An analysis method of preimage attack based on differential-linear distinguisher of hash function

Abstract

The application provides a preimage attack analysis method based on a differential-linear distinguisher of a hash function, comprising the following steps: obtaining a hash function to be analyzed and a given hash value; selecting a plurality of input differences of the hash function; under each input difference, selecting a plurality of output masks to obtain a plurality of correlation differential-linear distinguishers; and accelerating search for the preimage of the hash value according to the differential-linear distinguisher.

Description

Technical Field

[0001] This invention belongs to the field of information science. Background Technology

[0002] Currently, with the development of communication and computer technologies, the internet is impacting all aspects of people's lives. However, people's demands for the confidentiality and integrity of information are also increasing. The application of cryptographic algorithms ensures the security of people's data during internet activities, guaranteeing data integrity and confidentiality. Cryptographic hash functions, as a method of protecting data integrity, have seen their security analysis driving the development of secure cryptographic hash function design.

[0003] Currently, preimage attacks on cryptographic hash functions mainly include middle-meeting attacks and algebraic analysis methods. Middle-meeting attacks are a relatively common and mature method for analyzing cryptographic hash functions, and automated analysis of some cryptographic hash function algorithms is already quite sophisticated. However, middle-meeting attacks employ a space-for-time tradeoff strategy, resulting in very high storage resource requirements, rendering this analysis method largely theoretical.

[0004] For algebraic analysis methods, the overhead of storage resources is generally not significant. However, this method is only suitable for cryptographic hash functions with relatively low round function algebraic degrees; it is not applicable to cryptographic hash functions with high round function algebraic degrees. Summary of the Invention

[0005] The present invention aims to at least partially solve one of the technical problems in the related art.

[0006] Therefore, the purpose of this invention is to propose a preimage attack analysis method based on hash function difference-linear discriminator, which is used to perform algebraic analysis on cryptographic hash functions with high round function algebraic degree.

[0007] To achieve the above objectives, a first aspect of the present invention proposes a preimage attack analysis method based on a hash function difference-linear discriminator, comprising:

[0008] Obtain the hash function to be analyzed, given a hash value;

[0009] Select multiple input differences for the hash function;

[0010] Under each input difference, multiple output masks are selected to obtain multiple correlated difference-linear discriminators;

[0011] The preimage of the hash value is searched more quickly using the differential-linear discriminator.

[0012] Furthermore, the preimage attack analysis method based on the differential-linear distinguisher of a hash function according to the above embodiments of the present invention may further have the following additional technical features:

[0013] Further, in one embodiment of the present invention, the acquiring the hash function to be analyzed comprises:

[0014] Giving the hash value of the hash function to be analyzed Setting a threshold p, 0.5<p≤1, and inputting the difference set β∈span{α0,…α m-1}, 2 m output mask sets For the output mask set L' i , which contains |L' i | linearly independent output masks, for the input difference β c ∈span{α0,…α m-1}, the corresponding output mask set is recorded as

[0015] Further, in one embodiment of the present invention, the method further comprises:

[0016] For 0≤i,i'≤2 m -1, any two output mask sets L' i′ , L' i satisfy one of the following relationships:

[0017] Mutually exclusive relationship: for any λ1∈L' i , λ2∈L' i′ , it satisfies: λ1 cannot be linearly represented by the elements in L' i′ ; and λ2 cannot be linearly represented by the elements in L' i ;

[0018] Inclusion relationship: Or

[0019] Further, in one embodiment of the present invention, the selecting a plurality of output masks under each input difference to obtain a plurality of correlated differential-linear distinguishers comprises:

[0020] According to the output mask set corresponding to the input difference β c ∈span{α0,…α m-1} being , then for , there are sets of rotated differential-linear distinguishers:

[0021]

[0022] The probability of it being true is satisfy:

[0023]

[0024] in,

[0025] To achieve the above objectives, a second aspect of the present invention provides a preimage attack analysis device based on a hash function difference-linear discriminator, comprising the following modules:

[0026] The acquisition module is used to obtain the hash function to be analyzed, given a hash value;

[0027] The selection module is used to select multiple input differences of the hash function;

[0028] The building block is used to select multiple output masks for each input difference to obtain multiple correlated difference-linear discriminators;

[0029] An analysis module is used to accelerate the search for the preimage of the hash value based on the differential-linear discriminator.

[0030] To achieve the above objectives, a third aspect of the present invention provides a computer device, characterized in that it includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a preimage attack analysis method based on a hash function difference-linear discriminator as described above.

[0031] To achieve the above objectives, a fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements a preimage attack analysis method based on a hash function difference-linear discriminator as described above.

