorithm to make the ciphertext Decrypted Satisfy the difference β r-1 The round key with the highest probability is taken as the correct round key k obtained after searching and decrypting in the rth round r-1 .

[0112] ②Use and β r-2 Repeating this method can obtain the correct round key k obtained after searching and decrypting in the r-1th round r-2 .

[0113] (3) Master key recovery phase

[0114] Using two consecutive rounds of sub-keys k2 and k3, the master key can be obtained by reverse calculation through the SPECK key generation algorithm.

[0115] 3 Quantum Resource Analysis

[0116] It is known that 2n represents the block size of the SPECK algorithm, and mn represents the key size of the SPECK encryption. Note that when r is an integer, r+1 rounds of known plaintext attacks are required. Let the number of rounds required for encryption be t, the number of auxiliary quantum bits required for addition be a(n), the number of quantum gates required for an n-bit addition operation be g(n), and the depth required for an n-bit addition operation be d(n). The quantum resources required for the two stages of differential analysis are:

[0117] (1) Plaintext collection phase

[0118] The process of finding a plaintext pair that meets the SPECK high-probability differential path requires the Oracle line to run times. The quantum resources required for each Oracle line operation are:

[0119]

[0120] (2) Round key guessing stage

[0121] In the guessing round key phase, a set of plaintext and ciphertext pairs that conform to the high-probability differential path is used. It is necessary to find m consecutive round keys in this way. Each round key search requires the Oracle line to run The quantum resources required for each Oracle line operation are:

[0122]

[0123] (3) Total resource consumption

[0124] In the above two stages, the quantum bit resources can be released at the end of the first stage and handed over to the second stage for use, so only the larger value of the quantum bit required in the two stages is needed as the total quantum bit consumption. The remaining quantum resources need to be added in the two processes.

[0125] In summary, the present invention first constructs the SPECK algorithm quantum encryption circuit based on the SPECK algorithm key expansion function and the SPECK algorithm round encryption function; then obtains the SPECK algorithm quantum decryption circuit based on the SPECK algorithm quantum encryption circuit; constructs the Grover algorithm based on the SPECK algorithm quantum encryption circuit and the SPECK algorithm quantum decryption circuit to find the plaintext pair quantum circuit that meets the differential path and guess the round key quantum circuit of the rth round of the SPECK algorithm; finally, quantum differential analysis is performed based on the constructed quantum circuit to complete the SPECK algorithm security analysis. The present invention can effectively overcome the shortcomings of limited computing power of traditional computers, and can more efficiently analyze the security of existing block cipher algorithms.

[0126] The above is only a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A quantum differential analysis method for SPECK symmetric cryptography, characterized in that: include: Step 1: Based on the SPECK algorithm key expansion function and the SPECK algorithm round encryption function, construct the SPECK algorithm quantum encryption circuit; Step 2: Obtain the SPECK algorithm quantum decryption circuit based on the SPECK algorithm quantum encryption circuit; Step 3: Based on the quantum encryption circuit of the SPECK algorithm and the quantum decryption circuit of the SPECK algorithm, the Grover algorithm is constructed to find the plaintext pair quantum circuit that conforms to the differential path and guess the round key quantum circuit of the rth round of the SPECK algorithm; Step 4: Perform quantum differential analysis based on the constructed quantum circuit to complete the security analysis of the SPECK algorithm; The step 4 comprises: Step 4.1: Plaintext pair collection phase Step 4.1.1: Initialize an empty list C = φ; Step 4.1.2: Construct a plaintext pair that satisfies the difference β0 Step 4.1.3: Based on the constructed Grover algorithm, find the plaintext that meets the differential path. Find the quantum circuit that satisfies the differential β after r rounds of encryption. r All ciphertext pairs Save to list C; Step 4.2: Round key guessing phase Step 4.2.1: Based on the constructed guessing of the round key quantum circuit of the SPECK algorithm, search so that the ciphertext Decrypted Satisfy the difference β r-1 The round key with the highest probability is taken as the correct round key k obtained after searching and decrypting in the rth round r-1 ; Step 4.2.2: Exploitation and β r-2 Repeat the method in step 4.2.1 to obtain the correct round key k obtained after searching and decrypting in the r-1th round r-2 ; Step 4.3: Key recovery phase The master key is obtained by reverse calculation using two consecutive rounds of subkeys k2 and k3 through the SPECK key generation algorithm.

2. A quantum differential analysis method for SPECK symmetric cryptography according to claim 1, characterized in that: The SPECK algorithm key expansion function in step 1 is: Among them l i Indicates the array needed to generate the secret key for round i, k i represents the secret key of the i-th round, Represents modulo 2 n addition, Indicates bitwise exclusive OR, S -α Indicates that the input vector is shifted right by α bits according to binary cycle, S β It means to shift the input vector left by β bits in binary cycle.

3. A quantum differential analysis method for SPECK symmetric cryptography according to claim 1, characterized in that: In step 1, the SPECK algorithm round encryption function is: Where R i Indicates the high-order grouping of the i-th round input, L i Indicates the low-order group of the i-th round input, k i represents the secret key of the i-th round, Represents modulo 2 n addition, Indicates bitwise exclusive OR, S -α Indicates that the input vector is shifted right by α bits according to binary cycle, S β It means to shift the input vector left by β bits in binary cycle.

4. A quantum differential analysis method for SPECK symmetric cryptography according to claim 1, characterized in that: After step 4, the method further includes: Perform quantum resource analysis in the plaintext collection phase and the round key guessing phase.

Images