A hybrid differential byte-level discriminator search method

Abstract

The application relates to a mixed differential byte-level distinguisher search method, and belongs to the technical field of network information security block cipher design and analysis. First, a mixed differential mode coding variable is introduced for each input byte and each output byte of each state matrix in a block cipher using (semi-) byte-level permutation as a linear diffusion layer, and a probability variable is introduced for the XOR operation of each layer of the linear diffusion layer. For the S-box operation of the nonlinear layer in the encryption process, a new coding variable does not need to be generated. The input (semi-) byte mixed differential coding variable, the output (semi-) byte mixed differential coding variable and the probability variable of each XOR operation of each round of the linear diffusion layer are given the restrictions, a mixed integer linear programming problem is established by taking the sum of the probability variables of all the XOR operations of the linear diffusion layer in the block cipher as the target for minimization, and finally a high-probability mixed differential distinguisher is obtained by solving the mixed integer linear programming problem.

Description

TECHNICAL FIELD

[0001] The application relates to a mixed differential byte-level distinguisher search method and belongs to the technical field of network information security block cipher design and analysis. BACKGROUND

[0002] A symmetric cipher refers to a cipher algorithm using the same key for encryption and decryption and is mainly used for data encryption. Among them, a block cipher is a widely used symmetric cipher. Encryption of the block cipher refers to converting plaintext of a fixed length (such as n bits) into ciphertext of the same length (if the length of the plaintext is n, the length of the ciphertext is also n) under the control of a main key of m bits; decryption refers to restoring the plaintext from the ciphertext under the control of the same key. N is the block length of the plaintext, and m is the main key length, m is a positive integer, and n is a positive integer.

[0003] The block cipher can not only be used for data encryption, but also be used for constructing a hash function and a message authentication code (MAC), and the like, which makes the application of the block cipher very wide. How to design a secure and efficient block cipher is an important issue in the field of information security research.

[0004] The SPN (Substitution-Permutation Network) structure is one of the most commonly used structures in designing a block cipher. The core of designing an SPN block cipher is to design a suitable round function and iterate the round function for a sufficient number of times to achieve sufficient security. An SPN block cipher with a round function iterated R times is referred to as an R-round block cipher, wherein R is a positive integer. An R-round SPN block cipher with a block length of N needs to use an N-bit subkey in each round, and the subkey used in each round is obtained by a determined key expansion algorithm from the main key of the block cipher.

[0005] The round function structure of an SPN block cipher with a block length of N usually includes three operations, as shown in the following formula. Figure 1 The three operations are as follows:

[0006] 1. Round key XOR operation. The N input bits of the round function are subjected to XOR operation with the subkey of the corresponding round, and N output bits are output.

[0007] 2. Block S-box operation. The N output bits in the round key XOR operation are divided into N / w groups of output bits, wherein w is a positive integer, N is divisible by w, so that each group of output bits is w bits; each group of output bits is subjected to an S-box to obtain new output bits, wherein the input and output of the S-box are both w bits, and there are N / w S-boxes for processing the output bits divided after the XOR operation in step 1.

[0008] like Figure 2 The diagram shows the input and output of an S-box. An S-box with both input and output of w bits is essentially a mapping: in An S-box is a finite field with two elements, often referred to as a binary field. Typically, the mapping rules for an S-box are given by a table, such as Table 1, which shows the mapping rules for a 4-bit input, 4-bit output S-box in the CRAFT algorithm.

[0009] Table 1: Mapping rules for 4-bit input, 4-bit output S-boxes (hexadecimal representation)

[0010] x 0 1 2 3 4 5 6 7 8 9 a b c d e f S(x) c a d 3 e b f 7 8 9 1 5 0 2 4 6

[0011] From Table 1, we can see that: S(0) = c, S(1) = a, S(2) = d, S(3) = 3, S(4) = e, S(5) = b, S(6) = f, S(7) = 7, S(8) = 8, S(9) = 9, S(a) = 1, S(b) = 5, S(c) = 0, S(d) = 2, S(e) = 4, S(f) = 6.

[0012] 3. Linear diffusion layer operation. The output bits of the S-box output in the grouped S-box operation are subjected to a linear transformation to obtain the output bits, which are then used as the input bits of the next round function.

[0013] Figure 1 In this context, the grouped S-box operation and the linear diffusion layer operation are also referred to as the nonlinear substitution layer and the linear diffusion layer, respectively.

[0014] The widespread use of microcomputing devices in the modern information society has made the demand for lightweight block ciphers increasingly urgent. How to design a lightweight block cipher that is small in circuit area, low in power consumption, and secure has attracted widespread interest in the cryptography and industry communities. For example, CRAFT (a name for a lightweight block cipher) is a novel SPN-structured, AES-like lightweight adjustable block cipher. One of its main design criteria is effective resistance to differential fault attacks, while also being able to withstand linear attacks, differential attacks, integral attacks, encounter-in-the-middle attacks, and zero-correlation attacks.

