Method, system, device and medium for searching valuable subcubes based on cubic attack
By using the mononomial prediction model and core mononomial prediction model in cubic attacks, the serious time-consuming problem of the construction and judgment process in the existing technology is solved, and efficient cubic attacks are achieved.
Patent Information
- Application Number
- CN202410570322.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-05-09
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2044-05-09
AI Technical Summary
In existing cube attacks, the mother cube construction and subcube value judgment process are very time-consuming, especially in high-dimensional situations, resulting in inefficiency of actual attacks.
By applying for the mononomial prediction model MP and the core mononomial prediction model CMP in the public algorithm library, IV variables are added successively to build a mother cube, and CMP is used to determine whether the subcube contains a linear mononomial trajectory to quickly judge its value.
It significantly shortens the mother cube construction time, reduces it from half a month to less than one day, and improves the efficiency of subcube value judgment, and can quickly reject a large number of worthless cubes.
Smart Images
Figure CN118487807B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of cubic attack, and in particular relates to a method, system, device and medium for searching valuable subcubes based on cubic attack. Background Art
[0002] The actual cubic attack currently applied to the Trivium algorithm involves the construction of the mother cube and the value judgment of the subcube. The construction of the mother cube is conducive to reducing the computational complexity of the online attack stage of the cubic attack. In the mother cube construction process of the existing method, it is necessary to continuously add non-cube IV variables to the low-dimensional starting cube so that the order of the super polynomial corresponding to the current cube set decreases the fastest. Each time a non-cube IV variable is added, the order of the super polynomial corresponding to the cube set after adding each non-cube IV variable needs to be evaluated, and then the non-cube IV with the fastest order decrease is selected for addition. This process involves a large number of order evaluation processes and is very time-consuming. Then, in the subcube value judgment process, the super polynomial corresponding to the subcube contains linear monomials as a valuable judgment standard. To judge whether the super polynomial corresponding to the subcube contains linear monomials, it is necessary to collect all linear monomial trajectories. If there are an odd number of linear monomial trajectories, the subcube is judged to be valuable. This process is very time-consuming.
[0003] In summary, the existing mother cube construction process and subcube value judgment process are very time-consuming. For 820 rounds of Trivium's actual cube attack, it takes more than half a month to build two 52-dimensional mother cubes on a PC configured with Intel(R) Core(TM) i7-9700 CPU@3.00GHz3.00GHz. Summary of the invention
[0004] In order to overcome the disadvantage of slow search speed of valuable subcubes, the present invention provides a valuable subcube search method based on cubic attack, comprising the following steps:
[0005] Apply IV variables in the public algorithm library, solve the monomial prediction model MP, and obtain a 45-dimensional starting cube;
[0006] Add IV variables that make the order of the super polynomial corresponding to the cube decrease the fastest to the starting cube one by one. When the algebraic degree of the super polynomial corresponding to the starting cube drops to 0, remove the IV variables added last time, and then add IV variables that make the order of the super polynomial corresponding to the cube decrease the slowest one by one until the algebraic degree of the super polynomial corresponding to the starting cube drops to 0, and get the mother cube.
[0007] The core monomial prediction model CMP is used to determine whether each subcube in the mother cube has a linear monomial trajectory. If so, the current subcube is determined to be a valuable cube.
[0008] Preferably, solving the monomial prediction model MP to obtain a 45-dimensional starting cube comprises the following steps:
[0009] Apply for model M and secret variables in the public algorithm library;
[0010] Using Trivium's monomial trajectory propagation rule, the number of IV variables is set to 45 as the solution target of model M. There is no limit on the number of secret variables. The solution mode is set to obtain all feasible solutions. A 45-dimensional IV variable with an algebraic degree less than 20 is selected from the solution set as the starting cube.
[0011] Preferably, the step of determining whether the current subcube is a valuable cube comprises the following steps:
[0012] Apply for model M, IV variables and secret variables in the public algorithm library;
[0013] Using Trivium’s core monomial trajectory propagation rule, the number of secret variables is set to 1 as the solution target of model M, and the IV variable is fixed;
[0014] Set the solving mode to obtain a feasible solution and set the number of solving rounds;
[0015] Get the mother cube under the number of rounds solved;
[0016] Use CMP to determine whether each subcube in the mother cube has a linear monomial track, then perform algebraic degree detection on the super polynomial corresponding to the subcube. If the order of the super polynomial corresponding to the subcube is less than 10, restore the complete super polynomial corresponding to the subcube. If the super polynomial corresponding to the subcube contains independent linear terms, the current subcube is finally determined to be a valuable cube.
