Security analysis method, device and storage medium of cryptographic system

Abstract

The present disclosure relates to the field of information security technology, and includes a method, device, and storage medium for analyzing the security of a cryptographic system. The method comprises generating a graph data structure corresponding to a Boolean function obtained by cryptographic transformation; determining a target cut point set of the graph data structure; using each valid cut point of the target cut point set to split the graph data structure into multiple first connected branches, each first connected branch corresponding to a subfunction of the Boolean function; setting the common variables of each subfunction to a fixed value to obtain multiple independent subfunctions; determining the correlation of the multiple independent subfunctions based on the stacking lemma to obtain the correlation of the Boolean function to indicate the security of the cryptographic system; solving the problem that the security of the cryptographic system cannot be determined by a general Boolean function correlation calculation method due to the lack of a general polynomial time algorithm to determine the correlation of high-order Boolean functions; and improving the efficiency of cryptographic system security assessment.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a security analysis method, device, and storage medium for a cryptographic system. Background Art

[0002] Currently, cryptographic systems are commonly used to encrypt data during information transmission to ensure its security. The security of cryptographic systems can be analyzed by converting the password into a Boolean function and analyzing the correlation between the Boolean functions. A high correlation generally indicates poor cryptographic security.

[0003] Traditional security analysis methods for cryptographic systems based on Boolean function correlation include: converting the password generated by the cryptographic system into a Boolean function or constructing a Boolean function based on the password; for quadratic Boolean functions, converting the quadratic Boolean function containing n variables into a separating quadratic form so that each variable appears in only one subterm; based on the function expression of the separating quadratic form, obtaining the correlation of the Boolean function in polynomial time to determine the security of the cryptographic system based on the correlation of the Boolean function.

[0004] However, for cryptographic systems that can only be converted into higher-order Boolean functions, since the correlation calculation of higher-order Boolean functions is NP-hard, there is currently no general polynomial-time algorithm to determine the correlation of higher-order Boolean functions. Therefore, it is impossible to determine the security of the cryptographic system through a general Boolean function correlation calculation method. Summary of the Invention

[0005] In view of this, the present disclosure proposes a security analysis method, device and storage medium for a cryptographic system, which can solve the problem that the security of the cryptographic system cannot be determined by a general Boolean function correlation calculation method due to the lack of a general polynomial time algorithm to determine the correlation of high-order Boolean functions, and can calculate the correlation of Boolean functions in a shorter time, thereby improving the efficiency of determining the security of the cryptographic system.

[0006] According to one aspect of the present disclosure, a security analysis method for a cryptographic system is provided, the method comprising:

[0007] Obtaining a Boolean function converted from a password, wherein the password is generated by the cryptographic system;

[0008] Generate a graph data structure corresponding to the Boolean function; wherein the vertices of the graph data structure are used to indicate variables in the Boolean function, and the edges of the graph data structure are used to connect the vertices corresponding to the variables of each sub-item in the Boolean function;

[0009] Determining a target cut point set of the graph data structure; wherein the target cut point set includes at least one valid cut point, each valid cut point is used to split the graph data structure into a plurality of first connected branches, each first connected branch corresponding to a subfunction of the Boolean function;

[0010] Splitting the graph data structure based on the valid cut points to obtain a plurality of sub-functions;

[0011] The variables corresponding to the effective cut points in each sub-function are set to fixed values ​​to obtain multiple independent sub-functions;

[0012] The correlation of multiple independent sub-functions is determined based on the stacking lemma to obtain the correlation of the Boolean function. The correlation of the Boolean function is used to indicate the security of the cryptographic system, and the correlation of the Boolean function is negatively correlated with the security.

[0013] In a possible implementation, determining a target cut point set of the graph data structure includes:

[0014] Obtaining a vertex number threshold of the first connected component;

[0015] determining a second connected branch of the graph data structure based on a connected component algorithm;

[0016] For a target connected branch in which the number of vertices in the second connected branch is greater than the vertex number threshold, searching for the target cut point set in each vertex of the target connected branch based on an effective cut point search algorithm;

[0017] Deleting valid cut points and edges connected to the valid cut points in the graph data structure to obtain a processed graph;

[0018] Determining a second connected branch of the processed graph based on the connected component algorithm to trigger execution of the steps of searching for the target cut point set in each vertex of the target connected branch based on the effective cut point search algorithm for a target connected branch having a number of vertices greater than the vertex number threshold, and subsequent steps;

[0019] When the number of vertices in each second connected branch is less than or equal to the vertex number threshold, each target cut point set is output.

[0020] In a possible implementation, searching for the target cut point set in each vertex of the target connected branch based on an effective cut point search algorithm includes:

[0021] Obtain each candidate cut point set of each target connected branch;

[0022] For each candidate cut point set, determining the variance of the number of vertices of each connected branch in the processed graph corresponding to the candidate cut point set;

[0023] The candidate cut point set with the smallest variance is determined as the target cut point set.

[0024] In a possible implementation, before determining the set of cut points of the graph data structure, the method further includes:

[0025] In the case where there are independent points in the graph data structure, the correlation degree of the Boolean function is determined to be 0.

[0026] In a possible implementation, determining a target cut point set of the graph data structure includes:

[0027] In a case where the graph data structure does not have independent points, a target cut point set of the graph data structure is determined.

[0028] In a possible implementation, the number of valid cut points is k; accordingly,

[0029] The variables corresponding to the effective cut points in each sub-function are set to fixed values ​​to obtain multiple independent sub-functions, including:

[0030] The variable values ​​corresponding to the k valid cut points are set to the bit expansion of the value i, and multiple independent sub-functions corresponding to each value i are obtained; wherein the value of i is set to 0 to 2 in sequence. k -1, and k is a positive integer.

[0031] In a possible implementation, determining the correlation of multiple independent sub-functions based on the stacking lemma to obtain the correlation of the Boolean function includes:

[0032] For each value i, a plurality of mutually independent independent sub-functions corresponding to each value are determined, and the correlation of each independent sub-function is determined based on the product of the correlations of the independent sub-functions.

