A combined threshold mask protection method of Ascon authentication encryption algorithm

Abstract

The application discloses a combined threshold mask protection method of Ascon authentication encryption algorithm, which combines threshold implementation with exchange-based infection technology, and comprises the following steps: constructing a second-order threshold implementation of the Ascon algorithm; copying a complete copy of the constructed second-order threshold mask as a redundant mask; and reducing the number of additional random numbers used by the exchange technology based on the copy through the exchange bit sharing selection algorithm provided by the application, and exchanging part of the sharing selected. The method has the advantages that the Ascon algorithm can effectively resist second-order power consumption attacks and first-order differential fault attacks, only a small amount of additional random numbers and a small circuit implementation area are needed, and the hardware implementation cost can be significantly reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a combined threshold mask protection method for an Ascon authentication encryption algorithm. Background Art

[0002] Power Attack (PA) is a side-channel attack method that infers keys or other sensitive information by analyzing the changes in power consumption of encryption devices when performing encryption operations. This attack method exploits the physical leakage of encryption devices. The idea is that when encryption devices process data, their power consumption will change depending on the type of operation and the specific value of the processed data. Attackers can collect these power consumption traces through the device and extract characteristic information related to the encryption operation. By further analyzing this characteristic information, it is possible to infer the keys or other sensitive information used by the device, thereby compromising the security of the encryption system. Masking technology is an effective means of protecting against power consumption attacks. By randomizing the intermediate values ​​processed by the cryptographic device during the encryption process, the energy consumption of the device is no longer dependent on the intermediate values ​​of the executed cryptographic algorithm.

[0003] Fault attacks (FAs) artificially introduce faults (such as voltage fluctuations, clock signal interference, temperature changes, and laser interference) to cause encryption devices to produce erroneous outputs when performing encryption operations. The attacker then analyzes the output of the encryption algorithm under abnormal conditions and compares it with the normal output to infer critical information within the device, such as keys or other sensitive information. This type of attack exploits the erroneous behavior of encryption devices when processing faulty data to obtain additional information, helping attackers crack the encryption system. Infection countermeasures are one of the most popular countermeasures against fault attacks. In addition to the original calculations in cryptographic algorithms, redundant calculations are also required. Implementing infection countermeasures by disrupting the data paths of the original and redundant calculations can render the resulting erroneous ciphertext unrelated to the key.

[0004] Power consumption attacks and fault attacks are the two main physical attacks against cryptographic implementations. The two countermeasures mentioned above only consider a single power consumption attack or fault attack. Currently, countermeasures against either attack type often focus solely on a single attack type. One of their main drawbacks is that they are vulnerable to the other attack type or a combination of attacks. For example, masking techniques can effectively defend against power consumption attacks by randomizing power consumption characteristics to obscure sensitive information, but this technique is generally ineffective against fault attacks. Due to the limitations of a single protection strategy, existing cryptographic implementations often combine power consumption and fault attack protection techniques to simultaneously protect against both attacks.

[0005] Ascon algorithm is a lightweight authentication encryption algorithm developed by an international research team, specifically designed for resource-constrained environments such as Internet of Things (IoT) devices and embedded systems. Ascon algorithm was first proposed in 2014 and widely recognized in the subsequent CAESAR (Competition for Authenticated Encryption: Security, Applicability, and Robustness) competition. In February 2023, Ascon algorithm was rated as NIST (National Institute of Standards and Technology) lightweight cryptographic standard, due to its efficient, lightweight and secure design, its excellent performance and security, in this selection, stand out, become one of the NIST recommended lightweight encryption standards. It is widely used in various information systems around the world, including industrial control, wireless sensor networks, smart home and other fields. With the rapid development of Internet of Things and embedded devices, the protection capability and performance optimization of Ascon algorithm have attracted more and more attention.

