A Block Cipher Design and Automated Security Assessment Assistance System

Abstract

The present invention discloses a block cipher design and automated security assessment auxiliary system, including a front-end and a back-end. The front-end is designed based on the RESTful architecture, including a user interface, a FastAPI and a verification module; the back-end includes a component function system, a solver call module, an STP solver and a data parsing module. The method of the present invention receives the basic data and round function description passed in by the user at the front-end, uses the parsing method to link the basic description of the user-defined encryption algorithm with each module, uses the background script file to automatically generate the CVC language file, and uses the STP solver to complete the automatic search and modular implementation of different attack modes; it realizes the security assessment of the encryption algorithm designed by the user and returns the assessment result report. At present, there is no automated analysis tool that can both effectively analyze the block encryption algorithm and reduce the ability requirements for the user. The present invention fills this gap.

Description

Technical Field

[0001] The present invention belongs to the field of confidential communications, relates to the fields of cryptography and network security, and particularly relates to a block cipher design and automated security assessment auxiliary system. Background Art

[0002] Cryptography, as the theoretical foundation for ensuring secure data transmission, has become a hot research topic amidst the growing emphasis on information security. Block ciphers, due to their adaptability and flexibility, have gained widespread application. Therefore, research on the security of block ciphers is of great significance. Security analysis methods for block cipher algorithms include differential analysis, linear analysis, integral analysis, and many other methods. Each of these analysis techniques has its strengths, and evaluating a block cipher algorithm's resistance to various existing analysis techniques from different perspectives has become an important indicator of algorithm security.

[0003] A differential attack is a chosen-plaintext attack and one of the most effective known attacks against iterative block ciphers. Its basic idea is to find a high-probability differential signature and, based on the probability distribution of the differential signature, distinguish the block cipher from a random permutation. This high-probability differential signature can then be used to perform a key recovery attack. Differential cryptanalysis is widely used in the security analysis of block ciphers. After designing a block cipher, cryptographic algorithm designers must test its resistance to differential cryptanalysis. Impossible differential attacks are another important analytical method in the field of block ciphers. These differential attacks exploit high-probability differential signatures to construct a discriminator and perform a key recovery attack. However, from a hypothesis testing perspective, whether the differential probability is greater than or less than the random probability, it is different from a random permutation and can be used to construct a discriminator. Unlike differential attacks that exploit high-probability differential paths, impossible differential attacks aim to find the longest impossible differential path, that is, a differential path with zero probability.

[0004] Linear attacks fall under the category of known-plaintext attacks. Their basic concept is similar to differential attacks: they exploit linear expressions with high deviations between input and output to distinguish cryptographic algorithms from random permutations, allowing for key recovery attacks. Block ciphers' resistance to linear attacks is the bottom line of modern cryptographic security. Traditional linear attacks rely on high-deviation linear approximations, distinguishing the target algorithm from random permutations by observing how the linear approximation behaves under correct and incorrect keys. As the dual approach to impossible differential attacks in the linear attack domain, zero-correlation linear attacks rely on linear approximations with zero correlation under all keys.

[0005] An integral attack selects a group of plaintexts that satisfy a specific form for encryption and then analyzes the properties of the sum of the intermediate states after several rounds of encryption transformations. The sum of these intermediate states is called the integral. An integral attack distinguishes a cryptographic algorithm from a random permutation by exploiting the non-randomness of the integral value. Among these, the Division Property is a new method for finding integral discriminators, an extension of the integral attack. Based on the division of internal states, methods for obtaining integral discriminators can be divided into three categories: 1) State-based divisibility: These methods evaluate the divisibility of certain generalized structures. 2) Word-based divisibility: These methods evaluate the divisibility of certain specific passwords at the word level. 3) Bit-based divisibility: These methods evaluate the propagation of divisibility at the bit level.

[0006] Traditional analysis methods for cryptographic algorithm security assessment rely primarily on manual deduction and logical reasoning. The main drawback is that manual analysis relies heavily on the evaluator's expertise, integrating knowledge from various disciplines, including cryptography and algebra. Furthermore, manual analysis is a time-consuming and complex process requiring significant human and material resources. It is also inherently random, incomplete, and difficult to find optimal results. This makes it difficult for cryptographic algorithm designers to accurately assess the algorithm's security strength, impacting the scientific nature of cryptographic algorithm design and analysis. With the rapid development of computer technology, cryptanalysts have incorporated automated search techniques into cryptographic algorithm analysis, realizing automated models for analytical methods. Automated analysis methods leverage modern computing power to produce more refined and accurate cryptographic analysis results, significantly improving the efficiency of cryptographic algorithm analysis and facilitating a more accurate assessment of the algorithm's security strength. Therefore, research on automated analysis methods for block ciphers has strong application and theoretical value.

[0007] STP, an important tool for automated analysis of block ciphers, is a solver developed based on Satisfiability Modulo Theories. The STP solver accepts a set of CNF conjunctive normal forms (Boolean expressions and their negations are called literals, the disjunction of a finite number of literals is called a sentence, and the conjunction of a finite number of sentences is called a CNF conjunctive normal form) as input. After a series of processing, it is converted into a SAT problem (determining the solvability of a set of Boolean expressions), which is then solved using a SAT solver, ultimately determining the satisfiability of the input normal form.

[0008] Problems with existing technologies:

[0009] 1. Block ciphers have numerous attack modes and diverse structures. Common attack modes include differential attacks, linear attacks, impossible differential attacks, zero-correlation linear attacks, integral attacks, and meet-in-the-middle attacks. Mainstream block cipher algorithm structures include Feistel, SPN, and Lai-Massey structures in terms of round functions; and ARX structures with and without S-boxes in terms of nonlinear layers. Automated implementation of all these structures is challenging.

[0010] 2. Difficulty in building automated models. The key to automated search lies in converting the route search problem into a mathematical problem. When building automated models for common cryptographic attack patterns, the problems that need to be solved and the mathematical principles that need to be applied include the construction of differential distribution tables and linear approximation tables, the Markov chain assumption used in differential probability propagation, the stacking lemma used in linear probability propagation, and the construction and propagation of separable models in integral attacks. Automated search also utilizes convex hull theory, greedy algorithms, and finite state automata.

[0011] 3. Highly skilled personnel are required. Automated block cipher analysis requires a cryptanalyst to master cryptographic principles, algorithm design principles, various attack principles, mathematical modeling skills, and solver application capabilities. This in-depth understanding requires a cryptanalysis team. Currently, no automated analysis tool can effectively analyze block cipher algorithms while also reducing the required user skills. Summary of the Invention

[0012] In response to the problems existing in the prior art, the present invention provides a block cipher design and automated security assessment auxiliary system for users to customize the design of block encryption algorithms and perform security assessments on them.

