A fault analysis method for Deoxys-II algorithm

Abstract

The application relates to a fault analysis method for a Deoxys-II algorithm, which comprises the following steps: performing random fault injection on the Deoxys-II algorithm to obtain a fault label value; determining a fault byte according to the position of the random fault injection, enumerating a final round adjustable sub-key corresponding to the fault byte to obtain a final round adjustable sub-key value; deducing all possible intermediate state values by using the final round adjustable sub-key value and the fault label value; calculating the difference value between the intermediate state values obtained by the same final round adjustable sub-key value, and counting the Hamming weight of the difference value; finding that the final round adjustable sub-key value corresponding to the minimum value of the Hamming weight is the original final round adjustable sub-key corresponding to the fault byte; and restoring the master key according to the original final round adjustable sub-key. The application can perform fault analysis on the Deoxys-II algorithm, and has high detection efficiency and success rate.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a fault analysis method for the Deoxys-II algorithm. Background Technology

[0002] With the continuous development of computer information security technology, information security issues have gradually gained attention. Network attacks, unauthorized intrusions, and information leaks are on the rise every year, posing significant security risks to users of the internet. Ensuring information security has become a hot topic in recent years, and cryptography, as the cornerstone of information security, can provide authentication and encryption functions to protect users' information security. The Deoxys-II authentication encryption algorithm is one of the winning algorithms in the international Authentication and Encryption Algorithm Competition (CAESAR) and has been selected as the preferred algorithm in defense-in-depth systems. Its block size and key length are both 128 bits, ensuring the integrity, security, and authenticability of information.

[0003] Fault analysis refers to the process by which attackers use specific fault-finding techniques to interfere with devices carrying cryptographic algorithms, causing the algorithms to make erroneous calculations during operation. These errors are then analyzed mathematically to gradually deduce the correct key, thereby breaking the cipher. A fault analysis method for the Deoxys-II cryptographic algorithm is needed that is computationally efficient and has a high detection efficiency and success rate. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a fault analysis method for the Deoxys-II algorithm, which has high detection efficiency and success rate.

[0005] The technical solution adopted by this invention to solve its technical problem is: to provide a fault analysis method for the Deoxys-II algorithm, comprising the following steps:

[0006] S0. Perform random fault injection on the Deoxys-II algorithm to obtain a set number of fault label values;

[0007] S1. Determine the final adjustable subkey affected by the random fault based on the location of the random fault injection, and enumerate the final adjustable subkey to obtain multiple final adjustable key values;

[0008] S2. Calculate the difference between intermediate state values ​​derived from the same final round adjustable subkey value, and calculate the Hamming weight of the difference, wherein the intermediate state value is the output value of the random fault after one cell substitution operation;

[0009] S3. Find the correct value of the final adjustable subkey corresponding to the minimum value of the Hamming weight;

[0010] S4. Repeat steps S1-S3 until the original final round adjustable subkey is determined;

[0011] S5. Restore the master key based on the original final adjustable subkey.

[0012] Furthermore,

[0013] The calculation of the difference between intermediate state values ​​derived from the same final-round adjustable subkey value includes:

[0014] For any of the final adjustable subkey values, derive intermediate state values ​​by combining them with any of the fault tag values, and calculate the difference between the intermediate state values.

[0015] Furthermore, determining the final-round adjustable subkey affected by the random fault based on the location of the random fault injection includes:

[0016] The fault propagation path is derived based on the Deoxys–II algorithm;

[0017] Based on the fault propagation path, the final round adjustable subkey is derived using the location of the random fault injection.

[0018] Furthermore, the step of restoring the master key based on the original final-round adjustable subkey includes:

[0019] The original adjustable subkey of the last round is converted back into the original subkey of the last round using the subkey restoration formula;

[0020] Based on the original last round subkey, the first round subkey is derived using the subkey inverse formula, and then the first round subkey is restored to the master key.

[0021] Furthermore, the subkey recovery formula is as follows:

[0022]

[0023] Among them, RK r Let STK′ be the original subkey for the (r+1)th round. r T is the original adjustable subkey for the (r+1)th round. r Let RC be the wheel constant for the (r+1)th round. r For the (r+1)th round of the adjustment handle, 0≤r≤13.

