A hardware implementation method for cryptographic code that resists side-channel attacks based on loop expansion structure

Abstract

The present invention discloses a method for realizing cryptographic hardware against side channel attacks based on a loop expansion structure, and belongs to the field of information security technology. The method comprises selecting a cryptographic algorithm based on a round function, and determining the number of iterations N of the round function; selecting the number of loop expansions that can be divided by the number of iterations N; using cryptographic hardware of multiple loop expansion structures according to the number of loop expansions; calculating the sensitive intermediate value corresponding to the register leakage model according to the cryptographic hardware of the loop expansion structure, and analyzing the key search space of the sensitive intermediate value; performing a first screening through the key search space to select cryptographic implementations with the ability to resist side channel attacks; performing a second screening through information leakage detection to select cryptographic implementations with the corresponding ability to resist side channel attacks; combining the above screening results, screening cryptographic implementations against side channel attacks, and selecting cryptographic implementations with the ability to resist side channel attacks and high throughput per unit area.

Description

Technical Field

[0001] The invention belongs to the field of information security technology, and in particular relates to a method for realizing cryptographic hardware that resists side-channel attacks based on a loop expansion structure. Background Art

[0002] Cryptography technology, as the core and cornerstone of network and information security, is the most effective, reliable and economical means of protection, and plays an irreplaceable role in mobile communications, government affairs, transportation, finance, economy and residents' lives.

[0003] In modern cryptography, cryptographic algorithms can be divided into two categories: symmetric and asymmetric, depending on whether the same key is used for encryption and decryption. Block ciphers, as an important branch of symmetric cryptographic algorithms, are widely used in many fields that require data security and privacy protection because of their advantages such as fast encryption speed after data grouping, high efficiency of software and hardware implementation, and rapid security assessment. The application effect of block cipher algorithms greatly depends on their implementation carriers, including software, hardware, and firmware. With the revolutionary development of integrated circuit (IC) technology in the past 30 years, cryptographic hardware has become one of the most widely used cryptographic implementation carriers, which is significantly superior to software implementation in terms of performance and security.

[0004] As an important common basic unit in integrated circuits, cryptographic hardware is widely used in various systems and devices, such as general systems, smart phones / tablets, embedded systems, radio frequency tags, sensor networks, etc., to provide confidentiality protection for information security.

[0005] However, side channel attacks such as energy analysis and electromagnetic analysis are difficult to detect, posing a serious threat to the security of cryptographic hardware. Since 2002, both international standards (ISO / IEC17825) and national standards (GM0083-2020) have gradually made the ability to resist side channel attacks one of the important security requirements for the development of cryptographic hardware.

[0006] The design of cryptographic hardware to resist side channel attacks includes technical ideas such as masking, hiding, and utilizing hardware structural characteristics. Among them, masking and hiding are technical ideas for side channel attack protection frequently used in academia. The process of randomizing the intermediate values ​​of the cryptographic algorithm is called masking. Masking schemes include RSM low entropy masking schemes, threshold implementation schemes, ISW masking schemes, etc. The process of randomizing or homogenizing side information leakage is called hiding. Hiding schemes include frequency conversion or disorder schemes, dual-rail pre-charge logic schemes, etc. Utilizing hardware structural characteristics means adjusting or redesigning the hardware structure to resist side channel attacks according to the locations that are vulnerable to side channel attacks. This method has great flexibility. It is worth noting that the cryptographic implementation that introduces protective measures such as codes and hiding usually brings additional time and area overhead. Therefore, the present invention focuses on utilizing hardware structural characteristics to design cryptographic hardware to resist side channel attacks. Summary of the invention

[0007] The technical problem solved by the present invention is as follows: A cryptographic hardware implementation method for resisting side-channel attacks based on a loop expansion structure is proposed to solve the side-channel attack defense scheme implemented by existing cryptographic hardware, which has the disadvantages of large implementation area, low throughput and usually requiring random numbers. The ability between the loop expansion structure and resistance to side-channel attacks is explored, and a cryptographic hardware implementation method with high throughput per unit area for resisting side-channel attacks is provided.