[0013] The technical solution is implemented as follows:

[0014] A block cipher design and automated security assessment auxiliary system, including a front-end and a back-end:

[0015] The front end is designed based on a RESTful architecture and includes a user interface, FastAPI, and a verification module. The core idea of ​​the RESTful architecture is to regard network resources as a state and to transmit and operate these states through the HTTP protocol. The FastAPI described in the present invention is of this style. The user interface is used for users to intuitively design their desired block encryption algorithm. Users upload basic parameters of the block encryption algorithm such as the block size, number of branches, and number of rounds of the block encryption algorithm through the user interface, and use the function names provided by the user interface to design the round function structure and security self-assessment type of the block encryption algorithm. The supported security self-assessment types include differential attack, linear attack, impossible differential attack, zero-correlation linear attack, and integral attack. The basic parameters provided by the user are the input parameters of each function in the round function structure. The verification module uses JWT technology for verification between the front end and the back end. JWT, short for Json Web Token, is a JSON object that securely transmits information between parties. This information is digitally signed and can be verified and trusted. When the front end initiates a user request to the back end, the JWT is placed in the request header for the back end to authenticate. If the authentication is successful, the request is accepted and the data is returned; otherwise, the request is rejected.

[0016] The backend includes a component function system, a solver calling module, an STP solver and a data parsing module;

[0017] The component function system encompasses component functions for all attack modes (including differential attacks, linear attacks, impossible differential attacks, zero-correlation linear attacks, and integral attacks). Components for each attack mode can be categorized as linear or nonlinear. In block ciphers, linear components provide diffusion, while nonlinear components provide obfuscation. The component function transforms the propagation mode of each component, combined with the basic parameters of the function, into a CNF conjunction form acceptable to the STP solver. The basic parameters of the function must be provided by the user. Linear components include binary matrices, XOR, cyclic shifts, and branches; nonlinear components include S-boxes, modular addition, AND, and OR. Since the component function system contains various component functions under all attack modes, users can customize the design of the required block encryption algorithm round function structure and determine the security self-assessment type through the component functions provided in the component function system. Two points need to be supplemented: First, in the present invention, since the user is performing a security self-assessment on the block encryption algorithm designed by the user, the user needs to perform a cryptographic attack on the block encryption algorithm to evaluate the security of the block encryption algorithm. Therefore, in this article, security self-assessment can also be equivalent to the user attacking his own block encryption algorithm; Second, in the block encryption algorithm, the structure of each round is usually the same. This structure is called a round function structure. The structure of each round implements the encryption process by repeatedly applying the same steps. The last round is slightly different, but the branch permutation step is omitted only for the symmetry of encryption and decryption. Therefore, when describing the structure of a block encryption algorithm, it is only necessary to construct the round function structure.

[0018] The solver calling module includes a Python script file, which combines the basic parameters provided by the user with the round function structure and its security self-assessment type constructed by the user, executes all component functions determined by the user, and constructs the CNF conjunction normal form based on all component functions to form an STP solution model. Furthermore, the solver calling module calls the STP solver to solve the satisfiability problem of the model.

[0019] The STP solver is a solver developed based on the miniSAT solver for bit vector constraint problems. Specifically, the STP solver accepts a set of STP solution models in CNF conjunctive normal form as input (Boolean expressions and their negations are called literals, the disjunction of a finite number of literals is called a phrase, and the conjunction of a finite number of phrases is called a CNF conjunctive normal form). It converts these CNF conjunctive normal forms into SAT problems, then solves them using a SAT solver, ultimately determining whether the input paradigm is satisfiable. After solving the STP solution model, the STP solver generates a solution file.

[0020] The solution file contains several equations in CNF conjunction normal form, which contain solution information. To facilitate user understanding, the data parsing module uses a Python script to extract the information from each CNF conjunction normal form in the solution file and convert it into user-interpretable security assessment results. The information obtained varies depending on the attack mode. For example, under a differential attack, the user can obtain the differential route and differential route probability for each round of the block encryption algorithm. Under a linear attack, the user can obtain the linear route and linear route probability for each round of the block encryption algorithm. A route file is generated for each route obtained for each attack mode.

[0021] Furthermore, the component function system includes component functions under five attack modes. The propagation modes of each linear component and nonlinear component under different attack modes are as follows:

[0022] Differential propagation patterns of each component in differential attacks and impossible differential attacks, including:

[0023] (1) Difference propagation on XOR: The input difference is α1, α2, and the output difference is β, then in, It is an exclusive OR operation;

[0024] (2) Difference propagation on the branch: if the input difference is α1, α2, and the output difference is β, then α1 = α2 = β;

[0025] (3) Difference propagation on the S-box: Let x i represents the ith bit of the difference, that is, x i =0 means that the input pair is equal in the i-th bit, x i =1, the opposite is true. Let A t Indicates whether the S box is active, A t =0 means S box is inactive, A t =1 means the S-box is active. The purpose of finding a high-probability differential route is to increase the number of active S-boxes ∑ t A t Therefore, for an S-box with an input size of ω bits and an output size of v bits, the input difference and output difference are (x0, ..., x ω-1 ) and (y0,…,y v-1 ), to ensure that the input differential is non-zero to make the S-box active, and the output differential is non-zero to make the S-box active, we have:

[0026]

[0027] Furthermore, in the block cipher design and automated security assessment auxiliary system of the present invention, all S-boxes only consider bijective S-boxes with n-bit input and n-bit output.

[0028] (4) Differential propagation in the module: Let the input differential be α, β, and the output differential be γ. If:

[0029]

[0030] in, is the logical NOT operation, "∧" is the logical AND operation, and "<<" is the left shift operation, then the difference is effectively propagated in this module;

[0031] For the propagation of differential probability in the module plus, two steps are required: the first step is to determine whether the propagation of the differential route on the module plus component is effective, and the second step is to calculate the propagation of differential probability in the module plus. + ,have:

[0032]

[0033] Among them, “#” represents the cardinality of the set, that is, the number of elements in the set;

[0034] For the specific calculation of the above formula, it is necessary to first verify that the difference is effectively propagated in the module addition, and then calculate:

[0035]

[0036] Among them, eq(α[i], β[i], γ[i]) represents the function that determines whether α[i], β[i], and γ[i] are equal. The Boolean vector suffix [i] means the i-th bit of the Boolean vector, and for an n-bit difference, the difference probability is only related to the [0, n-2] bits.

