Differential fault attack method for lightweight cipher gift based on byte model

Abstract

The application discloses a differential fault attack method of a lightweight cipher GIFT based on a byte model, and comprises the following steps: obtaining correct cipher texts generated by using the GIFT algorithm to encrypt plaintexts without injecting byte faults and error cipher texts generated by encrypting the plaintexts after injecting byte faults, wherein the GIFT algorithm is encrypted through a plurality of S boxes; performing an exclusive or operation on the correct cipher texts and the error cipher texts to obtain output differentials of each corresponding S box in the encryption process of target plaintexts, and determining a target S box injected with a byte fault in the plurality of S boxes according to the output differentials of each S box and input differentials of each S box obtained in advance; determining an input value of the target S box in the encryption process of plaintexts without injecting byte faults as a correct input value of the target S box according to the input differentials and the output differentials of the target S box; and recovering an encryption key used by the plaintexts without injecting byte faults and the plaintexts with injecting byte faults through the correct input value of the target S box.

Description

Technical Field

[0001] This application relates to the fields of cryptography and information security technology, and in particular to a differential fault attack method, apparatus, device and medium for GIFT, a lightweight cryptosystem based on the byte model. Background Technology

[0002] As a bridge connecting the physical and digital worlds, the Internet of Things (IoT) technology is improving our lives. However, the security of IoT devices is becoming increasingly prominent, and resources are often severely limited. Therefore, when selecting cryptographic algorithms, in addition to sufficient security, they must also meet performance requirements such as high efficiency and low power consumption. The lightweight cryptographic algorithm GIFT has attracted widespread global attention and plays a crucial role in the IoT. It can provide secure encryption functions on resource-constrained devices while ensuring high device performance, providing a secure and efficient cryptographic protection solution for IoT devices. Compared with traditional cryptographic algorithms, the GIFT algorithm has higher execution efficiency, consumes fewer computational resources, and is suitable for use in micro-computing devices with limited computing power.

[0003] Side-channel attacks are a type of attack that indirectly obtains sensitive information by monitoring the physical characteristics of a cryptographic system during execution (such as power consumption, electromagnetic radiation, and timing). Differential fault attacks are a type of side-channel attack that introduces faults into the execution of a cryptographic algorithm and uses differential analysis to recover key information, thereby breaking the cryptographic system. Currently, differential fault attacks are widely used in the security evaluation of various GIFT algorithms.

[0004] There are two main approaches to differential fault attacks on the GIFT algorithm: First, starting from the round function of the GIFT algorithm, the basic idea of ​​differential faults is incorporated, leading to two new bit-based differential fault attack methods to recover the master key information. However, this approach is difficult to implement, has high uncertainty, and requires a large number of faults. Second, a differential fault attack method based on random half-bytes is used to analyze the key state information of the GIFT algorithm. However, the attack efficiency is limited by the accuracy of the fault injection and the fault tolerance of the target system, and may face limitations from defense mechanisms, leading to increased attack complexity and reduced success rate.

[0005] Therefore, the implementation of differential fault attack methods in the current GIFT algorithm is quite difficult and the success rate is not high, which is not conducive to the development of GIFT algorithm security assessment. Summary of the Invention

[0006] The purpose of this application is to provide a differential fault attack method, apparatus, device and medium for GIFT, a lightweight cryptographic algorithm based on the byte model. The attack has low complexity, is easy to implement and has good attack performance, which is beneficial to the security assessment of the GIFT algorithm.

[0007] To address the aforementioned technical problems, embodiments of this application provide a differential fault attack method for lightweight cryptographic GIFT based on a byte model, comprising the following steps:

[0008] The correct ciphertext generated by encrypting the target plaintext using the GIFT algorithm when there is no injected byte fault, and the incorrect ciphertext generated by encrypting the target plaintext using the GIFT algorithm after the injected byte fault are obtained respectively; wherein, the GIFT algorithm encrypts the target plaintext without injected byte fault and the target plaintext with injected byte fault through multiple S-boxes, and the target plaintext without injected byte fault and the target plaintext with injected byte fault use the same encryption key.

