A redundant enhanced algebraic fault analysis method and device for block ciphers

Abstract

The application discloses a redundant enhanced algebraic fault analysis method for a block cipher, and comprises the following steps: inputting a plaintext into a target block cipher to obtain correct ciphertext; injecting a fault into the target block cipher, and then inputting the plaintext into the faulty target block cipher again to obtain faulty ciphertext; forming a correct-faulty ciphertext pair by combining the correct ciphertext with the corresponding faulty ciphertext; constructing an inverse r-round encryption algebraic equation for each faulty ciphertext according to the round function composition of the target block cipher, and adding a corresponding key constraint algebraic equation to the encryption algebraic equation to obtain an encryption algebraic system; adding a redundant constraint to the encryption algebraic system according to the reversibility of the encryption operation of the target block cipher and the SPN structure; assigning values to variables in the encryption algebraic system according to the correct-faulty ciphertext pair; and solving the encryption algebraic system to obtain an encryption master key. The method improves the cracking efficiency and requires less ciphertext.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communication and information security, and in particular to a redundancy enhanced algebraic fault analysis method and device for block ciphers. BACKGROUND

[0002] Block cipher algorithm is an important field in cryptography, which is widely used in commercial devices such as smart cards. The commonly used algorithms such as Advanced Encryption Standard (AES) and PRESENT have very high theoretical security performance, and traditional cryptanalysis methods are difficult to pose a substantial threat to these algorithms.

[0003] For block ciphers, fault attacks are a common attack method. Fault attacks change the running conditions of the cryptographic system or apply external interference to make the cryptographic algorithm run incorrectly, and then obtain the sensitive information in the cryptographic system. According to the implementation process, fault attacks can be divided into two stages. The first stage is called fault injection stage, in which the attacker needs to interfere with the running of the cryptographic device and make it error, and the common fault injection means include electromagnetic, laser, voltage and clock glitch, etc. The second stage is called fault analysis stage, in which the attacker analyzes the output of the cryptographic device with faults, and then infers the sensitive information in the cryptographic system.

[0004] Common fault analysis methods include DFA (differential fault analysis), AFA (algebraic fault analysis), SFA (statistical fault analysis), etc. When classifying fault existence time, it can be divided into transient fault, permanent fault and persistent fault, etc., and most traditional fault attack methods are for transient fault. In order to solve the problem of poor universality of DFA, Courtois et al. combined DFA with algebraic cryptanalysis in 2010 and proposed AFA (algebraic fault analysis), which uses the universality of machine solver to give the algorithm the universality of recovering the key. In AFA, the attacker can inject a transient fault in the encryption process by force after obtaining a series of correct ciphertexts {C}, and get the corresponding fault ciphertexts {C *}, and then use this information to assign values to the corresponding variables in the constructed algebraic system. Finally, the problem of recovering the key is transformed into the problem of solving the solution of the equation set in mathematics.

[0005] However, AFA as a method of fault analysis for block ciphers still has the following disadvantages:

[0006] After the problem of fault analysis is converted into an algebraic system, extra information provided by the block cipher is lost, which results in that the special context cannot be utilized to accelerate the solving of the algebraic system by using a general solver. Therefore, AFA cannot deal with the case that the algebraic system has a large scale, and currently, the academia can only apply AFA to a lightweight block cipher and requires that the position of fault injection is very close to the position of ciphertext output. SUMMARY

[0007] In view of this, the present application provides a redundancy enhanced algebraic fault analysis method and device for block ciphers.