[0006] In recent years, researchers have focused on the mask protection of Ascon algorithm. For example, Prasad et al. [1] Based on the replacement guard technology, an Ascon algorithm second-order DOM mask method is proposed, which does not require additional random numbers and has lower delay. Gigerl et al. [2] Using the previously proposed Toffoli gate-based Keccak algorithm S-box first-order mask, it is extended to the second order and does not require any online random number, which realizes the software implementation of the second-order mask of Ascon algorithm. However, these protection methods can only resist second-order power attacks and cannot effectively resist fault attacks. Therefore, Kandi et al. [3] Proposed a combination protection implementation method of Ascon algorithm based on first-order threshold mask and triple / majority fault attack protection, effectively resisting first-order power attacks and first-order differential fault attacks, but this work did not improve the security order of threshold implementation to the second order. In summary, when designing and implementing cryptographic algorithms, the characteristics of power attacks and fault attacks must be considered, and effective combination protection methods must be proposed for these two attacks to ensure the overall security of the cryptographic algorithm.

[0007] References:

[0008] [1] S. H. Prasad, F. Mendel, M. Schlaeffer, et al. Efficient Low-Latency Masking of Ascon without Fresh Randomness. Cryptology ePrint Archive, Paper 2023 / 1914;

[0009] [2] B. Gigerl, F. Mendel, M. et al. Efficient Second-Order Masked Software Implementations of Ascon in Theory and Practice. Cryptology ePrint Archive, Paper 2024 / 755;

[0010] [3] A. Kandi, A. Basaki, P. Gan, et al. Side-Channel and Fault Resistant ASCON Implementation: A Detailed Hardware Evaluation (Extended Version). Cryptology ePrint Archive, Paper 2024 / 984. SUMMARY

[0011] The application proposes a combined threshold masking protection method of Ascon authentication encryption algorithm, which combines threshold implementation with exchange-based infection technology to construct a second-order threshold implementation of Ascon algorithm, and completely copies a copy as a redundant mask, optimizes the exchange-based infection technology, and performs partial shared exchange through the exchange bit selection algorithm proposed by the application, so that the algorithm can effectively resist second-order power analysis attacks and first-order differential fault attacks.

[0012] The technical method for achieving the purpose of the application is:

[0013] A combined threshold masking protection method of Ascon authentication encryption algorithm, comprising the following steps:

[0014] (1) Constructing a second-order threshold implementation of Ascon algorithm;

[0015] The second-order threshold implementation of Ascon algorithm is analyzed and constructed according to the structure of Ascon algorithm, which is used as the initial mask, so that it meets the correctness, incompleteness and uniformity, and achieves second-order detection security through three shared threshold implementation;

[0016] (2) Construct the redundant mask of Ascon algorithm;

[0017] The constructed second-order threshold implementation of Ascon algorithm is completely copied as its redundant mask;

[0018] (3) Construct the combined threshold mask of Ascon algorithm based on the exchange technique;

[0019] The original mask and the redundant mask of the previously constructed Ascon algorithm are given the same plaintext information, and are encrypted at the same time, the partial shares of the initial mask and the redundant mask are selected by the exchange bit selection algorithm, the partial shares are exchanged, and finally all the shares of the initial mask encryption result are integrated by using the exclusive or operation to generate the ciphertext output, forming the final Ascon authentication encryption algorithm combined threshold mask protection method.

[0020] Further, the second-order threshold implementation of the Ascon algorithm in step (1) is implemented as follows:

[0021] (1.1) Rearrange the Ascon algorithm round function;

[0022] The S-box is the only nonlinear component in the Ascon algorithm, and the design of the S-box of the Ascon algorithm is realized by introducing linear transformation and affine transformation on the input and output of the χ mapping function of the Keccak algorithm;

[0023] The linear transformation in the S-box is moved behind the linear diffusion layer in the round function, and the round constant of the next round is calculated and added to the linear transformation of the S-box, the permutation starts from the χ mapping of the S-box, and the round function of the Ascon algorithm is rearranged;

[0024] (1.2) Nonlinear function mask;

[0025] The χ mapping function is an exclusive or operation of each bit with the nonlinear terms of the other two input bits, which is composed of Three-bit functions;

[0026] The algebraic normal form after decomposition of the χ mapping function is as follows:

[0027] x(a,b,c,d,e)=de+a+d

[0028] y(a,b,c,d,e)=ae+b+e

[0029] z(a,b,c,d,e)=ab+a+c

[0030] t(a,b,c,d,e)=bc+b+d

[0031] w(a,b,c,d,e)=cd+c+e

[0032] Where a, b, c, d, e represent the five input bits, and x, y, z, t, w represent the five output bits;

[0033] (1.2.1) According to the d+1 sharing threshold implementation proposed by Bilgin et al. in the prior art, a block cipher can achieve d-order security with d+1 input sharing. Therefore, three input sharings are required to construct a second-order security sharing. At least nine component functions are required to achieve the second-order incompleteness of the quadratic function.

[0034] (1.2.2) Using ring refresh mask technology;

[0035] Use a ring masker to mask and refresh the component functions, and only refresh the cross terms. Use additional random numbers in the ring refresh configuration to ensure second-order incompleteness;

[0036] (1.2.3) Use paired S-box masking techniques;

[0037] The Ascon algorithm uses 64 S-boxes in parallel during one round of encryption and decryption, pairing the S-boxes in pairs without adding any additional masking costs.

[0038] On the basis of (1.2.2), the two inputs of each input of the other S-box in the paired S-box are shared and added to the method to form the χ mapping function mask method of the Ascon algorithm S-box;

[0039] (1.3) Linear function mask;

[0040] Masking a linear function is achieved by replicating the same XOR operation for each shared component. According to (1.1), the linear transformation and affine transformation in the S-box are linear functions, and the same XOR operation needs to be performed on each shared component to achieve masking.

[0041] (1.4) Complete the construction of the second-order threshold mask method of the Ascon algorithm;

[0042] Use manual layout and routing methods to implement circuit layout and form a mask method.

[0043] Furthermore, the redundancy mask of the Ascon algorithm described in step (2) is specifically implemented as follows:

[0044] The initial mask M is completely copied to M′, which is called a redundant mask. The same plaintext P and key K are input into M and M′ respectively for encryption, and M and M′ have the same number of input shares and output shares. The sharing method and random number used in the masking method are exactly the same.

[0045] Furthermore, the construction of the Ascon algorithm combined threshold mask based on the exchange technology of replication described in step (3) is specifically implemented as follows:

[0046] (3.1) Determine the range of the number of exchange bits;

[0047] Let the number of exchange bits be w = HW(R0, R1, R2), satisfying w ≤ d, where d is the detection security level. The range of the number of exchange bits is 0, 1, and 2; HW represents the Hamming weight; R0, R1, and R2 represent the selected exchange bit positions;

[0048] (3.2) Get R0, R1, and R2 through the exchange bit selection algorithm;

[0049] (3.2.1) Select the input shares a0, a1, a2, and concatenate them into a decimal number and assign it to A;

[0050] (3.2.2) Calculate the value of A mod 5. If A mod 5 = 0, go to (3.2.3); if A mod 5 = 1, go to (3.2.4); if A mod 5 = 2, go to (3.2.5); if A mod 5 = 3, go to (3.2.6); if A mod 5 = 4, go to (3.2.7);

[0051] (3.2.3) If A mod5 = 0, assign the shared inputs a0, a1, and a2 to sel0, sel1, and sel2, respectively, and go to (3.2.8);

[0052] (3.2.4) If A mod5 = 1, assign the shared inputs b0, b1, and b2 to sel0, sel1, and sel2, respectively, and go to (3.2.8);

[0053] (3.2.5) If A mod5 = 2, assign the shared inputs c0, c1, and c2 to sel0, sel1, and sel2, respectively, and go to (3.2.8);

[0054] (3.2.6) If A mod5 = 3, assign the shared inputs d0, d1, and d2 to sel0, sel1, and sel2, respectively, and go to (3.2.8).

[0055] (3.2.7) If A mod 5 = 4, assign the shared inputs e0, e1, and e2 to sel0, sel1, and sel2, respectively, and go to (3.2.8).