[0037] Furthermore, the linear mask propagation patterns of each component in the linear attack and zero-correlation linear attack are hereinafter referred to as masks, including:

[0038] (1) Mask propagation on XOR: The input mask is α1, α2, and the output mask is β, then α1 = α2 = β;

[0039] (2) Mask propagation on branches: The input mask is α1, α2, and the output mask is β, then

[0040] (3) Mask propagation on linear mapping: the input mask is α, the output mask is β, then α=M T β;

[0041] (4) Mask propagation on S-box: Let xi represents the i-th bit of the mask, that is, x i =0 means that the input pair is equal in the i-th bit, x i =1, the opposite is true. Let A t Indicates whether the S box is active, A t =0 means S box is inactive, A t =1 means the S-box is active. The purpose of finding a high-probability linear mask route is to increase the number of active S-boxes ∑ t A t Therefore, for an S-box with input size ω bits and output size v bits, the input mask and output mask are (x0, ..., x ω-1 ) and (y0,…,y v-1 ), to ensure that the input mask is non-0 to make the S-box active, and the output mask is non-0 to make the S-box active, we have:

[0042]

[0043] (5) Mask propagation in modular addition: Let the two inputs of modular addition be (x, y), and the input masks be Λ α , Λ β , the output mask is Γ, the correlation is expressed as cor, and the inner product (expressed as ·) is defined as follows: for two vectors on the binary domain The inner product of a and b is expressed as:

[0044]

[0045] Then the propagation of linear correlation in modular addition is:

[0046]

[0047] Specifically in the calculation of correlation, for modulo 2 n The linear approximation of , where the input mask is Λ α , Λ β , the output mask is Γ, Λ α , Λ β , And Λ α =(Λ α [n-1],…,Λ α [0]), Λ β =(Λ β [n-1],…,Λ β [0]), Γ=(Γ[n-1],...,Γ[0]), define vector u=(u[n-1],...,u[0]) where u[i]=4Γ[i]+2Λ α [i]+Λ β[i], where 0 ≤ u[i] < 8 and 0 ≤ i < n. The relevance can be calculated by the following linear expression:

[0048] cor 田 (Γ, Λ α , Λ β ) = LA u[n-1] A u[n-2] …A u[1] A u[0] C

[0049] where ⊕ is the symbol for modular addition, and A r (r = 0, …, 7) is a 2×2 matrix L is a row vector L = (1 0), and C is a column vector C = (1 1) T .

[0050] For example, for the binary mask vectors of the linear approximation formula (Γ = 10100, Λ α = 11110, Λ β = 11000), u = 736208, the relevance

[0051] Furthermore, in the integral attack, considering the propagation of the Division Property that can be divided at the word level, the input variables and output variables of each component are in the binary field For the propagation mode of the Division Property of each component, it includes:

[0052] (1) Propagation of the Division Property on the branch operation (copy): Denote as the propagation route of the n-bit Division Property on the branch operation, where a is the input of the branch operation, and b0 and b1 are the outputs of the branch operation. Each variable needs to satisfy the following constraints: a ≤ n

[0053] b0 ≤ n

[0054] b1 ≤ n

[0055] a = b0 + b1

[0056] (2) Propagation of the Division Property on the XOR operation: Denote as the propagation route of the n-bit Division Property on the XOR operation, where a0 and a1 are the inputs of the XOR operation, and b is the output of the branch operation. Each variable needs to satisfy the following constraints:

[0057] a0 ≤ n

[0058] a1 ≤ n

[0059] b≤n

[0060] a0+a1=b

[0061] (3) Propagation of separability on linear mappings: Let F(x) = M·x, where M is a finite field. In the MDS matrix, m determines the finite field to which each element in the matrix M and the vector belongs. The dimension of s determines the size of the matrix M and the length of the vector it acts on, that is, M is an s×s matrix acting on a vector of length s. is the propagation of separable features on the linear map F, a i 、b j They are input separable features and output separable features, and each variable needs to meet the following constraints:

[0062] a i ≤m, i=0, 1, …, s-1

[0063] b j ≤m, j=0, 1, …, s-1

[0064] a0+a1+…+a s -1=b0+b1+…b s-1

[0065] where i = 0, 1, ..., s-1 and j = 0, 1, ..., s-1;

[0066] (4) Propagation of the divisibility property on a 4-bit S-box: is the propagation path of the divisibility feature of a 4-bit S-box, where x = (x[0], x[1], x[2]) and y = (y[0], y[1], y[2]) are both 3-bit vectors. The propagation of the divisibility feature on a 4-bit S-box must satisfy the following constraints:

[0067] x≤4

[0068] y≤4

[0069]

[0070] in, Indicates the inversion of vector y[0], It means to negate the vector x[0], and so on.

[0071] (5) Propagation of the divisibility property on 8-bit S-boxes: is the propagation path of the divisibility feature of an 8-bit S-box, where x = (x[0], x[1], x[2], x[3]) and y = (y[0], y[1], y[2], y[3]) are both 4-bit vectors. The propagation of the divisibility feature on an 8-bit S-box must satisfy the following constraints:

[0072] x≤8

[0073] y≤8

[0074]

[0075] y[1]=0

[0076] y[2]=0

[0077]

[0078] Furthermore, based on the propagation patterns of the above differences on each component, the propagation patterns of the linear masks on each component, and the propagation patterns of the separability characteristics on each component, component functions are constructed to convert these propagation patterns into CNF conjunction normal form. These component functions together construct a component function system, including:

[0079] F XOR_DIF (I1, I2, O): differential XOR operation, accepts three input parameters, where I1 and I2 are two input differential variables, and O is the output differential variable;

[0080] F ls_DIF (I1, num): performs a left shift operation on the difference, accepting two parameters, where I1 is the input difference variable and num is the left shift value;

[0081] F rs_DIF (I1, num): performs a right shift operation on the difference, accepting two parameters, where I1 is the input difference variable and num is the right shift value;

[0082] F crs_DIF (I1, num): performs a circular right shift operation on the difference, accepting two parameters, where I1 is the input difference variable and num is the right shift value;

[0083] F cls_DIF (I1, num): performs a circular left shift operation on the difference, accepting two parameters, where I1 is the input difference variable and num is the left shift value;

[0084] F p_DIF (I, O): bit-level permutation of differential, receiving an input differential variable I and an output differential variable O;

[0085] F S_DIF(I, O): The difference passes through the nonlinear component S-box, receiving the input difference variable I and output difference variable O of the S-box;

[0086] F S_active_DIF (I): Calculate the number of active S-boxes in all rounds of the differential attack. A non-zero input differential will definitely make the output differential non-zero, so only one input differential I is needed;

[0087] F modulo_DIF (I1, I2, O): differential modular addition operation, accepts three parameters, where I1 and I2 are two input differential variables, and O is the output differential variable;

[0088] F w_DIF (I1, I2, O, w): Calculates the probability of modular difference. It accepts four parameters, where I1 and I2 are the two input difference variables, O is the output difference variable, and w is the variable used to represent the difference probability, that is, w is equal to the negative logarithm to base 2 of the probability of modular difference.