[0009] Perform an XOR operation on the correct ciphertext and the incorrect ciphertext to obtain the output difference of each corresponding S-box during the encryption process between the target plaintext without injected byte faults and the target plaintext with injected byte faults. Based on the output difference of each S-box and the input difference of each S-box obtained in advance, determine the target S-box with injected byte faults among multiple S-boxes.

[0010] Based on the input difference and output difference of the target S-box, determine the input value of the target S-box in the encryption process of the target plaintext without injected byte faults, and use it as the correct input value of the target S-box;

[0011] The encryption keys used to recover the target plaintext without injected byte faults and the target plaintext with injected byte faults are obtained by correctly inputting the target S-box.

[0012] In some optional embodiments, the GIFT algorithm iterates in multiple rounds, and in each round, multiple S-boxes are used to encrypt plaintext without injected byte faults and plaintext with injected byte faults.

[0013] The steps of obtaining the correct ciphertext generated by encrypting the target plaintext using the GIFT algorithm when there is no injected byte fault, and the incorrect ciphertext generated by encrypting it using the GIFT algorithm after an injected byte fault, include:

[0014] Obtain the iteratively correct ciphertext and iteratively incorrect ciphertext generated after each round of encryption of the target plaintext without injected byte faults and the target plaintext with injected byte faults;

[0015] In this process, the target plaintext with injected byte faults is injected with byte faults before each round of encryption to generate the corresponding round of iterative error ciphertext.

[0016] In some optional embodiments, the encryption key used to recover the target plaintext without injected byte faults and the target plaintext with injected byte faults from the correct input value of the target S-box includes:

[0017] Obtain the correct input values ​​of the target S-box in the four consecutive rounds of encryption using the GIFT algorithm, and recover the round keys used in the four consecutive rounds of encryption based on the correct input values ​​of the target S-box.

[0018] Based on the key arrangement algorithm, the encryption keys used for the target plaintext without injected byte faults and the target plaintext with injected byte faults are recovered by using the round keys used in four consecutive rounds of encryption.

[0019] In some optional embodiments, the step of recovering the round keys used in the last four rounds based on the correct input values ​​of the target S-box in the last four rounds includes:

[0020] The round key for round i+1 is obtained using the following formula:

[0021]

[0022] In the formula, K i+1 Let P represent the round key for round i+1, P represent P-box operation, S represent S-box operation, and D represent D. i+1 C represents the correct input value of the target S-box in round i+1. i+1 This represents the correct ciphertext for the (i+1)th iteration.

[0023] In some optional embodiments, determining the target S-box with injected byte faults among multiple S-boxes based on the output difference of each S-box and the pre-acquired input difference of each S-box includes:

[0024] Based on the output difference of each S-box, determine the S-boxes of the target plaintext without injected byte faults and the target plaintext with injected byte faults that are affected by byte faults during the encryption process;

[0025] Based on the input differences of the S-boxes affected by byte faults, identify the target S-box among multiple S-boxes that has been injected with byte faults.

[0026] In some optional embodiments, the GIFT algorithm iterates for 28 rounds, and the round keys used in the four consecutive rounds of encryption include the round keys used in the 28th, 27th, 26th and 25th rounds of encryption.

[0027] In some optional embodiments, the depth of the injected byte fault in the target plaintext is 2 rounds or 3 rounds.

[0028] Embodiments of this application also provide a differential fault attack apparatus for lightweight cryptographic GIFT based on a byte model, comprising:

[0029] The ciphertext acquisition module is used to acquire the correct ciphertext generated by encrypting the target plaintext using the GIFT algorithm when there is no injected byte fault, and the incorrect ciphertext generated by encrypting the target plaintext using the GIFT algorithm after the injected byte fault; wherein, the GIFT algorithm encrypts the target plaintext without injected byte fault and the target plaintext with injected byte fault through multiple S-boxes, and the target plaintext without injected byte fault and the target plaintext with injected byte fault use the same encryption key;

[0030] The S-box determination module is used to perform an XOR operation on the correct ciphertext and the incorrect ciphertext to obtain the output difference of each corresponding S-box during the encryption process between the target plaintext without injected byte faults and the target plaintext with injected byte faults. Based on the output difference of each S-box and the input difference of each S-box obtained in advance, the target S-box with injected byte faults is determined among multiple S-boxes.