[0024] Furthermore, the subkey inverse formula is as follows:

[0025]

[0026] Among them, RK r-1 Let r be the key of the rth round. It is the i-th byte of the key for the (r+1)-th round, where 0 ≤ r ≤ 13 and 0 ≤ i ≤ 15.

[0027] Furthermore, the random fault injection into the Deoxys–II algorithm includes:

[0028] Generate random plaintext information to be processed;

[0029] The random plaintext information is encrypted using the Deoxys-II algorithm, and a fault is injected into the random bytes at the input of the encryption round.

[0030] Collect the output fault label values.

[0031] Furthermore, the encryption round is set to the penultimate round.

[0032] Furthermore, the injected fault is a single-byte random fault.

[0033] Furthermore, the difference value is calculated using the following formula:

[0034]

[0035] Where, ΔB 11 SR is the difference value of the intermediate state value. -1 For row shift inverse operation, MC -1 For column obfuscation inverse operation, SB -1 STK replaces the inverse operation for information cells. 13 Tag is the adjustable subkey value for the final round. i and Tag j Let i and j be the fault label values, respectively, i ≠ j, and 1 ≤ i ≤ N, 1 ≤ j ≤ N, where N is the total number of fault label values.

[0036] Beneficial effects

[0037] Due to the adoption of the above technical solution, this invention has the following advantages and positive effects compared with the prior art: This invention enumerates the final-round adjustable subkeys affected by faults based on different fault injection bytes, and then uses the obtained final-round adjustable subkey value and all fault tag values ​​to inversely calculate all possible intermediate state values. Furthermore, by performing pairwise differences on the intermediate state values ​​derived from the same final-round adjustable subkey value, and calculating the Hamming weight of the difference values, the final-round adjustable subkey value with the most uneven distribution of intermediate state values ​​is found, which is the correct value of the final-round adjustable subkey. Using this method for fault analysis requires less work and has higher accuracy. During the calculation derivation, differential calculation is used to calculate STK... 12Offsetting can redirect faults to the penultimate encryption round without increasing the complexity of key enumeration. The calculation process is simple and the analysis speed is fast. Attached Figure Description

[0038] Figure 1 This is a flowchart of an embodiment of the present invention;

[0039] Figure 2 This is a fault propagation path diagram of the Deoxys–II algorithm in the embodiments of the present invention;

[0040] Figure 3 This is a structural diagram of the Deoxys–II algorithm in the embodiments of the present invention;

[0041] Figure 4 This is a schematic diagram of the experimental environment for an embodiment of the present invention. Detailed Implementation

[0042] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0043] Basic Symbol Explanation

[0044] X: Plaintext, X∈{{0,1} 8} 16 ;

[0045] Y: Correct ciphertext, Y∈{{0,1} 8} 16 ;

[0046] Error ciphertext

[0047] K: Master key, K∈{{0,1} 8} 16 ;

[0048] AD: Related data, AD∈{{0,1} 8} 16 ;

[0049] N: A random number, N∈{{0,1} 8} 16 ;

[0050] T: Handle, T∈{{0,1} 8} 16 ;

[0051] Tr : The value of the adjustment handle in the (r+1)th round, 0≤r≤13;

[0052] RK r : The key for the (r+1)th round, 0≤r≤13;

[0053] The i-th byte of the key for the (r+1)-th round, 0≤r≤13, 0≤i≤15;

[0054] STK r : The adjustable subkey for the (r+1)th round, 0≤r≤13;

[0055] The value of the adjustable subkey in round r+1 after column confusion and row shift inverse operation is 0≤r≤13.

