A side channel analysis method for a post-quantum cryptographic algorithm

Abstract

The application provides a side channel analysis method for a protected post-quantum cryptographic algorithm, and belongs to the field of post-quantum cryptographic security. The application can be used for a protected Dilithium algorithm, and the key is obtained by analyzing the power consumption curve in the execution process of the cryptographic algorithm. Mainly, the following means are adopted: curve intercepting, curve identifying, key hypothesis, correlation coefficient analysis and the like. According to the different key lengths and analysis lengths each time, different times are analyzed, and the complete key is analyzed until the complete key is analyzed.

Description

Technical Field

[0001] This invention belongs to the field of post-quantum cryptography security. Background Technology

[0002] Dilithium is an advanced post-quantum digital signature scheme specifically designed to counter the threats of future quantum computers. Based on lattice-based problems, it offers strong security while maintaining good signing and verification speeds, making it widely applicable in fields such as cybersecurity, the Internet of Things, finance, and government communications, ensuring long-term information security even in the quantum era. Side-channel analysis is a non-intrusive analytical method that bypasses the direct mathematical challenges of cryptographic algorithms, instead utilizing physical phenomena during algorithm execution, such as execution time differences, power consumption variations, electromagnetic radiation, or sound, to indirectly reveal encrypted data or key information. This type of analysis encompasses various methods, including timing analysis, power analysis, electromagnetic radiation analysis, and fault injection analysis. Current side-channel analysis methods primarily target unprotected Dilithium algorithms, with limited research on analysis methods for protected Dilithium algorithms. Summary of the Invention

[0003] To address the current lack of side-channel analysis schemes for protected Dilithium algorithms, this invention proposes a side-channel analysis method for protected post-quantum cryptography algorithms.

[0004] The implementation method of the present invention includes the following steps:

[0005] Step 1: During the execution of the Dilithium signature algorithm with first-order mask protection, the power consumption curve is collected as an analysis curve, where the calculation... The location is the analysis location, where It is knowable and random. It is unknown and will be randomly divided. and Repeat the signature process multiple times and collect curves. During each repetition, The value is random. The splitting is also random, and the results of multiple collections are combined into an analysis curve set;

[0006] Step 2: Observe the general pattern of each wave, determine the region of interest of the power consumption curve, determine a uniform interval length, extract the region of interest of each wave, and further update the analysis curve set into a curve set composed of all interval curves.

[0007] Step 3: When or When a portion of the value is 0, the corresponding operating power consumption is very low, resulting in a power consumption curve that is significantly different from other curves, thus identifying... or The corresponding curve containing 0 is used, and the remaining non-zero operation part of the curve is retained with a fixed length. When one part is 0, retain the second half. The corresponding part of the operation curve, when When one part is 0, retain the first half. The corresponding operation curves are analyzed, and the curve set is further updated to consist of all the curves that are retained.

[0008] Step 4: Record the calculations used for all curves in Step 3. ,all Form an array, and simultaneously assume keys for all possible parts. List them, calculate the product of the array and each individual partial hypothetical key to obtain partial intermediate values, based on the partial hypothetical keys. The number of values ​​yields a corresponding number of partial intermediate value arrays;

[0009] Step 5: Using each array in Step 4 as a unit, calculate the correlation coefficient between an array and the data at the same time sampling point in the curve set in Step 3, and obtain a correlation coefficient value. Calculate sequentially along the time sampling points to obtain a correlation coefficient curve. After calculating all arrays, obtain the same number of curves as the number of arrays.

[0010] Step 6: Analyze all correlation coefficient curves from Step 5, identify the curve with the highest peak, and determine the partial hypothesis key corresponding to the curve containing the peak. This is the key we are looking for. If the corresponding part of the true value cannot be analyzed... Repeat steps 2 through 6 until the key is extracted. all.

[0011] This analysis method consists of the above 6 steps. Step 1 describes the Dilithium signature algorithm with first-order mask protection. , , , The variables used in the analysis are merely symbolic and are not intended to limit the invention.

[0012] In actual analysis, the curve described in step 2 can be filtered appropriately first, and then the length of the region of interest can be adjusted according to actual needs, while ensuring that the calculation process of the analysis location is covered.