[0031] The input determination module is used to determine the input value of the target S-box during the encryption process of the target plaintext without injected byte faults, based on the input difference and output difference of the target S-box, and to use it as the correct input value of the target S-box.

[0032] The key recovery module is used to recover the encryption key used by the target plaintext without injected byte faults and the target plaintext with injected byte faults, based on the correct input value of the target S-box.

[0033] Embodiments of this application also provide a computer device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute the aforementioned differential fault attack method of the byte-model-based lightweight cryptography GIFT.

[0034] Embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned differential fault attack method for the lightweight cryptographic GIFT based on the byte model.

[0035] The differential fault attack method for lightweight cryptographic GIFT based on the byte model provided in this application has the following beneficial effects:

[0036] This application introduces byte faults into the plaintext. Byte faults have a wider attack range. When using the GIFT algorithm on plaintext with byte faults, the byte faults can simultaneously determine the correct input values ​​of the four S-boxes in the encryption process in a single attack. Therefore, it can achieve the same attack effect as existing technologies by introducing fewer faults, with lower attack complexity and ease of implementation. Furthermore, after injecting byte faults, a simple XOR operation between the normal encrypted ciphertext and the byte-fault-injected encrypted ciphertext is sufficient to obtain the correspondence between the S-box input differences, output differences, and correct input values. This makes it easier to recover the encryption key used for plaintext encryption, i.e., easier to attack, thereby further reducing the implementation complexity of the GIFT algorithm's security assessment. Attached Figure Description

[0037] One or more embodiments are illustrated by way of example with reference to the accompanying drawings, and these illustrative descriptions do not constitute a limitation on the embodiments.

[0038] Figure 1 This is a flowchart of a differential fault attack method for a lightweight cryptographic GIFT based on a byte model, according to an embodiment of this application;

[0039] Figure 2 This is a schematic diagram of a wheel structure for a GIFT algorithm according to an embodiment of this application. Figure 1 ;

[0040] Figure 3 This is a schematic diagram of a wheel structure for a GIFT algorithm according to an embodiment of this application. Figure 2 ;

[0041] Figure 4 This is a schematic diagram of a differential fault attack device for a lightweight cryptographic GIFT based on a byte model, according to an embodiment of this application.

[0042] Figure 5 This is a schematic diagram of the structure of a computer device according to an embodiment of this application. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been presented in the various embodiments of this application to enable readers to better understand this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the various embodiments below is for the convenience of description and should not constitute any limitation on the specific implementation of this application. The various embodiments can be combined with and referenced by each other without contradiction.

[0044] One embodiment of this application relates to a differential fault attack method for GIFT, a lightweight cryptosystem based on a byte model. The implementation details of the differential fault attack method for GIFT based on a byte model in this embodiment are described below. The following implementation details are provided for ease of understanding and are not necessary for implementing this solution.

[0045] The specific process of the differential fault attack method for the byte-model-based lightweight cryptographic GIFT in this embodiment can be described as follows: Figure 1 As shown, it includes:

[0046] Step 101: Obtain the correct ciphertext generated by encrypting the target plaintext using the GIFT algorithm when there is no injected byte fault, and the incorrect ciphertext generated by encrypting it using the GIFT algorithm after the injected byte fault; wherein, the GIFT algorithm encrypts the target plaintext without injected byte fault and the target plaintext with injected byte fault using multiple S-boxes, and the target plaintext without injected byte fault and the target plaintext with injected byte fault use the same encryption key.

[0047] Specifically, the GIFT algorithm iterates through multiple rounds. In each round, multiple S-boxes are used to encrypt both the plaintext target without injected byte faults and the plaintext target with injected byte faults. The round structure of the GIFT algorithm is as follows: Figure 2 As shown, based on its diffusion characteristics, there are 16 S-boxes in each round. These 16 S-boxes are divided into 4 groups of 4 S-boxes each, and each S-box diffuses into 4 S-boxes in a different group in the next round. Therefore, in this embodiment, the target plaintext without injected byte faults and the target plaintext with injected byte faults are obtained after each round of encryption, generating iteratively correct ciphertext and iteratively incorrect ciphertext. Meanwhile, the target plaintext with injected byte faults is injected with byte faults before each round of encryption to generate the iteratively incorrect ciphertext for the corresponding round.

