Method and device for automated security evaluation of block-oriented cryptographic algorithms

Abstract

This invention discloses an automated security assessment method and apparatus for block cipher algorithms. The method includes: obtaining the initial configuration parameters of the cryptographic algorithm to be assessed, the initial configuration parameters of the discriminator, and the number of key recovery rounds, and selecting an analysis scenario and analysis method; constructing an adjacency matrix representing the interdependencies between states and keys during encryption and decryption based on the initial configuration parameters of the cryptographic algorithm to be assessed and the analysis scenario; generating a variable set based on the initial configuration parameters of the discriminator and the number of key recovery rounds; performing pointer operations based on the adjacency matrix to obtain the dependencies between variables in the variable set; constructing an encryption directed graph and a decryption directed graph based on the dependencies between variables in the variable set; and attacking the cryptographic algorithm to be assessed based on the encryption directed graph and the decryption directed graph, combined with the analysis method, to obtain the security assessment result of the cryptographic algorithm to be assessed. This invention can improve the efficiency of security assessment of block cipher algorithms.

Description

Technical Field

[0001] This invention relates to the field of cryptographic algorithm technology, and in particular to an automated security assessment method and apparatus for block cipher algorithms. Technical Background

[0002] Cryptography is a discipline that studies the secure transmission and privacy protection of information. It is an important branch of computer science and has wide applications in information security. The implementation of core security strategies such as access control, authentication, and data encryption all rely on cryptography. Cryptography mainly includes two important branches: cryptographic coding techniques and cryptanalysis techniques. Cryptographic coding techniques primarily study how to use confusion and diffusion principles to thoroughly "scramble" the original plaintext information, obtaining ciphertext information with no logical logic. Typically, the initial sender first uses cryptographic coding techniques to encrypt the original information in a certain way and then sends it to the receiver. The receiver, upon receiving the encrypted information, decrypts it, completing the entire process of secure information transmission. However, because the transmission process involves wired or wireless communication, it is vulnerable to interception. An attacker can steal the encrypted information during transmission and recover the original text without knowing the algorithm; this is called cryptography. Cryptanalysis techniques study the difficulty of breaking a cipher. By analyzing the ease with which useful information can be obtained from intercepted encrypted information in specific cryptographic scenarios, the security of the cipher is assessed. Cryptographic encoding techniques and cryptanalysis techniques complement each other and jointly promote the development of modern cryptography.

[0003] With the emergence of block cipher algorithms, the analysis of specific block cipher algorithms has been continuously advancing, including security research based on mathematical theory (traditional analysis techniques) and security research combining physical implementation (side-channel analysis techniques). Among these, security research based on mathematical theory mainly includes two aspects: First, finding an effective distinguisher for the cryptographic algorithm, distinguishing it from random permutations. In cryptanalysis, for the same indicator, its value under random permutations is first calculated, and then its corresponding value under a specific cryptographic algorithm is calculated. If these two values ​​have a significant difference, then the indicator can distinguish the cryptographic algorithm from random permutations. Specifically, this feature that can distinguish a cryptographic algorithm from random permutations is called the distinguisher of that cryptographic algorithm. In cryptanalysis, if for certain forms of plaintext input, the corresponding ciphertext follows a certain pattern, then an effective distinguisher for the algorithm has been found. Second, key recovery, studying how to obtain the key information of the cryptographic algorithm. For iterative block ciphers, cryptanalysis first finds an effective distinguisher for the simplified round-to-round correspondence algorithm, and then verifies the correctness of the distinguisher by guessing the keys of some rounds other than the distinguisher. If a key guess results in a decrypted value that does not meet the requirements of the discriminator, then that guess is an incorrect key. To date, researchers have proposed numerous cryptanalysis methods, the most important of which are differential cryptanalysis proposed in the 1990s by Israeli cryptographers Biham and Shamir, and linear cryptanalysis proposed by Japanese cryptographer Matsui. These two methods were initially used to evaluate the security of DES and were later extended to evaluate the security of various block cipher algorithms. Even today, differential cryptanalysis and linear cryptanalysis remain the most effective cryptanalysis methods, and resistance to differential cryptanalysis and linear cryptanalysis is a crucial criterion for assessing the security of various block cipher algorithms.

[0004] With the development of cryptanalysis techniques, based on the ideas and techniques employed in differential cryptanalysis and linear cryptanalysis, cryptographers have proposed various cryptanalysis methods, including impossible differential cryptanalysis, integral cryptanalysis, and zero-correlation linear cryptanalysis. Evaluating the ability of block cipher algorithms to resist these attack methods has become a research hotspot for cryptanalysts in recent years. With the widespread application of automated analysis techniques in the field of block cipher algorithm analysis, many mature tools have been developed for searching for distinguishers in block cipher algorithms, such as the SAT / SMT method and the MILP method. However, when evaluating the security of a cryptographic algorithm, the longest distinguisher may not necessarily construct the optimal key recovery process. Therefore, cryptanalysts still need to invest more effort in completing the key recovery process, and constructing the recovery key is somewhat tedious compared to searching for distinguishers. Therefore, if a tool existed that could automatically perform key recovery attacks on a given distinguisher and provide the corresponding attack results, it would bring significant convenience to cryptanalysts.

[0005] To date, while researchers have proposed several automated analysis tools for symmetric cryptography and hash functions, most lack versatility for analyzing block cipher algorithms. On one hand, some tools are designed specifically for analyzing particular cryptographic algorithms, making it difficult to extend them to new algorithmic structures. On the other hand, when assessing the security of block cipher algorithms, cryptanalysts aim to consider as many algorithmic details as possible to achieve more accurate results. However, some algorithmic details are difficult to implement during coding and modify, resulting in many tools being suitable only for specialized cryptanalysts; they are more like computational aids than analytical tools.

[0006] Since the automated search for symmetric cryptographic algorithms can be reduced to solving a system of equations containing many variables, as Shannon described in his groundbreaking 1949 work on the theory of communication in secure systems, the effort required to break a good cipher should be equivalent to solving a system of simultaneous equations with a large number of complex unknowns. However, how to efficiently solve this system of equations remains a problem worthy of further research. Based on this, Bouillaguet et al. (Charles Bouillaguet, Patrick Derbez, and Pierre-Alain Fouque. Automatic search of attacks on round-reduced AES and applications. In Phillip Rogaway, editor, Advances in Cryptology - CRYPTO 2011-31st Annual Cryptology Conference, Santa Barbara, CA, USA, August 14-18, 2011. Proceedings, volume 6841 of Lecture Notes in Computer Science, pages) (169–187. Springer, 2011.) In 2011, Springer proposed a method to solve the system of equations for the AES algorithm using the guess-and-determine and meet-in-the-middle techniques in cryptography. In the guess-and-determine process, to minimize the number of guesses, the authors introduced the idea of ​​a directed acyclic graph (DAG), treating variables as nodes in the graph, and representing a relationship between two variables as an edge between the two nodes. While this method is applicable to both block ciphers and stream ciphers, solving such a system of equations remains difficult if the attack involves too much information.Building upon the work of Bouillaguet et al., at CRYPTO 2016, Derbez et al. (Patrick Derbez and Pierre-Alain Fouque. Automatic search of meet-in-the-middle and impossible differential attacks. In Matthew Robshaw and Jonathan Katz, editors, Advances in Cryptology - CRYPTO 2016 - 36th Annual International Cryptology Conference, Santa Barbara, CA, USA, August 14-18, 2016, Proceedings, Part II, volume 9815 of Lecture Notes in Computer Science, pages 157–184. Springer, 2016) applied an improved meet-in-the-middle technique to this idea of ​​solving equation systems for intermediate meeting analysis and impossible differential cryptanalysis. Furthermore, they introduced modular addition operations into their analysis tool, constructing a public and universal analysis tool for evaluating the security of block cipher algorithms. The approach to this automated analysis is as follows: Given a block cipher algorithm, firstly, based on the characteristics of the algorithm's round function and key arrangement scheme, a corresponding system of equations is constructed. Then, guess-and-determine or meet-in-the-middle techniques are used to solve the equations, and finally, the complexity is calculated. However, this analysis method still has the following problems:

[0007] The system setup process is too complex. During the analysis, for a given block cipher algorithm, the analyst first needs to transform the encryption and decryption process of the algorithm into a corresponding set of equations. For different encryption components, some techniques are required during the construction process, making the entire system setup process quite complex.