[0032] The preimage attack analysis method based on hash function difference-linear discriminators proposed in this invention can convert these difference-linear discriminators into a preimage attack analysis method without consuming storage resources, given the hash function difference-linear discriminators. Compared with other preimage attack analysis methods, the method of this invention has stronger versatility, is applicable to all types of hash functions, and consumes no storage resources. Attached Figure Description

[0033] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0034] Figure 1is a schematic flowchart of a preimage attack analysis method based on a hash function differential-linear distinguisher provided by an embodiment of the present invention.

[0035] Figure 2 is a schematic diagram of a hash function provided by an embodiment of the present invention.

[0036] Figure 3 is a schematic diagram of a preimage attack analysis apparatus based on a hash function differential-linear distinguisher provided by an embodiment of the present invention. Detailed Description of the Embodiments

[0037] The embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary, intended to explain the present invention, and shall not be construed as a limitation to the present invention.

[0038] The preimage attack analysis method based on a hash function differential-linear distinguisher according to an embodiment of the present invention is described below with reference to the accompanying drawings.

[0039] Figure 1 is a schematic flowchart of a preimage attack analysis method based on a hash function differential-linear distinguisher provided by an embodiment of the present invention.

[0040] Embodiment 1

[0041] As shown in Figure 1 , the preimage attack analysis method based on a hash function differential-linear distinguisher includes the following steps:

[0042] S101: Acquire a hash function to be analyzed, and specify a hash value;

[0043] Further, in one embodiment of the present invention, acquiring the hash function to be analyzed includes:

[0044] Specify the hash value of the hash function to be analyzed Set a threshold p where 0.5<p≤1, and input a difference set β∈span{α0,…α m-1}, 2 m output mask sets For the output mask set L' i , which contains |L' i | linearly independent output masks, for the input difference β c ∈span{α0,…α m-1}, the corresponding output mask set is denoted as

[0045] Furthermore, in one embodiment of the present invention, it further includes:

[0046] For 0≤i, i'≤2 m -1, any two output mask sets L' i′ ,L' i Satisfy one of the following relationships:

[0047] Mutual exclusion relation: for any λ1∈L' i ,λ2∈L' i′ Satisfy: λ1 cannot be obtained from L' i′ The elements in the expression are linearly represented; and λ2 cannot be derived from L' i The elements in the linear representation;

[0048] Inclusion relationship: or

[0049] S102: Select multiple input differences for the hash function;

[0050] S103: Under each input difference, select multiple output masks to obtain multiple correlated difference-linear discriminators;

[0051] Furthermore, in one embodiment of the present invention, under each input difference, multiple output masks are selected to obtain multiple correlated difference-linear discriminators, including:

[0052] Based on the input difference β c ∈span{α0,…α m-1 The corresponding output mask set is L' βc For have Grouped Rotational Differential-Linear Discriminator:

[0053]

[0054] The probability of it being true is satisfy:

[0055]

[0056] in,

[0057] S104: Accelerate the search for the preimage of the hash value using a differential-linear divider.

[0058] Example 2

[0059] For example Figure 2 The hash function shown, given a hash value Search for the preimage M.

[0060] Preparation: Set the threshold p to 0.5 <p≤1.。

[0061] Input difference set: β∈span{α0,…α m-1}

[0062] 2 m A set of output masks:

[0063] For the output mask set L' i Contains |L' i | A linearly independent output mask. For the input difference β c ∈span{α0,…α m-1 Let} be the set of output masks corresponding to it.

[0064] Require:

[0065] For 0≤i, i'≤2 m -1, any two output mask sets L' i′ ,L' i Satisfy one of the following relationships:

[0066] Mutual exclusion relationship:

[0067] For any λ1∈L' i ,λ2∈L' i′ Satisfy: λ1 cannot be obtained from L' i′ The elements in the expression are linearly represented; and λ2 cannot be derived from L' i The elements in the array are linearly represented.

[0068] Inclusion relationship:

[0069] or

[0070] For the input difference β c ∈span{α0,…α m-1}, and its corresponding output mask set is for This invention

[0071] have Grouped Rotational Differential-Linear Discriminator:

[0072]

[0073] The probability of it being true is satisfy:

[0074]

[0075] in,

[0076] principle:

[0077] Observation 1: For a β c ∈span{α0,…α m-1}, for all DL Diver:

[0078]

[0079] The probability of it being true is and

[0080] Accordingly, for If f(M) = T; So, for all

[0081]

[0082] The probability that both are true is at least p.

[0083] Therefore, given a hash value T, the preimage attack algorithm is as follows:

[0084] 1) Initialize a counter to 0.

[0085] 2) Randomly generate a valid initial state y, and calculate T′=f(y).

[0086] 3) For i from 0 to n-1:

[0087] 3.1 For β c Iterate through span{α0,…α m-1}:

[0088] 3.1.1 flag = true;

[0089] 3.1.2 For γ, iterate through β c The corresponding set L' βc :

[0090] 3.1.2.1if flag = false.