[0015] Differential attack is an important method among all known attacks, which obtains certain key bits by analyzing the influence of the difference of a specific plaintext pair on the difference of a ciphertext pair. Differential attack can be used to attack and analyze any cryptographic system constructed by iterating a fixed round function, including SPN block cipher, such as DES (Data Encryption Standard), AES (Advanced Encryption Standard), CRAFT (a kind of AES-like lightweight block cipher) and Midori (a name of lightweight block cipher algorithm). Among them, CRAFT algorithm is a new type of AES-like lightweight block cipher algorithm with SPN structure, which can effectively resist differential fault attack, and takes half byte as a single element to form a 4*4 matrix for nonlinear layer operation and linear layer operation. The specific nonlinear confusion layer and linear diffusion layer are shown in Figure 3 . The linear diffusion layer is divided into (semi) byte substitution and column confusion layer, and the column confusion layer generates new (semi) byte elements by using column confusion matrix and (semi) byte elements of each column. Midori algorithm is similar to CRAFT algorithm, which is a lightweight block cipher algorithm with SPN structure, and the block length is 64 bits and 128 bits, respectively taking half byte and byte as operation unit. Taking 64 bits as an example, 64-bit block is divided into 16 sub-blocks according to half byte, and is represented by 4*4 matrix, and the encryption process is shown in Figure 4 . When performing mixed differential analysis, the column confusion layer in the encryption process needs to be focused on. Differential attack involves selecting a plaintext pair with a certain special differential pattern, so that the ciphertext pair with a certain special differential pattern appears with a higher probability, and differential attack uses these characteristics to calculate the possible key. Differential attack depends largely on the structure of S-box.

[0016] Therefore, in order to resist differential attack, all block ciphers designed newly must prove the security of differential attack. In 2001, NIST (National Institute of Standards and Technology) proposed a new data encryption algorithm standard AES (Advanced Encryption Standard). AES is based on SPN structure, and its design uses byte substitution and maximum distance separable code as its linear diffusion layer, which can prove that AES can resist differential attack.

[0017] The effectiveness of differential attack depends on the probability of the selected differential characteristic, the higher the probability, the more effective the attack. Mixed differential analysis is a variant method of differential attack. The core idea of mixed differential cryptanalysis is to study the properties of four plaintext states and their corresponding four ciphertexts, which have a close relationship. This property was first proposed by Grassi et al. in Eurocrypt 2017, who first discovered a key recovery distinguisher for 5-round AES. In FSE / ToSC 2019, this property was formally defined as a mixed differential property. Specifically, the four ciphertexts corresponding to the specially constructed four plaintexts are located in a specific subspace with a probability of 1, which is different from random permutation. The purpose of mixed differential analysis is to obtain a mixed differential distinguisher on the corresponding algorithm. The mixed differential distinguisher is composed of a pair of differentials (input differential and output differential) and the probability of the pair of differentials. In order to distinguish from random permutation, the probability of the mixed differential distinguisher is greater than the probability of obtaining the pair of differentials in the case of random permutation.

[0018] At present, the properties of mixed differential have been studied from different angles, and have been extended to more block ciphers, that is, mixed differential properties have been tested on a variety of different block ciphers, and distinguishers with more rounds have been set.

[0019] However, the existing mixed differential properties are inferred by manually checking the structure of the AES-like cipher algorithm. And the search of mixed differential in most cryptanalysis relies on the dependence between large text sets to distinguish, so as to find more non-random properties to construct effective plaintext structures, which is a large amount of work. Therefore, it is necessary to search for an automatic mixed differential distinguisher for (semi) byte-level linear permutation layers. SUMMARY

[0020] The purpose of the present application is to solve the problem of automatic mixed differential distinguisher search for (semi) byte-level linear permutation layers in the field, and to propose a new mixed differential (semi) byte-level distinguisher search method, which can automatically obtain mixed differential distinguishers for block ciphers using (semi) byte-level permutation as linear diffusion layer. This method is also applicable to the case where the linear diffusion layer is a non-maximum distance separable code.

[0021] The present application adopts the following technical solutions.

[0022] A mixed differential (semi) byte-level distinguisher search method, comprising the following steps:

[0023] First, for each input byte and each output byte of each state matrix in a block cipher using (half)byte-level permutations as linear diffusion layers, a hybrid differential mode encoding variable is introduced, and a probability variable is introduced for the XOR operation of each linear diffusion layer. All variables are binary variables, i.e., they take values ​​of 0 or 1.

[0024] Then, for the nonlinear S-box operation in the encryption process, no new encoding variables need to be generated because the S-box operation does not change the hybrid differential mode. With the goal of minimizing the sum of probability variables for all linear diffusion layer XOR operations in the block cipher, the aforementioned constraints are imposed on the input (half)byte hybrid differential encoding variable, output (half)byte hybrid differential encoding variable, and probability variable for each XOR operation in each round of the linear diffusion layer, thus establishing a linear programming problem for mixed integers.

[0025] Finally, a high-probability mixed-difference discriminator is obtained by solving a mixed-integer linear programming problem.

[0026] Furthermore, the block cipher has a block length of N bits, a total of R rounds, and each round's state matrix contains T (half) bytes, each (half) byte having a width of w. Where N = T × w, N, R, T, and w are all positive integers, and N is divisible by T. The linear layer of each round of the block cipher consists of M (half) byte-level XOR operations.

[0027] Furthermore, in the block cipher, the hybrid differential mode encoding variable introduced at any byte position of the input state matrix in the i-th round is represented as (c2) i-1，k c1 i-1，k c0 i-1，k ), where c is short for code, i∈[1, R+1], k∈[0, T-1]. For cases where the output of XOR is not in the state matrix but serves as an intermediate state, a hybrid differential mode encoding variable on the intermediate state is introduced. i∈[1, R], j∈[0, J-1], where J is the number of intermediate variables. The specific settings are as follows:

[0028] If (c2) i-1，k c1 i-1，k c0 i-1，k If ) = 000, it means that the mixed differential mode represented by the (half) byte is "-";

[0029] If (c2) i-1，k c1 i-1，k c0 i-1，k If ) = 001, it means that the mixed differential mode represented by this (half) byte is "s";