[0008] To achieve the above-mentioned purposes, the technical solutions of the present application are as follows:

[0009] The first aspect of the embodiments of the present application provides a redundancy enhanced algebraic fault analysis method for block ciphers, which comprises the following steps:

[0010] inputting plaintext into a target block cipher to obtain correct ciphertext;

[0011] injecting a fault into the target block cipher, re-inputting the plaintext into the faulty target block cipher to obtain faulty ciphertext, and forming a correct-faulty ciphertext pair by combining the correct ciphertext and the corresponding faulty ciphertext;

[0012] constructing an encryption algebraic equation of the r-th inverse round for each faulty ciphertext according to the round function composition of the target block cipher, and adding a corresponding key constraint algebraic equation to the encryption algebraic equation to obtain an encryption algebraic system;

[0013] adding a redundancy constraint to the encryption algebraic system according to the reversibility of the encryption operation of the target block cipher and the SPN structure;

[0014] assigning values to variables in the encryption algebraic system according to the correct-faulty ciphertext pair;

[0015] solving the encryption algebraic system to obtain the encryption master key.

[0016] The second aspect of the embodiments of the present application provides a redundancy enhanced algebraic fault analysis device for block cipher algorithms, which comprises:

[0017] an encryption module, configured to input plaintext into a target block cipher to obtain correct ciphertext, inject a fault into the target block cipher, re-input the plaintext into the faulty target block cipher to obtain faulty ciphertext, and form a correct-faulty ciphertext pair by combining the correct ciphertext and the corresponding faulty ciphertext;

[0018] an analysis module, configured to construct an encryption algebraic equation of the r-th inverse round for each faulty ciphertext according to the round function composition of the target block cipher, add a corresponding key constraint algebraic equation to the encryption algebraic equation to obtain an encryption algebraic system, and add a redundancy constraint to the encryption algebraic system according to the reversibility of the encryption operation of the target block cipher and the SPN structure.

[0019] a redundancy module, adding redundancy constraints to the encryption algebraic system according to the reversibility of the target block cipher encryption operation and the SPN structure;

[0020] a solving module, for assigning values to variables in the encryption algebraic system according to the correct-fault ciphertext pair, solving the encryption algebraic system, and obtaining the encryption master key.

[0021] A third aspect of the embodiment of the present application provides an electronic device, comprising:

[0022] one or more processors;

[0023] a memory for storing one or more programs;

[0024] When the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0025] A fourth aspect of the embodiment of the present application provides a computer readable storage medium, which stores computer instructions, and the instructions are executed by a processor to implement the above steps.

[0026] Compared with the prior art, the present application has the beneficial effects that: the present application proposes a redundancy enhanced algebraic fault analysis method for block ciphers, introduces algebra to establish inverse multiple round encryption equations of the target cipher and constraint equations of corresponding round keys, and constructs effective redundancy constraints by using the universality of the SPN structure block cipher, greatly improving the system solving efficiency. The method of the present application not only maintains universality, but also solves the technical problem that AFA cannot be applied to heavy block ciphers in actual attack scenarios and has lower operability. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0028] Figure 1 a flowchart of the redundancy enhanced algebraic fault analysis method for block ciphers proposed by the present application;

[0029] Figure 2 a schematic diagram of the AES-128 encryption algorithm;

[0030] Figure 3 a flowchart of the redundancy enhanced algebraic fault analysis device for block ciphers proposed by the present application;

[0031] Figure 4 is a schematic view of an electronic device. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0033] It should be noted that the features in the following embodiments and implementation manners can be combined with each other without conflict.

[0034] Figure 1 is a flowchart of a redundant enhanced algebraic fault analysis method for a block cipher according to an exemplary embodiment, as shown in Figure 1 The method comprises the following steps:

[0035] Step S1, inputting a plaintext into a target block cipher to obtain a correct ciphertext.

[0036] In the implementation of step S1, the number of random plaintexts is selected according to the size of the target block cipher and the complexity of the selected fault model. When the size of the target cipher is larger, that is, the key length is longer, or the position of the fault injection is closer to the ciphertext output position, the number of faults to be injected is more. Generally, only 1-3 plaintexts are needed. After the plaintext is input, the corresponding plaintext-ciphertext pair is recorded.

[0037] Step S2, the target block cipher performs temporary fault injection, and the corresponding plaintext is input again to obtain a fault ciphertext; the correct ciphertext and the corresponding fault ciphertext form a correct-fault ciphertext pair.