[0008] Technical solution: In order to solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0009] A method for realizing cryptographic hardware against side channel attacks based on a loop expansion structure comprises the following steps:

[0010] S1: Select a cryptographic algorithm based on the round function and determine the number of iterations N of the round function;

[0011] S2: Select the number of loop unrollings that is divisible by the number of iterations N;

[0012] S3: cryptographic hardware using multiple loop unrolling structures according to the number of loop unrolling times;

[0013] S4: Calculate the sensitive intermediate value corresponding to the register leakage model according to the cryptographic hardware of the loop unrolling structure, and analyze the key search space of the sensitive intermediate value;

[0014] S5: Perform the first screening through the key search space to select the cryptographic implementation that is resistant to side channel attacks;

[0015] S6: Perform a second screening through information leakage detection to select cryptographic implementations with corresponding side channel attack resistance capabilities;

[0016] S7: Combine the screening results of S5 and S6 to screen the cryptographic implementations that are resistant to side channel attacks, and select the cryptographic implementations that have the ability to resist side channel attacks and have a high throughput per unit area.

[0017] Preferably, in S3, cryptographic hardware with a variety of loop expansion structures are used according to the number of loop expansions, including: single-round iteration structure, two-in-one iteration structure, four-in-one iteration structure, eight-in-one iteration structure, sixteen-in-one iteration structure and full expansion structure.

[0018] Preferably, in S4, according to the cryptographic hardware of the loop unrolling structure, the sensitive intermediate value corresponding to the register leakage model is calculated, and the key search space of the sensitive intermediate value is analyzed. Specifically, the content is:

[0019] The leakage model of the register is: HD(R1, R2)+Noise=HW(R1⊕R2)+Noise;

[0020] Among them, R1 and R2 represent the values ​​of the same register in two adjacent cycles; HD represents the Hamming distance; HW represents the Hamming weight; Noise represents noise; ⊕ represents XOR, and R1⊕R2 is called the sensitive intermediate value corresponding to the leakage model of the register.

[0021] Preferably, in S5, the first screening is performed through the key search space to select the cryptographic implementation with the ability to resist side channel attacks, and the specific contents include:

[0022] Screening is performed among cryptographic hardware with various loop expansion structures to select the cryptographic hardware with the largest key search space.

[0023] Preferably, in S6, a second screening is performed through information leakage detection to select the cryptographic implementation with corresponding side channel attack resistance capability. The specific content is:

[0024] For cryptographic hardware with various loop expansion structures, information leakage detection is performed under several energy traces, and the cryptographic hardware with the maximum TVLA value less than 4.5 is selected.

[0025] Preferably, according to TVLA, a set of data is collected, and according to any bit of the sensitive middle value, the data is divided into two groups of samples, LA and LB, wherein LA is the side information that the middle value of the selected bit is 0, and LB is the side information that the middle value of the selected bit is 1;

[0026] The calculation process of using TVLA to detect the device under test is as follows:

[0027]

[0028] in, is the mean of LA, S A2 is the variance of LA; is the mean value of LB, S B 2 is the variance of LB, if |t u |≥4.5, then the hypothesis H0 is rejected, indicating that the cryptographic device has no leakage, then LA and LB are independent of the plaintext key, and their means are equal, indicating that there is information leakage; if not, then H0 is accepted, indicating that LA and LB come from the same distribution, the side information of the two at the corresponding time is independent of the data running in the DUT, and there is no information leakage in the side information.

[0029] Preferably, in S7, the cryptographic implementations that resist side channel attacks are screened in combination with the screening results of S5 and S6, and the specific contents of selecting the cryptographic implementations that have the ability to resist side channel attacks and have a high throughput per unit area are:

[0030] Throughput refers to the ability of a cryptographic hardware unit to process data per unit time. For block ciphers, it is usually defined as the ratio of the block cipher plaintext length to the time required to process the plaintext.

[0031] The throughput per unit area represents the ratio of the throughput to the number of LUTs used by the password, where LUTs represent the lookup table resources in the FPGA.

[0032] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0033] (1) The present invention designs cryptographic hardware that is resistant to side channel attacks from the perspective of cryptographic hardware structure design. The cryptographic hardware implementation method for resistant to side channel attacks based on a loop expansion structure proposed in the present invention can resist side channel attacks without random numbers. Existing masking schemes require random numbers to generate shared factors and refresh masks, but the present invention does not require random numbers.

[0034] (2) The implementation method of the present invention can resist side channel attacks without any special constraints on layout and wiring. The dual-rail pre-charge logic of the existing hidden scheme requires that the positive and negative circuits can be laid out and wired evenly and balanced, while the present invention does not require special layout and wiring requirements.

[0035] The method of the present invention has the characteristics of not requiring random numbers and not requiring special constraints on layout and wiring, and can select a password implementation with high throughput per unit area from a variety of design schemes.