[0017] Preferably, after determining that the current subcube is a valuable cube, the method further includes performing super polynomial recovery on the valuable cube to obtain a subcube containing independent linear variables.
[0018] The present invention also provides a valuable subcube search system based on cubic attack, comprising:
[0019] The starting cube acquisition module is used to apply for IV variables in the public algorithm library, solve the monomial prediction model MP, and obtain a 45-dimensional starting cube;
[0020] The mother cube acquisition module is used to successively add IV variables that make the order of the super polynomial corresponding to the cube decrease the fastest to the starting cube. When the algebraic degree of the super polynomial corresponding to the starting cube decreases to 0, remove the IV variables added last time, and then successively add IV variables that make the order of the super polynomial corresponding to the cube decrease the slowest, until the algebraic degree of the super polynomial corresponding to the starting cube decreases to 0, and obtain the mother cube;
[0021] The valuable cube determination module is used to use the core monomial prediction model CMP to determine whether each subcube in the mother cube has a linear monomial trajectory. If so, the current subcube is determined to be a valuable cube.
[0022] The present invention also provides a computer device, comprising a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute the search method.
[0023] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor to execute the search method.
[0024] The valuable subcube search method, system, device and medium based on cubic attack provided by the present invention have the following beneficial effects:
[0025] The present invention can obtain a 45-dimensional high-dimensional starting cube by solving the MP model, and can become a mother cube by adding a small amount of IV variables to the starting cube, which greatly reduces the degree of order evaluation and shortens the time to obtain the mother cube; and then by using the CMP model, it is only necessary to determine whether the subcube in the mother cube has a linear monomial trajectory to determine whether the cube is valuable, that is, through a quick judgment of the cube's value, a large number of cubes can be rejected, which significantly improves the time to determine whether the cube is valuable. By using the method of the present invention, on a PC configured as Intel (R) Core (TM) i7-9700 CPU @ 3.00GHz3.00 GHz, for 820 rounds of Trivium's actual cube attack, it only takes less than 1 day to build two 52-dimensional mother cubes. Under the same PC configuration, it takes 15 days to build two 52-dimensional mother cubes using the best previous method. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] In order to more clearly illustrate the embodiment of the present invention and its design scheme, the following briefly introduces the drawings required for this embodiment. The drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0027] Figure 1 The figure is a flowchart of a method for searching for valuable subcubes according to an embodiment of the present invention. DETAILED DESCRIPTION
[0028] In order to enable those skilled in the art to better understand the technical solution of the present invention and implement it, the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention.
[0029] In the description of the present invention, it is to be understood that the terms “center”, “longitudinal”, “lateral”, “length”, “width”, “thickness”, “up”, “down”, “front”, “back”, “left”, “right”, “vertical”, “horizontal”, “top”, “bottom”, “inside”, “outside”, “axial”, “radial”, “circumferential”, etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are only for the convenience of describing the technical solutions of the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.
[0030] In addition, the terms "first", "second", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance. In the description of the present invention, it should be noted that, unless otherwise clearly specified or limited, the terms "connected" and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to the specific circumstances. In the description of the present invention, unless otherwise specified, "plurality" means two or more, which will not be described in detail here.
[0031] Example
[0032] The present invention provides a valuable subcube search method based on cubic attack, specifically as follows Figure 1 As shown, the following steps are included:
[0033] Step 1: Apply for IV variables in the public algorithm library, solve the monomial prediction model MP, and obtain a 45-dimensional starting cube.
[0034] Apply for model M, IV variables and secret variables in gurobi (a public algorithm library); set the number of IV variables to 45 as the solution target of model M according to the Trivium monomial trajectory propagation rule, and do not limit the number of secret variables; set the solution mode to obtain all feasible solutions; select a 45-dimensional IV variable with an algebraic degree less than 20 in the solution set as the starting cube.