[0038] In the implementation of step S2, the plaintext recorded in step S1 is input into the target cipher again, and a fixed physical disturbance (such as laser, heating, etc.) is applied to the encryption device during the encryption of each plaintext, wherein the specific position of the fault injection is known, but the fault value injected is unknown, so that a certain part of each plaintext will produce a constant and unknown fault value f during the encryption process, and this fault will be constantly propagated through the round function, and finally the fault ciphertext is obtained. Combined with the plaintext recorded in step S1, a plurality of correct ciphertext-fault ciphertext pairs can be obtained, denoted as

[0039] Step S3: Based on the round function composition of the target block cipher, construct the reciprocal r-round cryptographic algebraic equation for each faulty ciphertext, and add the corresponding key constraint algebraic equation to the cryptographic algebraic equation to obtain the cryptographic algebraic system.

[0040] Based on the target block cipher, construct the cryptographic algebraic equation for the reciprocal rounds, as shown below:

[0041] S i+1 =T i (K i ,S i )

[0042]

[0043]

[0044] Among them, S i For the bit variable corresponding to the correctly encrypted input data in the i-th round, f is the bit variable corresponding to the fault-encrypted input data in the i-th round. i K represents the fault differential value corresponding to the i-th round of encrypted data. i Let be the bit variable corresponding to the key in the i-th round.

[0045] In the specific implementation of step S3, an inverse r-round cryptographic algebraic equation is constructed for each of the faulty ciphertexts, and a corresponding key constraint algebraic equation is added to the cryptographic algebraic equation, including the following sub-steps:

[0046] Step S301: Analyze the composition of the target cipher round function based on the target block cipher;

[0047] Round functions in block ciphers generally include three operations: linear operations, non-linear substitutions, and round key XOR. Taking the AES-128 encryption algorithm as an example, such as... Figure 2 As shown, the round function of this cipher includes a non-linear substitution layer SubBytes, a linear layer ShiftRows, and a column mixing transformation MixColumns. At the end of each round, the data is XORed with the round key to obtain the output of that round.

[0048] Step S302: Establish the first equation based on the linear operations in the target cryptographic round function composition;

[0049] Specifically, suppose the input to a linear operation L is an n-bit array (x0, x1, ..., xn). n-1 The output is an n-bit array (y0, y1, ..., y). n-1 If there exists an n×n 0-1 matrix (a) ij ) 0≤i,j＜n and n constant bits (b i )0≤i＜n such that

[0050]

[0051] Taking AES-128 encryption algorithm as an example, assuming that the outputs of the rth round SubBytes, ShiftRows and MixColumns are and the 0-1 matrices and constant bits corresponding to the linear operations ShiftRows and MixColumns are and then the first equation contains:

[0052]

[0053]

[0054] Step S303, establishing a second equation according to the nonlinear operation in the target cipher round function;

[0055] Specifically, assuming that the input and output of an n-bit S-box are (x0, x1, …, x n-1 ) and (y0, y1, …, y n-1 ), then according to a mathematical theorem, there exists a unique set of constants

[0056] such that:

[0057]

[0058] where t i is the ith bit of t, and x i is the ith bit of x. Taking the AES encryption algorithm as an example:

[0059] y0=x0+x2+x3+x4+1+x0x1+x0x4+x0x5+x0x6+x1x2+x1x3+x1x4+x1x6+x2x3+x2x4+x2x6+x2x7+x4x6+x5x6+x5x7+x6x7+x0x1x4+x0x1x6+x0x1x7+x0x2x4+…

[0060] y1=x0+x3+x6+x7+1+x0x1+x0x2+x0x3+x0x4+x0x7+x1x3+x1x4+X1X7+x2x3+x2x6+x2x7+x3x7+X4x5+x4x6+x0x1x3+x0x1x4+x0x1x6+x0x2x3+x0x2x7+…

[0061] Step S304, according to the target cipher round function in the round key XOR layer to establish the third equation;

[0062] Specifically, the output of the XOR layer is always the XOR result of the output of the last round operation and the round key.

