A fault analysis method for GIFT-COFB algorithm

Abstract

The application relates to a fault analysis method for a GIFT-COFB algorithm, and is characterized by comprising the following steps: S0. Random fault injection is performed to obtain a set number of fault label values; S1. According to the position of the random fault injection, the last round subkey bit and the penultimate round subkey bit affected by the random fault are determined, and a plurality of subkey candidate values are obtained by enumerating the subkey bits; S2. The difference value of the intermediate state value obtained by the same subkey candidate value is calculated, and the Hamming weight of the difference value is counted; S3. The minimum value of the Hamming weight is searched, and the subkey candidate value corresponding to the minimum value is the correct value of the subkey bit; S4. Steps S1-S3 are repeated until the original subkey is determined; and S5. The main key is recovered according to the key expansion algorithm formula. The application has high detection efficiency and success rate for the GIFT-COFB algorithm.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a fault analysis method for the GIFT-COFB algorithm. Background Technology

[0002] With the rapid development of information technology and computer networks, technologies such as the Internet of Things (IoT) are gradually being applied to smart homes, smart manufacturing, and smart healthcare, bringing great convenience to people. However, while the IoT brings convenience, its vulnerabilities in areas such as information security are also increasingly attracting attention. Based on real-world scenarios, how to ensure information security has become a hot topic of research and concern. The GIFT-COFB authentication encryption algorithm is a candidate algorithm solicited by the National Institute of Standards and Technology (NIST) Lightweight Cryptography Standards Project. It uses the GIFT cryptographic algorithm with a block size and key length of 128 bits, and its security design goal is to simultaneously ensure the confidentiality and authentication of information.

[0003] Fault analysis refers to attackers using specific fault-finding techniques to interfere with devices carrying cryptographic algorithms, causing the algorithms to make erroneous calculations during operation. Attackers then use mathematical analysis and other methods to gradually deduce the correct key from these errors, thereby breaking the cipher. Currently, there is a lack of methods to assess the algorithm's resistance to fault attacks, leaving security vulnerabilities in products using Ascon encapsulation. Therefore, a fault analysis method for the GIFT-COFB cryptographic algorithm is needed that can save computing power and has high detection efficiency and success rate. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a fault analysis method for the GIFT-COFB algorithm, which has high detection efficiency and success rate for the GIFT-COFB algorithm.

[0005] The technical solution adopted by this invention to solve its technical problem is: to provide a fault analysis method for the GIFT-COFB algorithm, including the following steps:

[0006] S0. Perform random fault injection on the GIFT-COFB algorithm to obtain a set number of fault tag values;

[0007] S1. Determine the subkey bit affected by the random fault based on the location of the random fault injection, enumerate the subkey bits to obtain multiple subkey candidate values, the subkey bits include the last round subkey bit and the penultimate round subkey bit;

[0008] S2. Calculate the difference value of the intermediate state value obtained from the same subkey candidate value, and count the Hamming weight of the difference value;

[0009] S3. Find the minimum value of the Hamming weight, and find the correct value of the subkey candidate value, which is the correct value of the subkey bits;

[0010] S4. Repeat steps S1-S3 until the original subkey is determined;

[0011] S5. Restore the master key using the original subkey according to the key expansion algorithm formula.

[0012] Furthermore, the intermediate state value is the state value of the random fault injection location.

[0013] Furthermore, the calculation of the difference value of the intermediate state value derived from the same subkey candidate value includes:

[0014] For any of the subkey candidate values, the intermediate state value is calculated by inversely calculating it with any of the fault tag values, and then the difference value is obtained by pairwise difference calculation of the intermediate state value.

[0015] Furthermore, determining the subkey bits affected by the random fault based on the location of the random fault injection includes:

[0016] Deriving the fault propagation path based on the GIFT-COFB algorithm;

[0017] Based on the fault propagation path, the subkey bits are derived using the location of the random fault injection.

[0018] Furthermore, the random fault injection into the GIFT-COFB algorithm includes:

[0019] Generate random plaintext information to be processed;

[0020] The random plaintext information is encrypted using the GIFT-COFB algorithm, and a fault is injected during the encryption round.

[0021] Collect the output fault label values.

[0022] Furthermore, the encryption round is set to the penultimate round.

[0023] Furthermore, the injected fault is a half-byte random fault.

[0024] Furthermore, the difference value Calculated using the following formula:

[0025]

[0026] Among them, SC -1 PB replaces the inverse operation for the information cell. -1 Rk is the inverse operation of matrix permutation. 39RK 40 These are the penultimate and final round subkeys, T. i and T j Let i and j be the fault label values, respectively, i ≠ j, and 1 ≤ i ≤ N, 1 ≤ j ≤ N, where N is the total number of fault label values.