[0035] Step 2: Add IV variables that make the degree of the super polynomial corresponding to the cube decrease the fastest to the starting cube. When the algebraic degree of the super polynomial corresponding to the starting cube drops to 0, remove the IV variables added last time, and then add IV variables that make the degree of the super polynomial corresponding to the cube decrease the slowest until the algebraic degree of the super polynomial corresponding to the starting cube drops to 0, and the mother cube is obtained. The mother cube construction algorithm is shown in Table 1:
[0036] Table 1 The construction algorithm of mother cube
[0037]
[0038]
[0039]
[0040] In Algorithm 1, the present invention initializes an array Mothercube[] in line 1 to store the finally obtained mothercube, and initializes an array Startingcube[] to store the starting cube in the intermediate process of building the mother cube; in line 2 of the algorithm, initializes a set C I Store the candidate set of updated cubes; in steps 6 to 33 of the algorithm, the present invention creates a gurobi solution model M, and sets its solution mode to find all feasible solutions (by setting a large number of solutions, here 2000), and initializes 288 binary variables k corresponding to the number of Trivium state bits i , i∈{0, 1, ..., 287}, and fix the first 80 variable values representing the state bits of the Trivium secret variable to 0, and then set k i , the attributes of i∈{0, 1, ..., 287} are assigned to the intermediate variable w i , i∈{0, 1, ..., 287}, using Trivium's update function, w i , i∈{0, 1, ..., 287} is updated N times, and the output of Trivium's key stream is w i , the sum of i∈{65, 92, 161, 176, 242, 172} is 1, and the cubic variable w i , i∈{93, 94, ..., 172} The number of values of 1 is 45. Set it as the solution target of model M, solve the model, and store a solution corresponding to the super polynomial order less than 20 in the model solution set into Startingcube[]. Lines 34 to 38 of the algorithm generate all possible cubes for updating the cube and put them into the set C I In the 40-58th line of the algorithm, in the cube set C I Find the corresponding super polynomial c with the fastest algebraic degree decrease I , if c I When the order of the corresponding super polynomial drops to 0, it starts from the cube set C I Find the c that makes the corresponding super polynomial decrease the slowest I , until we find the c corresponding to the super polynomial with algebraic degree of 0 I , and store it in Mothercube[].
[0041] Step 3: Use the core monomial prediction model CMP to determine whether each subcube in the mother cube has a linear monomial trajectory. If so, the current subcube is determined to be a valuable cube. The algorithm for quickly searching for Trivium's valuable subcubes is shown in Table 2:
[0042] Table 2 Valuable subcube search algorithm
[0043] Table2 Valuable subcube search algorithm
[0044]
[0045]
[0046] In Algorithm 2, you need to input the target number of rounds of the Trivium algorithm you want to detect, and the algorithm outputs the valuable subcubes of Trivium under the target number of rounds, recorded as VSubcubes[]. In lines 3 to 4 of the algorithm, first initialize the array subcubes[] that stores the valuable subcubes determined by the Determine() function, initialize the array VSubcubes[] that stores the final valuable subcubes, initialize the array Mothercube[] that stores the mother cube, and initialize the counters i and j. In line 5 of the algorithm, use the function Mothercube() to get a mother cube. In lines 6 to 15 of the algorithm, the mother cube is initialized. Each subcube of the cube is judged to be valuable, and the subcubes judged to be valuable are stored in subcubes[]. Lines 17 to 24 of the algorithm estimate the algebraic degree of each subcubes stored in subcubes[]. If the algebraic degree is less than 10, the present invention will use the CMP model to restore its complete super polynomial, and store the subcubes containing linear independent terms in the complete super polynomial in VSubcubes[].
[0047] According to Algorithm 2, the steps to determine whether the current subcube is a valuable cube are as follows: apply for model M, IV variables and secret variables in the public algorithm library; use Trivium's core monomial trajectory propagation rule to set the number of secret variables to 1 as the solution target of model M, and fix the IV variable; set the solution mode to obtain a feasible solution, and set the number of solution rounds; obtain the mother cube under the number of solution rounds; use CMP to determine whether each subcube subcub in the mother cube has a linear monomial trajectory, then perform algebraic degree detection on the super polynomial corresponding to the subcube. If the order of the super polynomial corresponding to the subcube is less than 10, restore the complete super polynomial corresponding to the subcube. If the super polynomial corresponding to the subcube contains independent linear terms, the current subcube is finally determined to be a valuable cube.