[0089] F equal (I, O): equality operation, accepts two parameters I and O, and adds constraints to make the two parameters received by the function equal;

[0090] F XOR_LIN (I1, I2, O): Linear mask XOR operation, accepts three input parameters, where I1 and I2 are two input mask variables, and O is the output mask variable;

[0091] F ls_LIN (I1, num): Linear mask performs a left shift operation, accepting two parameters, where I1 is the input mask variable and num is the left shift value;

[0092] F rs_LIN (I1, num): Linear mask right shift operation, accepts two parameters, where I1 is the input mask variable and num is the right shift value;

[0093] F crs_LIN (I1, num): Linear mask performs a circular right shift operation, accepting two parameters, where I1 is the input mask variable and num is the right shift value;

[0094] F cls_LIN (I1, num): performs a circular left shift operation on a linear mask, accepting two parameters, where I1 is the input mask variable and num is the left shift value;

[0095] F Split_LIN (I1, I2, O): Linear mask undergoes a branching operation and receives two parameters, where I1 and I2 are two input mask variables and O is the output mask variable;

[0096] F p_LIN (I, O): bit-level permutation of a linear mask, receiving an input mask variable I and an output mask variable O;

[0097] F S_LIN (I, O): The linear mask passes through the nonlinear component S-box, receiving the input mask variable I and output mask variable O of the S-box;

[0098] F S_active_LIN (I): Calculate the number of active S-boxes in all rounds of the linear attack. A non-zero input mask will always make the output mask non-zero, so only one input mask I is needed;

[0099] F modulo_LIN (I1, I2, O): Linear masked modular addition operation, accepts three parameters, where I1 and I2 are two input mask variables, and O is the output mask variable;

[0100] F w_LIN (I1, I2, O, w): Calculates the probability of modulo masking. It accepts four parameters, where I1 and I2 are two input mask variables, O is the output mask variable, and w is a variable used to represent the probability of the linear path, that is, w is equal to the negative logarithm of the modulo probability of the total correlation.

[0101] F XOR_DP (I1, I2, O): XOR operation of divisible features, which accepts three input parameters, where I1 and I2 are two input divisible feature variables and O is the output divisible feature variable;

[0102] F p_DP (I, O): byte-level permutation, receiving an input splittable feature variable I and an output splittable feature variable O;

[0103] F S_DP (I, O): The divisible feature passes through the S-box, receiving the input divisible feature variable I and outputting the divisible feature variable O of the S-box;

[0104] F Separate_DP (I, O1, O2, O3, O4, O5, O6, O7, O8): The branch variables of the divisible feature are converted into byte variables. Taking the branch size of eight bytes as an example, it accepts a byte variable input I and eight branch variable outputs O1, O2, O3, O4, O5, O6, O7, O8;

[0105] F Combine_DP(I1, I2, I3, I4, I5, I6, I7, I8, O): Converts the divisible byte variable into a branch variable. Taking the branch size of eight bytes as an example, it accepts eight byte variable inputs I1, I2, I3, I4, I5, I6, I7, I8 and one branch variable output O.

[0106] Furthermore, the front-end user interface provides users with callable component function names. After verification by the verification module, users upload the basic parameters of the block encryption algorithm to FastAPI through the front-end user interface, call the provided component function name, customize the round function structure, and provide the selected security self-assessment type to FastAPI. Based on the basic parameters of the block encryption algorithm uploaded by the user, the described round function structure, and its attack mode, the system back-end generates an STP solution model for the block encryption algorithm through the solver call module and calls the STP solver based on the SMT satisfiability problem to solve the STP solution model. The data parsing module analyzes the results obtained by the STP solver, and different results are obtained based on the security self-assessment type. For example, a differential attack will produce a differential route and differential route probability, a linear attack will produce a linear route and linear route probability, an impossible differential attack will produce an impossible differential route, a zero-correlation linear attack will produce a zero-correlation linear route, and an integral attack will produce an integral route. In addition, all attack modes are given a solution time. Based on the obtained results, an analysis report file and a route file are generated and transmitted to the front-end for user download.

[0107] Furthermore, the operation process of the block cipher design and automated security assessment auxiliary system is as follows:

[0108] Step 1: The user logs in to the block cipher design and automated security assessment auxiliary system with the username and password, and obtains the JWT from the front-end FastAPI for the following request.

[0109] In step 2, the user enters the basic parameters of the block encryption algorithm, such as block size, number of branches, and number of rounds, through the front-end interface, and submits the input parameters and JWT to FastAPI.

[0110] In step 3, FastAPI authenticates the user through the verification module and saves the parameters entered by the user in memory through variables.

[0111] Step 4: After successful authentication, the user customizes the round function structure and its security self-assessment type based on the component function name provided in the component function system, and submits the designed round function structure and its security self-assessment type of the block encryption algorithm to FastAPI.

[0112] Step 5: The solver calling module calls the component function provided by the backend component function system according to the round function structure of the block encryption algorithm and its security self-assessment type obtained by FastAPI, takes the basic parameters passed in by the user as the input parameters of the component function, and converts the round function structure described by the user with the component function into a CNF conjunction normal form acceptable to the STP solver, thereby constructing the STP solution model.

[0113] Step 6: The solver calling module calls the STP solver to solve the satisfiability problem of the generated STP solution model and saves the solution result to a file.

[0114] In step 7, the backend uses the data parsing module to analyze the file generated by the STP solver. Based on the attack pattern corresponding to the security self-assessment type, the CNF conjunction normal form in the solution file is parsed into a user-friendly security assessment result. An analysis report file is generated based on the security assessment result, and a route file is generated for each route corresponding to each attack pattern. The security assessment result and the download link of the file generated by the data parsing module are passed to the front-end user interface via FastAPI for users to view and download the report.