[0033] The average value of the correlations corresponding to the respective values ​​i is determined to obtain the correlation of the Boolean function.

[0034] In a possible implementation, determining the relevance of each independent sub-function includes:

[0035] Determining a first probability that the independent sub-function is 0;

[0036] Determining a second probability that the independent sub-function is 1;

[0037] The relevance of the independent sub-functions is determined based on the first probability and the second probability.

[0038] According to another aspect of the present disclosure, a security analysis device for a cryptographic system is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0039] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions implement the above method when executed by a processor.

[0040] According to another aspect of the present disclosure, a computer program product is provided, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0041] The invention relates to a cryptographic algorithm for determining the security of a cryptographic system by obtaining a Boolean function obtained by cryptographic transformation; generating a graph data structure corresponding to the Boolean function; determining a target cut point set for the graph data structure; using each valid cut point in the target cut point set to split the graph data structure into multiple first connected branches, each corresponding to a sub-function of the Boolean function; setting the common variables of each sub-function to fixed values ​​to obtain multiple independent sub-functions; determining the correlation of the multiple independent sub-functions based on the stacking lemma to obtain the correlation of the Boolean function, which is used to indicate the security of the cryptographic system, and the correlation of the Boolean function is negatively correlated with the security; and solving the problem that the security of the cryptographic system cannot be determined using a general Boolean function correlation calculation method due to the lack of a general polynomial time algorithm for determining the correlation of high-order Boolean functions. Since the Boolean function corresponding to the cryptographic system can be split into multiple independent sub-functions, the correlation of the Boolean function can be determined by calculating the correlation of the multiple independent sub-functions, thereby realizing the use of a general method to determine the correlation of the Boolean function, thereby determining the security of the cryptographic system. At the same time, since the independent sub-functions have fewer variables, the correlation of even high-order Boolean functions can be determined in a relatively short time, thereby improving the efficiency of cryptographic system security assessment.

[0042] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0044] Figure 1 A flowchart showing a security analysis method for a cryptographic system according to an embodiment of the present disclosure is shown;

[0045] Figure 2 A flowchart of a method for determining a target cut point set of a graph data structure according to an embodiment of the present disclosure is shown;

[0046] Figure 3 A code schematic diagram corresponding to a security analysis method according to an embodiment of the present disclosure is shown;

[0047] Figure 4 A code schematic diagram corresponding to a method for determining a target cut point set according to an embodiment of the present disclosure is shown;

[0048] Figure 5 A schematic diagram showing a graph data structure constructed by a Boolean function according to an embodiment of the present disclosure;

[0049] Figure 6 A schematic diagram showing a processed graph according to an embodiment of the present disclosure;

[0050] Figure 7 A block diagram showing a security analysis device for a cryptographic system according to an embodiment of the present disclosure is shown;

[0051] Figure 8 A block diagram of a security analysis device for a cryptographic system according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0052] Various exemplary embodiments, features, and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise indicated.

[0053] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0054] In addition, numerous specific details are provided in the following detailed description to better illustrate the present disclosure. Those skilled in the art will appreciate that the present disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art are not described in detail in order to highlight the main points of the present disclosure.

[0055] First, several terms involved in this application are introduced.

[0056] 1. Boolean functions are a special type of mathematical function whose domain and range are both Boolean values, namely True or False, typically represented by 1 and 0. Boolean function expressions can be constructed using basic logical operators to form complex logical expressions. For example, they can be constructed using logical operators such as AND, OR, and NOT.

[0057] The independent variables in a Boolean function are called elements. For example, in the Boolean function f(x, y, z) = xy + xz + yz, x, y, and z are all elements. The order of the highest-order monomial in a Boolean function is called the degree of the Boolean function. For example, in the Boolean function f(x, y, z) = xy + yz + z, the highest-order monomials are xy and yz, and the order is 2, so the degree of this Boolean function is 2. The product term consisting of a subset of the variables in a Boolean function is called a subterm. For example, in the Boolean function f(x, y, z) = xy + yz + z, xy, yz, and z are all subterms of the Boolean function. A new function defined based on a subset of the truth table of a Boolean function is a subfunction of that Boolean function. In other words, a subset of the truth table of a Boolean function is the truth table of that subfunction.

[0058] 2. Boolean function correlation: This measure reflects the relationship between changes in a function's output and changes in its input variables. Specifically, if a Boolean function has a low correlation, then even small changes in its input variables won't significantly change its output. Conversely, if the correlation is high, changes in the input variables will have a greater impact on the output. Based on this principle, the correlation of Boolean functions can be used to measure cryptographic system security. A Boolean function with low correlation makes it difficult for an attacker to infer key information by observing the correlation between its input and output, making it more resistant to correlation attacks.

[0059] 3. A connected component of a graph is the largest subgraph in an undirected graph consisting of vertices that are connected by paths. In other words, a connected component is a part of a graph where any two vertices in the connected component can be reached from each other by a path, and no larger subgraph containing these vertices satisfies this condition.

[0060] 4. Cut point: refers to a point in an undirected connected graph where the graph becomes disconnected after removing a vertex and the edge connected to it.

[0061] Figure 1The flowchart of the security analysis method of the cryptographic system according to one embodiment of the present disclosure is shown. This embodiment takes the method as an example of an electronic device with computing capabilities, which can be a user terminal or a server. The user terminal includes but is not limited to: a computer, a mobile phone, or a tablet computer, etc. This embodiment does not limit the implementation method of the electronic device. Figure 1 As shown, the method includes:

[0062] Step 101: Obtain a Boolean function converted from a password, where the password is generated by a cryptographic system.

[0063] In one example, Boolean functions are induced and generated using a linear analysis method for a symmetric cryptographic system. When the correlation between these Boolean functions induced by the linear analysis method is high, the corresponding symmetric cryptographic system is vulnerable to attacks using the linear analysis method. Alternatively, symmetric cryptographic systems include, but are not limited to, block ciphers and stream ciphers. This embodiment does not limit the implementation of symmetric cryptographic systems.