[0091] 3.1.3 if flag = true: condition Is it equal to T?

[0092] 3.1.3.1 If equal, the program terminates and returns.

[0093] 4) If the counter equals The program terminates and returns an empty string; otherwise, it jumps to step 1.

[0094] Estimation of time complexity:

[0095] First, the present invention will 2 m A set of output masks After removing all duplicate output mask sets, we obtain k distinct output mask sets L0,…,L k-1 .

[0096] And for 0≤i≤k-1, the output mask set L i If all the corresponding linear mask conditions are met, the number of input differences that pass the filter is denoted as s. i If we define v as equal to:

[0097]

[0098] Therefore, the time complexity of the attack at this point is approximately:

[0099]

[0100] The acceleration ratio is approximately:

[0101]

[0102] The preimage attack analysis method based on hash function difference-linear discriminators proposed in this invention solves the problem of the difficulty in converting significant difference-linear discriminators in hash functions into effective attacks by utilizing the aforementioned accelerated search framework based on difference-linear discriminators. Compared with existing technologies, the advantages of this invention are that it is more versatile and applicable to all types of hash functions, and it consumes no storage resources.

[0103] To achieve the above embodiments, the present invention also proposes a preimage attack analysis device based on a hash function difference-linear discriminator.

[0104] Figure 3 This is a schematic diagram of a preimage attack analysis device based on a hash function difference-linear discriminator, provided in an embodiment of the present invention.

[0105] like Figure 3 As shown, the preimage attack analysis device based on hash function difference-linear discriminator includes: an acquisition module 100, a selection module 200, a construction module 300, and an analysis module 400, wherein...

[0106] The acquisition module is used to obtain the hash function to be analyzed, given a hash value;

[0107] The selection module is used to select multiple input differences for the hash function;

[0108] The building block is used to select multiple output masks for each input difference to obtain multiple correlated difference-linear discriminators;

[0109] The analysis module is used to accelerate the search for the preimage of the hash value based on the differential-linear discriminator.

[0110] To achieve the above objectives, a third aspect of the present invention provides a computer device, characterized in that it includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the preimage attack analysis method based on a hash function difference-linear discriminator as described above.

[0111] To achieve the above objectives, a fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements the preimage attack analysis method based on a hash function difference-linear discriminator as described above.

[0112] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0113] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0114] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A preimage attack analysis method based on a hash function difference-linear discriminator, characterized in that, Includes the following steps: Obtain the hash function to be analyzed, given a hash value; Select multiple input differences for the hash function; Under each input difference, multiple output masks are selected to obtain multiple correlated difference-linear discriminators; Accelerating the search for the preimage of the hash value using the differential-linear discriminator includes: Randomly generate a valid initial state y, and calculate... ; Traverse the input difference set span{α0,...,α m-1 Input difference β in} c And iterate through the corresponding set of output masks under the current input difference. The output mask γ in; For the current input difference, set flag=true, and iterate through the corresponding set of output masks under the current input difference. When determining the output mask γ in the middle, If true, update flag=false and output the mask set. After the traversal is complete, check if flag=true. If true, then check... If the hash value is equal to the given hash value T, terminate the search and return. ; The method further includes: A counter is introduced into the accelerated search, which is used to control the termination of the accelerated search.

2. The method according to claim 1, characterized in that, The process of obtaining the hash function to be analyzed includes: Given the hash value of the hash function to be analyzed Set threshold , Input difference set , A set of output masks For the output mask set ,contain A linearly independent output mask for the input difference β in the input difference set. c Let its corresponding output mask set be . .

3. The method according to claim 2, characterized in that, Also includes: for Any two sets of output masks , Satisfy one of the following relationships: Mutual exclusion: for any , satisfy: Cannot be The elements in the equation are linearly represented; and Cannot be The elements in the linear representation; Inclusion relationship: or .

4. The method according to claim 2, characterized in that, Under each input difference, multiple output masks are selected to obtain multiple correlated difference-linear discriminators, including: Based on input difference The corresponding output mask set is For ,have Grouped Rotational Differential-Linear Discriminator: ， M is the preimage, and the probability that it is true is... ,satisfy: in, .

5. A preimage attack analysis device based on a hash function difference-linear discriminator, characterized in that, The apparatus implements the method as described in claim 1, and the apparatus comprises the following modules: The acquisition module is used to obtain the hash function to be analyzed, given a hash value; The selection module is used to select multiple input differences of the hash function; The building block is used to select multiple output masks for each input difference to obtain multiple correlated difference-linear discriminators; An analysis module is used to accelerate the search for the preimage of the hash value based on the differential-linear discriminator.

6. A computer device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the preimage attack analysis method based on a hash function difference-linear discriminator as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the preimage attack analysis method based on the hash function difference-linear discriminator as described in any one of claims 1-4.

Images