[0063] Taking the AES encryption algorithm as an example, assuming that the XOR output of the rth round key is The rth round key is Then the third equation contains:

[0064]

[0065] Step S305, according to the target block cipher, the first, second and third equations are combined to establish the encryption equation of the rth round.

[0066] Taking the AES encryption algorithm as an example, the encryption equation of the rth round can be expressed as:

[0067]

[0068] Where, X r-1 , K r respectively represent the input state and the round key of the rth round, and R represents the maximum encryption round number of the block cipher. In particular, X 0 represents the input plaintext, and X R represents the output ciphertext.

[0069] Step S305, according to the target cipher, add a key constraint equation for the round key in the rth round;

[0070] Specifically, in the block cipher, the round key of each round is obtained by a certain expansion algorithm KeyExpansion from the last round key, and the input master key will be used as the initial value of these iterations. We add the following equation to the system

[0071]

[0072] Where, KeyExpansion i represents the algorithm for expanding the rth round key of the block cipher, r * represents the round position of fault injection, and K r is the rth round key. Generally, the operations used by the key expansion algorithm are derived from the round function.

[0073] Step S4, according to the reversibility of the target block cipher encryption operation and the SPN structure, add a redundant constraint to the encryption algebraic system;

[0074] In the specific implementation of step S4, the following sub-steps are included:

[0075] Step S401, for each operation T in the round function, the equation is established when the encryption process constraint is added in step S3:

[0076] S i+1 =T i i , S i

[0077] y = T

[0078] where x represents the input variable of the operation, and y represents the output variable of the operation. According to the properties of the block cipher, the encryption result of a plaintext is fixed and unique under the premise of a given master key, so the operation T must be reversible, and thus the decryption algorithm of the target cipher is used to backtrace from the ciphertext output position to the fault injection position, and the decryption equation of the inverse r rounds is established as the first redundancy constraint, and the expression is as follows:

[0079] S i =T i -1 i , S i+1

[0080] After adding this first redundancy constraint, the forward and backward reasoning of the solver on the variable values in the system will be promoted.

[0081] Taking the AES encryption algorithm as an example, on the basis of step S3, the following redundancy constraints are added:

[0082] AK r-1 =SubBytes -1 r

[0083] SB r =ShiftRows -1 r

[0084] SR r =MixColumns -1 r

[0085] Step S402, if the round function T i of the i-th round is an affine transformation, that is, for any j, k = 0, 1, …, n-1, there exist constants a j，k , b j ∈{0,1} such that the following equation holds:

[0086] T i (x n-1 …x1x0)=y n-1 …y1y0 ​​​​​​​​​​

[0087]

[0088] Therefore, its input and output also satisfy the corresponding linear relationship.

[0089] The differential faults between each round of correct encryption and faulty encryption are treated as Boolean variables. Based on the additive structure of the linear layers in the SPN structure, a redundant equation for fault propagation is constructed and added to the cryptographic algebra system.

[0090] When the round function T of the target block cipher in the i-th round i When performing a linear operation and a round key XOR operation, the input and output faults always have a linear relationship, requiring the addition of a second redundancy constraint, as shown in the following expression:

[0091]

[0092] Where f is the difference between the correct input and the faulty input, and f′ is the difference between the correct output and the faulty output. A is the linear transformation matrix corresponding to the round function, b is the offset value corresponding to the round function, and x is the input value corresponding to the correct encryption. * This is the input value corresponding to the incorrect encryption. This simple additional constraint allows the solver to detect contradictions earlier during the search process, pruning ahead of time and greatly improving efficiency.