[0064] For example, the Boolean function acquisition method includes: determining the first inner product of the key stream z of the stream cipher system of the linear feedback shift register and its mask β; determining the initial state s of the linear feedback shift register in the key stream z generation stage (0) The second inner product with its mask α; summing the first inner product and the second inner product, we get the Boolean function g = (0) , α>⊕<z,β> At this point, if the correlation of the Boolean functions is high, s(0) can be recovered, and thus the secret variable of the stream cipher system can be recovered. That is, the stream cipher system is vulnerable to attack. The key stream z is the password generated by the stream cipher system.

[0065] For example, the method of obtaining a Boolean function includes: determining the third inner product of the plaintext P of the block cipher system and its mask α; determining the fourth inner product of the ciphertext C and its mask β; summing the third inner product and the fourth inner product to obtain the Boolean function f=<P,α> ⊕<C,β> At this point, if the Boolean function has a high correlation, the block cipher system password can be recovered using this Boolean function. The ciphertext C is the password generated by the block cipher system.

[0066] The above-mentioned Boolean functions g and f are both Boolean functions induced by the linear class analysis method. In other embodiments, the method of converting the password generated by the password system into a Boolean function can also be other methods. This embodiment does not limit the conversion method of the Boolean function.

[0067] Optionally, the Boolean function may be obtained by the electronic device based on password conversion, or may be obtained by another device based on password conversion and then sent to the electronic device. This embodiment does not limit the method for obtaining the Boolean function.

[0068] ​Step 102: Generate a graph data structure corresponding to the Boolean function; wherein the vertices of the graph data structure are used to indicate the variables in the Boolean function, and the edges of the graph data structure are used to connect the vertices corresponding to the variables of each sub-item in the Boolean function.

[0069] Assume that the Boolean function g(x1,…,x n ) is a high-order Boolean function containing n variables, x1,…,x n is a variable in the Boolean function. At this time, the vertex set V in the graph data structure G consists of n variables x1,…,x n The edge set E in the graph data structure G is composed of the Boolean function g(x1,…,x n ), specifically, for each sub-item in the Boolean function, the vertices corresponding to the variables in the sub-item are connected to each other by an edge, and the edge set E of the graph G is obtained.

[0070] Step 103, determine the target cut point set of the graph data structure; wherein the target cut point set includes at least one valid cut point, each valid cut point is used to divide the graph data structure into multiple first connected branches, each first connected branch corresponds to a sub-function in the Boolean function.

[0071] In this embodiment, by dividing the graph data structure into multiple first connected branches, the correlation corresponding to the sub-function is determined based on the sub-function corresponding to each first connected branch, thereby determining the correlation of the Boolean function. The task of calculating the correlation of the overall Boolean function can be divided into multiple tasks of calculating the correlation corresponding to the sub-function. Since the sub-function contains fewer variables, the difficulty of calculating the correlation can be reduced.

[0072] In one example, reference Figure 2 , determine the target cut point set of the graph data structure, including the following steps 21-26:

[0073] Step 21: Obtain a vertex number threshold of the first connected component.

[0074] In this embodiment, the electronic device is pre-set with a vertex number threshold th to limit the size of the first connected branch. This can avoid the difficulty in calculating the relevance of a sub-function due to the large number of variables in the sub-function, thereby improving the calculation efficiency of the relevance of the Boolean function.

[0075] Optionally, the vertex number threshold may be a fixed value, or may be changed based on user needs. This embodiment does not limit the setting method of the vertex number threshold.

[0076] The vertex number threshold is smaller than the total number of variables of the Boolean function. For example, if the total number of variables of the Boolean function is 57, the vertex number threshold may be 8, 7, or 6. This embodiment does not limit the value of the vertex number threshold.

[0077] Step 22: Determine a second connected branch of the graph data structure based on a connected component algorithm.

[0078] In this embodiment, the electronic device calls a connected component algorithm Connected_components(G) to determine a second connected branch of the graph data structure G. Optionally, the connected component algorithm includes, but is not limited to, a depth-first search (DFS) algorithm or a breadth-first search (BFS) algorithm. This embodiment does not limit the implementation of the connected component algorithm.

[0079] Step 23 : For a target connected branch in which the number of vertices in the second connected branch is greater than the vertex number threshold, a target cut point set is searched in each vertex of the target connected branch based on an effective cut point search algorithm.

[0080] Initialize the target cut point set

[0081] In one example, a target cut point set is searched among the vertices of a target connected branch based on an effective cut point search algorithm, including: obtaining each candidate cut point set for each target connected branch; for each candidate cut point set, determining the variance of the number of vertices in each connected branch in the processed graph corresponding to the candidate cut point set; and determining the candidate cut point set with the smallest variance as the target cut point set.

[0082] In this example, the effective cut point search algorithm is used to search for k optimal cut points in the target connected branch (i.e., the effective cut points with the minimum variance mentioned above). The value of k is a positive integer, that is, the target cut point set output by the effective cut point search algorithm is a non-empty set.

[0083] Schematically, obtaining each candidate cutpoint set for each target connected component includes: calling the All_Node_Cuts function to determine each node cutset of the target connected component, each node cutset being a candidate cutpoint set. Each node cutset includes a set of vertices, and removing these vertices will increase the number of connected components in the graph.

[0084] The All_Node_Cuts function works by traversing the graph data structure using a DFS algorithm and searching for vertices that belong to a cut set based on a predefined search rule. The predefined search rule states that for each vertex p, if there is a child vertex q of vertex p and no backedge in the DFS search tree of that child vertex q points to an ancestor of the vertex p in the DFS search, then the vertex p belongs to the cut set. In other words, if the DFS process finds that a vertex's descendant is reachable only through the vertex itself or its descendants, then the vertex belongs to the cut set.

[0085] The processed graph corresponding to the candidate cut point set refers to a graph obtained after deleting each vertex in the candidate cut point set and the edges connected to the vertex from the graph data structure.