[0115] The beneficial effects of the present invention are as follows:

[0116] As can be seen from the above scheme, the method provided by the present invention receives basic data and round function descriptions input by the user at the front end, uses parsing to link the basic description of the user-defined encryption algorithm with various modules, automatically generates CVC language files using background script files, and uses the STP solver to automatically search and modularize differential attacks, linear attacks, impossible differential attacks, zero-correlation linear attacks, and integral attacks. It also evaluates the security of the user-designed encryption algorithm and returns an evaluation result report. Currently, there are no automated analysis tools that can effectively analyze block encryption algorithms while reducing user skill requirements. This present invention fills this gap. BRIEF DESCRIPTION OF THE DRAWINGS

[0117] Figure 1 This is a flow chart of the front-end and back-end interaction in the present invention;

[0118] Figure 2 This is a flow chart of the block cipher design and automated security assessment auxiliary platform in the present invention;

[0119] Figure 3 The 0-1 matrix form of the linear layer bit permutation of the block encryption algorithm in the first embodiment of the present invention;

[0120] Figure 4 This is a structural diagram of the linear layer bit permutation of the block encryption algorithm according to the first embodiment of the present invention;

[0121] Figure 5 This is a block encryption algorithm structure diagram of Example 1 of the present invention;

[0122] Figure 6 This is a block encryption algorithm structure diagram of Example 2 of the present invention. DETAILED DESCRIPTION

[0123] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0124] In order to make the advantages of the technical solution of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0125] in, Figure 1 It shows the front-end and back-end interaction process of block cipher design and automated security assessment auxiliary system. Figure 2 The principles of the entire block cipher design and automated security assessment auxiliary system operation process are demonstrated.

[0126] Example 1

[0127] The present invention is a block encryption algorithm with a nonlinear layer of S box. Figure 5 Take the Feistel structure algorithm shown as an example, Figure 5 The round function structure of the block encryption algorithm is given. The algorithm structure is designed and automatically evaluated based on the block cipher design and automated security assessment auxiliary system. The main process includes the following:

[0128] Step 1: The user provides the basic parameters of the block encryption algorithm, for example, the block size is 64 bits, the number of branches is 2, that is, the data length of each branch is 32 bits, and the nonlinear component is an S-box. For the bit-level permutation P component, an interface is provided for the user at the front end for the user to input the bit permutation P. It should be noted that the bit permutation P receives 0-1 matrix on , Figure 3 Given an example of a 0-1 matrix, Figure 4 This gives an intuitive representation of the bit permutation P for this matrix example, Figure 4 The bit permutation structure is Figure 3 The format of a 0-1 matrix is ​​provided for user input.

[0129] Assuming that the linear matrix is ​​represented by M, the input difference is represented by column vector X, and the output difference is represented by column vector Y, the propagation mode of the difference on the linear matrix M is:

[0130] Y=MX

[0131] It should be noted that the linear bit permutation P also supports the maximum separable matrix (MDS matrix). The maximum separable matrix only needs to be converted into a 0-1 matrix form and can be passed to the system as the input of the linear bit permutation P.

[0132] The user provides a 4-bit S-box in the S component on the client. In this architecture, the data flow size of the S component is 32 bits, that is, the data flow passes through 32 / 4 = 8 parallel identical S-boxes. Table 1 shows the mapping rules for a 4-bit input 4-bit output S-box.

[0133] Table 1: Mapping table for 4-bit input and 4-bit output S-box

[0134] x 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 S(x) 2 0 7 4 1 3 6 5 9 11 13 15 14 12 10 8

[0135] The user can use {2, 0, 7, 4, 1, 3, 6, 5, 9, 11, 13, 15, 14, 12, 10, 8} to represent the S-box, that is, list them in integer order. For each value in , the first integer represents the mapping of 0, the second integer represents the mapping of 1, and so on.

[0136] Step 2: The user uses the component functions provided in the component function system and the type of security self-assessment to be performed to Figure 5 The structure shown in the figure describes the round function structure to Figure 5 Taking the structure of the differential attack self-assessment as an example, the user needs to first perform the following function description to describe the round function structure of the algorithm, where L is the left branch of the round function input, R is the right branch of the round function input, k is the round key of the block encryption algorithm, S in is the input difference of the S-box, S out is the output differential of the S-box, P in is the input difference of the linear bit permutation P, P out is the output difference of the linear bit permutation P, L′ is the output of the left branch of the round function, and R′ is the output of the right branch of the round function. All parameters are in Figure 5 Mark in the corresponding position:

[0137] F equal (R,S in );

[0138] F S_DIF (S in , S out );

[0139] F p_DIF (P in , P out );

[0140] F XOR_DIF (L, P out , R′);

[0141] F equal (R, L′);

[0142] It should be noted that, assuming that for a pair of plaintexts p1 and p2, p1 and p2 are added to the key to obtain ciphertexts c1 and c2, that is, From these two formulas, we know that the difference of the plaintext is the same as the difference of the ciphertext, that is, Therefore, propagating the difference over the XOR key does not change the value of the difference, so there is no need to use functions to describe the XOR key components.

[0143] Based on the above round function structure, the structure is cycled r-1 times, which is the first r-1 rounds of the algorithm. The difference from the first r-1 rounds is that there is no branch permutation in the rth round, that is, the last round function structure is:

[0144] F XOR_DIF (R, k, S in );

[0145] F S_DIF (S in , S out );

[0146] F p_DIF (P in , P out );

[0147] F XOR_DIF (L, P out， L′);

[0148] F equal (R, R′);

[0149] All variables in the last round function structure are the same as those in the previous r-1 rounds, except for the last branch permutation. L is the left branch of the last round function input, R is the right branch of the last round function input, k is the round key of the last round of the block encryption algorithm, and S in is the input difference of the S-box, S out is the output differential of the S-box, P in is the input difference of the linear bit permutation P, P out is the output difference of the linear bit permutation P, L' is the output of the left branch of the custom block encryption algorithm, and R' is the output of the right branch of the custom block encryption algorithm.

[0150] Step 3: The solver calling module calls the component function provided by the backend component function system according to the round function structure and security self-assessment type of the block encryption algorithm obtained by FastAPI, takes the basic parameters passed in by the user as the input parameters of the component function, and converts the round function structure described by the user with the component function into a CNF conjunction normal form acceptable to the STP solver, thereby constructing the STP solution model.

[0151] Step 4: The solver calling module calls the STP solver to solve the satisfiability problem of the generated STP solution model and saves the solution result to a file.

[0152] In step 5, the backend data parsing module analyzes the results obtained by the STP solver. For the differential attack in this example, the system parses the CNF conjunction normal form in the solution result file obtained in step 4 into a security assessment result that is easy for users to understand, including the optimal differential path, differential path probability, and solution time. Based on the security assessment results, the data parsing module generates an analysis report and a complete optimal differential path file, and passes it to the frontend for users to download.

[0153] Furthermore, users can judge the security of the designed block encryption algorithm based on the analysis report and the optimal differential route, and improve the block encryption algorithm.