[0036] (3) The implementation method of the present invention is applicable to multi-round iterative cryptographic algorithms, including block cipher algorithms, hash algorithms, and authenticated encryption algorithms, such as AES, SM4, Present, SHA2, SHA3, Ascon, etc.; and can be applied to various hardware platforms such as FPGA and ASIC. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 is an overall flow chart of the method of the present invention;

[0038] Figure 2 It is a single-round iteration structure diagram of SM4 of the present invention;

[0039] Figure 3 It is a two-in-one iterative structure diagram of SM4 of the present invention;

[0040] Figure 4 It is a four-in-one iterative structure diagram of SM4 of the present invention;

[0041] Figure 5 This is an eight-in-one iterative structure diagram of SM4 of the present invention;

[0042] Figure 6 This is a sixteen-in-one iterative structure diagram of SM4 of the present invention;

[0043] Figure 7 This is a fully expanded structural diagram of SM4 of the present invention. DETAILED DESCRIPTION

[0044] The present invention is further illustrated below in conjunction with specific examples. The examples are implemented based on the technical solutions of the present invention. It should be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0045] like Figure 1 As shown, the present application proposes a method for implementing cryptographic hardware against side channel attacks based on a loop expansion structure, which can be used in the side channel attack defense of cryptographic hardware to design cryptographic hardware that resists side channel attacks. Specifically, it can be applied to the design of high-security cryptographic chips, such as bank cards in finance and economy, bus cards in government and transportation, and mobile phone chips in mobile communications, to protect privacy and data security.

[0046] The specific steps include:

[0047] S1: Select a cryptographic algorithm based on the round function and determine the number of iterations N of the round function;

[0048] In this embodiment, taking the SM4 cryptographic algorithm as an example, the number of iterations N of the round function is 32.

[0049] S2: Select the number of loop unrollings that is divisible by the number of iterations N;

[0050] In this embodiment, the number of loop unrollings for the iteration number 32 includes 1, 2, 4, 8, 16, and 32.

[0051] S3: cryptographic hardware using multiple loop unrolling structures according to the number of loop unrolling times;

[0052] like Figure 1-6 As shown in the figure, six types of cryptographic hardware with loop expansion structures are designed, namely single-round iteration structure (see Appendix Figure 1 ), two-in-one iterative structure (see attached Figure 2 ), four-in-one iterative structure (see attached Figure 3 ), eight-in-one iteration structure (see attached Figure 4 ), 16-in-1 iterative structure (see attached Figure 5 ) and the fully expanded structure (see attached Figure 6 ).

[0053] Figure 1-6 In the example, R1-R3 are registers, nr0-nr2 are line values, and P0-P3 represent the first, second, third, and fourth words of the plain text from high to low. LUT stands for lookup table (indicates the combinational logic implemented by the lookup table LUT in the FPGA).

[0054] S4: According to the cryptographic hardware of the loop unrolling structure, the sensitive intermediate value corresponding to the register leakage model is given, and the key search space of the sensitive intermediate value is analyzed;

[0055] The register leakage models of SM4 with different structures and the calculation process of sensitive intermediate values ​​corresponding to the leakage models are shown in Table 2.

[0056] In FPGA and ASIC, since the signal-to-noise ratio of the line value is very low, it is extremely difficult to use it for side channel attacks. Usually, only register leakage is considered, and the leakage of the line value is not considered. Table 1 below shows the key search space corresponding to different structures.

[0057] Table 1 Key search space corresponding to different structures

[0058]

[0059] The leakage model of the register is: HD(R1, R2)+Noise=HW(R1⊕R2)+Noise;

[0060] Among them, R1 and R2 represent the values ​​of the same register in two adjacent cycles; HD represents the Hamming distance; HW represents the Hamming weight; Noise represents noise; ⊕ represents XOR, and R1⊕R2 is called the sensitive intermediate value corresponding to the leakage model of the register.

[0061] As shown in Table 2 below, specific leakage models and sensitive intermediate values ​​corresponding to different structural implementations are given.

[0062] Table 2 Calculation of sensitive intermediate values ​​corresponding to different structures

[0063]

[0064]

[0065] Among them, M1, M2, ……, M6 represent leakage models of different structures, and the specific corresponding situations are shown in Table 2.

[0066] X0, X1, X2, X3 are 32-bit data, and P is 128-bit plaintext. C0, C1, C2, C3 are 32-bit data, and C is 128-bit ciphertext. It satisfies (X0, X1, X2, X3) = P; (C0, C1, C2, C3) = C. X4, X5, ……, X 35 , represent the output of the first-round round function of SM4, the output of the second-round round function, ……, the output of the 32nd-round round function. rk i is the round key of the i-th round of SM4, Sbox represents the S-box operation in the SM4 algorithm, and <<<k represents a 32-bit cyclic left shift by k bits.