[0086] In this example, by determining the candidate cut point set with the smallest variance in the number of vertices in each connected branch in the processed graph as the target cut point set, the number of vertices in each first connected branch can be made more balanced, so that the computing resources occupied when calculating the correlation of the sub-function corresponding to the first connected branch are more balanced, thereby improving computing efficiency.

[0087] Step 24: Delete the valid cut points and the edges connected to the valid cut points in the graph data structure to obtain a processed graph.

[0088] In this embodiment, the processed graph refers to a graph obtained by deleting valid cut points and edges connected to the valid cut points.

[0089] Step 25, based on the connected component algorithm, determines the second connected branch of the processed graph to trigger the execution of steps 23-25, that is, for the target connected branch in which the number of vertices in the second connected branch is greater than the vertex number threshold, searches for the target cut point set in each vertex of the target connected branch based on the effective cut point search algorithm and subsequent steps.

[0090] The related description of the connected component algorithm is detailed in step 22, which will not be repeated here in this embodiment.

[0091] Step 26: When the number of vertices in each second connected branch is less than or equal to the vertex number threshold, output each target cut point set.

[0092] Optionally, the method for determining the target cut point set in steps 21-26 is merely exemplary. In other embodiments, the All_Node_Cuts function may be called to determine the minimum cut set of the graph data structure, and each vertex in the minimum cut set is determined as a valid cut point to obtain the target cut point set. This embodiment does not limit the method for determining the target cut point set. The minimum cut set refers to the cut set with the least number of vertices.

[0093] Optionally, before step 103, i.e., before determining the cut point set of the graph data structure, if there are independent points in the graph data structure, the correlation of the Boolean function is determined to be 0. In this case, if there are no independent points in the graph data structure, determining the target cut point set of the graph data structure in step 103 is performed.

[0094] Since there are independent points in the graph data structure, it means that the probability of the Boolean function outputting 0 and outputting 1 is the same. In order to save computing resources, the correlation of the Boolean function can be directly determined to be 0.

[0095] Schematically, the method for determining an independent point in a graph data structure includes: obtaining a second connected branch of the graph data structure determined based on a connected component algorithm; determining whether there is a second connected branch including only one vertex; if so, determining that an independent point exists in the graph data structure; if not, determining that no independent point exists in the graph data structure.

[0096] In other embodiments, independent points in the graph data structure may be ignored, and the target cut point set of the graph data structure may be directly determined after step 102 . This embodiment does not limit this.

[0097] Step 104: segment the graph data structure based on valid cut points to obtain multiple sub-functions.

[0098] After obtaining the target cut point set, the Boolean function is divided into multiple sub-functions through each valid cut point in the target cut point set, that is, the Boolean function is the sum of multiple sub-functions, that is, g = g1⊕g2⊕…⊕gm, where g is a Boolean function, gi is a sub-function, i∈[1,m], m is a positive integer; ⊕ represents exclusive OR, which can be regarded as a sum over a field.

[0099] Among them, gi(i∈{1,…,m}) includes k common variables In this embodiment, the common variables are the variables corresponding to the valid cut points.

[0100] Schematically, the graph data structure is segmented based on effective cut points to obtain multiple sub-functions, including: for each first connected branch obtained by segmentation at effective cut points, searching for sub-items including each vertex in the first connected branch in the Boolean function, and determining the function composed of each sub-item as the sub-function corresponding to the first connected branch.

[0101] Step 105: Set the variables corresponding to the valid cut points in each sub-function to fixed values ​​to obtain multiple independent sub-functions.

[0102] When the variable corresponding to the effective cut point (that is, the public variable below) When the value of is fixed (or constant), the values ​​of the remaining variables in the sub-functions with these common variables will independently affect the output of the Boolean function. Therefore, gi(i∈{1,…,m}) after the common variables are fixed are independent sub-functions that are independent of each other.

[0103] Schematically, the variables corresponding to the effective cut points in each sub-function are set to fixed values ​​to obtain multiple independent sub-functions, including: setting the variable values ​​corresponding to k effective cut points to the bit expansion of the value i, to obtain multiple independent sub-functions corresponding to each value i; wherein the value of i is set to 0 to 2 in sequence k An integer of -1.

[0104] The bit expansion of the value i refers to expressing a value in binary form, that is, decomposing the value into a series of bits (ie, binary digits).

[0105] For example: if the value of i is 0, then the effective cut point is The corresponding values ​​are: 0,…,0;

[0106] If the value of i is 1, then the effective cut point The corresponding values ​​are: 0, ..., 1;

[0107] If the value of i is 2, then the effective cut point is The corresponding values ​​are: 0,…,1,0;

[0108] The value of i is 3, then the effective cut point The corresponding values ​​are: 0,…,1,1; and so on.

[0109] In other embodiments, the effective cut points of each sub-function may be set as fixed values ​​in other ways, such as: using multiple preset groups of fixed values ​​as fixed values ​​for the effective cut points, where the fixed value groups include multiple values, which correspond one-to-one to the effective cut points. This embodiment does not limit the method of setting fixed values ​​for the effective cut points.

[0110] Step 106 : Determine the correlation of multiple independent sub-functions based on the stacking lemma to obtain the correlation of the Boolean function. The correlation of the Boolean function is used to indicate the security of the cryptographic system, and the correlation of the Boolean function is negatively correlated with the security.

[0111] In one example, the correlation of multiple independent sub-functions is determined based on the stacking lemma to obtain the correlation of a Boolean function, including: for each multiple independent sub-functions corresponding to each numerical value i, determining the correlation of each independent sub-function; determining the correlation corresponding to the numerical value i based on the product of the correlations of each independent sub-function; and determining the average value of the correlations corresponding to each numerical value i to obtain the correlation of the Boolean function.

[0112] Schematically, determining the relevance of each independent sub-function includes: determining a first probability that the independent sub-function is 0; determining a second probability that the independent sub-function is 1; and determining the relevance of the independent sub-function based on the first probability and the second probability.

[0113] The correlation of each independent sub-function can be expressed as follows:

[0114] c(g j )=|Pr(g j =0)-Pr(g j =1)|;

[0115] Among them, c(g j ) represents an independent subfunction g j The correlation degree of g, j is a positive integer; Pr(g j =0) represents the first probability; Pr(g j =1) represents the second probability.