[0048] Step 4: Perform super polynomial recovery on the valuable cube to obtain a subcube containing independent linear variables.
[0049] In the actual secret variable recovery attack, it is necessary to find enough cubes whose corresponding super polynomials contain linear independent monomials. Traditional cubic attacks can only determine whether the super polynomial corresponding to the cube is a linear super polynomial through experiments. However, with the increase in the number of initialization rounds of the cryptographic algorithm, the number of cubes whose corresponding super polynomials are linear is getting smaller and smaller, and the dimension of the cube is getting larger and larger. The method of determining whether the cube is valuable through experiments is time-consuming and does not meet the needs of the actual secret variable recovery attack. In fact, the necessary condition for the super polynomial to contain linear terms is to contain linear separable trajectories. The detection of separable trajectories is faster than the detection of linear terms. In summary, the present invention proposes a faster valuable cube discrimination algorithm, and the details of the algorithm are shown in Algorithm 3.
[0050] Table 3 Subcube value judgment algorithm
[0051] Table 3 The value judgment algorithm of subcube
[0052]
[0053] In Algorithm 3, the target number of rounds Rounds and the selected cube set cube[] are input, and the output is the tag Tag to judge whether cube[] has value; in lines 3 to 4 of the algorithm, the tag that records whether cube[] is valuable is initialized, and the array TERM[] storing the back-pushing items is initialized; in lines 5 to 12 of the algorithm, the function BackExpand(Rounds) in the CMP model is first used to obtain the back-pushing items, and then the CMP model is used to restore the monomial of TERM[] that can be propagated to the back-pushing items. If the model has a solution, cube[] is judged to be a valuable cube; by performing super polynomial recovery on valuable cubes, the accurate judgment of whether the cube implementation is valuable can be improved.
[0054] The present invention also provides a valuable subcube search system based on cubic attack, comprising a starting cube acquisition module, a mother cube acquisition module, and a valuable cube determination module. The starting cube acquisition module is used to apply for IV variables in a public algorithm library, solve the monomial prediction model MP, and obtain a 45-dimensional starting cube cube; the mother cube acquisition module is used to successively add IV variables that make the super polynomial order corresponding to the cube decrease the fastest to the starting cube, when the algebraic degree of the super polynomial corresponding to the starting cube decreases to 0, remove the IV variables added last time, and then successively add IV variables that make the super polynomial order corresponding to the cube decrease the slowest, until the algebraic degree of the super polynomial corresponding to the starting cube decreases to 0, and obtain the mother cube mother cube; the valuable cube determination module is used to use the core monomial prediction model CMP to determine whether each subcube subcub in the mother cube has a linear monomial track, and if so, determine that the current subcube is a valuable cube.
[0055] The present invention also provides a computer device, comprising a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute the search method.
[0056] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor to execute the search method.
[0057] From the above description, it can be seen that the present invention can obtain a 45-dimensional high-dimensional starting cube by solving the monomial prediction model MP. By adding a small amount of IV variables to the starting cube, it can become a mother cube, which greatly reduces the degree of order evaluation and shortens the time to build the mother cube.
[0058] By using CMP, we only need to determine whether the subcub in the mother cube has a linear monomial trajectory to determine whether the cube is valuable. That is, through a quick judgment of the cube's value, a large number of cubes can be rejected, which significantly reduces the time to determine whether the cube is valuable. In addition, by performing super polynomial recovery on valuable cubes, we can improve the accuracy of determining whether the cube is valuable.
[0059] The present invention proposes a method for quickly constructing a mother cube and a method for quickly judging the value of a subcube. Through these two methods, a method for quickly searching for valuable subcubes is designed. On a PC configured with Intel(R) Core(TM) i7-9700 CPU@3.00GHz3.00 GHz, for 820 rounds of Trivium's actual cube attack, it only takes less than 1 day to build two 52-dimensional mother cubes.
[0060] The embodiments described above are only preferred specific implementation modes of the present invention, and the protection scope of the present invention is not limited thereto. Any simple changes or equivalent replacements of the technical solutions that can be obviously obtained by any technician familiar with the field within the technical scope disclosed in the present invention belong to the protection scope of the present invention.