[0048] Step 102: Perform an XOR operation on the correct ciphertext and the incorrect ciphertext to obtain the output difference of each corresponding S-box during the encryption process between the target plaintext without injected byte faults and the target plaintext with injected byte faults. Based on the output difference of each S-box and the input difference of each S-box obtained in advance, determine the target S-box with injected byte faults among multiple S-boxes.

[0049] Specifically, an XOR operation is performed on the correct ciphertext and the incorrect ciphertext of corresponding rounds, and the XOR result is expressed by the following formula:

[0050]

[0051] In the formula, Δout i+1 C represents the XOR result of the correct ciphertext and the incorrect ciphertext in the (i+1)th iteration. i+1 C represents the correct ciphertext of the (i+1)th iteration. i+1* K represents the ciphertext of the iteration error in the (i+1)th round. i+1 Let represent the round key for the (i+1)th round, and P represent the P-box operation.

[0052] In its implementation, the XOR operation between the two ciphertexts (i.e., the correct ciphertext and the incorrect ciphertext) actually compares the differences between them. These differences arise from the different outputs of the various components (including the S-boxes) in the GIFT algorithm under nonlinear transformations of the input data. Although the operation directly involves XORing the ciphertexts, the result reflects the output differences of components such as the S-boxes in the encryption algorithm given the input difference. Therefore, by performing an XOR operation on the correct and incorrect ciphertexts, we can obtain the output differences of each corresponding S-box during the encryption process between the target plaintext without injected byte faults and the target plaintext with injected byte faults.

[0053] The input difference of the S-box can be denoted as... Then we have:

[0054]

[0055] The input difference of the S-box is determined by the wheel structure of the GIFT algorithm, such as... Figure 3 As shown, taking the two rounds of the GIFT algorithm as an example: assuming in the red area... and Injecting a byte fault, the S-boxes affected by the byte fault in the next round are respectively and As can be seen from the figure The last two bits will be affected at this time. There are three possible input differences, namely (0001, 0010, 0011); The middle two bits are affected. There are three possible input differences, namely (0010, 0100, 0110); The first two bits are affected, at this time There are three possible input differences: (1000, 0100, 1100). The outermost two bits are affected at this time. There are three possible input differences: (1000, 0001, 1001).

[0056] At this point, based on the output difference of each S-box, the S-boxes affected by the byte fault during encryption are determined for both the target plaintext without injected byte faults and the target plaintext with injected byte faults. Then, based on the input difference of the S-boxes affected by the byte faults, the target S-box with injected byte faults among the multiple S-boxes is determined. See also... Figure 3 Assume the S-box with the injected byte fault is the red area in the diagram. The positions where the XOR result is "1" correspond to the spread of the red lines in the diagram (i.e., the positions of the red lines in the last row are the positions where the result is "1"). Based on the positions where the XOR result is "1", the four S-boxes in the second-to-last row affected by the byte fault can be identified. and Therefore, the S-box containing the injected byte fault can be identified as the red area in the first row. like If any one of (0001, 0010, 0011) exists in the input difference, then the S-box for injecting a byte fault is: and like If any one of (1000, 0100, 1100) exists in the input difference, then the S-box for injecting a byte fault is: and

[0057] Step 103: Based on the input difference and output difference of the target S-box, determine the input value of the target S-box in the encryption process of the target plaintext without injected byte faults, and use it as the correct input value of the target S-box.

[0058] Specifically, combining Tables 1 and 2, and utilizing the relationship between the input difference, output difference, and S-box input value, we obtain the input value of the target S-box during the encryption process of the target plaintext without injected byte faults (i.e., the correct input value of the target S-box). Let D be the correct input value of the S-box, and D... i+1 =Prossible_inputs(D), Prossible_inputs(D) means filtering the correct input values ​​of the S-box each time until only one correct value of D is obtained.