[0154] Example 2

[0155] The present invention uses a block encryption algorithm with a nonlinear layer as a modular addition. Figure 6 Take the Lai-Massey structure SPECK-32 algorithm as an example, Figure 6 The round function structure of the algorithm is given. The block cipher design and automated security evaluation of the algorithm structure mainly include the following processes.

[0156] In step 1, the user needs to provide the basic parameters of the block encryption algorithm, for example, the block size is 64 bits, the number of branches is 2 (i.e., the data length of each branch is 32 bits), and the nonlinear component is a modular addition operation.

[0157] Step 2: The user uses the functions provided in the component function system and the type of security self-assessment to be performed to Figure 6 The structure shown in the figure describes the round function structure to Figure 6 Taking the structure of linear attack self-evaluation as an example, the user needs to first perform the following function description to describe the round function structure of the algorithm, where x i is the input mask of the left branch of the round function structure of the block cipher algorithm, y i is the input mask of the right branch of the round function structure of the block cipher algorithm, Modulo in1 and Modulo in2Two input masks for the modulo addition operation, Modulo out Output mask for the modulo addition operation, XOR in1 and XOR in2 The two input masks for the XOR operation on the right branch, XOR out is the output mask of the XOR operation on the right branch, x i+1 and y i+1 are the output masks of the left and right branches of the round function structure respectively. All parameters are in Figure 5 Mark in the corresponding position:

[0158] F Split_LIN (y i , Modulo in2 , F crs_LIN (XOR in1 ,2));

[0159] F equal (F crs_LIN (x i ,7),Modulo in1 );

[0160] F modulo_LIN (Modulo in1 , Modulo in2 , Modulo out );

[0161] F Split_LIN (XOR in2 , Modulo out , x i+1 );

[0162] F XOR_LIN (XOR in1 , XOR in2 , XOR out );

[0163] F equal (XOR out ,y i+1 );

[0164] It should be noted that, assuming that for a plaintext p1, p1 is added to the key to obtain the ciphertext c1, that is If we make inner product of p1, c1, k and the same mask α, we can easily get

[0165]

[0166] This always holds true with probability 1, so propagating a linear mask over the XOR key does not change the value of the mask, so there is no need to use a function to describe the XOR key components.

[0167] Based on the above round function structure, the structure is cycled r times, that is, the rth round of the block encryption algorithm

[0168] Step 3: The solver calling module calls the component function provided by the backend component function system according to the round function structure and security self-assessment type of the block encryption algorithm obtained by FastAPI, takes the basic parameters passed in by the user as the input parameters of the component function, and converts the round function structure described by the user with the component function into a CNF conjunction normal form acceptable to the STP solver, thereby constructing the STP solution model.

[0169] Step 4: The solver calling module calls the STP solver to solve the satisfiability problem of the generated STP solution model and saves the solution result to a file.

[0170] Step 4: The solver calling module calls the STP solver to solve the satisfiability problem of the generated STP solution model and saves the solution result to a file.

[0171] In step 5, the backend data parsing module analyzes the results obtained by the STP solver. For the linear attack in this example, the system parses the CNF conjunction normal form in the solution result file obtained in step 4 into a user-friendly security assessment result, including the optimal linear route, linear route probability, and solution time. Based on the security assessment results, the data parsing module generates an analysis report and a complete optimal linear route file, which are then passed to the frontend for the user to download.

[0172] Furthermore, users can judge the security of the designed block encryption algorithm based on the analysis report and the optimal linear route, and improve the block encryption algorithm.

[0173] The serial numbers of the above embodiments are for description only and do not represent the advantages or disadvantages of the embodiments.

[0174] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0175] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.

Claims

1. A block cipher design and automated security assessment auxiliary system, characterized in that: Including front-end and back-end: The front-end is designed based on a RESTful architecture and includes a user interface, FastAPI, and a verification module. The user interface is used for users to intuitively design their desired block encryption algorithm. Users upload basic parameters of the block encryption algorithm, such as the block size, number of branches, and number of rounds, through the user interface. The function name provided by the user interface is used to design the round function structure and security self-assessment type of the block encryption algorithm. The supported security self-assessment types include differential attack, linear attack, impossible differential attack, zero-correlation linear attack, and integral attack. The basic parameters provided by the user are the input parameters of each function in the round function structure; the verification module uses JWT technology for front-end and back-end verification. When the front-end initiates a user request to the back-end, the JWT is placed in the request header for the back-end to authenticate. If the authentication is successful, the request is accepted and the data is returned; otherwise, the request is rejected; The backend includes a component function system, a solver calling module, an STP solver and a data parsing module; The component function system includes various component functions under all attack modes, and the components under different attack modes can be divided into linear components and nonlinear components. The function of the component function is to convert the propagation mode of each component into a CNF conjunction normal form acceptable to the STP solver by combining the basic parameters of the function. The linear components include binary matrices, XOR, cyclic shift, and branches. The nonlinear components include S-boxes, modular addition operations, AND operations, and OR operations. The solver call module includes a Python script file, which combines the basic parameters provided by the user with the round function structure and its security self-assessment type constructed by the user, executes all component functions determined by the user, and forms an STP solution model based on the CNF conjunction normal form obtained by converting all component functions. Furthermore, the solver call module calls the STP solver to solve the satisfiability problem of the model. The STP solver accepts a set of STP solution models in the form of CNF conjunction normal forms as input, converts these CNF conjunction normal forms into SAT problems, and then uses the SAT solver to solve them, and finally makes a determination on the satisfiability of the input normal forms; after solving the STP solution model, the STP solver generates a solution file; The data parsing module uses a Python script file to extract information from each CNF conjunction normal form in the solution file and convert it into security assessment result information that the user can understand. The information obtained in different attack modes is different; and a route file is generated for the routes corresponding to all attack modes.

2. A block cipher design and automated security assessment auxiliary system according to claim 1, characterized in that: The component function system includes component functions under five attack modes. The propagation modes of linear and nonlinear components under different attack modes include: The propagation pattern of the difference across components, the propagation pattern of the linear mask across components, and the propagation pattern of the separable feature across components.