[0008] This analysis method is not suitable for probabilistic attacks. Because during the system construction process, whether it is encryption or decryption, the value of the variable propagates with a probability of 1, the authors only used this tool for meet-in-the-middle cryptanalysis, impossible differential analysis, and the search for truncated differential paths.

[0009] In this analysis tool, for the SPN algorithm, since the S-box is a permutation operation, it is difficult to directly express the propagation of the input and output states of the S-box using a system of equations. Therefore, in the previous analysis process, the S-box was treated as a black box.

[0010] Furthermore, as the number of variables increases, solving the entire system of equations becomes more difficult. This method is only applicable to cryptanalysis methods that can be transformed into solving a system of equations, and cannot be extended to difference analysis and linear analysis. Additionally, the solution process for the entire system of equations is not a propagation of values, but rather a propagation of the states corresponding to the variables. That is, if an equation contains four variables, and three of them are known, then the value of the remaining variable is also uniquely determined. Summary of the Invention

[0011] In view of this, the purpose of this invention is to provide an automated security assessment method and apparatus for block cipher algorithms. The method, given a distinguisher, can quickly estimate the complexity required to construct a recovery key using the distinguisher, thereby improving the efficiency of security assessment for block cipher algorithms.

[0012] The technical solution of the present invention includes:

[0013] A security evaluation method for block cipher algorithms, comprising:

[0014] The initial configuration parameters of the cryptographic algorithm to be evaluated, the initial configuration parameters of the discriminator, and the number of key recovery rounds are obtained, and the analysis scenario and analysis method are selected; wherein, the discriminator is used to distinguish the cryptographic algorithm from random permutations, and the analysis methods include: differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero-correlation linear cryptanalysis, and integral cryptanalysis.

[0015] Based on the initial configuration parameters of the cryptographic algorithm to be evaluated and the analysis scenario, an adjacency matrix representing the interdependence between state and key during the encryption and decryption process is constructed.

[0016] Based on the initial configuration parameters of the discriminator and the number of key recovery rounds, a variable set is generated; wherein, the variable set includes: a round function input variable set, a round function output variable set, a round key variable set, and an intermediate variable set;

[0017] Pointer operations are performed based on the adjacency matrix to obtain the dependencies between variables in the variable set;

[0018] Based on the dependencies between variables in the variable set, construct the encryption directed graph and the decryption directed graph;

[0019] Based on the encrypted directed graph and the decrypted directed graph, and combined with the analysis method, the cryptographic algorithm to be evaluated is attacked to obtain the security evaluation result of the cryptographic algorithm to be evaluated.

[0020] Furthermore, the initial configuration parameters of the cryptographic algorithm to be evaluated include: algorithm name, block length, S-box size, number of S-boxes in each round, and master key length.

[0021] Furthermore, the analysis scenario includes: block-based analysis;

[0022] The step of constructing an adjacency matrix representing the interdependence between state and key during encryption and decryption, based on the initial configuration parameters of the cryptographic algorithm to be evaluated and the analysis scenario, includes:

[0023] Construct the relationship matrix V between the output state of the decryption round function of the cryptographic algorithm to be evaluated and the round key and input state. E ; where the relation matrix V E The rows correspond to the output states, and the relation matrix V E The columns correspond to the key state and the input state, and the V of the relation matrix E The size is Sbox Num × (Key Num + Sbox Num), where Sbox Num represents the number of S boxes in each round, and Key Num represents the number of key blocks in the round;

[0024] Construct the relationship matrix V between the output state of the decryption round function of the cryptographic algorithm to be evaluated and the round key and input state. D ; where the relation matrix V D The rows correspond to the output states, and the relation matrix V D The columns correspond to the key state and the input state, and the relation matrix V D The size is Sbox Num × (Key Num + Sbox Num);

[0025] Construct a matrix V representing the relationship between the output state of the round function in the first round of decryption or the last round of encryption in the cryptographic algorithm to be evaluated, and the input state and round key. L , where the relation matrix V L The rows correspond to the output states, and the relation matrix V L The columns correspond to the key state and the input state, and the relation matrix V L The size of Sbox Num × (Key Num + Sbox Num);

[0026] Construct the relation matrix V of the key arrangement scheme of the cryptographic algorithm to be evaluated. K ; where the relation matrix V K The rows correspond to the output states, and the relation matrix VK The columns correspond to the key state and the input state, and the relation matrix V K The size is KeyNum × Key Num;

[0027] Furthermore, the analysis scenario includes: bit-based analysis;

[0028] Construct the relationship matrix V between the output state of the decryption round function of the cryptographic algorithm to be evaluated and the round key and input state. E ; where the relation matrix V E The rows correspond to the output states, and the relation matrix V E The columns correspond to the key state and the input state, and the V of the relation matrix E The size is Cipher Size × (Key Size + Cipher Size), where Cipher Size represents the block size and Key Size represents the length of the master key;

[0029] Construct the relationship matrix V between the output state of the decryption round function of the cryptographic algorithm to be evaluated and the round key and input state. D ; where the relation matrix V D The rows correspond to the output states, and the relation matrix V D The columns correspond to the key state and the input state, and the relation matrix V D The size is Cipher Size × (Key Size + Cipher Size);

[0030] Construct the relation matrix V of the key arrangement scheme of the cryptographic algorithm to be evaluated. K ; where the relation matrix V K The rows correspond to the output states, and the relation matrix V K The columns correspond to the key state and the input state, and the relation matrix V K The size is KeySize × Key Size.

[0031] Furthermore, the acquisition of the key recovery round number includes:

[0032] Based on the initial configuration parameters of the discriminator, determine the position of the discriminator and the number of rounds of the discriminator;

[0033] Based on the attack requirements and the position of the distinguisher, the number of forward expansion rounds and the number of backward expansion rounds are determined to obtain the key recovery rounds; wherein, the sum of the number of rounds of the distinguisher, the number of forward expansion rounds, and the number of backward expansion rounds is less than the total number of rounds of the analyzed cryptographic algorithm.

[0034] Furthermore, the construction of the encryption directed graph and the decryption directed graph based on the dependencies between variables in the variable set includes:

[0035] The root nodes of the encrypted directed graph and the decrypted directed graph are initialized so that the state of the root node of the encrypted directed graph is consistent with the input state of the discriminator, and the state of the root node of the decrypted directed graph is consistent with the output state of the discriminator.

[0036] Starting from the root nodes of the encrypted and decrypted directed graphs, the state variables and key information are guessed based on the dependencies between variables in the variable set. By obtaining the relationships between the associated states and keys, the encrypted and decrypted directed graphs are constructed.

[0037] Furthermore, after constructing the encrypted directed graph and the decrypted directed graph based on the dependencies between variables in the variable set, the process further includes:

[0038] Generate an adjacency matrix between the master key and the round keys based on the key arrangement scheme;

[0039] By using the master key as the input variable of the adjacency matrix and the round key as the output variable of the adjacency matrix, a mutual dependency relationship between the round key and the master key is established.

[0040] Furthermore, the step of attacking the cryptographic algorithm under evaluation based on the encrypted directed graph and the decrypted directed graph, combined with the analysis method, to obtain the security evaluation result of the cryptographic algorithm under evaluation, includes:

[0041] By guessing the key and verifying the encrypted state value, data pairs and keys that satisfy the output state value are selected.