[0027] Furthermore, the key expansion algorithm formula is as follows:

[0028] RK 40 ||RK 39 =(k3>>4)||(k2>>8)||(k7>>2)||(k6>>12 )||(k1>>>4)||(k0>>>8)||(k52)||(k4>>>12);

[0029] K=k7||k6||k5||k4||k3||k2||k1||k0

[0030] Among them, RK 39 RK 40 These are the penultimate and final round subkeys, k, respectively. n The 0th to 7th bytes of the master key.

[0031] Beneficial effects

[0032] By adopting the above-mentioned technical solution, this invention has the following advantages and positive effects compared with the prior art: This invention enumerates the subkey bits that are encrypted with the fault injection at different positions, and then reverse-engineers all possible intermediate state values ​​by obtaining the subkey candidate values ​​and all fault tag values. By performing pairwise differences on the intermediate state values ​​derived from the same subkey candidate values, the Hamming weight of the difference values ​​is calculated to find the subkey candidate value with the most uneven distribution of intermediate state values, which is the correct value of the subkey bits. Using this method, the workload of fault analysis is small and the accuracy is high. The fault can be introduced into the penultimate encryption round without increasing the complexity of key enumeration, making the calculation process simple and the analysis speed fast. Attached Figure Description

[0033] Figure 1 This is a flowchart of an embodiment of the present invention;

[0034] Figure 2 This is a fault propagation path diagram of the GIFT-COFB algorithm in an embodiment of the present invention;

[0035] Figure 3 This is a structural diagram of the GIFT-COFB algorithm in an embodiment of the present invention;

[0036] Figure 4 This is a schematic diagram of the experimental environment for an embodiment of the present invention. Detailed Implementation

[0037] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0038] Basic Symbol Explanation

[0039] X: Plaintext, X∈{{0,1} 4} 32 ;

[0040] A: Related data, A∈{{0,1} 4} 32 ;

[0041] N: A random number, N∈{{0,1} 4} 32 ;

[0042] K: Master key, K∈{{0,1} 4} 32 ;

[0043] k j The j-th byte of the master key K, 0≤j≤7;

[0044] RK r The key for the r-th round, 0 ≤ r ≤ 40;

[0045] Y: Correct ciphertext, Y∈{{0,1} 4} 32 ;

[0046] Error ciphertext

[0047] SC: Cell Substitution Operation;

[0048] PB: Matrix permutation operation;

[0049] SC -1 : Information element substitution inverse operation;

[0050] PB -1 Matrix permutation inverse operation;

[0051] GS: S box;

[0052] The intermediate state of the r-th round, 0≤r≤40;

[0053] The intermediate state of the r-th round after difference calculation, 0≤r≤40;

[0054] T: Tag value;

[0055] T i After grouping by candidate keys, the i-th tag value in each group, 0≤i≤150;

[0056] XOR operation;

[0057] >>>: Circular right shift;

[0058] ||: Cascade.

[0059] The embodiments of the present invention relate to a fault analysis method for the GIFT-COFB algorithm, comprising the following steps:

[0060] S0. Perform random fault injection on the GIFT-COFB algorithm to obtain a set number of fault tag values;

[0061] S1. Determine the subkey bits affected by the random fault based on the location of the random fault injection, and enumerate the above subkey bits to obtain multiple subkey candidate values, where the subkey bits include the last round subkey bits and the penultimate round subkey bits;

[0062] S2. Calculate the difference between intermediate state values ​​derived from the same subkey candidate values, and count the Hamming weight of the difference. The intermediate state value is the state value at the random fault injection location.

[0063] S3. Find the minimum value of the Hamming weight that corresponds to the correct value of the subkey candidate value in bits;

[0064] S4. Repeat steps S1-S3 until the original subkey is determined;

[0065] S5. Based on the key expansion algorithm formula, recover the master key using the original subkey.

[0066] In some implementations, step S1 can determine the subkey bits by the following method:

[0067] The fault propagation path is derived based on the GIFT-COFB algorithm;

[0068] Based on the fault propagation path, the subkey bits affected by the random fault are derived by utilizing the location of the random fault injection.

[0069] When the location of a random fault injection is uncertain (a fault could be injected into any bit), we can first assume that some bits in the encryption rounds where the fault is injected are affected. Then, we can deduce the subkey bits affected by the random fault in each encryption round and recover the master key using the method described above. For example, when analyzing the 0th nibble, the fault injection into other bits will not change the numerical distribution of the intermediate state value corresponding to the 0th nibble, so it will not affect the distribution result and therefore will not affect the Hamming weight of the difference value. However, when there are enough faults to cover all bits, each bit will have a fault label value that is unevenly distributed due to the fault injection, and thus the correct value of the corresponding subkey bit can be found using the method described above.