[0056] RC r : The constant of the (r+1)th round, 0≤r≤13;

[0057] ARK: XOR operation for tunable subkeys; ARK -1 : XOR inverse operation of adjustable subkey;

[0058] SB: Cell Substitution Operation; SB -1 : Information element substitution inverse operation;

[0059] SR: Row shift operation; SR -1 Row shift inverse operation;

[0060] MC: Column Confusion Operation; -1 : Inverse operation of column confusion;

[0061] A r : The intermediate state output value of the XOR operation of the adjustable subkey in the (r+1)th round, 0≤r≤12;

[0062] A r The i-th byte, 0≤r≤12, 0≤i≤15;

[0063] B r : The intermediate state output value of the cell substitution operation in the (r+1)th round, 0≤r≤12;

[0064] B r The i-th byte, 0≤r≤12, 0≤i≤15;

[0065] C r : The intermediate state output value of the (r+1)th row shift operation, 0≤r≤12;

[0066] C rThe i-th byte, 0≤r≤12, 0≤i≤15;

[0067] D r : The intermediate state output value of the (r+1)th round of column confusion operation, 0≤r≤12;

[0068] D r The i-th byte, 0≤r≤12, 0≤i≤15;

[0069] ΔA r : The difference value of the intermediate state output value of the XOR operation of the adjustable subkey in the (r+1)th round, 0≤r≤12;

[0070] Tag: Tag value;

[0071] Tag j After grouping by candidate keys, the j-th tag value in each group, 1≤j≤100;

[0072] P: Permutation operation in the key arrangement algorithm;

[0073] LFSR: Linear Feedback Shift Register;

[0074] XOR operation;

[0075] ||: Cascade.

[0076] The embodiments of the present invention relate to a fault analysis method for the Deoxys–II algorithm, comprising the following steps:

[0077] S0. Perform random fault injection on the Deoxys-II algorithm to obtain a set number of fault label values;

[0078] S1. Determine the final adjustable subkey affected by the random fault based on the location of the random fault injection, and enumerate the final adjustable subkeys to obtain multiple final adjustable key values;

[0079] S2. Calculate the difference between intermediate state values ​​derived from the same final round adjustable subkey value, and count the Hamming weight of the difference. The intermediate state value is the output value after a random fault undergoes one cell substitution operation.

[0080] S3. Find the correct value of the final adjustable subkey corresponding to the minimum value of the Hamming weight;

[0081] S4. Repeat steps S1-S3 until the original final round adjustable subkey is determined;

[0082] S5. Restore the master key based on the original adjustable subkey from the last round.

[0083] In some implementations, step S1 can determine the final round adjustable subkey by the following method:

[0084] The fault propagation path is derived based on the Deoxys–II algorithm;

[0085] Based on the fault propagation path, the final round adjustable subkey is derived using the location of random fault injection.

[0086] When the location of a random fault injection is uncertain (a faulty byte could be injected into any byte), we can first assume that a certain byte in the encryption round where the fault injection occurred is injected. Then, we can deduce the final adjustable subkey affected by the fault in the last encryption round and recover the master key using the method described above. For example, when analyzing byte 0, the fault injected into other bytes will not change the numerical distribution of byte 0, so it will not affect the distribution result and therefore will not affect the Hamming weight of the difference value. However, when there are enough faults to cover all bytes, any byte will have a fault label value that is unevenly distributed due to the fault injection, and thus the corresponding correct adjustable subkey can be found using the method described above.

[0087] Step S2 can be achieved by using any final round adjustable subkey value STK 13 Calculate and derive each fault tag value separately to obtain all possible intermediate state values, and then calculate the difference values ​​pairwise. Step S5 can be achieved through the following steps:

[0088] Using the following formula

[0089]

[0090] Convert the original last-round adjustable subkey to the original last-round key;

[0091] Based on the original last-round key, using the following formula

[0092]

[0093] The first round subkey is derived, and then the first round subkey is restored to the master key.

[0094] Among them, RK 13 The original last wheel key, STK′ 13 T is the original final round adjustable subkey. 13 RC is the wheel constant of the last wheel. 13 For the last wheel adjustment lever, RK r-1 Let r be the key of the rth round. It is the i-th byte of the key for the (r+1)-th round, where 0 ≤ r ≤ 13 and 0 ≤ i ≤ 15.

[0095] In some preferred embodiments, random fault injection is performed on the Deoxys–II algorithm using the following method:

[0096] Generate random plaintext information to be processed;

[0097] The random plaintext information is encrypted using the Deoxys-II algorithm, and a single-byte fault is randomly injected into the input end of the penultimate round.