[0042] Based on the data pairs and keys that satisfy the output state values, calculate the data complexity, storage complexity, and computational complexity in the process of recovering the key;

[0043] The security assessment result of the cryptographic algorithm to be evaluated is obtained based on the data complexity, the storage complexity, and the computational complexity.

[0044] A security evaluation device for block cipher algorithms, comprising:

[0045] The data acquisition module is used to acquire the initial configuration parameters of the cryptographic algorithm to be evaluated, the initial configuration parameters of the discriminator, and the number of key recovery rounds, and to select the analysis scenario and analysis method; wherein, the discriminator is used to distinguish the cryptographic algorithm from random permutations, and the analysis methods include: differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero-correlation linear cryptanalysis, and integral cryptanalysis;

[0046] The state analysis module is used to construct an adjacency matrix representing the interdependence between the state and the key during the encryption and decryption process, based on the initial configuration parameters of the cryptographic algorithm to be evaluated and the analysis scenario.

[0047] The variable analysis module is used to generate a variable set based on the initial configuration parameters of the discriminator and the number of key recovery rounds; and to perform pointer operations based on the adjacency matrix to obtain the dependencies between variables in the variable set; wherein, the variable set includes: a round function input variable set, a round function output variable set, a round key variable set, and an intermediate variable set;

[0048] The directed graph building module is used to build encrypted and decrypted directed graphs based on the dependencies between variables in a set of variables.

[0049] The security assessment module is used to attack the cryptographic algorithm to be evaluated based on the encrypted directed graph and the decrypted directed graph, combined with the analysis method, so as to obtain the security assessment result of the cryptographic algorithm to be evaluated.

[0050] A computer device, characterized in that the computer device comprises: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the security assessment method for block cipher algorithms described above.

[0051] In summary, this invention provides a method for security evaluation of block cipher algorithms. Combined with a given discriminator, this method can return the data complexity, time complexity, and storage complexity required for key recovery under fast and exact analysis modes. It efficiently and effectively predicts the longest number of rounds required for key recovery under a given analysis method, thus providing a reference for evaluating the ability of cryptographic algorithms to resist cryptanalysis methods. Furthermore, compared to existing analysis tools, this invention has the following advantages:

[0052] Advantage 1: It is the first to introduce the concept of adjacency matrix, which is used to characterize the relationship between the input and output variables of the encryption components and key arrangement scheme of the cryptographic algorithm. It is simple, clear and universal.

[0053] Advantage 2: In constructing the key recovery attack, the concept of a directed graph is introduced, treating variables as nodes in the graph, and the relationship between variables is represented by the edge between two nodes, which can effectively reduce the number of guesses.

[0054] Advantage 3: Simple operation. In the automated analysis algorithm of this invention embodiment, as long as the corresponding parameters of the algorithm and the information of the discriminator are input, this invention embodiment can select any number of rounds to construct the key recovery process according to the needs of the analysis, and judge the feasibility of the analysis result by the result returned by the algorithm.

[0055] Other features and advantages of the present invention will be set forth in the following description. To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the following embodiments of the present invention will be described by way of example, in conjunction with the accompanying drawings. Attached Figure Description

[0056] Figure 1 This invention provides an implementation framework for an automated security assessment method for block cipher algorithms.

[0057] Figure 2 This invention provides an automated password recovery software design framework for embodiments of the invention.

[0058] Figure 3 This invention provides a software implementation framework for an automated key recovery algorithm.

[0059] Figure 4 This is a matrix showing the relationship between the output state, key, and input state based on the Bit analysis mode provided in this embodiment of the invention.

[0060] Figure 5 This is a matrix showing the relationship between the output state, key, and input state under the Block analysis mode provided in this embodiment of the invention.

[0061] Figure 6 The establishment of the interdependence matrix between round keys provided in the embodiments of the present invention. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] To address the aforementioned technical problems, in one aspect, embodiments of the present invention provide an analytical model for the automated key recovery process of block cipher algorithms, the model comprising:

[0064] 1. Obtaining the interdependencies between input and output variables of the round function during the encryption and decryption processes of a block cipher algorithm. To address this problem, this invention provides a method for describing the interdependencies between various encryption components of a block cipher algorithm. This method primarily utilizes the adjacency matrix, which describes the relationships between vertices and edges in graph theory, to transform the interdependencies between the input and output variables of the encryption and decryption components of the cryptographic algorithm into a binary adjacency matrix. That is: Let F be an encryption component with n-byte (bit) input and m-byte (bit) output, and its input variable be x. i (0≤i≤n-1), the output variable is y. i (0≤i≤m-1). The adjacency matrix of the input and output variables is an n×m 0-1 matrix M, M i，j =1 indicates that y j With x i The value of M is related. i，j =0 indicates that y j The value of x i The value is irrelevant.

[0065] 2. Given a discriminator, this invention addresses the interdependencies between variables in the key recovery process, specifically the forward-expanding decryption process constrained by the discriminator's input state and the backward-expanding encryption process constrained by the discriminator's output state. To resolve this issue, this embodiment of the invention introduces the concept of directed graphs. By constructing a directed graph for forward expansion of decryption and a directed graph for backward expansion of encryption based on a specified discriminator, the interdependencies between variables in the block cipher key recovery process are established. This method effectively transforms the key recovery process into a shortest path search process in graph theory.

[0066] 3. Establish the key recovery process. Based on the encryption and decryption directed graphs, this invention example determines the variable information to be calculated and the key information to be guessed at each step. Based on the characteristics of differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero-correlation linear cryptanalysis, and integral cryptanalysis, corresponding recovery key models are constructed. The model construction process for each analysis method is shown below.

[0067] 3.1 Combining points 1 and 2 of the first aspect, this invention proposes an evaluation model applicable to block cipher algorithms' resistance to differential cryptanalysis under a given differential discriminator. Differential analysis is a cryptanalysis method proposed by Biham and Shamir in 1990 for the DES algorithm. This analysis method belongs to chosen-plaintext attacks and is an important method for analyzing block cipher algorithms. The principle of differential analysis is simple: it utilizes the probability propagation characteristics of plaintext and ciphertext differences to find statistical patterns and thus recover the key. For block cipher algorithms... Given Let x be the plaintext input, k be the encryption key, and α and β be the given input and output difference values, respectively. Then, the differential propagation probability is expressed as:

[0068]

[0069] Given an r-round difference feature Ω = (α0, α1, α2, ..., α... r If the difference probability is 0, then the formula for calculating it is:

[0070]

[0071] Since {0, 1} n The difference propagation probability of the random permutation is 2. -n Therefore, we need to find a path with a probability much greater than 2. _n The differential features, i.e., high-probability differential features, are used to distinguish the algorithm from random permutations, and then a key recovery attack is performed on the algorithm. Assuming the attacker uses the high-probability differential features of round r as a discriminator to recover part or all of the key in round r+1, the steps for constructing the key recovery process under differential cryptanalysis are given below:

[0072] Step 1: Find a high-probability differential feature (α, β) for r rounds, denoted by probability p (p>2). -n );

[0073] Step 2: Uniformly and randomly select N plaintext pairs, such that each plaintext pair satisfies Where N≈c×1 / p, and c is a constant. Under the same unknown key k, X and... After r+1 rounds of encryption, the corresponding ciphertext pair C and... And filter it.

[0074] Step 3: For each possible candidate key gk i Set the corresponding counter λ i The key is initialized to 0. For each obtained ciphertext pair, a round of decryption is performed using the candidate key, and the difference between the decrypted and encrypted versions is calculated. If the decrypted difference Δ = β, then the corresponding counter is incremented by 1. In this step, the variable information that needs to be calculated in this invention (the variable nodes that need to be calculated and guessed in the directed graph of encryption / decryption) is: The key information that needs to be guessed (the key information that the above variable nodes need to know) is gk i .