Claims
1. A valuable subcube search method based on cubic attack, characterized in that: The steps include: Apply IV variables in the public algorithm library, solve the monomial prediction model MP, and obtain a 45-dimensional starting cube; Add IV variables that make the order of the super polynomial corresponding to the cube decrease the fastest to the starting cube one by one. When the algebraic degree of the super polynomial corresponding to the starting cube drops to 0, remove the IV variables added last time, and then add IV variables that make the order of the super polynomial corresponding to the cube decrease the slowest one by one until the algebraic degree of the super polynomial corresponding to the starting cube drops to 0, and get the mother cube. Use the core monomial prediction model CMP to determine whether each subcube in the mother cube has a linear monomial trajectory. If so, the current subcube is considered to be a valuable cube. The monomial prediction model MP is solved to obtain a 45-dimensional starting cube, including the following steps: Apply for model M and secret variables in the public algorithm library; Using Trivium's monomial trajectory propagation rule, the number of IV variables is set as 45 as the solution target of model M. There is no limit on the number of secret variables. The solution mode is set to obtain all feasible solutions. A 45-dimensional IV variable with an algebraic degree less than 20 is selected from the solution set as the starting cube. The process of determining whether the current subcube is a valuable cube includes the following steps: Apply for model M, IV variables and secret variables in the public algorithm library; Using Trivium’s core monomial trajectory propagation rule, the number of secret variables is set to 1 as the solution target of model M, and the IV variable is fixed; Set the solving mode to obtain a feasible solution and set the number of solving rounds; Get the mother cube under the number of rounds solved; Use CMP to determine whether each subcube in the mother cube has a linear monomial track, then perform algebraic degree detection on the super polynomial corresponding to the subcube. If the order of the super polynomial corresponding to the subcube is less than 10, restore the complete super polynomial corresponding to the subcube. If the super polynomial corresponding to the subcube contains independent linear terms, the current subcube is finally determined to be a valuable cube.
2. The method for searching for valuable subcubes according to claim 1, characterized in that: After determining that the current subcube is a valuable cube, the method further includes performing super polynomial recovery on the valuable cube to obtain a subcube containing independent linear variables.
3. A valuable subcube search system based on cubic attack, characterized in that: include: The starting cube acquisition module is used to apply for IV variables in the public algorithm library, solve the monomial prediction model MP, and obtain a 45-dimensional starting cube; The mother cube acquisition module is used to successively add IV variables that make the order of the super polynomial corresponding to the cube decrease the fastest to the starting cube. When the algebraic degree of the super polynomial corresponding to the starting cube decreases to 0, remove the IV variables added last time, and then successively add IV variables that make the order of the super polynomial corresponding to the cube decrease the slowest, until the algebraic degree of the super polynomial corresponding to the starting cube decreases to 0, and obtain the mother cube; The valuable cube determination module is used to use the core monomial prediction model CMP to determine whether each subcube in the mother cube has a linear monomial trajectory. If so, the current subcube is determined to be a valuable cube; The monomial prediction model MP is solved to obtain a 45-dimensional starting cube, specifically: Apply for model M and secret variables in the public algorithm library; Using Trivium's monomial trajectory propagation rule, the number of IV variables is set as 45 as the solution target of model M. There is no limit on the number of secret variables. The solution mode is set to obtain all feasible solutions. A 45-dimensional IV variable with an algebraic degree less than 20 is selected from the solution set as the starting cube. The determination of whether the current subcube is a valuable cube is as follows: Apply for model M, IV variables and secret variables in the public algorithm library; Using Trivium’s core monomial trajectory propagation rule, the number of secret variables is set to 1 as the solution target of model M, and the IV variable is fixed; Set the solving mode to obtain a feasible solution and set the number of solving rounds; Get the mother cube under the number of rounds solved; Use CMP to determine whether each subcube in the mother cube has a linear monomial track, then perform algebraic degree detection on the super polynomial corresponding to the subcube. If the order of the super polynomial corresponding to the subcube is less than 10, restore the complete super polynomial corresponding to the subcube. If the super polynomial corresponding to the subcube contains independent linear terms, the current subcube is finally determined to be a valuable cube.
4. A computer device, characterized in that: It comprises a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute the search method according to any one of claims 1 to 2.
5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor to execute the search method according to any one of claims 1 to 2.