[0093] Taking the AES encryption algorithm as an example, the following redundancy is added in this step:

[0094]

[0095]

[0096]

[0097] When the round function T of the target block cipher in the i-th round i For nonlinear operations, a third redundancy constraint is added. Generally, the input difference and output difference have only a very complex nonlinear relationship, and adding such a nonlinear constraint to the system incurs a huge overhead. However, in special cases, embodiments of the present invention can guarantee that the input and output differences are equal. Assuming that the S-box used in the block cipher is k bits in size, if all k bits of the input to a certain S-box are fault-free, then its k output bits are also fault-free.

[0098] The expression for adding the third redundancy constraint is as follows:

[0099]

[0100] Step S5: Assign values ​​to the variables in the cryptographic algebra system according to the correct-fault ciphertext pairs;

[0101] In the implementation of step S5, the known correct ciphertext and the faulty ciphertext are used to assign values to the variables in the algebraic system: specifically, the variable representing the output ciphertext in the inverse r-round encryption equation is assigned a value using the actual collected correct ciphertext C. The i-th bit c i of the correct ciphertext C is 0, the variable representing the ciphertext in the encryption equation is assigned a value of 0, and vice versa. Through this step, the actual correct ciphertext C is associated with the algebraic equation. Similarly, the faulty ciphertext C * can be associated with the algebraic equation. Among them, the correct ciphertext C and the faulty ciphertext C * are stored in step S2.

[0102] Step S6, solve the encryption algebraic system with added redundancy to obtain the encryption master key.

[0103] In the implementation of step S6, it includes:

[0104] Step S601, according to the encryption algebraic system with added redundancy, input it into the algebraic solver and call the algebraic solver to solve;

[0105] Specifically, in this embodiment, the CryptoMiniSAT solver based on the satisfiability (SAT) problem uses the pycryptosat library under python to first create an object of the solver, then transmits the encryption algebraic system with added redundancy into the object, and finally calls the built-in solver in the object to solve.

[0106] Step S602, according to the solving result, restore the master key used by the target password encryption.

[0107] Specifically, after solving using the above SAT solver, the result of the variable used to represent the master key in the encryption algebraic equation variable is the master key used by the target password during encryption.

[0108] As can be seen from the above embodiments, the present application introduces algebra to establish the inverse multi-round encryption equation of the target password and the constraint equation of the corresponding round key, and uses the universality of the SPN structure block cipher to construct effective redundancy constraints, which can greatly improve the system solving efficiency. Compared with the traditional AFA, the RAFA algorithm (Redundancies-assisted AFA) proposed in the present application not only maintains universality, but also solves the technical problems that AFA cannot be applied to heavy block ciphers and has low operability in actual attack scenarios.

[0109] Corresponding to the foregoing embodiment of the redundancy enhanced algebraic fault analysis method for a block cipher algorithm, the application further provides an embodiment of a redundancy enhanced algebraic fault analysis device for a block cipher algorithm.

[0110] The encryption module 301 is configured to input plaintext into a target block cipher to obtain correct ciphertext, perform fault injection on the target block cipher, re-input the plaintext into the faulty target block cipher to obtain faulty ciphertext, and form a correct-faulty ciphertext pair by combining the correct ciphertext and the corresponding faulty ciphertext.

[0111] The analysis module 302 is configured to construct an encryption algebraic equation of the inverse r rounds for each faulty ciphertext according to the round function composition of the target block cipher, and add a corresponding key constraint algebraic equation to the encryption algebraic equation to obtain an encryption algebraic system.

[0112] The redundancy module 303 is configured to add a redundancy constraint to the encryption algebraic system according to the reversibility of the encryption operation of the target block cipher and the SPN structure.

[0113] The solving module 304 is configured to assign values to variables in the encryption algebraic system according to the correct-faulty ciphertext pair, solve the encryption algebraic system, and obtain an encryption master key. As to the device in the above embodiment, the specific manners in which the various modules perform operations have been described in detail in the embodiment of the method, and will not be described in detail here.

[0114] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts are described in the method embodiment. The device embodiments described above are merely illustrative, and the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e., they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the application scheme according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0115] Correspondingly, as shown in Figure 4 The application further provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the redundancy enhanced algebraic fault analysis method for a block cipher as described above.