[0075] Step 4: Select the candidate key value corresponding to the counter whose value is significantly higher than the other counter values ​​as the correct key value.

[0076] Complexity Analysis: In differential cryptanalysis, assuming the differential probability of the discriminator is p, the data complexity m required for the attack is proportional to 1 / p, i.e., m ≈ c·1 / p, where c is a fixed constant representing the expected number of correct pairs in a single guess. The value of c is approximated based on the signal-to-noise ratio. Storage complexity is the sum of the amount of data required to store in each round of key guessing and the storage space occupied by the counter corresponding to each key to be guessed. For cryptographic algorithms containing S-boxes in their round functions, the computational complexity of the key guessing process is estimated by the proportion of S-box calculations in each round to the total number of S-boxes in the entire attack process, determining the number of encryption rounds required. Furthermore, during key guessing, only a portion of the key information can usually be recovered; an exhaustive search is needed for the remaining key information until all key information is recovered. Therefore, the total computational complexity is determined by the computational complexity of each step in the key guessing process and the complexity of the final exhaustive search.

[0077] 3.2 Combining points 1 and 2 of the first aspect, this invention proposes an evaluation model for the resistance of block cipher algorithms to linear cryptanalysis under a given linear approximation. Linear cryptanalysis was first proposed by Japanese scholar Matsui at the 1993 European Cryptography Conference, where he also used it to evaluate the security of DES. Unlike differential cryptanalysis, linear cryptanalysis is a known-plaintext attack method. It distinguishes block cipher algorithms from random permutations by finding an effective linear approximation expression between the plaintext and ciphertext, and then performs key recovery based on this. Similar to differential cryptanalysis, in linear cryptanalysis, the linear discriminator with the largest deviation is found by constructing mask propagation rules for different components of the block cipher algorithm. The following will briefly introduce how to construct the corresponding key recovery process using the found discriminator. Suppose that for a block cipher algorithm, we find an r-1 round linear approximation (α, β) where the linear probability LP(α, β) ≠ 0, i.e., the deviation ε(α, β) ≠ 0. Then, using this linear approximation expression, we can distinguish the r-1 round encryption algorithm from random permutations. This linear discriminator can then be used to recover the key from the block cipher algorithm. Assuming we use an r-1 round linear discriminator to obtain the round key (or partial bits) for r rounds, the key recovery steps are as follows:

[0078] Step 1: Find a linear approximation expression (α, β) for r-1 rounds, with a deviation of ε, such that |ε(α, β)| is large.

[0079] Step 2: Based on the output of the discriminator, the cryptanalyst determines the round key k to be recovered for the r-th round. r (or a portion thereof) Let the amount of key the cryptanalyst possess be l, for each possible candidate key gk i , 0≤i≤2 l -1, set the corresponding 2l counters Initialize and clear.

[0080] Step 3: Uniformly and randomly select plaintext P and encrypt it using the same unknown key k to obtain the corresponding ciphertext C. The number of plaintexts selected here is m ≈ c·1 / ε. 2 c is a certain constant.

[0081] Step 4: For each ciphertext C, use the round key gk from each guess in the r-th round. i (or a portion of the bits) is the correct key value obtained during the recovery key process.

[0082] Complexity Analysis: Similar to differential analysis, linear cryptanalysis essentially falls under the category of statistical analysis. Therefore, the choice of data complexity is related to the deviation of the linear approximation expression. Assuming the deviation of the linear approximation expression corresponding to a linear discriminator is ε, then the data complexity m required in the key recovery process is related to 1 / ε. 2 Proportional, i.e., m≈c·1 / ε 2 , where c is a constant, and the choice of c is related to the probability of successfully recovering the key. Therefore, in linear cryptanalysis, to make the constructed attack effective, 1 / ε 2 <2 n That is, ε>2 -n / 2 Linear cryptanalysis is a cryptanalysis method based on known plaintext. During key recovery, the corresponding ciphertext is decrypted by guessing the key, and the decrypted data is then fed into the linear approximation expression corresponding to the linear discriminator to determine whether the left-hand side of the expression is 0 or 1. Therefore, for each key, two counters are required. and If the value obtained by substituting the data obtained from guessing the key into the left side of the linear approximation expression is 0, then... Add 1; otherwise Add 1. Finally, choose the option that makes The key with the largest value is selected as the candidate key. Therefore, assuming that ω bits of key information need to be guessed during the key guessing process, the required data complexity is 2^n. N The storage complexity of linear cryptanalysis is then the storage complexity of storing all 2×2... ω The space required for an N-bit counter. The computational complexity of linear cryptanalysis is calculated similarly to that of differential cryptanalysis, and will not be described in detail here.

[0083] 3.3 Combining points 1 and 2 of the first aspect, this invention proposes an evaluation model for the resistance of block cipher algorithms to impossible differential cryptanalysis given an impossible differential discriminator. Unlike differential cryptanalysis, which searches for a high-probability differential path, impossible differential cryptanalysis evaluates an algorithm's resistance to differential cryptanalysis methods by using a differential path with a probability of 0 as a discriminator. Typically, an intermediate staggered approach is used to search for impossible differential paths. With the widespread application of automated analysis tools in cryptanalysis, the search for impossible differential paths has become increasingly sophisticated and efficient. The following describes how to construct the corresponding key recovery using a known impossible differential discriminator for a block cipher algorithm.

[0084] Step 1: Find an impossible difference path α0→α in r-1 rounds r-1 ;

[0085] Step 2: Find plaintext pairs with a difference of α0 And perform r rounds of encryption, the ciphertext is denoted as

[0086] Step 3: Guess the round key k for the r-th round. r The possible values ​​are determined by using the guessed key to test C and... Decrypting in one round, the intermediate value is denoted as D and judge Check if the key is valid; if it is valid, the corresponding key guess value is an incorrect key.

[0087] Step 4: Repeat the above steps to determine the unique and correct key value.

[0088] Complexity Analysis: When evaluating the ability of block cipher algorithms to resist impossible differential cryptanalysis, this embodiment of the invention utilizes the Early-Abort technique proposed by Lü Jiqiang et al. in their analysis of the security of the Camellia and Misty1 algorithms. The basic idea is to divide the key into several parts to reduce the amount of key required for a single guess. The attacker first guesses a portion of the unknown key, performs partial decryption, and then checks whether the obtained partial information meets the requirements of impossible differential cryptanalysis. Only the guessed key that meets the requirements is retained. Based on this, the remaining part of the key is guessed, and the above checks are repeated. Since each part can filter out some erroneous keys, the number of candidate keys is reduced, thus lowering the complexity of the attack. Regarding data complexity, assuming that m bits are active in the plaintext information used to construct the key recovery process, during the attack, to recover as much key information as possible, N data structures are typically needed, and the values ​​in each data structure iterate through all active bits in the plaintext information, with the remaining bits being constants. Therefore, the data complexity should be 2^n. N+m+1 Total composition 2 N+2m-1There are 2 data pairs, where N is chosen based on the number of keys that can be filtered out during the key guessing process. Assume that after filtering the data pairs during the key guessing process, the amount of data used in the final step is 2. N+s For a guessed key, the probability that a pair of data will not be filtered is 2. -t Therefore, the analyst expects N to be chosen such that at least 1 bit of key information is filtered out during the key guessing process, that is:

[0089]

[0090] Right now:

[0091]

[0092] Therefore, the value of N can be determined by determining the number of keys that are filtered out during the key guessing process, and from this, the storage complexity and computational complexity required for the key recovery process can be further determined.