[0030] If (c2) i-1，kc1 i-1，k c0 i-1，k If ) = 010, it means that the mixed differential mode represented by this (half) byte is "c";

[0031] If (c2) i-1，k c1 i-1，k c0 i-1，k If ) = 100, it means that the mixed differential mode represented by this (half) byte is "x";

[0032] If (c2) i-1，k c1 i-1，k c0 i-1，k If ) = 101, it means that the mixed differential mode represented by this (half) byte is "*";

[0033] like This indicates that the mixed differential mode represented by the intermediate state (half) byte is "-";

[0034] like This indicates that the mixed differential mode represented by the intermediate state (half) byte is "s";

[0035] like This indicates that the mixed differential mode represented by the intermediate state (half) byte is "c";

[0036] like This indicates that the mixed differential mode represented by the intermediate state (half) byte is "x";

[0037] like This indicates that the mixed differential mode represented by the intermediate state (half) byte is "*";

[0038] Where i ranges from 1 to R+1, and k ranges from 0 to T-1, a ternary code is used to represent the mixed differential pattern of each (half) byte in the state matrix. See the diagram for a specific illustration. Figure 5 .

[0039] Furthermore, in the block cipher, the probability variable introduced by any XOR operation potentially causing a change in the hybrid differential mode is expressed as: m∈[0, M-1], where M is a positive integer, meaning the probability of a mode change caused by the XOR operation is... in:

[0040] like This means that the probability of obtaining the output mixed difference mode after the input mixed difference mode is XORed is 1.

[0041] like The probability of the input mixed differential mode being XORed to obtain the output mixed differential mode is 2 -w ;

[0042] If The probability of the input mixed differential mode being XORed to obtain the output mixed differential mode is 2 -2w ;

[0043] If The probability of the input mixed differential mode being XORed to obtain the output mixed differential mode is 2 -3w ;

[0044] wherein, i is an integer ranging from 1 to R, and m is an integer ranging from 0 to M-1.

[0045] Further, the restriction comprises: for the XOR operation corresponding to the mixed differential mode variable and the mixed differential probability variable, without loss of generality, two input mixed differential mode variables are denoted as (c l2 , c l1 , c l0 ) and (c r2 , c r1 , c r0 ), the output mixed differential mode variable is denoted as (c o2 , c O1 , c o0 ), and the probability variable is denoted as (ph, pl), wherein, c l , c r represent the input mixed differential mode encoding on both sides of the XOR operation, respectively, and c o represents the output mixed differential mode encoding of the XOR operation. Enumerate the feasible propagation of the mixed differential mode and the corresponding probability. There are 50 11-dimensional points under the representation of the mixed differential mode variable and the probability variable, representing the feasible values of 9 mode variables and 2 probability variables, and the rules are as follows:

[0046] The probability of "s" XOR "s" -> "s" is 1, and the variable value is (001 001 000 00);

[0047] The probability of "s" XOR "s" -> "-" is 2 -w , and the variable value is (001 001 000 01);

[0048] The probability of "s" XOR "x" -> "c" is 2 -w , and the variable value is (001 100 010 01);

[0049] The probability of "x" XOR "x" -> "-" is 2 -w , and the variable value is (100 100 000 01);

[0050] The probability of "*" ⊕ "*" -> "-" is 2 -w , the variable takes the value (101 101 000 11);

[0051] A portion of the 50 is selected in the text, all in the form of drawings, as shown in Figure 6 .

[0052] Further, the restrictions include:

[0053] Inequality is used to characterize the feasible point set. Each inequality is about 11 mode variables and probability variables corresponding to the current XOR operation. The above feasible point set is characterized by the following inequalities:

[0054] -c l2 -3c l1 -c l0 -c r2 -3c r1 -c r0 -2c O2 -3c o1 -2c o0 -2ph-3pl+9≥0;

[0055] 3c l2 +3c l1 +2c l0 +3c r2 +3c r1 +2c ro -c O2 -c O1 -2c o0 -6ph-4pl≥0;

[0056] -c r2 -2c r1 -c r0 +c O2 +2c O1 +c O0 +ph+2pl≥0;

[0057] -3c l2 -4c l1 -3c l0 +c r1 +c o2 +c o0 +3ph-pl+≥0;

[0058] -c l1 -c l0 -2c r2 -3c r0 -c o1 +4c o0+ 5ph + 2pl + 2 > 0;

[0059] - c l2 - c r2 + 2c o2 - c o1 - c o0 + 2ph + pl + 1 > 0;

[0060] - c l2 - 2c l1 - c l0 + c r1 + c o2 + 2c O1 + c O0 + ph + pl > 0;

[0061] c l1 + c l0 + c r1 + c r0 - 2c o2 - c O1 - c o0 - 2ph - 2pl + 2 > 0;

[0062] - c l0 - c r0 - c o2 - c o1 + 2c o0 + 2ph + pl + 1 > 0;

[0063] c l1 - 2c l0 - 3c r2 - 4c r1 - c r0 + 3c o2 + 2c o1 + c o0 + 3ph + pl + 2 > 0;

[0064] 2c l2 + c l1 + 2c l0 + 2c r2 + c r0 - c o2 - c o0 - 3ph - pl > 0;

[0065] - 2c l2 - c l1 + c l0 + c r2 + 2c o2 + c o1 + c o0 + pl > 0;

[0066] cl2 + c l1 + c r2 + c r1 - c o2 - c O1 - 2c o0 - 2ph-2pl+2≥0;

[0067] Further, the restriction comprises:

[0068] In order to distinguish the mixed differential distinguisher from the random permutation distinguisher, it is required to take the sum of the probability variables of the output mode obtained under the random permutation as an upper bound of the sum of the probability variables of the mixed differential distinguisher of the block cipher:

[0069] For the output mixed differential mode of the random permutation, each (semi) byte contains 5 propagation cases, which are represented in ternary code mode, i.e. 000, 010, 100, 001, 101. Among them, there are different probabilities for different mixed differential modes, so that 5 feasible points can be obtained, with the dimension of 5, represented by (c o2 , c o1 , c o0 ) representing the output mixed differential mode, and the probability variable of the output mixed differential mode obtained under the random permutation. Represented as: 00011, 01010, 10010, 00110, 10100.