[0059] Table 1

[0060]

[0061]

[0062] Table 2

[0063]

[0064] Step 104: Recover the encryption keys used for the target plaintext without injected byte faults and the target plaintext with injected byte faults using the correct input values ​​of the target S-box.

[0065] Specifically, since the input value of the S-box usually comes from an intermediate state in a round of encryption, this input value may be obtained by several rounds of operations (such as row shifting and column obfuscation) involving the plaintext, the key, and the previous encryption results. Each S-box corresponds to several possible S-box input values, but only one is correct. Furthermore, in the GIFT algorithm, only the last two bits of each S-box participate in the round key addition. Therefore, after obtaining the correct input value of the S-box, the key can be obtained by selecting only the last two bits for key arrangement each time.

[0066] Furthermore, because the GIFT algorithm employs a block key arrangement strategy, the four round keys are independent and do not affect each other. The master key (i.e., the encryption key used for the target plaintext without injected byte faults and the target plaintext with injected byte faults) can be recovered from the four consecutive round keys. Therefore, firstly, the correct input values ​​of the target S-box in the four consecutive rounds of encryption of the GIFT algorithm are obtained, and based on the correct input values ​​of the target S-box in the four consecutive rounds of encryption, the round keys used in the four consecutive rounds of encryption are recovered. Then, based on the key arrangement algorithm, the encryption keys used for the target plaintext without injected byte faults and the target plaintext with injected byte faults are recovered using the round keys used in the four consecutive rounds of encryption.

[0067] In the process of recovering the round keys used in the last four rounds based on the correct input values ​​of the target S-box in the last four rounds, the round key of the (i+1)th round is obtained by the following formula:

[0068]

[0069] In the formula, K i+1 Let P represent the round key for round i+1, P represent P-box operation, S represent S-box operation, and D represent D. i+1 C represents the correct input value of the target S-box in round i+1. i+1 This represents the correct ciphertext for the (i+1)th iteration.

[0070] In one example, the GIFT algorithm iterates through 28 rounds. The round keys used in the four consecutive rounds of encryption include those used in rounds 28, 27, 26, and 25. First, the round key for the last round (round 28) is obtained. Then, a differential fault attack is performed to reverse-engineer the round keys for the preceding three rounds (rounds 27, 26, and 25), ultimately achieving complete recovery of the master key (i.e., the encryption key).

[0071] In some embodiments, the depth of the injected byte fault in the target plaintext is 2 or 3 rounds. The differential fault attack process of the GIFT algorithm with a depth of 2 and 3 rounds of injected byte faults is described below with specific examples:

[0072] (1) The byte fault depth is 2 rounds.

[0073] S1: Select any plaintext M (i.e., the target plaintext), and encrypt it using the given key K (i.e., the encryption key used for the target plaintext without injected byte faults and the target plaintext with injected byte faults as described in the above embodiments), to obtain the correct ciphertext C under normal encryption and the incorrect ciphertext C after injected byte faults. * .

[0074] Specifically, S1 includes:

[0075] S11: Choose any plaintext M and encrypt it using the given key K to obtain the correct ciphertext C in the (i+1)th round under normal encryption. i+1 .

[0076] S12: Select the same plaintext M and, during the encryption process under key K, inject a byte fault before the i-th round of S-box operation to obtain the erroneous ciphertext C. i+1* .

[0077] S2: Perform an XOR operation on the correct ciphertext and the incorrect ciphertext, and use the XOR result Δout to determine the fault injection location (i.e. the target S-box that will be affected by the byte fault). Based on the fault injection location, calculate the input difference and output difference of the affected S-box in the next round.

[0078] Specifically, S2 includes:

[0079] S21: For the correct ciphertext C i+1 and erroneous ciphertext C i+1* Perform an XOR operation, and denote the result as .