[0093] 3.4 Combining points 1 and 2 of the first aspect, this invention proposes an evaluation model for the resistance of block cipher algorithms to zero-correlation linear cryptanalysis under a given zero-correlation linear discriminator. Zero-correlation linear cryptanalysis, as the dual technique of impossible differential cryptanalysis in the field of linear analysis, constructs a linear approximation expression with a probability of 1 / 2 by discussing the propagation properties of linear masks in block cipher algorithm components; that is, a linear approximation with zero correlation. Based on the linear approximation expression with zero correlation, block cipher algorithms can be distinguished from random permutations, thereby enabling key recovery. Since the probability of zero correlation for a nontrivial linear approximation on an n-bit permutation function is approximately... Where n≥5. Therefore, during the key recovery process, the probability of a random permutation misjudgment in a block cipher algorithm is: However, this discriminator will not misjudge a block cipher algorithm as a random permutation. During key recovery, the algorithm can be considered a random permutation under incorrect key guessing.

[0094] Complexity Analysis: The existence of zero-correlation linear approximation in block cipher algorithms reflects the non-random nature of their mathematical structure. Based on this, a discriminator can be constructed to distinguish between block cipher algorithms with correct key guesses and random permutations with incorrect keys. This distinction requires calculating the correlation of a given linear approximation expression based on the obtained plaintext and ciphertext pairs. A common method is to iterate through all plaintexts and obtain the corresponding ciphertexts to calculate the correlation of the corresponding linear approximation expression. Therefore, in zero-correlation linear cryptanalysis, the required data complexity is the entire codebook, i.e., 2^n. Since the counter can be reused during key guessing, only an n-bit counter is needed during key recovery to verify whether the zero-correlation relationship is satisfied under the guessed key. Therefore, the storage complexity is n bits, equivalent to one block length. The estimation of the computational complexity of zero-correlation linear analysis is similar to that of linear analysis and will not be detailed here.

[0095] 3.5 Combining points 1 and 2 of the first aspect, this invention proposes an evaluation model for the resistance of block cipher algorithms to integral cryptanalysis under a given integral discriminator. Integral cryptanalysis is a new cryptanalysis method proposed by Knudsen based on his summary of Square's security analysis, saturation analysis, and multiset analysis. The integral discriminator uses a set (or multiset) of plaintext to be selected, where some bits of the plaintext are fixed constants, while the remaining bits iterate through all possible values. The key to integral cryptanalysis is finding the integral discriminator, i.e., selecting a specific form of plaintext for encryption to obtain the corresponding ciphertext. The non-randomness of the ciphertext integral distinguishes the cryptographic algorithm from random permutations. Then, all erroneous keys are eliminated by verifying whether the decrypted data set satisfies the output characteristics of the integral discriminator. Unlike differential analysis, integral cryptanalysis generally does not involve selecting ciphertext or counting keys; it only requires that keys that fail the detection are erroneous keys, thus allowing the correct key to be directly recovered using an elimination method. The key recovery process for recovering the key from round r+1 using an r-round integral discriminator is shown below:

[0096] Step 1: Find the integral distinguisher for the r-th round;

[0097] Step 2: Based on the found integral discriminator, select the set of plaintext that satisfies the input features of the discriminator, and perform r+

[0098] One round of encryption yields the corresponding set of ciphertext.

[0099] Step 3: Guess the key for the (r+1)th round and use the key to decrypt the ciphertext obtained in Step 2 in one round. Determine whether the decrypted data set satisfies the output characteristics of the integrator. If it does not, the key is an incorrect key and is discarded.

[0100] Step 4: Repeat the above steps until all incorrect keys are eliminated and the correct key is obtained.

[0101] Complexity Analysis: In integral cryptanalysis, ciphertext is decrypted by guessing the key. Any key that fails the detection test is an incorrect key, and the correct key can be recovered using an elimination method. In integral cryptanalysis, the data complexity required for a given integral discriminator is determined by the number of bits traversed to produce the balanced input. The number of keys that can be recovered is determined by the number of data structures required in the entire key recovery process and the number of balanced bits in the discriminator's output state. Therefore, the process of recovering the key for a block cipher algorithm using integral cryptanalysis is similar to a shortest path optimization problem, minimizing the number of nodes that need to be stored for each guess. The principles of storage and computational complexity in integral cryptanalysis are similar to those in differential cryptanalysis, so they will not be explained in detail here.

[0102] On the other hand, embodiments of the present invention provide software suitable for security evaluation of block cipher algorithms, the software comprising the following modules:

[0103] 1. Configure the parameters of the block cipher algorithm. This process requires the user to provide various parameters of the block cipher algorithm, the adjacency matrix of the encryption round function, the adjacency matrix of the decryption round function, and the adjacency matrix of the key arrangement scheme according to the software input requirements. The construction of the adjacency matrix is ​​based on the first item of the first aspect.

[0104] 2. Select the analysis mode. This process requires the user to choose between block-based or bit-based analysis based on the encryption and decryption characteristics of the block cipher algorithm being analyzed and the features of its key arrangement scheme. If the analyzed cryptographic algorithm is based on block encryption, such as Midori, then select the block-based analysis mode; if the analyzed cryptographic algorithm is based on bit encryption, such as GIFT, then select the bit-based analysis mode.

[0105] 3. Determine the analysis method. This process requires the user to select one analysis method from differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero-correlation linear cryptanalysis, and integral cryptanalysis, and configure the parameters of the discriminator, including the number of input rounds and output rounds of the discriminator, the input state value, the output state value, and the number of rounds to extend the discriminator forward and backward during the key recovery process.

[0106] 4. Selecting the type of analysis. In the analysis model of this invention, for each analysis method, there are two analysis models: fast analysis and precise analysis. The fast analysis model does not consider the details of the key arrangement scheme during the key recovery process. Assuming that each round of keys is independent, it quickly provides an upper bound for the complexity estimate under this security analysis model. The precise analysis model, on the other hand, considers the specific details of the key arrangement scheme and uses the adjacency matrix of the key arrangement scheme to characterize the interdependencies between round keys. It can more accurately estimate the complexity in the key recovery process and provide a theoretical basis for the security evaluation of the algorithm.

[0107] 5. Calculation and Evaluation Module: Based on the theoretical models of the five cryptanalysis methods introduced in Section 3 of the first aspect, this module technically implements the key recovery process and complexity estimation, outputs the details of key recovery and the complexity estimate, and evaluates the ability of the cryptographic algorithm to resist the cryptanalysis method based on the complexity value.

[0108] Specifically Figure 1 This provides an overall framework for implementing automated security assessment methods for block cipher algorithms. For example... Figure 1 As shown, this invention provides a security assessment method for automatically recovering keys from block cipher algorithms using five analysis methods: differential analysis, impossible differential analysis, linear analysis, zero-correlation linear analysis, and integral analysis, given an existing discriminator. Through this invention, the ability of a block cipher algorithm to resist these analysis methods can be quickly determined based on a given discriminator.

[0109] Figure 2 The basic framework for the software layer implementation of this invention embodiment is given below. The following will combine... Figure 1 and Figure 3 The diagram illustrates the implementation principle of the evaluation device, using the GIFT-64 and Midori-64 block cipher algorithms as examples.

[0110] Step S102. Receive the initial configuration parameters of the cryptographic algorithm to be evaluated, including the data storage address identifier and the implementation level of the cryptographic algorithm. For example, for a block key algorithm with a round function based on an SPN structure, this embodiment of the invention requires providing the data storage identifier of the algorithm, including the "algorithm name," and the implementation level of the cryptographic algorithm, including information such as "block length," "master key length," and "number and size of S-boxes." The initial configuration parameters of GIFT-64 are shown below.

[0111] struct BlockCipherDescribe

[0112] {

[0113] char cipher_name[cipher_name_size] = "GIFT-64"; / / Name of the block cipher algorithm

[0114] int cipher_size = 64; / / Group length

[0115] int sbox_size = 64; / / Size of the S-box

[0116] int sbox_num = 16; / / Number of S-boxes in each round

[0117] int key_size = 128; / / Length of the master key

[0118] };

[0119] Step S104. Based on the initial configuration parameters, construct the interdependencies between the encryption round function, decryption round function, and input and output variables of the key arrangement scheme of the cryptographic algorithm.