[0056] (3.2.8) Concatenate the binary numbers sel0, sel1, and sel2 and convert them into a decimal number and assign it to R;

[0057] (3.2.9) Calculate Rmod7, convert the calculation result into a three-bit binary number, and assign R0, R1, R2 to R0, R1, R2 respectively;

[0058] (3.3) Select exchange sharing through G function;

[0059] Let y0, y1, y2 be the output shares of the initial mask, and y'0, y'1, y'2 be the output shares of the redundant mask, according to the algorithm in (3.2), 3 exchange bits R0, R1, R2 (R i ∈0,1) are obtained, and y i , y i ' and R0, R1, R2 (R i ∈0,1) are input into the G function, wherein,

[0060]

[0061] (3.3.1) Determine whether R i is 0, if R i =0, go to (3.3.2); if R i =1, go to (3.3.3);

[0062] (3.3.2) If R i =0, the shares of y i and y i ' remain unchanged;

[0063] (3.3.3) If R i =1, perform partial share exchange on the corresponding y i and y i ';

[0064] (3.4) After each round of nonlinear operation, perform partial share exchange according to the steps of (3.3);

[0065] (3.5) After the last round, use XOR operation to integrate all shares of the initial mask encryption result to generate the ciphertext output, forming the final Ascon authentication encryption algorithm combined threshold mask method.

[0066] The beneficial effects of the method of the application are:

[0067] (1) The method of the application can effectively resist second-order power consumption attacks and first-order differential fault attacks.

[0068] (2) The method of the application reduces a delay period by rearranging the round function of the algorithm.

[0069] (3) The method of the application uses fewer additional random numbers and smaller circuit implementation area. BRIEF DESCRIPTION OF DRAWINGS

[0070] Figure 1 Schematic diagram of the S-box structure of the Ascon authentication encryption algorithm of the present invention;

[0071] Figure 2 Schematic diagram of the Ascon authentication encryption algorithm based on round implementation of the present invention;

[0072] Figure 3 Schematic diagram of the paired S-box structure used in the present invention. DETAILED DESCRIPTION

[0073] The present invention will be further described below with reference to the accompanying drawings and embodiments, but the present invention is not limited thereto.

[0074] Example:

[0075] A comprehensive threshold mask protection implementation method for the Ascon authenticated encryption algorithm includes three parts:

[0076] Step (1) constructs the second-order threshold implementation of the Ascon algorithm. The specific implementation process is as follows:

[0077] (1.1) Rearrange the Ascon algorithm round function;

[0078] The S-box is the only nonlinear component in the Ascon algorithm. Figure 1 As shown in Figure 2, the design of the S-box of the Ascon algorithm is realized by introducing linear transformation and affine transformation on the input and output of the χ mapping function of the Keccak algorithm;

[0079] The linear transformation in the S-box is moved behind the linear diffusion layer in the round function, and the round constant of the next round is calculated and added to the linear transformation of the S-box. The permutation starts from the χ map of the S-box and rearranges the round function of the Ascon algorithm. The round function after arrangement is as follows Figure 2 As shown;

[0080] (1.2) Nonlinear function mask;

[0081] The χ mapping function is to perform an XOR operation on each bit with the nonlinear terms of the other two input bits, which is given by It consists of three bit functions;

[0082] The algebraic normal form of the decomposed χ mapping function is as follows:

[0083] x(a,b,c,d,e)=de+a+d

[0084] y(a,b,c,d,e)=ae+b+e

[0085] z(a,b,c,d,e)=ab+a+c

[0086] t(a,b,c,d,e) = bc + b + d

[0087] w(a,b,c,d,e) = cd + c + e

[0088] where a, b, c, d, e represent five input bits, x, y, z, t, w represent five output bits;

[0089] (1.2.1) According to the d+1 sharing threshold implementation proposed by Bilgin et al., a block cipher can achieve d-order security through d+1 input sharing, so three input sharing is required to build a second-order secure sharing, such as: Then at least 9 component functions are required to realize the quadratic function second-order imperfection, such as:

[0090] (1.2.2) Use ring refresh mask technology;