[0070] Further, the 5 feasible points are represented by linear inequalities, and four linear inequality constraints are obtained, i.e.

[0071]

[0072]

[0073]

[0074]

[0075] Among them, R represents the number of rounds covered by the mixed differential distinguisher, and B represents the upper bound.

[0076] The input mixed differential of the block cipher is restricted to the sum of the probability variables corresponding to the output mixed differential being less than the sum of the probability variables under the random permutation:∑(2ph+pl)+∑ k Δ k <N.

[0077] Further, the restriction comprises:

[0078] For the cipher algorithm using almost-MDS as the column confusion matrix, in order to avoid the invalid difference appearing in the searched mixed differential path, in addition to the constraint on the XOR operation, an additional constraint needs to be added.

[0079] For the Midori algorithm, the column confusion layer therein, when the output difference is 0, the corresponding input difference should also be 0, and when the input difference is non-0 and the output difference is 0, the difference propagation of this part is called invalid difference propagation.

[0080] Therefore, the ternary code representation of the mixed differential propagation mode obtains three linear inequality constraints, wherein j represents the number of the column of the state matrix, and i represents the number of the row of the state matrix, that is:

[0081]

[0082]

[0083]

[0084] When the ternary code is all 0, it represents the mode "-"; at this time, the values of the (semi) byte corresponding to each state matrix in the mixed differential mode are equal; when non-0 appears in the ternary code, it represents other non-0 mixed differential modes. Therefore, the ternary code representation of the output and input difference mode guarantees that any non-0 input difference will not obtain 0 output difference.

[0085] It can be seen from the above scheme that the method of the present application describes the mixed differential propagation property of a byte-level linear permutation layer of a block cipher system into a mixed integer linear programming problem, solves the mixed integer linear programming problem, obtains a high-probability mixed differential distinguisher that can be distinguished from a random permutation, and further greatly reduces the workload and error probability of manually searching for a mixed differential distinguisher.

[0086] Advantages

[0087] Compared with the prior art, the method of the present application realizes automatic searching for a high-probability mixed differential distinguisher for a block cipher using (semi) byte-level permutation as a linear diffusion layer, while the prior art does not have a method capable of automatically searching for a high-probability mixed differential distinguisher for a block cipher using (semi) byte-level XOR operation as a linear diffusion layer. At the same time, the present application is also equally applicable to block ciphers using bit-level permutation and linear diffusion layers constructed by non-maximum distance separable codes. BRIEF DESCRIPTION OF DRAWINGS

[0088] Figure 1 A round function structure diagram of the SPN structure block cipher;

[0089] Figure 2 A diagram of an S-box with w-bit input and output;

[0090] Figure 3 A diagram of the encryption process of the CRAFT lightweight block cipher algorithm;

[0091] Figure 4 A diagram of the encryption process of the Midori lightweight block cipher algorithm;

[0092] Figure 5 A legend and symbolic representation of mixed-differential mode variables;

[0093] Figure 6 A table of feasible differential propagation modes, probabilities, and variable values;

[0094] Figure 7 A flowchart of the method for obtaining a (semi-) byte-level linear diffusion layer block cipher high-probability mixed-differential distinguisher according to the present application;

[0095] Figure 8 A diagram of an example of a 9-round high-probability mixed-differential distinguisher path for the CRAFT block cipher algorithm;

[0096] Figure 9 Inequality constraint parameter point sets for each XOR operation. DETAILED DESCRIPTION

[0097] In order to make the purpose, technical solutions and advantages of the present application clearer and more apparent, the present application is further described in detail below with reference to the accompanying drawings and examples.

[0098] Referring to Figure 7 the present application proposes a mixed-differential byte-level distinguisher search method, which includes the following steps.

[0099] Step 1: Introduce mixed-differential variables for each (semi-) byte in a block cipher using (semi-) byte-level XOR operations as a diffusion layer, and introduce probability variables for each XOR operation.

[0100] Step 2: For each XOR operation, analyze the restrictions on the propagation of input mixed-differential modes to output mixed-differential modes, and assign the restrictions to the mixed-differential variables of each input (semi-) byte and each output (semi-) byte of each XOR operation and the probability variable of each XOR operation with the goal of minimizing the sum of the probability variables of all XOR operations in the block cipher, add restrictions distinguishable from random permutations, and establish a mixed-integer linear programming problem.

[0101] Step 3: Solve the mixed-integer linear programming problem to obtain a mixed-differential distinguisher for the block cipher.

[0102] The present method is further described below in combination with Figure 3 、 Figure 5 、 Figure 8 .

[0103] Step 1: introducing a mix-difference variable to each (half) byte in a block cipher using (half) byte-level XOR operation as a diffusion layer, and introducing a probability variable to each XOR operation.

[0104] wherein the block length of the block cipher using (half) byte-level permutation as a diffusion layer is N bits, the block cipher has R rounds in total, each round has T state matrix elements, and the width of each state matrix element is w; wherein N = T x w, N, T, w are all positive integers, and N is divisible by w.