[0120] When using this device to perform security analysis on a given cryptographic algorithm, the correct description of the algorithm's encryption and decryption process has a very important impact on the final analysis results. Therefore, it is crucial to convert the interdependence between the state and the key in the encryption and decryption process of an algorithm into a model that the software can recognize. Figure 4 The diagram shows the construction of the adjacency matrix in Bit analysis mode using block cipher algorithms based on SPN and Feistel structures. Figure 5 This represents the construction of the adjacency matrix in Block analysis mode for block cipher algorithms based on the SPN structure. Figure 6 This describes the process of establishing an adjacency matrix between round keys according to a key arrangement scheme. In the software implementation, this corresponds to the RelationMatrix_xxx.c++ / h module. The following embodiment of the invention provides a detailed explanation of the definition and input format of the adjacency matrix.

[0121] `EncRoundFunctionRM` represents the relationship matrix between the output state, input state, and round key of the algorithm's encryption round function. Rows correspond to the output state, and columns correspond to the key and input states. For bit-based analysis, the size of the relationship matrix is ​​`Cipher Size × (Key Size + Cipher Size)`; for block-based analysis, the size is `Sbox Num × (Key Num + Sbox Num)`, where `Sbox Num` represents the number of S-boxes in the round function, and `Key Num` represents the number of round key blocks. Input matrices are arranged row-wise, separated by commas, and terminated with a comma.

[0122] DecRoundFunctionRM: Represents the relationship matrix between the output state of the algorithm's decryption round function and the round key and input state. Rows correspond to the output state, and columns correspond to the key state and input state. For bit-based analysis, the size of the relationship matrix is ​​Cipher Size × (Key Size + Cipher Size); for block-based analysis, the size is Sbox Num × (Key Num + Sbox Num). Input matrices are arranged row-wise, separated by commas, and terminated with a comma.

[0123] LastDeccRoundFunctionRM: In block cipher algorithm design, the final round typically only performs non-linear operations, omitting the preceding operations. Therefore, this invention uses this matrix to represent the relationship between the output state, input state, and round key of the first round (the round function of the final round in the encryption process) during the algorithm's decryption process. Rows correspond to the output state, and columns correspond to the key state and input state. For bit-based analysis, the size of the corresponding relationship matrix is ​​Cipher Size × (Key Size + Cipher Size); for block-based analysis, the size is Sbox Num × (Key Num + Sbox Num). Input matrices are arranged row-wise, separated by commas, and terminated with a comma.

[0124] KeyScheduleRM: Represents the key arrangement scheme relation matrix, where rows correspond to output states and columns correspond to input states and key states. For bit-based analysis, the relation matrix size is Key Size × KeySize; for block-based analysis, the relation matrix size is Key Num × Key Num. Input matrices are arranged row-wise, with data separated by commas and ending with a comma.

[0125] Step S106. Select the analysis scenario and analysis method, where the analysis scenario includes bit-based analysis and block-based analysis, such as... Figure 2 As shown, each analysis scenario includes five analysis methods supported by this device, including integral analysis, difference analysis, linear analysis, impossible difference analysis, and zero-correlation linear analysis. Each analysis method corresponds to a structure for storing the parameters under that analysis, as shown below:

[0126] struct Differential; / / Difference analysis

[0127] struct Linear; / / Linear analysis

[0128] struct ImpossibleDifferential; / / Impossible difference analysis

[0129] struct ZeroCorrelationLinearApprox; / / Zero-correlation linear analysis

[0130] struct Integral; / / Integral analysis

[0131] Step S108. Receive the configuration parameters of a given discriminator, including the starting round number and input state values ​​of the discriminator, the ending round number and corresponding output state values, and other parameters characterizing the features of the analysis method. For example, in differential analysis, the input parameters of the discriminator are as follows:

[0132] struct Differential

[0133] {

[0134] int input_round_index; / / Index of the round number input to the discriminator, round numbers are counted starting from 0.

[0135] int*input_distinguisher; / / Input difference of the discriminator

[0136] int input_information_size; / / The amount of information contained in the input difference of the discriminator.

[0137] int*output_distinguisher; / / Output difference of the discriminator

[0138] int output_round_index; / / Index of the round number output by the discriminator

[0139] int output_information_size; / / The amount of information contained in the output difference of the discriminator.

[0140] double probability; / / Difference probability

[0141] };

[0142] In differential and impossible difference analysis, if the input and output difference correspond to a specific value, then the information content contained in the input and output difference is 2. 0 =1, that is, input_information_size = 0; If the given discriminator is truncated, that is, the position of "0" in the input difference indicates that the corresponding state is inactive, and "1" indicates that the corresponding state is active, then the amount of information contained in the input and output differences is w. in and w out , where w in and w out These correspond to the weights of the input and output differences, respectively. Similarly, in linear analysis and zero-correlation linear analysis, they correspond to the mask information. Furthermore, in differential analysis, probability represents the difference probability corresponding to the discriminator, while in linear analysis, bias represents the deviation of the linear approximation expression corresponding to the discriminator. Specifically, for an integral discriminator, "0" in the input represents stable bits and "1" represents active bits, while "0" in the output represents unknown and "1" represents balanced bits, where balanced_bits is the number of balanced bits. Additionally, in integral cryptanalysis, it is necessary to specify the number of balanced bits in the discriminator's output state used in the key recovery process and whether the discriminator's structure is cyclic.

[0143] Step S110. Determine the number of rounds for key recovery. In the key recovery process, given a discriminator, this embodiment of the invention obtains the model required for key analysis by expanding both sides of the discriminator. Therefore, after determining the position of the discriminator, it is necessary to determine the number of forward and backward expansion rounds. In the algorithm implementation, this embodiment of the invention uses `header_extended_round` to represent the number of forward expansion rounds and `trail_extended_round` to represent the number of backward expansion rounds. This parameter can be arbitrarily changed according to the attack requirements. Finally, the effectiveness of the attack is determined based on the program's output. Additionally, `total_key_round` represents the number of round keys required during the attack. For example, the encryption process of the Midori64 algorithm alternates between the 128-bit master key k0 and k1, so the number of round keys is 2. When performing a 19-round differential attack on the GIFT-64 algorithm, each round requires an XOR operation of the round keys, so the master key needs to undergo 19 rounds of iteration; therefore, `total_key_round` = 19.

[0144] Step S112. Variable Declaration: Based on the initial configuration parameters of the cryptographic algorithm and the number of rounds for key recovery, generate the input variable set, output variable set, round key variable set, and intermediate variable set for the round function. Each variable set corresponds to an array, and each element in the array corresponds to a structure. The parameter information contained in each structure is shown below.

[0145] struct individual

[0146] {

[0147] char individual_name[individual_name_size];

[0148] int is_relation;

[0149] int is_known;

[0150] int connect_num;

[0151] struct individual*connect_name[child_max_num];

[0152] int child_state_num;

[0153] struct individual*child_state_name[child_max_num];

[0154] int child_key_num;

[0155] struct individual*child_key_name[child_max_num];

[0156] };

[0157] For each variable named individual_name[individual_name_size], it contains all of the following information:

[0158] int is_relation: This is used to mark whether the variable is related to the key recovery process. If it is related, is_relation = 1, otherwise it is 0.

[0159] int is_known: This is used to mark whether the variable was known during the key recovery process. If it was known, is_known = 1, otherwise it is 0.

[0160] int connect_num: Represents the number of other variables that are related to this variable during the key recovery process;

[0161] struct individual*connect_name[child_max_num]: Used to record other variables related to this variable during the recovery key process;

[0162] int child_state_num: Represents the number of input and output variables related to this variable during the key recovery process;

[0163] struct individual*child_state_name[child_max_num]: Used to record input and output variables related to this variable;

[0164] int child_key_num: Represents the number of round keys associated with this variable during the key guessing process;

[0165] struct individual*child_key_name[child_max_num]: Used to record key variables related to this variable during the key guessing process.