3. A block cipher design and automated security assessment auxiliary system according to claim 2, characterized in that: Differential propagation patterns of each component in differential attacks and impossible differential attacks, including: (1) Difference propagation on XOR: The input difference is α1, α2, and the output difference is β, then in, It is an exclusive OR operation; (2) Difference propagation on the branch: the input difference is α1, α2, and the output difference is β, then α1 = α2 = β; (3) Difference propagation on the S-box: Let x i represents the ith bit of the difference, that is, x i =0 means that the input pair is equal in the i-th bit, x i =1, the opposite is true; let A t Indicates whether the S box is active, A t =0 means S box is inactive, A t =1 means the S-box is active. The purpose of finding a high-probability differential route is to increase the number of active S-boxes ∑ t A t minimized; therefore, for an S-box with an input size of ω bits and an output size of υ bits, the input difference and the output difference are (x0,…,x ω-1 ) and (y0,…,y υ-1 ), to ensure that the input differential is non-zero to make the S-box active, and the output differential is non-zero to make the S-box active, we have: All S-boxes only consider bijective S-boxes with n-bit input and n-bit output; (4) Propagation of differentials in modulo addition: Let the input differentials be α and β, and the output differential be γ; if: in, is the logical NOT operation, "∧" is the logical AND operation, and "<<" is the left shift operation, then the difference is effectively propagated in this module; For the propagation of differential probability in the module plus, two steps are required: the first step is to determine whether the propagation of the differential route on the module plus component is effective, and the second step is to calculate the propagation of differential probability in the module plus; for the differential probability xdp + ,have: Among them, "#" represents the cardinality of the set, that is, the number of elements in the set; For the specific calculation of the above formula, it is necessary to first verify that the difference is effectively propagated in the module addition, and then calculate: Among them, eq(α[i],β[i],γ[i]) represents the function that determines whether α[i],β[i],γ[i] are equal, that is, The Boolean vector suffix [i] means the i-th bit of the Boolean vector, and for an n-bit difference, the difference probability is only related to the [0, n-2] bits.

4. A block cipher design and automated security assessment auxiliary system according to claim 2, characterized in that: The linear mask propagation patterns of each component in linear attacks and zero-correlation linear attacks are referred to as masks below, including: (1) Mask propagation on XOR: The input mask is α1, α2, and the output mask is β, then α1 = α2 = β; (2) Mask propagation on branches: The input mask is α1, α2, and the output mask is β, then (3) Mask propagation on linear mapping: the input mask is α, the output mask is β, then α=M T β; (4) Mask propagation on S-box: Let x i represents the i-th bit of the mask, that is, x i =0 means that the input pair is equal in the i-th bit, x i =1, the opposite is true; let A t Indicates whether the S box is active, A t =0 means S box is inactive, A t =1 means the S-box is active. The purpose of finding a high-probability linear mask route is to increase the number of active S-boxes ∑ t A t minimized; therefore, for an S-box with input size ω bits and output size u bits, the input mask and output mask are (x0,…,x ω-1 ) and (y0,…,y υ-1 ), to ensure that the input mask is non-0 to make the S-box active, and the output mask is non-0 to make the S-box active, we have: (5) Mask propagation in modular addition: Let the two inputs of modular addition be (x, y), and the input masks be Λ α ,Λ β , the output mask is Γ, the correlation is expressed as cor, and the inner product is defined as: for two vectors on the binary domain The inner product of a and b is expressed as: Then the propagation of linear correlation in modular addition is: Specific to the calculation of relevance, for the modulo-2 n linear approximation, where the input masks are Λ α , Λ β respectively, the output mask is Γ, and Λ α =(Λ α [n - 1], …, Λ α [0]), Λ β =(Λ β [n - 1], …, Λ β [0]), Γ=(Γ[n - 1], …, Γ[0]), define the vector u=(u[n - 1], …, u[0]) where u[i]=4Γ[i]+2Λ α [i]+Λ β [i], 0 ≤ u[i]<8, 0 ≤ i < n; the relevance can be calculated by the following linear expression: in A is the symbol for modular addition. r (r=0,…,7) is a 2×2 matrix L is a row vector L = (1 0), C is a column vector C = (1 1) T .