[0080]

[0081] S22: Calculate the input difference of the S-box affected in the (i+1)th round, denoted as... Then we have:

[0082]

[0083] S23: Based on the position where Δout result is "1" and S-box Output difference Find the input difference Determine the location of the fault injection

[0084] S24: If input difference Then the injected fault S box is If input difference Then the injected fault S box is

[0085] S3: Calculate the correct input value for each S-box based on the output difference of the affected S-boxes, and derive the round key.

[0086] Specifically, S3 includes:

[0087] S31: Combining Tables 1 and 2, using the relationship between the input difference, output difference, and S-box input value, calculate the output difference and correct input value of the affected S-box in rounds (i+1) and (i+2). Let D be the S-box input value, then D i+1 =Prossible_inputs(D).

[0088] S32: Using the correct S-box input value in round i+1, calculate the round key K for round i+1. i+1 Then there is

[0089] S33: Use the above process to recover and determine the round key K for round 28. 28 As shown in Algorithm 1:

[0090]

[0091]

[0092] S4: Using the round keys obtained from the last four rounds, combined with the key arrangement algorithm, the complete master key can be recovered.

[0093] Specifically, S4 includes:

[0094] S41: The GIFT encryption algorithm employs a block key arrangement strategy. The four round keys are independent and do not affect each other. The master key K can be recovered using four consecutive round keys. After obtaining the 28th round key, a differential fault attack is performed to reverse-engineer the round keys of the 27th, 26th, and 25th rounds, ultimately achieving complete recovery of the master key, as shown in Algorithm 2:

[0095]

[0096]

[0097] (2) The byte fault depth is 3 rounds.

[0098] S1: Select any plaintext M (i.e., the target plaintext), encrypt it using the given key K, and obtain the correct ciphertext C under normal encryption and the erroneous ciphertext C after injecting a faulty byte. * .

[0099] Specifically, S1 includes:

[0100] S11: Choose any plaintext M and encrypt it using the given key K to obtain the correct ciphertext C in the (i+2)th round under normal encryption. i+2 .

[0101] S12: Select the same plaintext M and, during the encryption process under key K, inject a byte fault before the i-th round of S-box operation to obtain the erroneous ciphertext C. i+2* .

[0102] S2: Perform an XOR operation on the correct ciphertext and the incorrect ciphertext, and determine the fault injection location from the result Δout; based on the fault injection location, calculate the input difference and output difference of the affected S-box in the next round.

[0103] Specifically, S2 includes:

[0104] S21: For the correct ciphertext C i+2 and erroneous ciphertext C i+2* Perform an XOR operation, and denote the result as .

[0105]

[0106] S22: Calculate the input difference of the S-box affected in the (i+2)th round, denoted as... Then there is

[0107]

[0108] S23: Based on the position where Δout result is "1" and S-box Output difference Find the input difference Determine the location of the fault injection As shown in Algorithm 3.

[0109]

[0110] S3: Based on the output differences of the affected S-boxes, calculate the correct input value for each S-box using Table 3, and derive the round key.

[0111] Table 3

[0112]

[0113]

[0114] S4: Using the round keys obtained from the last four rounds, combined with the key arrangement algorithm, the complete master key can be recovered.

[0115] When the fault depth is 3 rounds, steps S3 and S4 are as shown in Algorithm 4, after obtaining the round key K. 28 K 27 K 26 and K 25 Then, by combining the key arrangement principles, the original master key K can be recovered.

[0116]

[0117]

[0118] The steps of the various methods described above are only for clarity. In practice, they can be combined into one step or some steps can be split into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but without changing the core design of the algorithm and process, are also within the scope of protection of this patent.

[0119] Another embodiment of this application relates to a differential fault attack device for the GIFT algorithm, a lightweight cryptographic algorithm based on a byte model. The implementation details of the differential fault attack device for the GIFT algorithm in this embodiment are described below. The following implementation details are provided for ease of understanding and are not essential for implementing this solution. A schematic diagram of the differential fault attack device for the GIFT algorithm in this embodiment can be seen as follows: Figure 4 As shown, it includes: ciphertext acquisition module 401, S-box determination module 402, input determination module 403, and key recovery module 404.