[0116] Correspondingly, the application further provides a computer readable storage medium having computer instructions stored thereon, characterized in that the instructions are executed by a processor to implement the redundancy enhanced algebraic fault analysis method for a block cipher as described above.

[0117] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the application embrace any and all variations of the present application that fall within the scope of the general inventive concept as defined in the claims and that the specification and examples be considered exemplary only in nature. The true scope and spirit of the application is indicated by the claims.

[0118] It is to be understood that the application is not limited to the precise details of construction and the

[0119] Various modifications and changes can be made as would be obvious to one skilled in the art without departing from the scope of the application. It is intended that the scope of the application should only be limited as recited in the claims.

Claims

1. A redundancy-enhanced algebraic fault analysis method against a block cipher, characterized in that, The method comprises: inputting plaintext into a target block cipher to obtain correct ciphertext; injecting faults into the target block cipher, re-inputting the plaintext into the faulty target block cipher to obtain faulty ciphertext; and forming a correct-faulty ciphertext pair from the correct ciphertext and the corresponding faulty ciphertext; constructing an encryption algebraic equation of the r-th round from each piece of faulty ciphertext according to the round function of the target block cipher, and adding a corresponding key constraint algebraic equation to the encryption algebraic equation to obtain an encryption algebraic system; adding a redundancy constraint to the encryption algebraic system according to the reversibility of the encryption operation of the target block cipher and the SPN structure; assigning values to variables in the encryption algebraic system according to the correct-faulty ciphertext pair; solving the encryption algebraic system to obtain the encryption master key. The adding of the redundancy constraint to the encryption algebraic system according to the reversibility of the encryption operation of the target block cipher and the SPN structure comprises: establishing a decryption equation of the r-th round as a first redundancy constraint, and the expression is as follows: S i = T i -1 (K i , S i+1 ) where S i is the bit variable corresponding to the i-th round correct encryption of the input data, T i -1 (.) the inverse function of the i-th round function, K i is the bit variable corresponding to the i-th round key; When the round function T of the target block cipher in the i-th round i To perform a linear operation and a round key XOR operation, a second redundancy constraint is added, expressed as follows: where f is the difference between the correct input and the faulty input, f' is the difference between the correct output and the faulty output, A is a linear transformation matrix corresponding to the round function, b is an offset value corresponding to the round function, x is an input value corresponding to the correct encryption, and x * is an input value corresponding to the incorrect encryption. In the above formula, f is the difference between the correct input and the faulty input, f' is the difference between the correct output and the faulty output, A is a linear transformation matrix corresponding to the round function, b is an offset value corresponding to the round function, x is an input value corresponding to the correct encryption, and x * is an input value corresponding to the incorrect encryption. When the round function T of the target block cipher in the i-th round i For nonlinear operations, a third redundant constraint is added, expressed as follows: In the formula, f i,jk is the jkth bit value of the output fault difference of the ith round.

2. A redundancy-enhanced algebraic fault analysis method against a block cipher according to claim 1, characterized in that, injecting faults into the block cipher, and re-inputting the plaintext into the faulty block cipher to obtain faulty ciphertext comprises: re-inputting the plaintext into the block cipher, and applying physical interference during encryption of each block cipher to make each plaintext generate an unknown fault value in the encryption process, and obtaining the faulty ciphertext after propagation through the block cipher round function.

3. A redundancy-enhanced algebraic fault analysis method against a block cipher according to claim 1, characterized in that, The constructing of the encryption algebraic equation of the r-th round according to the target block cipher comprises: S i+1 = T i (K i , S i ) where S i is the bit variable corresponding to the i-th round of correctly encrypted input data, is the bit variable corresponding to the i-th round of faulted encrypted input data, f i is the faulted differential value corresponding to the i-th round of encrypted data, T i is the round function of the i-th round, K i is the bit variable corresponding to the i-th round key.