5. A block cipher design and automated security assessment auxiliary system according to claim 2, characterized in that: In the integral attack, the propagation of separable features at the word level is considered, and the input variables and output variables of each component are in the binary domain. Above, for each component, the divisible feature propagation mode includes: (1) Propagation of divisibility in branch operations: It is the propagation path of the n-bit divisibility feature on the branch operation, where a is the input of the branch operation, b0 and b1 are the outputs of the branch operation, and each variable needs to satisfy the following constraints: a≤n b0≤n b1≤n a=b0+b1 (2) Propagation of divisibility in XOR operation: This is the propagation path of the n-bit divisibility property in the XOR operation, where a0 and a1 are the inputs of the XOR operation, b is the output of the branch operation, and each variable needs to meet the following constraints: a0≤n a1≤n b≤n a0+a1=b (3) Propagation of separability on linear mappings: Let F(x) = M·x, where M is a finite field. In the MDS matrix, m determines the finite field to which each element in the matrix M and the vector belongs. The dimension of s determines the size of the matrix M and the length of the vector it acts on, that is, M is an s×s matrix acting on a vector of length s. is the propagation of separable features on the linear map F, a i 、b j They are input separable features and output separable features, and each variable needs to meet the following constraints: a i ≤m,i=0,1,…,s-1 b j ≤m,j=0,1,…,s-1 a0+a1+…+a s-1 =b0+b1+…b s-1 where i = 0, 1, ..., s-1 and j = 0, 1, ..., s-1; (4) Propagation of the divisibility property on a 4-bit S-box: is the propagation path of the divisibility feature of a 4-bit S-box, where x = (x[0], x[1], x[2]) and y = (y[0], y[1], y[2]) are both 3-bit vectors. The propagation of the divisibility feature on a 4-bit S-box must satisfy the following constraints: x≤4 y≤4 in, Indicates the inversion of vector y[0], It means to negate the vector x[0], and so on; (5) Propagation of the divisibility property on 8-bit S-boxes: is the propagation route of the divisibility feature of an 8-bit S-box, where x = (x[0], x[1], x[2], x[3]) and y = (y[0], y[1], y[2], y[3]) are both 4-bit vectors. The propagation of the divisibility feature on an 8-bit S-box must satisfy the following constraints: x≤8 y≤8 y[1]＝0 y[2]＝0 6. A block cipher design and automated security assessment auxiliary system according to any one of claims 2 to 5, characterized in that: Based on the propagation patterns of the above differences on each component, the propagation patterns of the linear masks on each component, and the propagation patterns of the separability characteristics on each component, component functions are constructed to convert these propagation patterns into CNF conjunction normal form. These component functions together construct a component function system, including: F XOR_DIF (I1, I2, O): differential XOR operation, accepts three input parameters, where I1 and I2 are two input differential variables, and O is the output differential variable; F ls_DIF (I1, num): performs a left shift operation on the difference, accepting two parameters, where I1 is the input difference variable and num is the left shift value; F rs_DIF (I1, num): performs a right shift operation on the difference, accepting two parameters, where I1 is the input difference variable and num is the right shift value; F crs_DIF (I1, num): performs a circular right shift operation on the difference, accepting two parameters, where I1 is the input difference variable and num is the right shift value; F cls_DIF (I1, num): performs a circular left shift operation on the difference, accepting two parameters, where I1 is the input difference variable and num is the left shift value; F p_DIF (I, O): bit-level permutation of differential, receiving an input differential variable I and an output differential variable O; F S_DIF (I, O): The difference passes through the nonlinear component S-box, receiving the input difference variable I and output difference variable O of the S-box; F S_active_DIF (I): Calculate the number of active S-boxes in all rounds of the differential attack. A non-zero input differential will definitely make the output differential non-zero, so only one input differential I is needed; F modulo_DIF (I1, I2, O): differential modulo addition operation, accepting three parameters, where I1 and I2 are two input differential variables, and O is the output differential variable; F w_DIF (I1, I2, O, w): Calculates the probability of modular difference. It accepts four parameters, where I1 and I2 are the two input difference variables, O is the output difference variable, and w is the variable used to represent the difference probability, that is, w is equal to the negative logarithm to base 2 of the probability of modular difference. F equal (I, O): equality operation, accepts two parameters I and O, and adds constraints to make the two parameters received by the function equal; F XOR_LIN (I1, I2, O): Linear mask XOR operation, accepts three input parameters, where I1 and I2 are two input mask variables, and O is the output mask variable; F ls_LIN (I1, num): Linear mask performs a left shift operation, accepting two parameters, where I1 is the input mask variable and num is the left shift value; F rs_LIN (I1, num): Linear mask right shift operation, accepts two parameters, where I1 is the input mask variable and num is the right shift value; F crs_LIN (I1, num): Linear mask performs a circular right shift operation, accepting two parameters, where I1 is the input mask variable and num is the right shift value; F cls_LIN (I1, num): performs a circular left shift operation on a linear mask, accepting two parameters, where I1 is the input mask variable and num is the left shift value; F Split_LIN (I1, I2, O): Linear mask undergoes a branching operation and receives two parameters, where I1 and I2 are two input mask variables and O is the output mask variable; F p_LIN (I, O): bit-level permutation of a linear mask, receiving an input mask variable I and an output mask variable O; F S_LIN (I, O): The linear mask passes through the nonlinear component S-box, receiving the input mask variable I and output mask variable O of the S-box; F S_active_LIN (I): Calculate the number of active S-boxes in all rounds of the linear attack. A non-zero input mask will always make the output mask non-zero, so only one input mask I is needed; F modulo_LIN (I1, I2, O): Linear masked modular addition operation, accepts three parameters, where I1 and I2 are two input mask variables and O is the output mask variable; F w_LIN (I1, I2, O, w): Calculates the probability of modulo masking. It accepts four parameters, where I1 and I2 are two input mask variables, O is the output mask variable, and w is a variable used to represent the probability of the linear path, that is, w is equal to the negative logarithm of the modulo probability of the total correlation. F XOR_DP (I1, I2, O): XOR operation of divisible features, which accepts three input parameters, where I1 and I2 are two input divisible feature variables and O is the output divisible feature variable; F p_DP (I, O): byte-level permutation, receiving an input splittable feature variable I and an output splittable feature variable O; F S_DP (I, O): The divisible feature passes through the S-box, receiving the input divisible feature variable I and outputting the divisible feature variable O of the S-box; F Separate_DP (I, O1, O2, O3, O4, O5, O6, O7, O8): The branch variables of the divisible feature are converted into byte variables. Taking the branch size of eight bytes as an example, it accepts a byte variable input I and eight branch variables output O1, O2, O3, O4, O5, O6, O7, O8; F Combine_DP (I1, I2, I3, I4, I5, I6, I7, I8, O): Converts the divisible byte variable into a branch variable. Taking the branch size of eight bytes as an example, it accepts eight byte variable inputs I1, I2, I3, I4, I5, I6, I7, I8 and one branch variable output O.

7. A block cipher design and automated security assessment auxiliary system according to claim 1, characterized in that: The user interface at the front end provides the user with a callable component function name. After verification by the verification module, the user uploads the basic parameters of the block encryption algorithm to FastAPI in the front-end user interface, calls the provided component function name, customizes the description of the round function structure, and provides the selected security self-assessment type to FastAPI. The system backend generates an STP solution model of the block encryption algorithm through the solver call module based on the basic parameters of the block encryption algorithm uploaded by the user, the described round function structure and its attack mode, and calls the STP solver based on the SMT satisfiability problem to solve the STP solution model. The results obtained by the STP solver are analyzed through the data parsing module, and different results are obtained according to the security self-assessment type. Based on the obtained results, an analysis report file and a route file are generated and passed to the front end for the user to download.

8. A block cipher design and automated security assessment auxiliary system according to claim 1, characterized in that: The operation process of the block cipher design and automated security assessment auxiliary system is as follows: Step 1: The user logs in to the Block Cipher Design and Automated Security Assessment Assistance System with their username and password, and obtains the JWT from the front-end FastAPI for the following request; Step 2: The user enters the basic parameters of the block encryption algorithm through the front-end interface and submits the input parameters and JWT to FastAPI; Step 3: FastAPI authenticates the user through the verification module and saves the parameters entered by the user in the memory through variables; Step 4: After successful authentication, the user customizes the round function structure and its security self-assessment type based on the component function name provided in the component function system, and submits the designed round function structure and its security self-assessment type of the block encryption algorithm to FastAPI; Step 5: The solver calling module calls the component function provided by the backend component function system based on the round function structure and security self-assessment type of the block encryption algorithm obtained by FastAPI, takes the basic parameters passed by the user as the input parameters of the component function, and converts the round function structure described by the user with the component function into a CNF conjunction normal form acceptable to the STP solver, thereby constructing the STP solution model; Step 6: The solver calling module calls the STP solver to solve the satisfiability problem of the generated STP solution model and saves the solution result to a file; Step 7: The backend uses the data parsing module to analyze the file obtained by the STP solver. Based on the attack mode corresponding to the security self-assessment type, the CNF conjunction normal form in the solution result file is parsed into a security assessment result that is easy for users to understand. Then, an analysis report file is generated based on the security assessment result. A route file is generated for each route obtained corresponding to each attack mode. The security assessment results and the download link of the file generated by the data analysis module are passed to the front-end user interface through FastAPI for users to view and download the report.

Images