[0105] As shown in Figure 3 , it is a block cipher round function provided by step 1 using (half) byte-level permutation as a diffusion layer, Figure 3 wherein N = 64, i.e. Figure 3 As shown in Figure 3 , Figure 5 and Figure 8 , each step of the present application is described in detail in combination with the embodiments shown in the drawings.

[0106] Figure 8 In the block cipher shown in the example, R = 9, i.e. there are 9 rounds, each round has three steps, see Figure 1 , Figure 2 and the background art, i.e.

[0107] (1) round key XOR operation;

[0108] (2) S-box confusion operation;

[0109] (3) linear diffusion layer operation.

[0110] S = 16 in each round, i.e. there are 16 S-boxes in each round, and w = 4 for each S-box, i.e. each S-box has 4 input bits and 4 output bits.

[0111] After each round of operation (3), operation (1) of the next round is entered, i.e. 64-bit plaintext is subjected to Figure 3The group cipher shown is encrypted, enters the operation (1) of the 2nd round after the operation (3) of the 1st round, enters the operation (1) of the 3rd round after the operation (3) of the 2nd round, enters the operation (1) of the 4th round after the operation (3) of the 3rd round and so on for multi-round encryption, in which the propagation of the mixed differential mode of the special plaintext constitution and the probability are considered.

[0112] As Figure 3 shown, the linear diffusion layer in each round includes column confusion operation containing 3 XOR operations on each column and nibble permutation on the whole state. The input-output permutation relationship of the nibble permutation is shown in Table 3.

[0113] Table 3: Figure 3 Permutation table of the linear diffusion layer shown

[0114] j 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 P(j) 15 12 13 14 10 9 8 11 6 5 4 7 1 2 3 0

[0115] Figure 3 In the nibble permutation in, the nibble at position 0 is permuted to position 15, the nibble at position 1 is permuted to position 12, the nibble at position 3 is permuted to position 14, the nibble at position 4 is permuted to position 10, the nibble at position 5 is permuted to position 9, the nibble at position 6 is permuted to position 8, the nibble at position 7 is permuted to position 11, the nibble at position 8 is permuted to position 6, the nibble at position 9 is permuted to position 5, the nibble at position 10 is permuted to position 4, the nibble at position 11 is permuted to position 7, the nibble at position 12 is permuted to position 1, the nibble at position 13 is permuted to position 2, the nibble at position 14 is permuted to position 3, and the nibble at position 15 is permuted to position 0.

[0116] Referring to Figure 3 , Figure 8 in the group cipher, for searching 9-round mixed differential distinguisher, the following steps are performed:

[0117] Step 1: define the mixed differential mode variable on the state of each round as follows:

[0118] Input mode:

[0119] (c2 0，0 , c1 0，0 , c0 0，0 ), (c2 0，1 , c1 0，1 , c0 0，1 ), …, (c2 0，15 , c1 0，15 , c0 0，15 ),

[0120] 1st round output mode:

[0121] (c2 1，0 , c1 1，0 , c0 1，0 ), (c2 1，1 , c1 1，1 , c0 1，1 ),..., (c2 1，15 , c1 1，15 , c0 1，15 ),

[0122] Round 2 output pattern:

[0123] (c2 2，0 , c1 2，0 , c0 2，0 ), (c2 2，1 , c1 2，1 , c0 2，1 ),..., (c2 2，15 , c1 2，15 , c0 2，15 ),

[0124] Round 3 output pattern:

[0125] (c2 3，0 , c1 3，0 , c0 3，0 ), (c2 3，1 , c1 3，1 , c0 3，1 ),..., (c2 3，15 , c1 3，15 , c0 3，15 ),

[0126] Round 4 output pattern:

[0127] (c2 4，0 , c1 4，0 , c0 4，0 ), (c2 4，1 , c1 4，1 , c0 4，1 ),..., (c2 4，15 , c1 4，15 , c0 4，15 ),

[0128] Round 5 output pattern:

[0129] (c2 5，0 , c1 5，0 , c0 5，0 ), (c2 5，1 , c1 5，1 , c0 5，1 ),..., (c2 5，15 , c15，15 , c0 5，15 ),

[0130] Round 6 output pattern:

[0131] (c2 6，0 , c1 6，0 , c0 6，0 ), (c2 6，1 , c1 6，1 , c0 6，1 ),..., (c2 6，15 , c1 6，15 , c0 6，15 ),

[0132] Round 7 output pattern:

[0133] (c2 7，0 , c1 7，0 , c0 7，0 ), (c2 7，1 , c1 7，1 , c0 7，1 ),..., (c2 7，15 , c1 7，15 , c0 7，15 ),

[0134] Round 8 output pattern:

[0135] (c2 8，0 , c1 8，0 , c0 8，0 ), (c2 8，1 , c1 8，1 , c0 8，1 ),..., (c2 8，15 , c1 8，15 , c0 8，15 ),

[0136] Round 9 output pattern:

[0137] (c2 9，0 , c1 9，0 , c0 9，0 ), (c2 9，1 , c1 9，1 , c0 9，1 ),..., (c2 9.15 , c1 9，15 , c0 9，15 ),

[0138] The mixed-difference pattern variables defining the intermediate states in each round are defined as follows:

[0139] Round 1 intermediate pattern:

[0140]

[0141] Round 2 Intermediate Mode:

[0142]

[0143] Round 3 Intermediate Mode:

[0144]

[0145] Round 4, Intermediate Mode:

[0146]

[0147] Round 5, Intermediate Mode:

[0148]

[0149] Round 6 Intermediate Mode:

[0150]

[0151] Round 7 Intermediate Mode:

[0152]

[0153] Round 8, Intermediate Mode:

[0154]

[0155] Round 9 Intermediate Mode:

[0156]

[0157] The probability variables for each XOR operation in each round are defined as follows, where the XOR operations in each column are sorted from left to right and from top to bottom:

[0158] Round 1: (ph 0，0 ,pl 0，0 ), ..., (ph 0，m ,pl 0，m ), ..., (ph 0，11 ,pl 0，11 ),

[0159] Round 2: (ph) 1，0 ,pl 1，0 ), ..., (ph 1,m ,pl 1，m ), ..., (ph 1,11 ,pl 1，11 ),

[0160] Round 3: (ph) 2，0 ,pl 2，0 ), ..., (ph2，m , pl 2，m ), …, (ph 2，11 , pl 2，11 ),

[0161] Round 4: (ph 3，0 , pl 3，0 ), …, (ph 3，m , pl 3，m ), …, (ph 3，11 , pl 3，11 ),

[0162] Round 5: (ph 4，0 , pl 4，0 ), …, (ph 4，m , pl 4，m ), …, (ph 4，11 , pl 4，11 ),

[0163] Round 6: (ph 5,0 , pl 5,0 ), …, (ph 5，m , pl 5，m ), …, (ph 5，11 , pl 5，11 ),

[0164] Round 7: (ph 6，0 , pl 6，0 ), …, (ph 6，m , pl 6，m ), …, (ph 6，11 , pl 6，11 ),

[0165] Round 8: (ph 7，0 , pl 7，0 ), …, (ph 7，m , pl 7，m ), …, (ph 7，11 , pl 7，11 ),

[0166] Round 9: (ph 8,0 , pl 8，0 ), …, (ph 8，m , pl 8，m ), …, (ph 8，11 , pl 8，11 ), where (ph i-1，m , pl i-1，m ) denotes the probability variable on the m / 3th column and m%3th XOR operation in the i-th round.

[0167] The probability variables of the output pattern obtained under the random permutation are defined as follows:

[0168]

[0169] where each group of mode variables only takes one of the values 000, 010, 100, 001, 101, representing the mixed differential modes aaaa, abab, abba, aabb and abcd, respectively.

[0170] Step 2: XOR operation for the jth of the ith round.

[0171] Introduce the following inequality constraints:

[0172] For each XOR operation, analyze the propagation restriction of input mixed differential mode to output mixed differential mode, and add inequality constraints to the mixed differential variables and probability variables of each XOR operation with the goal of minimizing the sum of probability variables of all XOR operations in the block cipher, and add restrictions distinguishable from random permutation to establish a mixed integer linear programming problem.

[0173] A. For XOR operation

[0174] Take the constraints on all XOR operations of the rth round as an example:

[0175] The 0th column of the rth round:

[0176] 0th XOR:

[0177]

[0178] 1st XOR:

[0179]

[0180] 2nd XOR:

[0181] a0c2 r-1，4 +a1c1 r-1，4 +a2c0 r-1，4 +a3c2 r-1，12 +a4c1 r-1，12 +a5c0 r-1，12 +a6c2 r，10 +a7c1 r，10 +a8c0 r，10 +a9ph r-1，2 +a 10 pl r-1，2 +a 11 ≥ 0;

[0182] The 1st column of the rth round:

[0183] 0th XOR:

[0184]

[0185] 1st XOR:

[0186]

[0187] 2nd XOR:

[0188] a0c2 r-1，5 +a1c1 r-1，5 +a2c0 r-1，5 +a3c2 r-1，13 +a4c1 r-1，13 +a5c0 r-1，13 +a6c2 r，9 +a7c1 r，9 +a8c0 r，9 +a9ph r-1，5 +a 10 pl r-1，5 +a 11 ≥ 0;

[0189] rth round, 2nd column:

[0190] 0th XOR:

[0191]

[0192] 1st XOR:

[0193]

[0194] 2nd XOR:

[0195] a0c2 r-1，6 +a1c1 r-1，6 +a2c0 r-1，6 +a3c2 r-1，14 +a4c1 r-1，14 +a5c0 r-1，14 +a6c2 r，8 +a7c1 r，8 +a8c0 r，8 +a9ph r-1，8 +a 10 pl r-1，8 +a 11 ≥ 0;

[0196] rth round, 3rd column:

[0197] 0th XOR:

[0198]

[0199] 1st XOR:

[0200]

[0201] 2nd XOR:

[0202] a0c2 r-1，7 +a1c1 r-1，7 +a2c0 r-1，7 +a3c2 r-1，15 +a4c1 r-1，15 +a5c0 r-1，15 +a6c2 r，11 +a7c1 r，11 +a8c0 r，11 +a9ph r-1，11 +a 10 pl r-1，11 +a 11 ≥ 0;

[0203] where r ranges from [0, 9], and parameters a0-a9 are from the inequality point set, see 11 Figure 9 .

[0204] The following inequality constraints are introduced for the output mode variable and the probability variable of the output mode obtained by random permutation:

[0205]

[0206]

[0207]

[0208]

[0209] For the algorithm using the almost maximum distance separable code matrix as the column confusion matrix, the following inequality constraints are introduced for each column confusion operation:

[0210] rth round, ith column:

[0211] First group:

[0212] Second group:

[0213] Third group:

[0214] The objective function is set as:

[0215]

[0216] where Δ = 1 when the mixed differential mode is (a, a, a, a), (a, b, a, b), (a, b, b, a), (a, a, b, b).​k Take 0, when the mixed difference pattern is (a, b, c, d), Δ k Take 1; N represents the probability boundary of the set mixed difference discriminator.