[0091] Use ring masker to refresh the mask of component functions, only the cross term needs to be refreshed, and an additional random number is used in the ring refresh configuration to ensure the second-order imperfection;

[0092] Take x(a,b,c,d,e) = de + a + d as an example:

[0093]

[0094] (1.2.3) Use paired S-box mask technology;

[0095] Ascon algorithm uses 64 S-boxes in parallel to calculate in one round of encryption and decryption, and the S-boxes are combined in pairs to form pairs, and the paired S-box structure is as shown in Figure 3 , and no additional mask cost is required;

[0096] Two paired S-boxes are denoted as S0(a0, a1, a2, b0, b1, b2, c0, c1, c2, d0, d1, d2, e0, e1, e2) and S1(k0, k1, k2, l0, l1, l2, m0, m1, m2, n0, n1, n2, o0, o1, o2), where a i ,b i ,c i ,d i ,e i ,i∈0,1,2 are input shares of the first S-box S0, k i ,l i ,m i ,n i ,o i ,i∈0,1,2 are input shares of the other S-box S1,

[0097] On the basis of (1.2.2), the two inputs of each input in S1 are shared in pairs and added to the method to form the χ mapping function mask method of the Ascon algorithm S-box;

[0098] The specific masking method of the χ mapping function of the S-box in the Ascon algorithm is as follows:

[0099]

[0100]

[0101] (1.3) Linear function mask;

[0102] Masking a linear function is achieved by replicating the same XOR operation for each shared component. According to (1.1), the linear transformation and affine transformation in the S-box are linear functions, and the same XOR operation needs to be performed on each shared component to achieve masking.

[0103] (1.4) Complete the construction of the second-order threshold mask method of the Ascon algorithm;

[0104] Manual placement and routing is used to implement circuit layout and form a threshold mask method.

[0105] Step (2) constructs the redundancy mask of the Ascon algorithm. The specific implementation process is as follows:

[0106] The initial mask M is completely copied to M′, which is called the redundant mask. The same plaintext P and key K are input to M and M′ for encryption, and M and M′ have the same number of input shares and output shares. The sharing method and random number used in the masking method are exactly the same.

[0107] Step (3) constructs the Ascon algorithm combined threshold mask based on the replication exchange technology. The specific implementation process is as follows:

[0108] (3.1) Determine the range of the number of exchange bits;

[0109] Let the number of exchange bits be w = HW(R0, R1, R2), satisfying w ≤ d, where d is the detection security level. The range of the number of exchange bits is 0, 1, and 2; HW represents the Hamming weight; R0, R1, and R2 represent the selected exchange bit positions;

[0110] (3.2) Get R0, R1, and R2 through the exchange bit selection algorithm;

[0111] (3.2.1) Select the input shares a0, a1, a2, and concatenate them into a decimal number and assign it to A;

[0112] (3.2.2) Calculate the value of A mod 5. If A mod 5 = 0, go to (3.2.3); if A mod 5 = 1, go to (3.2.4); if A mod 5 = 2, go to (3.2.5); if A mod 5 = 3, go to (3.2.6); if A mod 5 = 4, go to (3.2.7);

[0113] (3.2.3) If A mod5 = 0, assign the shared inputs a0, a1, and a2 to sel0, sel1, and sel2, respectively, and go to (3.2.8);

[0114] (3.2.4) If A mod5 = 1, assign the shared inputs b0, b1, and b2 to sel0, sel1, and sel2, respectively, and go to (3.2.8);

[0115] (3.2.5) If A mod5 = 2, assign the shared inputs c0, c1, and c2 to sel0, sel1, and sel2, respectively, and go to (3.2.8);

[0116] (3.2.6) If A mod5 = 3, assign the shared inputs d0, d1, and d2 to sel0, sel1, and sel2, respectively, and go to (3.2.8).

[0117] (3.2.7) If A mod 5 = 4, assign the shared inputs e0, e1, and e2 to sel0, sel1, and sel2, respectively, and go to (3.2.8).