[0013] Step 3 or The length of the zero-value portion is uncertain, and the length of an analysis can be selected according to the actual situation.

[0014] Step 4 requires the use of The array and some hypothetical keys Calculate the intermediate value array.

[0015] The correlation coefficient mentioned in step 5 is the correlation coefficient between the median value and the point on the curve.

[0016] The key obtained in step 6 The corresponding part, if its length is less than the key Then repeat steps 2 through 6 until the key is determined. Each part, thus obtaining the complete key. The specific number of iterations depends on the length of each analysis and the total key length. Attached Figure Description

[0017] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0018] Figure 1 The Dilithium signature algorithm;

[0019] Figure 2 This is a flowchart illustrating the analysis process; Detailed Implementation

[0020] To facilitate understanding of the present invention by those skilled in the art, the invention will be further described below with reference to the accompanying drawings, which constitute a part of this application and are not intended to limit the scope of the invention.

[0021] Figure 1 This refers to the Dilithium cryptographic algorithm in existing technology. The Dilithium algorithm includes key generation, signature generation, and signature verification processes, wherein the key generation algorithm Gen outputs a public key. and private key Signature generation algorithm The input is the private key. and messages Output a valid signature , , , It is unknown. and It is an unknown byte string. It is known. The analysis location of this invention is as follows: Figure 1 As shown, the analysis process is as follows: Figure 2 As shown below, in conjunction with Figure 2 The side-channel analysis method of the signature algorithm in this embodiment of the invention will be described.

[0022] Step 1: During the execution of the Dilithium signature algorithm with first-order mask protection, the power consumption curve is collected as an analysis curve, where the calculation... The location is the analysis location, where It is knowable and random. It is unknown and will be randomly divided. and Repeat the signature process multiple times and collect curves. During each repetition, The value is random. The splitting is also random, and the results of multiple collections are combined into an analysis curve set.

[0023] In this example, The number of waveforms collected was 10,000. Furthermore, a single analysis... The 8 bits can be regarded as At this time there is .

[0024] Step 2: Observe the general pattern of each wave, determine the region of interest of the power consumption curve, determine a uniform interval length, extract the region of interest of each wave, and further update the analysis curve set into a curve set composed of all interval curves.

[0025] In this example, the region of interest (ROI) has a length of 1000. In actual analysis, appropriate filtering can be applied, and the ROI length can be further adjusted according to actual needs, while ensuring coverage. and Two-step calculation process.

[0026] Step 3: When or When a portion of the value is 0, the corresponding operating power consumption is very low, resulting in a power consumption curve that is significantly different from other curves, thus identifying... or The corresponding curve containing 0 is used, and the remaining non-zero operation part of the curve is retained with a fixed length. When one part is 0, retain the second half. The corresponding part of the operation curve, when When one part is 0, retain the first half. The corresponding operational curves are analyzed, and the curve set is further updated to consist of all the retained curves.

[0027] In this example, after zero-value analysis, the remaining length is 500. In practical applications, non-zero positions are retained according to the specific analysis situation, and an appropriate length is truncated.

[0028] Step 4: Record the calculations used for all curves in Step 3. ,all Form an array, and simultaneously assume keys for all possible parts. List them, calculate the product of the array and each individual partial hypothetical key to obtain partial intermediate values, based on the partial hypothetical keys. The number of values ​​yields a corresponding number of partial intermediate value arrays.

[0029] In this example, each waveform corresponds to a vector C, and all hypothetical keys... Constructing vectors C and Multiply each element in the matrix. Assume the key... The bit width is 8 bits. Assuming there are a total of 256 keys, a total of 256 arrays are obtained.

[0030] Step 5: Using each array from Step 4 as a unit, calculate the correlation coefficient between an array and the data at the same time sampling point in the curve set from Step 3, and obtain a correlation coefficient value. Calculate the correlation coefficient sequentially along the time sampling points to obtain a correlation coefficient curve. After calculating all arrays, obtain the same number of curves as the number of arrays.