[0098] Collect the output fault label values.

[0099] At this point, the difference between the intermediate state values ​​can be calculated using the following formula:

[0100]

[0101] Where, ΔB 11 SR is the difference value of the intermediate state value. -1 For row shift inverse operation, MC -1 For column obfuscation inverse operation, SB -1 STK replaces the inverse operation for information cells. 13 Tag is the adjustable subkey value for the final round. i and Tag j Let i and j be the fault label values, respectively, i ≠ j, and 1 ≤ i ≤ N, 1 ≤ j ≤ N, where N is the total number of fault label values.

[0102] The following details how to perform fault analysis on the Deoxys-II authentication encryption algorithm during the penultimate round of fault injection using this implementation method. This implementation method assumes that the device equipped with the Deoxys-II authentication encryption algorithm has an authentication mechanism, and information is only output upon successful authentication. Therefore, this invention simulates both encryption and authentication steps in the software simulation. Only when the tag verification is successful will the ciphertext and tag value be output; thus, the collected tags are all tag values ​​affected by invalid faults. For example... Figure 1 As shown, the specific method is as follows:

[0103] Step 1: Generate random plaintext information to be processed, denoted as X∈{{0,1} 8} 16 .

[0104] Step 2: Use plaintext X, random number N, and associated data AD as input to the Deoxys-II algorithm, and inject faults during the algorithm's operation. The fault location is before SB in the penultimate round, the fault model is an 8-bit random fault, and collect the output fault tags.

[0105] Step 3: Repeat steps 1 and 2 until enough tag values ​​are collected. This invention uses 100 tag values ​​as an example.

[0106] Step 4: Calculate intermediate state values. Derive the fault propagation path diagram based on the possible injection locations of the fault, in order to... Figure 2 For example, assuming a single-byte random fault injection is injected into the first byte, after two rounds of propagation, the SR in the last round will affect 4 bytes (32 bits). Therefore, the adjustable subkey STK in the last round can be enumerated by the corresponding 32 bits. 13 The formula for reversing the intermediate state value affected by the fault is:

[0107]

[0108] Due to SR -1 and MC -1 Since both are linear, the formula can be simplified to:

[0109]

[0110] For ease of calculation, keys can be enumerated directly. in:

[0111]

[0112] Step 5: Group the obtained intermediate state values ​​according to the key value, STK 13 Identical values ​​are grouped together, and the differences between the intermediate state values ​​corresponding to each candidate key are calculated. These differences can be used to determine the STK. 12 This cancels out the effect, so during software simulation, only STK needs to be enumerated. 13 The formula is:

[0113]

[0114] Step 6: Calculate the ΔB obtained for each group of identical keys. 11 The Hamming weight value. The Hamming weight is the number of "1"s in the intermediate state value, for example, ΔB. 11 When =224, its binary representation is 11100000, and its corresponding Hamming weight is 3.

[0115] Step 7: Find the value corresponding to the minimum Hamming weight Since the distribution of intermediate state values ​​changes from uniform to non-uniform after the fault is passed and the intermediate state is injected bitwise by "AND", the overall distribution shows that there are more "0"s than "1"s. Therefore, the key value corresponding to the minimum Hamming weight is the 32-bit correct tunable subkey.

[0116] Step 8: Repeat steps 1 to 7, enumerating the corresponding 32-bit key according to different fault injection locations, and gradually obtaining all 128-bit adjustable subkeys.

[0117] Step 9: Key Recovery. First, […]. Restore to STK 13 The relationship is as follows:

[0118]

[0119] Then, according to such Figure 3 As can be seen from the key arrangement scheme shown:

[0120]

[0121]

[0122] Where 0≤r≤13, and the wheel constant RC r and the tuning handle T r Given that the key RK for the (r+1)th round can be calculated. r Then, the transformation relationship between subkeys can be obtained through the key arrangement scheme:

[0123]

[0124] Where 0≤r≤13. The first round subkey RK0 can be gradually obtained through the above formula, and finally the master key can be obtained by K=RK0.