[0166] Step S114. Establish the dependencies between variables. Based on the adjacency matrix and the generated variable set, the dependencies between the input and output variables represented by the adjacency matrix are expressed as relationships between symbolic variables through pointer operations. That is, assuming that by traversing the values ​​corresponding to the rows and columns of the adjacency matrix, the value of the output variable node y0 depends on the values ​​of the input variable nodes x0 and x1 and the value of the key k0, then for the structure individual_name = y0, y0.connect_name = {x0, x1, k0}, y0.child_state_name = {x0, x1}, and y0.child_key_name = {k0}.

[0167] In addition to establishing the relationships between state variables, this embodiment of the invention also needs to establish the interdependence between the round keys and the master key, since the influence of the algorithm's key arrangement scheme needs to be considered during the key recovery process. Similar to the process of establishing state relationships, this embodiment first needs to generate an adjacency matrix between the master key and the round keys based on the algorithm's key arrangement scheme. Then, the master key is used as the input variable of the adjacency matrix, and the round keys are used as the output variable of the adjacency matrix to establish the relationships between the keys. Specifically, in the algorithm implementation process, it is necessary to first establish directed encryption and decryption graphs, and then establish the relationships between the keys.

[0168] Step S116. Generate a directed encryption / decryption graph. Based on the interdependencies between variables and the configuration parameters of the discriminator, automatically filter the input variable set, output variable set, and key variable set participating in the entire key recovery process, and establish a directed encryption and decryption graph showing the interdependencies between variables.

[0169] The key recovery process in block cipher algorithms can generally be divided into three parts: the discriminator in the middle r0 rounds, the encryption process extending forward r1 rounds, and the decryption process extending backward r2 rounds. In the process of establishing the relationship between variables based on the adjacency matrix, this embodiment of the invention establishes the propagation relationships of the states in the forward r1 rounds and the backward r2 rounds, respectively. However, before constructing the entire r0+r1+r2 round key recovery process, it is necessary to first associate the number of forward and backward expansion rounds with the given discriminator. Therefore, before establishing the directed graphs for encryption and decryption, this embodiment of the invention needs to initialize the root nodes of the directed graphs for encryption and decryption, ensuring that the state of the root node of the encrypted directed graph is consistent with the input state of the discriminator, and the state of the root node of the decrypted directed graph is consistent with the output state of the discriminator. For example: Suppose that the input difference of a 3-round differential divider for a toy cipher is (0, 0, 1, 0) and the output difference is (0, 0, 0, 1). If the differential divider is extended forward by 1 round and backward by 2 rounds to construct a 6-round differential attack, then the root node of the encrypted directed graph is initialized to x1[2].is_relation=1, while the root node of the decrypted directed graph is initialized to x3[3].is_relation=1, and the is_relation of the other nodes is 0.

[0170] After initializing the root node, this embodiment of the invention will next explain the approach to building the decryption directed graph by utilizing the decryption strategy of a 6-round integral discriminator in the Midori64 algorithm for a 9-round key recovery attack. The construction of the encryption directed graph is similar and will not be described in detail here.

[0171] Because the output state of the integrator in the 6 rounds of the Midori64 algorithm only has The corresponding positions are balanced. Based on the principle of integral attacks, this embodiment of the invention requires continuous key guessing during the key guessing process, making... in, The state unit with index 0 represents the output state of the 6th round of the ith ciphertext. Therefore, during the initialization of the root node of the decrypted directed graph, this embodiment of the invention sets... and Based on the characteristics of the algorithm's round function, during the decryption process, the state... The value is determined by the output state of round 7. The value is obtained through the AddRoundKey, MixColumn, ShuffleCell, and SubCell operations. Therefore, according to the principle of the algorithm implementation in this embodiment of the invention, And make the state If is_relation = 1, then proceed to the next round of state association determination. The final result is the decryption directed graph shown below, along with the set of key variables associated with each state variable.

[0172]

[0173] Step S118. Execute the key recovery process, output the details of the guessed key at each step, and return the complexity calculation result to evaluate the cryptographic algorithm's ability to resist this attack method.

[0174] In block cipher analysis, the security of a block cipher algorithm is typically evaluated by the total computational complexity, which includes the data complexity and storage complexity required for key recovery, the computational complexity required for each step of key guessing, and the computational complexity required for the final exhaustive search of the key. In the algorithm implementation, this embodiment of the invention uses the following structure to store the complexity information.

[0175] struct AttackComplexity

[0176] {

[0177] doubledata_complexity; / / Data complexity

[0178] double computation_complexity; / / computational complexity

[0179] double storage_complexity; / / Storage complexity

[0180] double exhaustive_complexity; / / Exhaustive search complexity

[0181] double is_valid_attack; / / A scalar marker used to determine whether an attack is valid.

[0182] };

[0183] Then, the key recovery process and complexity calculation are performed in this embodiment of the invention. Although the key recovery process in this embodiment involves five different analysis methods—differential analysis, linear analysis, impossible differential analysis, zero-correlation linear analysis, and integral analysis—the key guessing process involves guessing the key and verifying the encrypted state value, then filtering out data pairs and keys that satisfy the output state value. The entire process can be viewed as a "guess-verify-filter" process. For different attack methods, the complexity calculation and processing can be referred to Part 3 above. The following embodiment of the invention will first describe the several modules included in the key recovery algorithm implementation.

[0184] Round Key Update Module: In this embodiment of the invention, after each key guess, the state of all keys in the entire key set needs to be updated according to the key arrangement scheme to determine whether they are known. For example, when performing 18 rounds of differential analysis on the GIFT-64 algorithm, if this embodiment of the invention guessed the key in the first round... If the value is , then let This indicates that the value of this key is known; at the same time, it can be known from the key arrangement scheme. After 16 rounds of updates and iterations, it became Therefore, it is obtained from the key update function. express Since it is known, there is no need to make repeated guesses.

[0185] Complexity Integration Module: In the key guessing process of this embodiment, after each round of encryption or decryption, the number of keys to be guessed, the number of S-boxes passed through, the amount of data to be stored, and the amount of remaining data after filtering are all calculated. Therefore, each guessing step corresponds to a storage complexity and a computational complexity. The final total complexity is the sum of the complexities required for each step. These two functions are used to calculate the total complexity. Since the difference between the exponents of two powers with the same base is greater than 5, this embodiment considers the influence of the smaller exponent on the larger exponent to be negligible. Therefore, in the calculation process, this embodiment only considers the sum of all numbers whose exponents differ from the maximum value by no more than 5. For example, the computational complexity of each step after extending an algorithm by 4 rounds is 2. 50 ,2 54 ,2 58 ,2 48 The total computational complexity is then...

[0186] Attack Model Construction Module: In this module, this embodiment of the invention constructs a corresponding key recovery model based on the number of forward and backward expansion rounds in step S110. During each round of key guessing, this embodiment of the invention uses the established encrypted and decrypted directed graphs to determine whether the is_relation of each node is 1. If it is 1, the state node in the corresponding child_state_name is recovered, and the key information in the corresponding child_key_name is guessed. The ciphertext filtering exponent is determined by the changes in the input and output variables in each round. Finally, based on the characteristics of each analysis method, the data complexity, storage complexity, and total computational complexity required in the key recovery process are determined.

[0187] For example, using the security analysis method proposed in this embodiment of the invention, the following five-round impossible differential discriminator for the Midori-64 block cipher algorithm is analyzed: This invention embodiment, through analysis, shows that the discriminator can be used to construct a key recovery process for a maximum of 10 rounds. Specifically, extending the discriminator forward by 2 rounds and backward by 3 rounds results in a data complexity of 2^32 for key recovery. 61 The storage complexity is 2. 88.46 The time complexity is 2^30000 blocks. 117 .