[0217] Step 3: Solve the mixed integer linear programming problem obtained in Step 2 to obtain the values of all variables, obtain the mixed difference discriminator, and its corresponding probability.

[0218] In this example, the searched discriminator is 9 rounds, as shown in Figure 8 The results are as follows:

[0219] The input pattern is: the mode is "-" on the first half byte, the mode is "-" on the second half byte, the mode is "-" on the third half byte, the mode is "-" on the fourth half byte, the mode is "x" on the fifth half byte, the mode is "s" on the sixth half byte, the mode is "-" on the seventh half byte, the mode is "-" on the eighth half byte, the mode is "-" on the ninth half byte, the mode is "-" on the tenth half byte, the mode is "-" on the eleventh half byte, the mode is "-" on the twelfth half byte, the mode is "-" on the thirteenth half byte, the mode is "-" on the fourteenth half byte, the mode is "-" on the fifteenth half byte, and the mode is "-" on the sixteenth half byte.

[0220] The output pattern is: the mode is "c" on the first half byte, the mode is "*" on the second half byte, the mode is "*" on the third half byte, the mode is "*" on the fourth half byte, the mode is "*" on the fifth half byte, the mode is "*" on the sixth half byte, the mode is "c" on the seventh half byte, the mode is "c" on the eighth half byte, the mode is "*" on the ninth half byte, the mode is "*" on the tenth half byte, the mode is "*" on the eleventh half byte, the mode is "*" on the twelfth half byte, the mode is "*" on the thirteenth half byte, the mode is "*" on the fourteenth half byte, the mode is "c" on the fifteenth half byte, and the mode is "*" on the sixteenth half byte.

[0221] The probability is 2 -28 , and the probability of obtaining this output pattern under random permutation is 2 -32 .

[0222] B. About other nonlinear operations and linear operations

[0223] For the nonlinear S-box, the S-box operation is a permutation, and two unequal values are still two unequal values after the S-box permutation, and therefore, the nonlinear S-box operation does not affect the probability calculation for the mode propagation and the probability distribution of the mixed difference mode. Similarly, the remaining linear operations, such as the round key XOR and the row shift, only change the position of the difference mode of each cell and do not change the mixed difference mode of the cell, and therefore, the probability variable does not consider other linear operations.

[0224] So far, the difference propagation mode of the mixed input difference mode and the mixed output difference mode of each cell of each round of the block cipher and the introduced probability variable are given the inequality constraint as described above, aiming to minimize the sum of the probability variables introduced by all XOR operations in the block cipher, to establish a mixed integer linear programming problem.

[0225] Step 3: Solve the above mixed integer linear programming problem to obtain a high-probability mixed difference distinguisher that is distinguishable from a random permutation.

[0226] Regarding the mixed integer linear programming problem, find a set of values of x j that satisfy the formula when 1≤j≤t, so that the formula reaches the minimum value, under the premise that i, j, N, M are positive integers, a ij is any real number, c j is any real number, x j is an integer, and t is an integer greater than or equal to 2 and less than N. The methods for solving this problem include branch and bound method, branch and cut method, cutting plane method, etc.

[0227] It should be noted that the solution of the mixed integer linear programming problem is a known technology in the art.

[0228] The method of the present application introduces a mixed difference variable for each (half) byte in the block cipher using a (semi) byte-level linear diffusion layer, and a probability variable for the XOR operation; for each operation, the restriction of the propagation of the input (half) byte mixed difference mode to the output (half) byte mixed difference mode is analyzed, and the mixed difference variable of each input (half) byte and each output (half) byte of each linear operation and the probability variable of each linear operation are given the restriction, aiming to minimize the sum of the probability variables of all linear operations in the block cipher, and adding a restriction that is distinguishable from a random permutation, to establish a mixed integer linear programming problem; the mixed integer linear programming problem is solved to obtain a mixed difference distinguisher mode. The present application provides an automated method for obtaining a mixed difference distinguisher, which can be used for security evaluation of block cipher resistance to mixed difference analysis, filling the gap of automated security evaluation of block cipher resistance to mixed difference analysis.

[0229] The above description is only the preferred embodiment of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A hybrid differential byte-level discriminator search method, characterized by, The method comprises the following steps: First, for each input byte and each output byte of each state matrix in a block cipher using half-byte level or byte level permutation as a linear diffusion layer, a mixed differential mode coding variable is introduced, and a probability variable is introduced for the XOR operation of each layer of linear diffusion layer, wherein all variables are binary variables, i.e. 0 or 1; Then, for the non-linear layer S-box operation in the encryption process, without generating new coding variables, the sum of the probability variables of all linear diffusion layer XOR operations in the block cipher is minimized, the input half-byte or byte mixed differential coding variable, the output half-byte or byte mixed differential coding variable, and the probability variable of each XOR operation of each round of linear diffusion layer are restricted, and a mixed integer linear programming problem is established; the mixed integer linear programming problem is solved to obtain a mixed differential distinguisher that meets the requirements.