[0067] The calculation of T is shown in the following formula.

[0068]

[0069] The encryption or decryption process of SM4 contains 32 rounds of round function iterations, X4, X5, ……, X 35 , respectively represent the output of the first-round round function of SM4, the output of the second-round round function, ……, the output of the 32nd-round round function. For details, refer to the standard of "SM4 Cipher Algorithm Used in Wireless Local Area Network Products".

[0070] The order of the round keys used during encryption is: (rk0, rk1, ……, rk 31 ), rk 31 represents the 32nd-round round key of SM4.

[0071] This embodiment attempts to recover the round key rk of SM4 by using the known ciphertext C 31 , and then recover the master key. Therefore, (C0, C1, C2, C3) represents the known ciphertext, where C j represents the j-th word of the ciphertext and is 32 bits.

[0072] S5: Through the key search space, perform the first screening to select the cryptographic implementation with the ability to resist side-channel attacks;

[0073] Screen among various cryptographic hardwares with loop unrolling structures, and select the cryptographic hardware with the largest key search space. Among them, the key search spaces of SM4-8r, SM4-16r, and SM4-32r are 2^128, and they have extremely strong abilities to resist side-channel attacks.

[0074] S6: Perform a second screening through information leakage detection (Test Vector Leakage Assessment, TVLA) to select cryptographic implementations with corresponding side-channel attack resistance capabilities;

[0075] For cryptographic hardware with various loop expansion structures, information leakage detection is performed under 1 million energy traces, and the cryptographic hardware with the maximum TVLA value less than 4.5 is screened.

[0076] As shown in Table 3, the maximum TVLA values ​​of SM4-8r, SM4-16r and SM4-32r are all less than 4.5, and they have the ability to resist side channel attacks under 1 million energy traces.

[0077] According to TVLA, a set of data is collected, which is the energy or electromagnetic information (called energy trace or electromagnetic trace) collected during the operation of the cryptographic algorithm. According to any bit of the sensitive intermediate value, the data is divided into two groups of samples, LA and LB, where LA is the side information with the selected bit intermediate value of 0 and LB is the side information with the selected bit intermediate value of 1. Both are n*m ​​matrices, n is the number of side information, and m is the number of sampling points contained in each side information.

[0078] The calculation process of using TVLA to detect the device under test is as follows:

[0079]

[0080] in, is the mean of LA, S A 2 is the variance of LA; is the mean value of LB, S B 2 is the variance of LB. If |t u |≥4.5, then the hypothesis H0 is rejected, indicating that the cryptographic device has no leakage, then LA and LB are independent of the plaintext key, and their means are equal, indicating that there is information leakage; if not, then H0 is accepted, indicating that LA and LB come from the same distribution, and the side information of the two at the corresponding time is independent of the data running in the DUT, and there is no evidence to support the existence of information leakage in the side information.

[0081] Table 3. Information leakage detection results of different passwords when using 1 million energy traces

[0082]

[0083]

[0084] S7: Combine the screening results of S5 and S6 to screen the cryptographic implementations that resist side channel attacks, and select the cryptographic implementations that have the ability to resist side channel attacks and have a high throughput per unit area. As shown in Table 4, the cryptographic implementation that has the ability to resist side channel attacks and has a high throughput per unit area is SM4-8r.

[0085] Throughput (TP) refers to the ability of a cryptographic hardware unit to process data per unit time. For block ciphers, it is usually defined as the ratio of the block cipher plaintext length to the time required to process the plaintext. For example, the plaintext input of SM4 is 128 bits, and the time required to process the plaintext is the number of cycles × clock delay. Therefore, the throughput calculation TP = 128 / (number of cycles × clock delay).

[0086] The throughput per unit area represents the ratio of the throughput to the number of LUTs used by the password, where LUTs represent the lookup table resources in the FPGA.

[0087] Table 4 Throughput per unit area of ​​different SM4

[0088]

[0089] The present invention designs cryptographic hardware to resist side-channel attacks from the perspective of cryptographic hardware structure design. Existing masking schemes require random numbers to generate shared factors and refresh masks, but the present invention does not require random numbers. The dual-track precharge logic of existing hiding schemes requires that the positive and negative circuits can be laid out and wired evenly and balanced, but the present invention does not require special layout and wiring requirements. The method of the present invention has the characteristics of not requiring random numbers and not requiring special constraints on layout and wiring, and a cryptographic implementation with high throughput per unit area can be selected from a variety of design schemes.