[0118] (3.2.8) Concatenate the binary numbers sel0, sel1, and sel2 and convert them into a decimal number and assign it to R;

[0119] (3.2.9) Calculate Rmod7, convert the result into a three-digit binary number, and assign it to R0, R1, and R2 respectively;

[0120] The pseudo code of the exchange bit selection algorithm is as follows:

[0121]

[0122] (3.3) Select exchange sharing through G function;

[0123] Let y0, y1, y2 be the output shares of the initial mask, and y′0, y1′, y′2 be the output shares of the redundant mask. According to the algorithm in (3.2), we can get the 3-bit swap bits R0, R1, R2 (R i ∈0,1), and y i ,y i ′ and R0, R1, R2(R i ∈0,1) is input into the G function, where

[0124]

[0125] (3.3.1) judge R i whether it is 0, if R i = 0, turn (3.3.2); if R i = 1, turn (3.3.3);

[0126] (3.3.2) if R i = 0, the sharing of y i and y i ' remains unchanged;

[0127] (3.3.3) if R i = 1, the corresponding y i and y i ' are partially shared and exchanged;

[0128] (3.4) after each round of nonlinear operation, the steps according to (3.3) are used for partial shared exchange;

[0129] (3.5) after the last round, all shares of the initial mask encryption result are integrated using the XOR operation to generate the ciphertext output, forming the final Ascon authentication encryption algorithm combined threshold mask method.

[0130] The method has the advantages that the Ascon algorithm can effectively resist second-order power consumption attacks and first-order differential fault attacks, only a small amount of additional random numbers and a small circuit implementation area are required, and the hardware implementation cost can be significantly reduced.

Claims

1. A combined threshold mask protection method for the Ascon authentication encryption algorithm, characterized in that: The steps include: (1) Construct a second-order threshold implementation of the Ascon algorithm; The Ascon algorithm structure is analyzed and its second-order threshold implementation is constructed as the initial mask to ensure correctness, incompleteness, and uniformity. The second-order detection security is achieved through the three-shared threshold implementation. (2) Constructing the redundancy mask of the Ascon algorithm; The constructed second-order threshold implementation of the Ascon algorithm is fully copied as its redundancy mask; (3) Constructing the Ascon algorithm combined threshold mask based on the replicated exchange technique; The initial mask and redundant mask of the previously constructed Ascon algorithm are assigned to the same plaintext information and encrypted at the same time. The partial shares of the initial mask and redundant mask are selected through the exchange bit selection algorithm, and the partial shares are exchanged. Finally, all shares of the initial mask encryption results are integrated using the XOR operation to generate the ciphertext output, forming the final Ascon authenticated encryption algorithm combined threshold mask protection method.

2. The combined threshold mask protection method of the Ascon authentication encryption algorithm according to claim 1 is characterized in that: The second-order threshold of the Ascon algorithm described in step (1) is implemented as follows: (1.1) Rearrange the Ascon algorithm round function; The S-box is the only nonlinear component in the Ascon algorithm. The design of the S-box of the Ascon algorithm is achieved by introducing linear transformation and affine transformation on the input and output of the χ mapping function of the Keccak algorithm. Move the linear transformation in the S-box behind the linear diffusion layer in the round function, and add the round constant of the next round to the linear transformation of the S-box after calculation. The permutation starts from the χ map of the S-box and rearranges the round function of the Ascon algorithm. (1.2) Nonlinear function mask; The χ mapping function is to perform an XOR operation on each bit with the nonlinear terms of the other two input bits, which is given by It consists of three bit functions; (1.2.1) According to the d+1 sharing threshold implementation proposed in the prior art, a block cipher achieves d-order security through d+1 input sharing. Therefore, to construct a second-order security sharing, three input sharings are required. At least nine component functions are required to achieve the second-order incompleteness of the quadratic function. (1.2.2) Using ring refresh mask technology; Use a ring masker to perform mask refresh on the component functions, only the cross terms need to be refreshed, and use additional random numbers in the ring refresh configuration to ensure second-order incompleteness; (1.2.3) Use paired S-box masking techniques; The Ascon algorithm uses 64 S-boxes in parallel during one round of encryption and decryption, pairing the S-boxes in pairs without adding any additional masking costs. On the basis of (1.2.2), the two inputs of each input of the other S-box in the paired S-box are shared and added to the method to form the χ mapping function mask method of the Ascon algorithm S-box; (1.3) Linear function mask; Masking a linear function is achieved by replicating the same XOR operation for each shared component. According to (1.1), the linear transformation and affine transformation in the S-box are linear functions, and the same XOR operation needs to be performed on each shared component to achieve masking. (1.4) Complete the construction of the second-order threshold mask method of the Ascon algorithm; Use manual layout and routing methods to implement circuit layout and form a mask method.