[0120] Specifically, the ciphertext acquisition module 401 is used to acquire the correct ciphertext generated by encrypting the target plaintext using the GIFT algorithm when there is no injected byte fault, and the incorrect ciphertext generated by encrypting it using the GIFT algorithm after the injected byte fault. The GIFT algorithm encrypts the target plaintext without injected byte fault and the target plaintext with injected byte fault using multiple S-boxes, and the target plaintext without injected byte fault and the target plaintext with injected byte fault use the same encryption key.

[0121] S-box determination module 402 is used to perform an XOR operation on the correct ciphertext and the incorrect ciphertext to obtain the output difference of each corresponding S-box during the encryption process between the target plaintext without injected byte faults and the target plaintext with injected byte faults. Based on the output difference of each S-box and the input difference of each S-box obtained in advance, the target S-box with injected byte faults is determined among multiple S-boxes.

[0122] The input determination module 403 is used to determine the input value of the target S-box in the encryption process of the target plaintext without injected byte faults based on the input difference and output difference of the target S-box, and use it as the correct input value of the target S-box.

[0123] Key recovery module 404 is used to recover the encryption key used by the target plaintext without injected byte faults and the target plaintext with injected byte faults by using the correct input value of the target S-box.

[0124] It is not difficult to see that this embodiment is a device embodiment corresponding to the above method embodiments, and this embodiment can be implemented in conjunction with the above method embodiments. The relevant technical details and technical effects mentioned in the above embodiments are still valid in this embodiment, and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiments.

[0125] It is worth mentioning that all modules involved in this embodiment are logical modules. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. Furthermore, to highlight the innovative aspects of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed in this application; however, this does not mean that other units are absent in this embodiment.

[0126] Another embodiment of this application relates to a computer device, such as... Figure 5 As shown, it includes: at least one processor 501; and a memory 502 communicatively connected to the at least one processor 501; wherein the memory 502 stores instructions executable by the at least one processor 501, the instructions being executed by the at least one processor 501 to enable the at least one processor 501 to execute the differential fault attack method of the byte-model-based lightweight cryptography GIFT in the above embodiments.

[0127] The memory and processor are connected via a bus, which can include any number of interconnecting buses and bridges, connecting various circuits of one or more processors and memories. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which further receives data and transmits it to the processor.

[0128] The processor manages the bus and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory is used to store data used by the processor during operation.

[0129] Another embodiment of this application relates to a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method embodiments described above.

[0130] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0131] Those skilled in the art will understand that the above embodiments are specific embodiments for implementing this application, and in practical applications, various changes can be made to them in form and detail without departing from the spirit and scope of this application.

Claims

1. A differential fault attack method for lightweight cryptographic GIFT based on a byte model, characterized in that, The method includes: The correct ciphertext generated by encrypting the target plaintext using the GIFT algorithm when there is no injected byte fault, and the incorrect ciphertext generated by encrypting the target plaintext using the GIFT algorithm after the injected byte fault are obtained respectively; wherein, the GIFT algorithm encrypts the target plaintext without injected byte fault and the target plaintext with injected byte fault through multiple S-boxes, and the target plaintext without injected byte fault and the target plaintext with injected byte fault use the same encryption key. Perform an XOR operation on the correct ciphertext and the incorrect ciphertext to obtain the output difference of each corresponding S-box during the encryption process between the target plaintext without injected byte faults and the target plaintext with injected byte faults. Based on the output difference of each S-box and the input difference of each S-box obtained in advance, determine the target S-box with injected byte faults among multiple S-boxes. Based on the input difference and output difference of the target S-box, determine the input value of the target S-box in the encryption process of the target plaintext without injected byte faults, and use it as the correct input value of the target S-box; The encryption keys used to recover the target plaintext without injected byte faults and the target plaintext with injected byte faults are obtained by correctly inputting the target S-box.