[0116] If the fixed values ​​of the variables corresponding to the valid cut points in each independent sub-function are set to the bit expansion of the value i in sequence, the correlation degree of the Boolean function can be expressed as follows:

[0117]

[0118] in, Indicates that the independent subfunction g j Variables in The value of is fixed to the bit expansion of the value i. Then in g j If a variable in S does not exist in g, the variable and its value are skipped, that is, not in g j Set the fixed value corresponding to the variable in the "||" represents the string concatenation operator, Indicates the variables corresponding to the valid cut points.

[0119] In other embodiments, if the fixed values ​​of the variables in the independent sub-functions are set in other ways, the sum of the correlations of the independent sub-functions under different fixed values ​​can also be determined, thereby determining the average value of the correlations and obtaining the correlation of the Boolean function. This embodiment will not be listed one by one here.

[0120] Optionally, the electronic device can output the correlation of the Boolean function to indicate the security of the cryptographic system, or the electronic device can convert the correlation of the Boolean function into a security index according to a preset conversion rule to indicate the security of the cryptographic system. The preset conversion rule is established based on the negative correlation between the correlation of the Boolean function and the security of the cryptographic system. This embodiment does not limit the way in which the electronic device indicates the security of the cryptographic system.

[0121] In summary, the security analysis method of the cryptographic system provided in this embodiment obtains a Boolean function obtained by password conversion; generates a graph data structure corresponding to the Boolean function; determines a target cut point set of the graph data structure; each valid cut point of the target cut point set is used to divide the graph data structure into multiple first connected branches, each first connected branch corresponds to a sub-function of the Boolean function; sets the common variables of each sub-function to a fixed value to obtain multiple independent independent sub-functions; determines the correlation of multiple independent sub-functions based on the stacking lemma to obtain the correlation of the Boolean function, the correlation of the Boolean function is used to indicate the security of the cryptographic system, and the correlation of the Boolean function is negatively correlated with the security; it can solve the problem that the security of the cryptographic system cannot be determined by a general Boolean function correlation calculation method due to the lack of a general polynomial time algorithm to determine the correlation of high-order Boolean functions; since the Boolean function corresponding to the password can be split into multiple independent independent sub-functions, the correlation of the Boolean function is determined by calculating the correlation of multiple independent sub-functions, and the use of a general method to determine the correlation of the Boolean function is realized, thereby determining the security of the cryptographic system. At the same time, since there are fewer variables in the independent sub-functions, even for high-order Boolean functions, the correlation of high-order Boolean functions can be determined in a shorter time, thereby improving the efficiency of the evaluation of the security of the cryptographic system.

[0122] In addition, by setting a vertex number threshold of the first connected branch to determine the target cut point set, it can be ensured that the number of vertices in the first connected branch will not exceed the vertex number threshold. In this way, there will not be too many variables in the obtained sub-function, thereby ensuring that the amount of correlation calculation of independent sub-functions will not be too large.

[0123] In addition, by determining the variance of the number of vertices in each connected branch in the processed graph corresponding to the candidate cut point set, and determining the candidate cut point set with the smallest variance as the target cut point set, the number of vertices in each first connected branch can be made more balanced, so that the computing resources occupied when calculating the correlation of the sub-function corresponding to the first connected branch are more balanced, thereby improving the computing efficiency.

[0124] In addition, by directly determining the correlation of the Boolean function to be 0 when there are independent points in the graph data structure, the computing resources consumed in the subsequent processes of determining the target cut point set and determining the correlation of independent sub-functions can be saved, thereby improving computing efficiency.

[0125] In addition, by setting the values ​​of k public variables to the bits of the value i, multiple independent sub-functions corresponding to each value i are obtained, so that the fixed value of the public variable can traverse various possible values, thereby improving the accuracy of calculating the correlation.

[0126] In order to further understand the security analysis method of the cryptographic system provided by this application, the following example is given to illustrate the method. Figure 3 The code diagram corresponding to the security analysis method shown is based on Figure 3 It can be seen that the security analysis method includes at least the following steps:

[0127] Step 301: Initialize the target cut point set The vertex set V and edge set E of the graph data structure are both Graph data structure G =<V,E> ;

[0128] Step 302: for each sub-term x of the Boolean function g t1 、x t2 ,……,x tn , add each variable in this subitem to the vertex set V;

[0129] Step 303: connect an edge between different variables of the sub-item and add the edge to the edge set E;

[0130] Step 304: Call the connected component algorithm Connected_components(G) to determine the second connected branch {G1, G2, ..., G n};

[0131] Step 305: Determine whether there is an independent point with 1 vertex in the second connected branch; if so, output the correlation of the Boolean function as 0; if not, execute step 306;

[0132] Step 306: Call the cut point algorithm CUT_SETS(G, th) to determine the target cut point set;

[0133] Step 307: Split the Boolean function g into m sub-functions using a target cut point set, g = g1 ⊕ g2 ⊕ … ⊕ gm, where the target cut point set includes multiple valid cut points and m is a positive integer.

[0134] Step 308: For each value i, set the variable values ​​corresponding to the S valid cut points in the m sub-functions to the bit expansion of the value i, and calculate the sum of the correlations corresponding to each value i. The value of i is set to 0 to 2 in sequence. S An integer of -1;

[0135] Step 309: multiply the sum of the correlations by 2 S , and get the correlation of Boolean functions.