[0090] The implementation method of the present invention is applicable to multi-round iterative cryptographic algorithms, including block cipher algorithms, hash algorithms, and authenticated encryption algorithms, such as AES, SM4, Present, SHA2, SHA3, Ascon, etc.; and can be applicable to various hardware platforms such as FPGA and ASIC.

[0091] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for implementing cryptographic hardware against side channel attacks based on a loop expansion structure, characterized in that: The following steps are involved: S1: Select a cryptographic algorithm based on the round function and determine the number of iterations N of the round function; S2: Select the number of loop unrollings that is divisible by the number of iterations N; S3: cryptographic hardware using multiple loop unrolling structures according to the number of loop unrolling times; S4: Calculate the sensitive intermediate value corresponding to the register leakage model according to the cryptographic hardware of the loop unrolling structure, and analyze the key search space of the sensitive intermediate value; S5: Perform the first screening through the key search space to select the cryptographic implementation that is resistant to side channel attacks; S6: Perform a second screening through information leakage detection to select cryptographic implementations with corresponding side channel attack resistance capabilities; S7: Combine the screening results of S5 and S6 to screen the cryptographic implementations that are resistant to side channel attacks, and select the cryptographic implementations that have the ability to resist side channel attacks and have a high throughput per unit area.

2. The method for realizing side-channel attack-resistant cryptographic hardware based on loop expansion structure according to claim 1, characterized in that: In S3, cryptographic hardware with a variety of loop expansion structures are used according to the number of loop expansions, including: single-round iteration structure, two-in-one iteration structure, four-in-one iteration structure, eight-in-one iteration structure, sixteen-in-one iteration structure and full expansion structure.

3. The method for implementing a cryptographic hardware that resists side channel attacks based on a loop expansion structure according to claim 1, characterized in that: In S4, according to the cryptographic hardware of the loop unrolling structure, the sensitive intermediate value corresponding to the register leakage model is calculated, and the key search space of the sensitive intermediate value is analyzed. The specific contents are: The leakage model of the register is: HD(R1, R2)+Noise=HW(R1⊕R2)+Noise; Among them, R1 and R2 represent the values ​​of the same register in two adjacent cycles; HD represents the Hamming distance; HW represents the Hamming weight; Noise represents noise; ⊕ represents XOR, and R1⊕R2 is called the sensitive intermediate value corresponding to the leakage model of the register.

4. The method for realizing side-channel attack-resistant cryptographic hardware based on loop expansion structure according to claim 1, characterized in that: In S5, the first screening is performed through the key search space to select cryptographic implementations that are resistant to side channel attacks. The specific contents include: Screening is performed among cryptographic hardware with various loop expansion structures to select the cryptographic hardware with the largest key search space.

5. The method for realizing side-channel attack-resistant cryptographic hardware based on loop expansion structure according to claim 1, characterized in that: In S6, a second screening is performed through information leakage detection to select the cryptographic implementation with corresponding anti-side channel attack capability: For cryptographic hardware with various loop expansion structures, information leakage detection is performed under several energy traces, and the cryptographic hardware with the maximum TVLA value less than 4.5 is selected, where TVLA represents information leakage detection.

6. The method for realizing cryptographic hardware against side channel attacks based on loop expansion structure according to claim 5, characterized in that: According to TVLA, a set of data is collected and divided into two groups of samples, LA and LB, according to any bit of the sensitive middle value, where LA is the side information of the selected bit with the middle value of 0, and LB is the side information of the selected bit with the middle value of 1; The calculation process of using TVLA to detect the device under test is as follows: Where n represents the number of side information, is the mean of LA, is the variance of LA; is the mean value of LB, is the variance of LB, if |t u |≥4.5, then the hypothesis H0 is rejected, indicating that the cryptographic device has no leakage, then LA and LB are independent of the plaintext key, and their means are equal, indicating that there is information leakage; if not, then H0 is accepted, indicating that LA and LB come from the same distribution, the side information of the two at the corresponding time is independent of the data running in the DUT, and there is no information leakage in the side information.

7. The method for realizing side-channel attack-resistant cryptographic hardware based on loop expansion structure according to claim 1, characterized in that: In S7, the cryptographic implementations that resist side channel attacks are screened in combination with the screening results of S5 and S6. The specific contents of the cryptographic implementations that have the ability to resist side channel attacks and have a high throughput per unit area are selected as follows: Throughput refers to the ability of a cryptographic hardware unit to process data per unit time. For block ciphers, it is usually defined as the ratio of the block cipher plaintext length to the time required to process the plaintext. The throughput per unit area represents the ratio of the throughput to the number of LUTs used by the password, where LUTs represent the lookup table resources in the FPGA.

Images