3. The combined threshold mask protection method of the Ascon authentication encryption algorithm according to claim 1 is characterized in that: The specific implementation process of constructing the redundant mask of the Ascon algorithm described in step (2) is as follows: the initial mask M is completely copied to M′, which is called the redundant mask. The same plaintext P and key K are input into M and M′ respectively for encryption, and M and M′ have the same input sharing and output sharing number. The sharing method and random number used in the masking method are exactly the same.

4. The combined threshold mask protection method of the Ascon authentication encryption algorithm according to claim 1 is characterized in that: The construction of the Ascon authentication encryption algorithm combined threshold mask based on the exchange technology of replication described in step (3) is specifically implemented as follows: (3.1) Determine the range of the number of exchange bits; Let the number of exchange bits be w = HW(R0, R1, R2), satisfying w ≤ d, where d is the detection security level. The range of the number of exchange bits is 0, 1, and 2; HW represents the Hamming weight; R0, R1, and R2 represent the selected exchange bit positions; (3.2) Get R0, R1, and R2 through the exchange bit selection algorithm; (3.2.1) Select the shared inputs a0, a1, a2, and concatenate them into decimal numbers and assign them to A; (3.2.2) Calculate the value of Amod5. If Amod5 = 0, go to (3.2.3); if Amod5 = 1, go to (3.2.4); if Amod5 = 2, go to (3.2.5); if Amod5 = 3, go to (3.2.6); if Amod5 = 4, go to (3.2.7); (3.2.3) If Amod5 = 0, assign the shared inputs a0, a1, a2 to sel0, sel1, sel2 respectively, and go to (3.2.8); (3.2.4) If Amod5 = 1, assign the shared inputs b0, b1, b2 to sel0, sel1, sel2, go to (3.2.8); (3.2.5) If Amod5 = 2, assign the shared inputs c0, c1, c2 to sel0, sel1, sel2 respectively, go to (3.2.8); (3.2.6) If Amod5 = 3, assign the shared inputs d0, d1, d2 to sel0, sel1, sel2 respectively, go to (3.2.8); (3.2.7) If Amod5 = 4, assign the shared inputs e0, e1, e2 to sel0, sel1, sel2 respectively, go to (3.2.8); (3.2.8) Concatenate the binary numbers sel0, sel1, sel2 and convert them into a decimal number and assign it to R; (3.2.9) Calculate Rmod7, convert the result into a three-digit binary number, and assign it to R0, R1, and R2 respectively; (3.3) Select exchange sharing through G function; Let y0, y1, y2 be the output shares of the initial mask, y′0, y1′, y′2 be the output shares of the redundant mask, and according to the algorithm in (3.2), we can get the 3-bit swap bits R0, R1, R2 (R i ∈0,1), and y i ,y i ′ and R0, R1, R2(R i ∈0,1) is input into the G function, where (3.3.1) Determine R i Is it 0? If R i =0, go to (3.3.2); if R i =1, go to (3.3.3); (3.3.2) If R i =0, then y i and y i ′’s sharing remains unchanged; (3.3.3) If R i =1, the corresponding y i with y i 'Perform partial sharing exchange; (3.4) After each round of nonlinear operation, the partial shares are exchanged according to the steps of (3.3); (3.5) After the last round, all shares of the initial mask encryption results are combined using an XOR operation to generate the ciphertext output, forming the final Ascon authenticated encryption algorithm combined threshold mask method.

Images