[0070] Step S2 can be calculated by the following method: for any candidate subkey value, calculate the intermediate state value by inversely calculating it with any fault tag value, and then calculate the difference value by pairwise difference of the intermediate state value.

[0071] In some preferred embodiments, random fault injection is performed on the GIFT-COFB algorithm by the following methods:

[0072] Generate random plaintext information to be processed;

[0073] The GIFT-COFB algorithm is used to encrypt random plaintext information, and a half-byte random fault is injected in the penultimate encryption round.

[0074] Collect the output fault label values.

[0075] At this point, the difference between the intermediate state values It can be calculated using the following formula:

[0076]

[0077] Among them, SC -1 PB replaces the inverse operation for the information cell. -1 RK is the inverse operation of matrix permutation. 39 RK 40 These are the keys for rounds 39 and 40, respectively, T i and T j Let i and j be the fault label values, respectively, i ≠ j, and 1 ≤ i ≤ N, 1 ≤ j ≤ N, where N is the total number of fault label values.

[0078] The key expansion algorithm formula can be expressed as follows:

[0079] RK 40 ||RK 39=(k3>>4)||(k2>>8)||(k7>>2)||(k6>>12)| |(k1>>4)||(k0>>8)||(k5>>2)||(k4>>12);

[0080] K=k7||k6||k5||k4||k3||k2||k1||k0

[0081] Among them, RK 39 RK 40 These are the penultimate and final round subkeys, k, respectively. n These are bytes 0 through 7 of the master key.

[0082] The following details how to perform fault analysis on the GIFT-COFB authentication encryption algorithm using this implementation method during the penultimate round of fault injection.

[0083] When processing the same plaintext message with the same key using the GIFT-COFB cryptographic algorithm, an attacker can obtain an erroneous output by changing the experimental environment (normal conditions versus conditions affected by physical factors such as clock, voltage, humidity, radiation, pressure, light, and eddy currents). This erroneous output can then be used to deduce key information. An attacker can induce random faults during the execution of the GIFT-COFB algorithm, but the specific location of the fault is unknown. Therefore, obtaining the location of the fault is crucial. This invention employs a half-byte random fault model, with the fault location being the penultimate round. This implementation assumes that the device equipped with the GIFT-COFB authentication encryption algorithm has an authentication mechanism, and information is only output upon successful authentication. Therefore, this invention simulates both encryption and authentication steps in software simulation. Ciphertext and tag values ​​are only output upon successful tag verification; thus, the collected tags are all tag values ​​affected by invalid faults. Figure 1 As shown, the specific method is as follows:

[0084] Step 1: Randomly generate plaintext messages to be processed, denoted as X∈{{0,1} 4} 32 ;

[0085] Step 2: Using the random number N, associated data A, and plaintext X as input to the GIFT-COFB algorithm, a fault is introduced during the operation of the cryptographic system. A half-byte random fault model is used, injected in the penultimate round, resulting in erroneous ciphertext output. And collect the output label T, where label T is the label value after being affected by invalid faults;

[0086] Step 3: Repeat steps 1 to 2 until a sufficient number of labels T are obtained;

[0087] Step 4: Calculate intermediate states. Derive the fault propagation path diagram based on the possible injection locations of the fault, in order to... Figure 2 For example, assuming the random fault injection occurs in the last half-byte, after two rounds of computation and propagation, it will affect RK. 39 2 bits and RK 40 The system has 8 bits in total, which is 10 bits. Therefore, by enumerating the 10 bits at the corresponding positions, we can deduce the intermediate state value affected by the fault, i.e., the state value at the fault injection position. The formula is as follows:

[0088]

[0089] Step 5: Obtain the intermediate state values Grouped according to key candidate values;

[0090] Step 6: Calculate the difference between the intermediate state values ​​corresponding to each subkey candidate value. For example, RK 40 =10110000, RK 39 When = 10, intermediate state and By performing the difference, we obtain The formula is as follows:

[0091]

[0092] Step 7: Use statistical methods to determine the intermediate state values. The Hamming weight, where the Hamming weight represents the number of '1's contained in the binary form of the intermediate state. For example, when The binary representation of 139 is 10001011, then The weight of the Hamming is 4;

[0093] Step 8: Select the set of intermediate state values ​​with the smallest Hamming weight value. The corresponding subkey candidate value is the 10 bits of the correct subkey.