2. The differential fault attack method for the lightweight cryptographic GIFT based on the byte model according to claim 1, characterized in that, The GIFT algorithm has multiple iterations, and each iteration uses multiple S-boxes to encrypt plaintext without injected byte faults and plaintext with injected byte faults. The steps of obtaining the correct ciphertext generated by encrypting the target plaintext using the GIFT algorithm when there is no injected byte fault, and the incorrect ciphertext generated by encrypting it using the GIFT algorithm after an injected byte fault, include: Obtain the iteratively correct ciphertext and iteratively incorrect ciphertext generated after each round of encryption of the target plaintext without injected byte faults and the target plaintext with injected byte faults; In this process, the target plaintext with injected byte faults is injected with byte faults before each round of encryption to generate the corresponding round of iterative error ciphertext.

3. The differential fault attack method for lightweight cryptographic GIFT based on the byte model according to claim 2, characterized in that, The encryption key used to recover the target plaintext without injected byte faults and the target plaintext with injected byte faults through the correct input value of the target S-box includes: Obtain the correct input values ​​of the target S-box in the four consecutive rounds of encryption using the GIFT algorithm, and recover the round keys used in the four consecutive rounds of encryption based on the correct input values ​​of the target S-box. Based on the key arrangement algorithm, the encryption keys used for the target plaintext without injected byte faults and the target plaintext with injected byte faults are recovered by using the round keys used in four consecutive rounds of encryption.

4. The differential fault attack method for the lightweight cryptographic GIFT based on the byte model according to claim 3, characterized in that, The step of recovering the round keys used in the last four rounds based on the correct input values ​​of the target S-box in the last four rounds includes: The round key for round i+1 is obtained using the following formula: In the formula, K i+1 Let P represent the round key for round i+1, P represent P-box operation, S represent S-box operation, and D represent D. i+1 C represents the correct input value of the target S-box in round i+1. i+1 This represents the correct ciphertext for the (i+1)th iteration.

5. The differential fault attack method for the lightweight cryptographic GIFT based on the byte model according to claim 1, characterized in that, The step of determining the target S-box with injected byte faults among multiple S-boxes based on the output difference of each S-box and the pre-acquired input difference of each S-box includes: Based on the output difference of each S-box, determine the S-boxes of the target plaintext without injected byte faults and the target plaintext with injected byte faults that are affected by byte faults during the encryption process; Based on the input differences of the S-boxes affected by byte faults, identify the target S-box among multiple S-boxes that has been injected with byte faults.

6. The differential fault attack method for lightweight cryptographic GIFT based on the byte model according to claim 3, characterized in that, The GIFT algorithm has 28 iterations, and the round keys used in the four consecutive rounds of encryption include the round keys used in the 28th, 27th, 26th and 25th rounds of encryption.

7. The differential fault attack method for the lightweight cryptographic GIFT based on the byte model according to any one of claims 1 to 6, characterized in that, The depth of the injected byte fault in the target plaintext is 2 or 3 rounds.

8. A differential fault attack device for lightweight cryptographic GIFT based on a byte model, characterized in that, The device includes: The ciphertext acquisition module is used to acquire the correct ciphertext generated by encrypting the target plaintext using the GIFT algorithm when there is no injected byte fault, and the incorrect ciphertext generated by encrypting the target plaintext using the GIFT algorithm after the injected byte fault; wherein, the GIFT algorithm encrypts the target plaintext without injected byte fault and the target plaintext with injected byte fault through multiple S-boxes, and the target plaintext without injected byte fault and the target plaintext with injected byte fault use the same encryption key; The S-box determination module is used to perform an XOR operation on the correct ciphertext and the incorrect ciphertext to obtain the output difference of each corresponding S-box during the encryption process between the target plaintext without injected byte faults and the target plaintext with injected byte faults. Based on the output difference of each S-box and the input difference of each S-box obtained in advance, the target S-box with injected byte faults is determined among multiple S-boxes. The input determination module is used to determine the input value of the target S-box during the encryption process of the target plaintext without injected byte faults, based on the input difference and output difference of the target S-box, and to use it as the correct input value of the target S-box. The key recovery module is used to recover the encryption key used by the target plaintext without injected byte faults and the target plaintext with injected byte faults, based on the correct input value of the target S-box.

9. A computer device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the differential fault attack method of the byte-based lightweight cryptography GIFT as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the differential fault attack method of GIFT, a lightweight cryptographic system based on a byte model, as described in any one of claims 1 to 7.

Images