2. The mixed differential byte level distinguisher search method according to claim 1, wherein: The block cipher has a block length of N bits, a total of R rounds, and each round of state matrix contains T half-bytes or bytes, each half-byte or byte has a width of w, wherein N = T * w, N, R, T and w are positive integers, and N is divisible by T; the linear layer of each round of the block cipher is composed of M half-byte level or byte level XOR operations; In a block cipher, the introduced mixed-differential pattern encoding variable at any byte position of the i-th round input state matrix is denoted as , is a short hand for , ; for the case that the output of XOR is not in the state matrix but as an intermediate state, the introduced mixed-differential pattern encoding variable on the intermediate state is , , J is the number of intermediate variables, which is set as follows: If = 0, then it indicates that the hybrid differential mode represented by the nibble or byte is "-"; If = 001, then it indicates that the hybrid differential mode represented by the nibble or byte is "s"; If = 010, then it indicates that the hybrid differential mode represented by the nibble or byte is "c"; If = 100, then it indicates that the mix difference pattern represented by the nibble or byte is "x"; If = 101, then it indicates that the hybrid differential mode represented by the nibble or byte is "*"; If = 0, then it indicates that the mixed difference mode represented by the intermediate state nibble or byte is "-"; If = 001, then it indicates that the hybrid differential pattern represented by the intermediate state nibble or byte is "s"; If = 010, then it indicates that the mixed-difference pattern represented by the intermediate state nibble or byte is "c"; If = 100, then it indicates that the mixed-difference pattern represented by the intermediate state nibble or byte is "x"; If = 101, then it indicates that the mixed difference pattern represented by the intermediate state nibble or byte is "*"; Wherein, the value range of i is from 1 to R+1, the value range of k is from 0 to T-1, and the mixed differential mode of each half-byte or byte in the state matrix is represented by a ternary code; wherein the restriction comprises: for the XOR operation corresponding to the mixed differential mode variable and the mixed differential probability variable, without loss of generality, let the two input mixed differential mode variables be denoted as and , the output mixed differential mode variable is denoted as , and the probability variable is denoted as , , denote the XOR operation input mixed differential mode encoding on both sides respectively, denote the XOR operation output mixed differential mode encoding; denote the probability variable high bit, denote the probability variable low bit; The feasible propagation of the mixed differential mode and the corresponding probability are enumerated, and 50 11-dimensional points are represented by the mixed differential mode variable and the probability variable, representing the feasible values of 9 mode variables and 2 probability variables, and the rules are as follows: The probability is , the variable takes the value (001 001 000 00); The probability is , the variable takes the value (001 001 000 01); The probability is , the variable takes the value (001 100 010 01); The probability is , the variable takes the value (100 100 000 01); The probability is , the variable takes the value (101 101 000 11); The restrictions further include: The feasible point set is characterized by inequalities, each inequality is about 11 mode variables and probability variables corresponding to the current XOR operation, and the above feasible point set is characterized by the following inequalities: ; ; ; ; ; ; ; ; ; ; ; ; ; The restrictions further include: In order to distinguish the mixed differential distinguisher from the random permutation, the sum of the probability variables of the output mode obtained by the random permutation is taken as the upper bound of the sum of the probability variables of the mixed differential distinguisher of the block cipher: For the output mixed differential mode of random permutation, 5 propagation cases are contained on each nibble or byte, expressed in ternary code mode, i.e. 000, 010, 100, 001, 101, wherein for different mixed differential modes, 5 feasible points are expressed by using feasible points, with dimension 5, expressed as representing the output mixed differential mode, expressed as the probability variable of the output mixed differential mode obtained under random permutation; expressed as 00011, 01010, 10010, 00110, 10100; Five feasible points are represented by linear inequalities, and four linear inequality constraints are obtained, i.e. ; ; ; ; Wherein, R represents the number of rounds covered by the mixed differential distinguisher, and B represents the upper bound; The sum of probability variables corresponding to the input mixed differential to the output mixed differential of the limited block cipher is less than the sum of probability variables under the random permutation: ; The restrictions further include: For the cipher algorithm using almost-MDS as the column confusion matrix, in order to avoid invalid differences in the searched mixed differential path, in addition to the constraints on the XOR operation, additional constraints need to be added; For the Midori algorithm, when the output difference is 0, the corresponding input difference should also be 0, and when the input difference is not 0 and the output difference is 0, the difference propagation of this part is called invalid difference propagation. Three linear inequality constraints are obtained using the ternary representation of the mixed difference propagation pattern, where denotes the number of the column of the state matrix, denotes the number of the row of the state matrix, i.e. + + ; + + ; + + ; When the ternary code is all 0, it represents the mode "- ", at this time the values of the half bytes or bytes corresponding to each state matrix in the mixed difference mode are equal, when non-0 appears in the ternary code, it represents other non-0 mixed difference modes; the ternary code representation of the output and input difference mode ensures that any non-0 input difference will not get 0 output difference.

3. The search method of the mixed difference byte-level distinguisher according to claim 1, characterized in that: In block ciphers, any XOR operation can introduce a probability variable represented as , is a positive integer, i.e. the probability of a pattern change due to an XOR operation is , denotes the high bits of the probability variable, denotes the low bits of the probability variable, wherein: If , it means that the probability of input mixed differential mode after XOR operation to get the output mixed differential mode is 1; If , it means that the probability of input mixed differential mode after XOR operation gets output mixed differential mode is ; If , it means that the probability of input mixed differential mode after XOR operation to get output mixed differential mode is ; If , it means that the probability of input mixed differential mode after XOR operation gets output mixed differential mode is ; wherein the value range of i is from 1 to R integer, and the value range of m is from 0 to M-1 integer.

4. The search method of the mixed difference byte-level distinguisher according to claim 1, characterized in that: For mixed integer linear programming problem, under the premise of satisfying find the assignment of a set of satisfying when minimize the formula ; wherein, i, j, N, M are positive integers, is any real number, is any real number, is an integer, t is an integer greater than or equal to 2 and less than N; the solution method includes branch and bound method, branch cutting method cutting plane method.

Images