4. A redundancy-enhanced algebraic fault analysis method against a block cipher according to claim 1 or 3, characterized in that, The constructing of the encryption algebraic equation of the r-th round from each piece of faulty ciphertext according to the round function of the block cipher comprises: The round function of the block cipher comprises a linear layer, a nonlinear layer and a round key XOR layer; a first equation is established according to the linear layer, a second equation is established according to the nonlinear layer, and a third equation is established according to the round key XOR layer; the first, second and third equations are combined according to the structure of the block cipher to establish the encryption algebraic equation of the r-th round.

5. A redundancy-enhanced algebraic fault analysis method against a block cipher according to claim 1, characterized in that, The adding of the corresponding key constraint algebraic equation to the encryption algebraic equation comprises: The round key of each round is obtained by an expansion algorithm KeyExpansion from the key of the previous round, and the expression is as follows: wherein KeyExpansion i denotes the algorithm of the rth round key expansion of the block cipher, r * denotes the round position of the fault injection, K r is the rth round key.

6. A redundancy-enhanced algebraic fault analysis method against a block cipher according to claim 1, characterized in that, The assigning of values to variables in the encryption algebraic system according to the correct-faulty ciphertext pair comprises: the i-th bit of the correct ciphertext c i when 0, the variable representing the ciphertext in the encryption algebraic system is assigned 0, and vice versa the jth bit c of the faulty ciphertext j is 0, the variable representing the ciphertext in the encryption algebraic system is assigned the value 0, and vice versa.

7. A redundancy-enhanced algebraic fault analysis device for block cipher algorithms, characterized in that, comprises: an encryption module, configured to input plaintext into a target block cipher to obtain correct ciphertext; inject faults into the target block cipher, re-input the plaintext into the faulty target block cipher to obtain faulty ciphertext; and form a correct-faulty ciphertext pair from the correct ciphertext and the corresponding faulty ciphertext; an analysis module, configured to construct an encryption algebraic equation of the r-th round from each piece of faulty ciphertext according to the round function of the target block cipher, and add a corresponding key constraint algebraic equation to the encryption algebraic equation to obtain an encryption algebraic system; a redundancy module, configured to add a redundancy constraint to the encryption algebraic system according to the reversibility of the encryption operation of the target block cipher and the SPN structure; comprising: establish a decryption equation of the r-th round as a first redundancy constraint, and the expression is as follows: a solving module, configured to assign values to variables in the encryption algebraic system according to the correct-faulty ciphertext pair, solve the encryption algebraic system, and obtain the encryption master key. S i = T i -1 (K i , S i+1 ) where S i is the bit variable corresponding to the i-th round correct encryption of the input data, T i -1 (.) the inverse function of the round function of the i-th round, K i is the bit variable corresponding to the i-th round key; When the round function T of the target block cipher in the i-th round i To perform a linear operation and a round key XOR operation, a second redundancy constraint is added, expressed as follows: where f is the difference between the correct input and the faulty input, f' is the difference between the correct output and the faulty output, A is a linear transformation matrix corresponding to the round function, b is an offset value corresponding to the round function, x is an input value corresponding to the correct encryption, and x * is an input value corresponding to the incorrect encryption. In the above formula, f is the difference between the correct input and the faulty input, f' is the difference between the correct output and the faulty output, A is a linear transformation matrix corresponding to the round function, b is an offset value corresponding to the round function, x is an input value corresponding to the correct encryption, and x * is an input value corresponding to the incorrect encryption. When the round function T of the target block cipher in the i-th round i For nonlinear operations, a third redundant constraint is added, expressed as follows: In the formula, f i,jk is the jkth bit value of the i-th round output fault difference; comprise:

8. An electronic device, comprising: one or more processors; a memory for storing one or more programs; ​ When the one or more programs are executed by the one or more processors, the one or more processors implement a method according to any of claims 1-6.

9. A computer readable storage medium having stored thereon computer instructions, wherein, The instructions, when executed by a processor, implement steps of a method according to any of claims 1-6.

Images