[0125] The fault importing action described in step 3 can be implemented through software simulation or by processing the real hardware using techniques such as laser, electromagnetic, and voltage interference. Step 5 utilizes a set of difference equations to... 12 By offsetting the fault, the error can be introduced into the penultimate round without increasing the complexity of enumerating the key. Repeating the fault introduction and analysis process, the correct key K can finally be derived.

[0126] In steps 1 and 2, during the processing of the plaintext X of the authentication information using the Deoxys-II authentication encryption algorithm, the experimental environment needs to be strictly controlled to ensure the accuracy of the experimental results and obtain the corresponding output. The specific experimental environment is as follows:

[0127] Experimental environment: Input plaintext X, introduce faults during the Deoxys-II algorithm execution, and thus obtain erroneous ciphertext. and tags.

[0128] For the above execution steps, select an experimental environment such as... Figure 4As shown, software simulation is used to randomly generate the plaintext X input to Deoxys-II, and the output result after processing and analyzing the plaintext input through the Deoxys-II algorithm is processed and analyzed; the device that encapsulates the Deoxys-II algorithm is used to process the input message and obtain the corresponding output result; the device that imports faults is used to perform the import fault action, which will be performed during the operation of the Deoxys-II algorithm, thereby obtaining the output of the erroneous ciphertext and the tag value.

[0129] Using the above analysis method, this invention simulated the import failure and Deoxys-II authentication encryption algorithm processing on a computer with an Intel(R) Core(TM) i5–10400F CPU@2.90GHz and 16GB of memory using the IDEA development tool, repeating the process 5000 times. The experimental results show that the above detection method is accurate. The method provided by this invention is easy to implement, fast, and highly accurate, and is of great significance to the security research of the Deoxys-II authentication encryption algorithm.

Claims

1. A fault analysis method for the Deoxys–II algorithm, characterized in that, Includes the following steps: S0. Perform random fault injection on the Deoxys-II algorithm to obtain a set number of fault label values; The random fault injection into the Deoxys–II algorithm includes: Generate random plaintext information to be processed; encrypt the random plaintext information using the Deoxys-II algorithm, and inject faults into the random bytes at the input of the encryption round; collect the output fault tag values; S1. Determine the final-round adjustable subkey affected by the random fault based on the location of the random fault injection, and enumerate the final-round adjustable subkeys to obtain multiple final-round adjustable subkey values; the step of determining the final-round adjustable subkey affected by the random fault based on the location of the random fault injection includes: The fault propagation path is derived based on the Deoxys-II algorithm; the final round adjustable subkey is derived based on the fault propagation path and the location of the random fault injection. S2. Calculate the difference between intermediate state values ​​derived from the same final-round adjustable subkey value, and calculate the Hamming weight of the difference value. The intermediate state value is the output value of the random fault after one cell substitution operation. The calculation of the difference between intermediate state values ​​derived from the same final-round adjustable subkey value includes: for any final-round adjustable subkey value, deriving intermediate state values ​​by respectively comparing it with any fault tag value, and calculating the difference between the intermediate state values. The difference value is calculated using the following formula: in, The difference value between the intermediate state values. This is the inverse row shift operation. For column obfuscation inverse operation, Replace the inverse operation with the information cell. This is the adjustable subkey value for the final round. and The first The and the first Each fault label value, ,and , , The total number of fault label values; S3. Find the correct value of the final adjustable subkey corresponding to the minimum value of the Hamming weight; S4. Repeat steps S1-S3 until the original final round adjustable subkey is determined; S5. Restore the master key based on the original final adjustable subkey.

2. The method according to claim 1, characterized in that, The step of restoring the master key based on the original final-round adjustable subkey includes: The original adjustable subkey of the last round is converted back into the original subkey of the last round using the subkey restoration formula; Based on the original last round subkey, the first round subkey is derived using the subkey inverse formula, and then the first round subkey is restored to the master key.

3. The method according to claim 2, characterized in that, The formula for restoring the subkey is: ， in, For the first Wheel primitive key, For the first Round the original adjustable subkey, For the first Wheel constant, For the first wheel adjustment handle, .

4. The method according to claim 2, characterized in that, The formula for inverse subkey derivation is: in, For the first Wheel key, For the first The first wheel key bytes, , .

Images