Claims

1. A security evaluation method for block cipher algorithms, characterized in that, The method includes: The initial configuration parameters of the cryptographic algorithm to be evaluated, the initial configuration parameters of the discriminator, and the number of key recovery rounds are obtained, and the analysis scenario and analysis method are selected; wherein, the discriminator is used to distinguish the cryptographic algorithm from random permutations, and the analysis methods include: differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero-correlation linear cryptanalysis, and integral cryptanalysis. Based on the initial configuration parameters of the cryptographic algorithm to be evaluated and the analysis scenario, an adjacency matrix representing the interdependence between state and key during the encryption and decryption process is constructed. Based on the initial configuration parameters of the discriminator and the number of key recovery rounds, a variable set is generated; wherein, the variable set includes: a round function input variable set, a round function output variable set, a round key variable set, and an intermediate variable set; Pointer operations are performed based on the adjacency matrix to obtain the dependencies between variables in the variable set; Based on the dependencies between variables in the variable set, construct the encryption directed graph and the decryption directed graph; Based on the encrypted directed graph and the decrypted directed graph, and combined with the analysis method, the cryptographic algorithm to be evaluated is attacked to obtain the security evaluation result of the cryptographic algorithm to be evaluated.

2. The method as described in claim 1, characterized in that, The initial configuration parameters of the cryptographic algorithm to be evaluated include: algorithm name, block length, S-box size, number of S-boxes in each round, and master key length.

3. The method as described in claim 2, characterized in that, The analysis scenarios include: block-based analysis; The step of constructing an adjacency matrix representing the interdependence between state and key during encryption and decryption, based on the initial configuration parameters of the cryptographic algorithm to be evaluated and the analysis scenario, includes: Construct the relationship matrix V between the output state of the decryption round function of the cryptographic algorithm to be evaluated and the round key and input state. E ; where the relation matrix V E The rows correspond to the output states, and the relation matrix V E The columns correspond to the key state and the input state, and the V of the relation matrix E The size is Sbox Num × (Key Num + Sbox Num), where Sbox Num represents the number of S boxes in each round, and Key Num represents the number of key blocks in the round; Construct the relationship matrix V between the output state of the decryption round function of the cryptographic algorithm to be evaluated and the round key and input state. D ; where the relation matrix V D The rows correspond to the output states, and the relation matrix V D The columns correspond to the key state and the input state, and the relation matrix V D The size is Sbox Num × (Key Num + Sbox Num); Construct a matrix V representing the relationship between the output state of the round function in the first round of decryption or the last round of encryption in the cryptographic algorithm to be evaluated, and the input state and round key. L , where the relation matrix V L The rows correspond to the output states, and the relation matrix V L The columns correspond to the key state and the input state, and the relation matrix V L Size Sbox Num × (Key Num + Sbox Num); Construct the relation matrix V of the key arrangement scheme of the cryptographic algorithm to be evaluated. K ; where the relation matrix V K The rows correspond to the output states, and the relation matrix V K The columns correspond to the key state and the input state, and the relation matrix V K The size is Key Num × Key Num.

4. The method as described in claim 2, characterized in that, The analysis scenarios include: bit-based analysis; Construct the relationship matrix V between the output state of the decryption round function of the cryptographic algorithm to be evaluated and the round key and input state. E ; where the relation matrix V E The rows correspond to the output states, and the relation matrix V E The columns correspond to the key state and the input state, and the V of the relation matrix E The size is Cipher Size × (Key Size + Cipher Size), where Cipher Size represents the block size and Key Size represents the length of the master key; Construct the relationship matrix V between the output state of the decryption round function of the cryptographic algorithm to be evaluated and the round key and input state. D ; where the relation matrix V D The rows correspond to the output states, and the relation matrix V D The columns correspond to the key state and the input state, and the relation matrix V D The size is Cipher Size × (Key Size + Cipher Size); Construct the relation matrix V of the key arrangement scheme of the cryptographic algorithm to be evaluated. K ; where the relation matrix V K The rows correspond to the output states, and the relation matrix V K The columns correspond to the key state and the input state, and the relation matrix V K The size is Key Size × Key Size.

5. The method as described in claim 1, characterized in that, The number of key recovery rounds obtained includes: Based on the initial configuration parameters of the discriminator, determine the position of the discriminator and the number of rounds of the discriminator; Based on the attack requirements and the position of the distinguisher, the number of forward expansion rounds and the number of backward expansion rounds are determined to obtain the key recovery rounds; wherein, the sum of the number of rounds of the distinguisher, the number of forward expansion rounds, and the number of backward expansion rounds is less than the total number of rounds of the analyzed cryptographic algorithm.

6. The method as described in claim 3, characterized in that, The construction of the encryption directed graph and the decryption directed graph based on the dependencies between variables in the variable set includes: The root nodes of the encrypted directed graph and the decrypted directed graph are initialized so that the state of the root node of the encrypted directed graph is consistent with the input state of the discriminator, and the state of the root node of the decrypted directed graph is consistent with the output state of the discriminator. Starting from the root nodes of the encrypted and decrypted directed graphs, the state variables and key information are guessed based on the dependencies between variables in the variable set. By obtaining the relationships between the associated states and keys, the encrypted and decrypted directed graphs are constructed.

7. The method as described in claim 1, characterized in that, After constructing the encrypted directed graph and the decrypted directed graph based on the dependencies between variables in the variable set, the method further includes: Generate an adjacency matrix between the master key and the round keys based on the key arrangement scheme; By using the master key as the input variable of the adjacency matrix and the round key as the output variable of the adjacency matrix, a mutual dependency relationship between the round key and the master key is established.

8. The method as described in claim 1, characterized in that, The method of attacking the cryptographic algorithm under evaluation based on the encrypted directed graph and the decrypted directed graph, combined with the analysis method, to obtain the security evaluation result of the cryptographic algorithm under evaluation, includes: By guessing the key and verifying the encrypted state value, data pairs and keys that satisfy the output state value are selected. Based on the data pairs and keys that satisfy the output state values, calculate the data complexity, storage complexity, and computational complexity in the process of recovering the key; The security assessment result of the cryptographic algorithm to be evaluated is obtained based on the data complexity, the storage complexity, and the computational complexity.

9. A security evaluation device for block cipher algorithms, characterized in that, include: The data acquisition module is used to acquire the initial configuration parameters of the cryptographic algorithm to be evaluated, the initial configuration parameters of the discriminator, and the number of key recovery rounds, and to select the analysis scenario and analysis method; wherein, the discriminator is used to distinguish the cryptographic algorithm from random permutations, and the analysis methods include: differential cryptanalysis, linear cryptanalysis, impossible differential cryptanalysis, zero-correlation linear cryptanalysis, and integral cryptanalysis; The state analysis module is used to construct an adjacency matrix representing the interdependence between the state and the key during the encryption and decryption process, based on the initial configuration parameters of the cryptographic algorithm to be evaluated and the analysis scenario. The variable analysis module is used to generate a variable set based on the initial configuration parameters of the discriminator and the number of key recovery rounds; and to perform pointer operations based on the adjacency matrix to obtain the dependencies between variables in the variable set; wherein, the variable set includes: a round function input variable set, a round function output variable set, a round key variable set, and an intermediate variable set; The directed graph building module is used to build encrypted and decrypted directed graphs based on the dependencies between variables in a set of variables. The security assessment module is used to attack the cryptographic algorithm to be evaluated based on the encrypted directed graph and the decrypted directed graph, combined with the analysis method, so as to obtain the security assessment result of the cryptographic algorithm to be evaluated.

10. A computer device, characterized in that, The computer device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the security assessment method for block cipher algorithms as described in any one of claims 1-8.

Images