[0136] Schematically, the process of calling the cut point algorithm CUT_SETS(G, th) in step 306 to determine the target cut point set is referred to Figure 4The code diagram shown is based on Figure 4 It can be seen that the process of determining the target cut point set includes the following steps:

[0137] Step 401: Initialize the target cut point set

[0138] Step 402: searching for a target connected component in which the number of vertices in the second connected component is greater than a vertex number threshold th;

[0139] Step 403: for each target connected branch G i , call the valid cut point search algorithm VALID_CUT_SET(G i ) Search for the target cut point set S1 and merge S1 into S;

[0140] Among them, the effective cut point search algorithm VALID_CUT_SET(G i ) includes the following steps: initializing the size k of the candidate cut point set to 0, the target cut point set S1 to Call the optimal k-cut point search algorithm kCut_Sets(G,k) to search for the optimal k-cut points and obtain the target cut point set S1;

[0141] The optimal k-cut point search algorithm includes the following steps: calling the All_Node_Cuts function to determine the point cut sets of the target connected branch; for each point cut set, i Delete the vertex in the point cut set and the edge connected to the vertex to obtain the processed graph Calling the connected components algorithm Determine the processed image Each connected branch in the connected branch is obtained to obtain the number of vertices in the connected branch; the variance of the number of vertices is determined; and the point cut set with the smallest variance is determined as the target cut point set S1.

[0142] Step 404: Delete the valid cut points in the target cut point set S1 and the edges connected to the valid cut points from the graph data structure G to obtain a processed graph G'.

[0143] Step 405 : After determining the first connected branch of the processed graph G′ through the connected component algorithm Connected_components(G′), each target cut point set is output.

[0144] In this embodiment, by determining the candidate cut point set with the smallest variance as the target cut point set, the number of vertices in each first connected branch can be relatively balanced, so that the computing resources occupied when calculating the correlation of the sub-function corresponding to the first connected branch are relatively balanced, thereby improving computing efficiency.

[0145] in addition, Figure 3 and Figure 4 The code implementation method is only illustrative. Different codes can be used to implement the same function in actual implementation. This embodiment does not limit the code implementation method of the security analysis method of the cryptographic system in this application.

[0146] The following example illustrates the security analysis method for the cryptographic system provided in this embodiment. Assume that the Boolean function f(b) obtained by cryptographic transformation is a 6-order Boolean function consisting of 57 variables, and the expression of the Boolean function is as follows:

[0147] f(b)=b 103 b 95 b 80 b 76 ⊕b 103 b 95 b 88 ⊕b 106 b 103 ⊕b 106 b 103 b 64 b 58

[0148] ⊕b 106 b 103 b 95 b 88 b 80 ⊕b 106 b 88 b 71 b 52 ⊕b 108 b 101 b 93 b 89 b 84 b 77

[0149] ⊕b 116 b 108 b 101 ⊕b 116 b 108 b 93 b 89 ⊕b 119 b 101 b 84 b 65 ⊕b 119 b 116

[0150] ⊕b 119 b 116 b 108 b 101 b 93 ⊕b 119 b 116 b77 b 71 ⊕b 16 b 10 ⊕b 17 b 11

[0151] ⊕b 19 b 13 ⊕b 25 b 19 ⊕b 34 b 29 b 22 ⊕b 34 b 29 b 22 b 16 b 10

[0152] ⊕b 35 b 30 b 23 ⊕b 35 b 30 b 23 b 17 b 11 ⊕b 37 b 32 b 25

[0153] ⊕b 37 b 32 b 25 b 19 b 13 ⊕b 38 b 34 ⊕b 39 b 35 ⊕b 41 b 37 ⊕b 43 b 38 b 31

[0154] ⊕b 43 b 38 b 31 b 25 b 19 ⊕b 46 b 40 ⊕b 47 b 43 ⊕b 53 b 46 b 38 b 34 b 29 b 22

[0155] ⊕b 54 b 47 b 39 b35 b 30 b 23 ⊕b 56 b 49 b 41 b 37 b 32 b 25 ⊕b 58 b 52

[0156] ⊕b 61 b 53 b 38 b 34 ⊕b 61 b 53 b 46 ⊕b 62 b 54 b 39 b 35 ⊕b 62 b 54 b 47

[0157] ⊕b 62 b 55 b 47 b 43 b 38 b 31 ⊕b 64 b 46 b 29 b 10 ⊕b 64 b 56 b 41 b 37

[0158] ⊕b 64 b 56 b 49 ⊕b 64 b 59 b 52 ⊕b 64 b 59 b 52 b 46 b 40 ⊕b 64 b 61

[0159] ⊕b 64 b 61 b 22 b 16 ⊕b 64 b 61 b 53 b 46 b 38 ⊕b 65 b 47 b30 b 11 ⊕b 65 b 62

[0160] ⊕b 65 b 62 b 23 b 17 ⊕b 65 b 62 b 54 b 47 b 39 ⊕b 67 b 49 b 32 b 13 ⊕b 67 b 64

[0161] ⊕b 67 b 64 b 25 b 19 ⊕b 67 b 64 b 56 b 49 b 41 ⊕b 68 b 64 ⊕b 70 b 62 b 47 b 43

[0162] ⊕b 70 b 62 b 55 ⊕b 71 b 65 ⊕b 73 b 55 b 38 b 19 ⊕b 73 b 70

[0163] ⊕b 73 b 70 b 31 b 25 ⊕b 73 b 70 b 62 b 55 b 47 ⊕b 76 b 71 b 64

[0164] ⊕b 76 b 71 b 64 b 58 b52 ⊕b 80 b 76 ⊕b 83 b 76 b 68 b 64 b 59 b 52

[0165] ⊕b 89 b 84 b 77 ⊕b 89 b 84 b 77 b 71 b 65 ⊕b 91 b 83 b 68 b 64 ⊕b 91 b 83 b 76

[0166] ⊕b 93 b 89 ⊕b 94 b 76 b 59 b 40 ⊕b 94 b 91 ⊕b 94 b 91 b 52 b 46

[0167] ⊕b 94 b 91 b 83 b 76 b 68 ⊕b 95 b 88 b 80 b 76 b 71 b 64

[0168] Graph data structure reference constructed based on the above Boolean function Figure 5 As shown, according to Figure 5 It can be seen that the graph data structure G has one second connected branch, contains 57 vertices and 253 edges, and has no independent points. Based on this, assuming that the vertex number threshold of the first connected branch th = 10, the cut point algorithm CUT_SETS (G, th) is called, and the target cut point set S = {b 71 ,b 65 ,b 64 ,b 38 ,b46 ,b 62 ,b 47 ,b 76 ,b 52 ,b 19 ,b 25}, the time complexity of the cut point search is approximately After deleting the valid cut points and the edges connected to the valid cut points in the graph G, the processed graph reference is obtained. Figure 6 As shown, according to Figure 6 It can be seen that the effective cut point divides the graph G into 7 first connected branches, corresponding to the following 7 sub-functions:

[0169] f1=b 43 b 38 b 31 ⊕b 43 b 38 b 31 b 25 b 19 ⊕b 47 b 43 ⊕b 62 b 55 b 47 b 43 b 38 b 31 ⊕b 70 b 62 b 47 b 43 ⊕b 70 b 62 b 55 ⊕b 73 b 55 b 38 b 19 ⊕b 73 b 70 ⊕b 73 b 70 b 31 b 25 ⊕b 73 b 70 b 62 b 55 b 47 ⊕b 25 b 19 ⊕b 65 b 62 ⊕b 71 b 65 ⊕b 76 b 71 b 64 ;

[0170] f2=b 103 b 95 b 80 b76 ⊕b 103 b 95 b 88 ⊕b 106 b 103 ⊕b 106 b 103 b 64 b 58 ⊕b 106 b 103 b 95 b 88 b 80 ⊕b 106 b 88 b 71 b 52 ⊕b 58 b 52 ⊕b 76 b 71 b 64 b 58 b 52 ⊕b 80 b 76 ⊕b 95 b 88 b 80 b 76 b 71 b 64 ;

[0171] f3=b 46 b 40 ⊕b 64 b 59 b 52 ⊕b 64 b 59 b 52 b 46 b 40 ⊕b 68 b 64 ⊕b 83 b 76 b 68 b 64 b 59 b 52 ⊕b 94 b 91 ⊕b 91 b 83 b 68 b 64 ⊕b 91 b 83 b 76 ⊕b 94 b 76 b 59 b 40 ⊕b 94 b 91 b 52 b46 ⊕b 94 b 91 b 83 b 76 b 68 ;

[0172] f4=b 16 b 10 ⊕b 34 b 29 b 22 ⊕b 34 b 29 b 22 b 16 b 10 ⊕b 38 b 34 ⊕b 53 b 46 b 38 b 34 b 29 b 22 ⊕b 64 b 61 ⊕b 61 b 53 b 38 b 34 ⊕b 61 b 53 b 46 ⊕b 64 b 46 b 29 b 10 ⊕b 64 b 61 b 22 b 16 ⊕b 64 b 61 b 53 b 46 b 38

[0173] f5=b 17 b 11 ⊕b 35 b 30 b 23 ⊕b 35 b 30 b 23 b 17 b 11 ⊕b 39 b 35 ⊕b 54 b 47 b 39 b 35 b 30 b 23 ⊕b 62 b 54 b39 b 35 ⊕b 62 b 54 b 47 ⊕b 65 b 47 b 30 b 11 ⊕b 65 b 62 b 23 b 17 ⊕b 65 b 62 b 54 b 47 b 39 ;

[0174] f6=b 19 b 13 ⊕b 37 b 32 b 25 ⊕b 37 b 32 b 25 b 19 b 13 ⊕b 41 b 37 ⊕b 56 b 49 b 41 b 37 b 32 b 25 ⊕b 67 b 64 ⊕b 64 b 56 b 41 b 37 ⊕b 64 b 56 b 49 ⊕b 67 b 49 b 32 b 13 ⊕b 67 b 64 b 25 b 19 ⊕b 67 b 64 b 56 b 49 b 41 ;

[0175] f7=b 108 b 101 b 93 b 89 b 84 b 77 ⊕b 116 b 108 b101 ⊕b 116 b 108 b 93 b 89 ⊕b 119 b 101 b 84 b 65 ⊕b 119 b 116 ⊕b 119 b 116 b 108 b 101 b 93 ⊕b 119 b 116 b 77 b 71 ⊕b 89 b 84 b 77 ⊕b 89 b 84 b 77 b 71 b 65 ⊕b 93 b 89 .

[0176] At this time, f(b)=f1⊕f2⊕f3⊕f4⊕f5⊕f6⊕f7. There are at most 11 common variables between these sub-functions, namely the variables b corresponding to the effective cut points. 71 ,b 65 ,b 64 ,b 38 ,b 46 ,b 62 ,b 47 ,b 76 ,b 52 ,b 19 ,b 25 , when the values ​​of these variables are constants, we get 7 independent sub-functions that are independent of each other.

[0177] Specifically, traverse 2 of the 11 valid cut points 11 The variable values ​​corresponding to the 11 effective cut points are fixed according to the value selection results, and then the 2 11 The correlation of the Boolean function can be calculated using the stacking theorem by summing up all the correlations obtained by taking the value of the seed.

[0178] The correlation calculation process of Boolean function is as follows: let S = {b 71 ,b 65 ,b 64 ,b 38 ,b 46 ,b 62 ,b 47 ,b 76,b 52 ,b 19 ,b 25 ;

[0179] b S =b 71 ||b 65 ||b 64 ||b 38 ||b 46 ||b 62 ||b 47 ||b 76 ||b 52 ||b 19 ||b 25 , where “||” represents the string concatenation operator, resulting in:

[0180]

[0181] in, Indicates that the variable b in fj 71 ,b 65 ,b 64 ,b 38 ,b 46 ,b 62 ,b 47 ,b 76 ,b 52 ,b 19 ,b 25 The value of is fixed to the bit expansion of the value i. If a variable in S does not exist in fj, the variable and its value are skipped. For example, b does not exist in f7 64 ,b 38 ,b 46 ,b 62 ,b 47 ,b 76 ,b 52 ,b 19 ,b 25 , in the calculation When , these variables and their values ​​are skipped. Finally, the correlation of the Boolean function f(b) is 2 -17.54 .

[0182] Figure 7 This is a block diagram of a security analysis device for a cryptographic system provided by an embodiment of the present application, which includes: a function acquisition module 710, a graph generation module 720, a cut point determination module 730, a function segmentation module 740, a function processing module 750 and a security analysis module 760.