[0094] Step 9: Repeat steps 1 to 8 until the correct values ​​of all bits of the penultimate round subkey and the final round subkey are determined, i.e., the penultimate round original subkey and the final round original subkey;

[0095] Step 10: Restore the master key. Based on, as shown below... Figure 3 The key arrangement scheme of the GIFT-COFB algorithm with a block length of 128 bits, as shown, can be used to deduce the master key K, as follows:

[0096] RK 40 ||RK 39=(k3>>4)||(k2>>8)||(k7>>2)||(k6>>12)| |(k1>>4)||(k0>>8)||(k5>>2)||(k4>>12);

[0097] K=k7||k6||k5||k4||k3||k2||k1||k0

[0098] The fault importing action in step 2 can be achieved through software simulation or by processing the real hardware using techniques such as laser, electromagnetic, and voltage interference.

[0099] In step 2, during the processing of plaintext X using the GIFT-COFB authentication encryption algorithm, to ensure the accuracy of the experimental results, it is necessary to strictly control the experimental environment to obtain the corresponding output. The specific experimental environment is as follows: Figure 4 As shown, the computer is used to generate the plaintext X input to GIFT-COFB, and to process and analyze the output of the plaintext input after it has been processed by the GIFT-COFB algorithm; the device that encapsulates the GIFT-COFB algorithm is used to process the input message and obtain the corresponding output; the device that imports faults is used to perform the import fault action, which will be performed during the operation of the GIFT-COFB algorithm, thereby obtaining the output of the erroneous ciphertext and the tag value.

[0100] Using the above analysis method, this invention simulated the import failure and GIFT-COFB authentication encryption algorithm processing on a computer with an Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz 1.99GHz and 8GB of memory, using the IDEA development tool. The simulation was repeated 2000 times, and the experimental results show that the above detection method is accurate. The method provided by this invention is easy to implement, fast, and highly accurate, and is of great significance to the security research of the GIFT-COFB authentication encryption algorithm.

Claims

1. A fault analysis method for the GIFT-COFB algorithm, characterized in that, Includes the following steps: S0. Perform random fault injection on the GIFT-COFB algorithm to obtain a set number of fault tag values; S1. Determine the subkey bit affected by the random fault based on the location of the random fault injection, enumerate the subkey bits to obtain multiple subkey candidate values, the subkey bits include the last round subkey bit and the penultimate round subkey bit; S2. Calculate the difference value of the intermediate state value obtained from the same subkey candidate value, and count the Hamming weight of the difference value; S3. Find the minimum value of the Hamming weight, and find the correct value of the subkey candidate value, which is the correct value of the subkey bits; S4. Repeat steps S1-S3 until the original subkey is determined; S5. Restore the master key using the original subkey according to the key expansion algorithm formula.

2. The method according to claim 1, characterized in that, The intermediate state value is the state value of the random fault injection location.

3. The method according to claim 1, characterized in that, The calculation of the difference value of the intermediate state value derived from the same subkey candidate value includes: For any of the subkey candidate values, the intermediate state value is calculated by inversely calculating it with any of the fault tag values, and then the difference value is obtained by pairwise difference calculation of the intermediate state value.

4. The method according to claim 1, characterized in that, Determining the subkey bits affected by the random fault based on the location of the random fault injection includes: Deriving the fault propagation path based on the GIFT-COFB algorithm; Based on the fault propagation path, the subkey bits are derived using the location of the random fault injection.

5. The method according to claim 1, characterized in that, The random fault injection into the GIFT-COFB algorithm includes: Generate random plaintext information to be processed; The random plaintext information is encrypted using the GIFT-COFB algorithm, and a fault is injected into the encryption round. Collect the output fault label values.

6. The method according to claim 5, characterized in that, The encryption round is set to the penultimate round.

7. The method according to claim 6, characterized in that, The injected fault is a half-byte random fault.

8. The method according to claim 7, characterized in that, The difference value Calculated using the following formula: Among them, SC -1 PB replaces the inverse operation for the information cell. -1 RK is the inverse operation of matrix permutation. 39 RK 40 These are the penultimate and final round subkeys, T. i and T j Let i and j be the fault label values, respectively, i ≠ j, and 1 ≤ i ≤ N, 1 ≤ j ≤ N, where N is the total number of fault label values.

9. The method according to claim 7, characterized in that, The key expansion algorithm formula is as follows: RK 40 ||RK 39 =(k3>>>4)||(k2>>>8)||(k7>>>2)||(k6>>>12)||(k1>>>4)||(k0>>>8)||(k5>>>2)||(k4>>>12); K=k7||k6||k5||k4||k3||k2||k1||k0 Among them, Rk 39 Rk 40 These are the penultimate and final round subkeys, respectively, and k0 to k7 are the 0th to 7th bytes of the master key, respectively.

Images