[0031] In this example, a total of 256 correlation coefficient curves were obtained. Each correlation coefficient curve consists of 500 correlation coefficient points, the number of which is determined by the curve retention length in step 3.

[0032] Step 6: Analyze all correlation coefficient curves from Step 5, identify the curve with the highest peak, and determine the partial hypothesis key corresponding to the curve containing the peak. This is the key we are looking for. If the corresponding part of the true value cannot be analyzed... Repeat steps 2 through 6 until the key is extracted. all.

[0033] In this example, the desired result can be obtained by statistically analyzing the curve containing the highest peak of the data. Repeat steps 2 through 6 768 times until you get... The data from all locations, when combined sequentially, constitutes the complete key for this algorithm.

[0034] The technical solution of this application is used under legal circumstances.

Claims

1. A side-channel analysis method for protected post-quantum cryptography algorithms, characterized in that, The method includes the following steps: Step 1: During the execution of the Dilithium signature algorithm with first-order mask protection, the power consumption curve is collected as an analysis curve, where the calculation... The location is the analysis location, where It is knowable and random. It is unknown and will be randomly divided. and Repeat the signature process multiple times and collect curves. During each repetition, The value is random. The splitting is also random, and the results of multiple collections are combined into an analysis curve set; Step 2: Observe the general pattern of each wave, determine the region of interest of the power consumption curve, determine a uniform interval length, extract the region of interest of each wave, and further update the analysis curve set into a curve set composed of all interval curves. Step 3: When or When a portion of the value is 0, the corresponding operating power consumption is very low, resulting in a power consumption curve that is significantly different from other curves, thus identifying... or The corresponding curve containing 0 is used, and the remaining non-zero operation part of the curve is retained with a fixed length. When one part is 0, retain the second half. The corresponding part of the operation curve, when When one part is 0, retain the first half. The corresponding operation curves are analyzed, and the curve set is further updated to consist of all the curves that are retained. Step 4: Record the calculations used for all curves in Step 3. ,all Form an array, and simultaneously assume keys for all possible parts. List them, calculate the product of the array and each individual partial hypothetical key to obtain partial intermediate values, based on the partial hypothetical keys. The number of values ​​yields a corresponding number of partial intermediate value arrays; Step 5: Using each array in Step 4 as a unit, calculate the correlation coefficient between an array and the data at the same time sampling point in the curve set in Step 3, and obtain a correlation coefficient value. Calculate sequentially along the time sampling points to obtain a correlation coefficient curve. After calculating all arrays, obtain the same number of curves as the number of arrays. Step 6: Analyze all correlation coefficient curves from Step 5, identify the curve with the highest peak, and determine the partial hypothesis key corresponding to the curve containing the peak. This is the key we are looking for. If the corresponding part of the true value cannot be analyzed... Repeat steps 2 through 6 until the key is extracted. all.

2. The side-channel analysis method for a protected post-quantum cryptography algorithm according to claim 1, characterized in that: This study focuses on the Dilithium signature algorithm with first-order mask protection.

3. The side-channel analysis method for a protected post-quantum cryptography algorithm according to claim 1, characterized in that: In actual analysis, the curve can be filtered appropriately first, and then the length of the region of interest can be adjusted according to actual needs, while ensuring that the calculation process of the analysis location is covered.

4. The side-channel analysis method for a protected post-quantum cryptography algorithm according to claim 1, characterized in that: or The length of the zero-value portion is uncertain, and the length of an analysis can be selected according to the actual situation.

5. The side-channel analysis method for a protected post-quantum cryptography algorithm according to claim 1, characterized in that: Need to use The array formed and the hypothetical key Calculate the intermediate value array.

6. The side-channel analysis method for a protected post-quantum cryptography algorithm according to claim 1, characterized in that: The calculated correlation coefficient is the correlation coefficient between the median value and the point on the curve.

7. The side-channel analysis method for a protected post-quantum cryptography algorithm according to claim 1, characterized in that: Required key The corresponding part, if its length is less than the key Then repeat steps 2 through 6 until the key is determined. Each part, thus obtaining the complete key. The specific number of iterations depends on the length of each analysis and the total key length.

Images