[0183] a function acquisition module 710 for acquiring a Boolean function converted from a password generated by the password system;

[0184] A graph generation module 720 is configured to generate a graph data structure corresponding to the Boolean function; wherein the vertices of the graph data structure are used to indicate variables in the Boolean function, and the edges of the graph data structure are used to connect the vertices corresponding to the variables of each sub-item in the Boolean function;

[0185] a cut point determination module 730 for determining a target cut point set for the graph data structure; wherein the target cut point set includes at least one valid cut point, each valid cut point being used to partition the graph data structure into a plurality of first connected branches, each first connected branch corresponding to a subfunction in the Boolean function;

[0186] A function partitioning module 740 is configured to partition the graph data structure based on the valid cut points to obtain a plurality of sub-functions;

[0187] Function processing module 750, used to set the variables corresponding to the valid cut points in each sub-function to fixed values, to obtain multiple independent sub-functions;

[0188] The security analysis module 760 is used to determine the correlation of multiple independent sub-functions based on the stacking lemma to obtain the correlation of the Boolean function. The correlation of the Boolean function is used to indicate the security of the cryptographic system, and the correlation of the Boolean function is negatively correlated with the security.

[0189] For detailed description, please refer to the above method embodiment.

[0190] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments. For the sake of brevity, it will not be repeated here.

[0191] The present disclosure also provides a computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions implement the above method when executed by a processor. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium.

[0192] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0193] An embodiment of the present disclosure also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0194] Figure 8 1 is a block diagram of an apparatus 1900 for security analysis of a cryptographic system according to an exemplary embodiment. For example, the apparatus 1900 may be provided as a server or a terminal device. Figure 8 The apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above-described method.

[0195] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output interface 1958 (I / O interface). The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server 2003. TM , MacOS X TM , Unix TM ,Linux TM , FreeBSD TM or similar.

[0196] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by the processing component 1922 of the apparatus 1900 to perform the above-described method.

[0197] While various embodiments of the present disclosure have been described above, the foregoing description is intended to be illustrative, non-exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technological improvements in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A security analysis method for a cryptographic system, characterized in that: The method comprises: Obtaining a Boolean function converted from a password, wherein the password is generated by the cryptographic system; Generate a graph data structure corresponding to the Boolean function; wherein the vertices of the graph data structure are used to indicate variables in the Boolean function, and the edges of the graph data structure are used to connect the vertices corresponding to the variables of each sub-item in the Boolean function; Determining a target cut point set of the graph data structure; wherein the target cut point set includes at least one valid cut point, each valid cut point is used to split the graph data structure into a plurality of first connected branches, each first connected branch corresponding to a subfunction of the Boolean function; Splitting the graph data structure based on the valid cut points to obtain a plurality of sub-functions; The variables corresponding to the effective cut points in each sub-function are set to fixed values ​​to obtain multiple independent sub-functions; The correlation of multiple independent sub-functions is determined based on the stacking lemma to obtain the correlation of the Boolean function. The correlation of the Boolean function is used to indicate the security of the cryptographic system, and the correlation of the Boolean function is negatively correlated with the security.

2. The method according to claim 1, characterized in that Determining a target cut point set of the graph data structure includes: Obtaining a vertex number threshold of the first connected component; determining a second connected branch of the graph data structure based on a connected component algorithm; For a target connected branch in which the number of vertices in the second connected branch is greater than the vertex number threshold, searching for the target cut point set in each vertex of the target connected branch based on an effective cut point search algorithm; Deleting valid cut points and edges connected to the valid cut points in the graph data structure to obtain a processed graph; Determining a second connected branch of the processed graph based on the connected component algorithm to trigger execution of the steps of searching for the target cut point set in each vertex of the target connected branch based on the effective cut point search algorithm for a target connected branch having a number of vertices greater than the vertex number threshold, and subsequent steps; When the number of vertices in each second connected branch is less than or equal to the vertex number threshold, each target cut point set is output.

3. The method according to claim 2, characterized in that The searching for the target cut point set in each vertex of the target connected branch based on an effective cut point search algorithm includes: Obtain each candidate cut point set of each target connected branch; For each candidate cut point set, determining the variance of the number of vertices of each connected branch in the processed graph corresponding to the candidate cut point set; The candidate cut point set with the smallest variance is determined as the target cut point set.

4. The method according to claim 1, wherein Before determining the cut point set of the graph data structure, the method further includes: In the case where there are independent points in the graph data structure, the correlation degree of the Boolean function is determined to be 0.

5. The method according to claim 4, characterized in that Determining a target cut point set of the graph data structure includes: In a case where the graph data structure does not have independent points, a target cut point set of the graph data structure is determined.

6. The method according to claim 1, characterized in that The number of valid cut points is k; accordingly, The variables corresponding to the effective cut points in each sub-function are set to fixed values ​​to obtain multiple independent sub-functions, including: The variable values ​​corresponding to the k valid cut points are set to the bit expansion of the value i, and multiple independent sub-functions corresponding to each value i are obtained; wherein the value of i is set to 0 to 2 in sequence. k -1, and k is a positive integer.

7. The method according to claim 6, characterized in that The determining of the correlation of the plurality of independent sub-functions based on the stacking lemma to obtain the correlation of the Boolean function includes: For each value i, a plurality of mutually independent independent sub-functions corresponding to each value are determined, and the correlation of each independent sub-function is determined based on the product of the correlations of the independent sub-functions. The average value of the correlations corresponding to the respective values ​​i is determined to obtain the correlation of the Boolean function.

8. The method according to claim 7, characterized in that Determining the relevance of each independent sub-function includes: Determining a first probability that the independent sub-function is 0; Determining a second probability that the independent sub-function is 1; The relevance of the independent sub-functions is determined based on the first probability and the second probability.

9. A security analysis device for a cryptographic system, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to implement the method according to any one of claims 1 to 8 when executing the instructions stored in the memory.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images