Collision message pair rapid search method based on SAT

Abstract

The invention discloses a collision message pair rapid search method based on SAT, and the method comprises the steps: building an SAT model of a target difference algorithm and an SAT verification model of a collision message pair meeting difference features according to the idea of the target difference algorithm, combining the two models, solving the models through a solver to obtain an effective collision message pair, and completing a collision attack. The search method optimizes the connector construction stage in the collision attack, and has the advantages of accuracy and high efficiency. According to the method, the application of the target difference algorithm in collision attacks is effectively optimized through the SAT technology, the target difference algorithm is combined with the collision message pair verification algorithm, the collision message pairs can be searched more quickly, and the method has the advantages of being accurate and efficient. The method disclosed by the invention is wide in applicability, and is suitable for quickly searching collision message pairs in collision attacks of all sponge structures and the Hash algorithm based on S-box large replacement.

Description

Technical Field

[0001] The invention relates to a search method, in particular to a SAT-based fast search method for collision message pairs. Background Art

[0002] The principle of the differential-based collision attack is that if a message pair with a non-zero input differential is operated internally by the hash function, the resulting message digest has a zero output differential, and the message pair is called a collision pair. The search for a collision pair is closely related to the size of the differential probability Pr and the number of rounds of the collision attack.

[0003] In order to expand the number of attack rounds, the literature [1-3] all use the idea of ​​the target differential algorithm to construct multi-round connectors. First, the S-box layer of the initial round of the algorithm is linearized, and then the target differential algorithm [4] is used to construct a valid connector. The construction of the connector can usually be transformed into a problem of solving a linear equation system. Finally, a high-probability differential feature is combined to obtain a collision attack with a high number of rounds.

[0004] Let ΔIN and ΔOUT represent the input and output differences of the differential feature respectively. Use the target differential algorithm to extend the differential feature forward one round. Let the input and output differences of this round be ΔI and ΔT respectively. Then ΔT = ΔIN. The output difference ΔT is called the target difference. Find the input state pair Make in represents a round of permutation, n = r + c (R is a round of permutation, n is the number of state bits of the cryptographic algorithm, is an n-bit operation on a binary field, r is the rate part of the state, and c is the capacity part of the state). Then use enough different state pairs To verify whether there is a state pair that meets the differential feature. If the first d bits of the state pair output differential ΔOUT are 0, a valid collision message pair is generated, which is the first r bits of the state pair, such as Figure 1 shown.

[0005] In the collision attack based on the sponge structure hash algorithm, the key step is to use the target differential algorithm to construct a connector. The algorithm that finds the message pair that satisfies the given target differential after one round of hash permutation is the target differential algorithm. When executing the target differential algorithm, on the one hand, it is necessary to satisfy and The last c+p bits of c , where p is the padding bit, || indicates cascading, 0 c represents c 0s; on the other hand, the state needs to satisfy Usually, the algebraic degree of the S-box of the hash function on GF(2) is only 2, so we can use the affine subspace to construct a linear equation to solve The status is correct.

[0006] The target differential algorithm is generally divided into two stages. The first stage is to find all possible input differentials corresponding to the S-box output differential, which is called the differential stage; the second stage is to obtain all possible input values ​​that satisfy the S-box input-output differential, that is, to obtain the actual value of the target differential message pair, which is called the value stage. After the algorithm runs, a series of candidate message pairs are obtained, and finally an exhaustive search is performed for the message pairs that satisfy the differential characteristics, that is, the collision message pairs are obtained. Previously, the target differential algorithm was implemented by constructing a system of linear equations, and the number of equations was too large and redundant. The two stages of the algorithm need to be solved separately, which further increases resource consumption and time costs.

[0007] References:

[0008] 【1】Qiao K, Song L, Liu M, et al. New Collision Attacks on Round-ReducedKeccak[C]. International Conference on the Theory and Applications ofCryptographic Techniques. Paris, France, 2017: 216-243. Doi: 10.1007 / 978-3-319-56617-7_8;

[0009] 【2】Song L, Liao G, Guo J.Non-Full Sbox Linearization:Applications toCollision Attacks on Round-Reduced Keccak[C].International CryptologyConference,Santa Barbara,USA,2017:428-451.Doi:10.1007 / 978-3-319-63715-0_15;

[0010] 【3】Guo J, Liao G, Liu G, et al. Practical Collision Attacks against Round-Reduced SHA-3[J]. Journal of Cryptology, 33, 228–270(2020). https: / / doi.org / 10.1007 / s00145-019-09313-3;

[0011] 【4】Dinur I, Dunkelman O, Shamir A. New Attacks on Keccak-224and Keccak-256[C]. International Conference on Fast Software Encryption. Washington, USA, 2012, 12: 442-461. Doi: 10.1007 / 978-3-642-34047-5_25. Summary of the invention

[0012] In view of the above problems, the present invention proposes a fast search method for collision message pairs based on SAT. According to the idea of ​​target differential algorithm, by constructing the SAT model of target differential algorithm and the SAT verification model of collision message pairs that meet differential characteristics, and combining these two models, the solver is used to solve the model to obtain valid collision message pairs, and the collision attack is completed. This search method optimizes the connector construction stage in the collision attack, and has the advantages of accuracy and efficiency.

[0013] The technical solution for achieving the purpose of the present invention is:

[0014] A method for quickly searching for collision message pairs based on SAT comprises the following steps:

[0015] (1) Construct the SAT model of the connector based on the idea of ​​the target difference algorithm:

[0016] Find all possible message pairs that satisfy the given target difference ΔT after one round of hash permutation. The message pairs need to go through one round of permutation of the nonlinear layer SLayer and the linear layer L.

[0017] For the nonlinear layer, the affine subspace of the S-box is characterized according to the difference distribution table DDT, so that its difference is propagated with probability 1, while the probability of differential propagation of the linear layer itself is 1;

[0018] The difference phase and value phase of the target difference algorithm are merged to construct a SAT model that can directly output a series of candidate message pairs.

[0019] (2) Constructing a SAT model for connecting connectors to differential features:

[0020] According to the structure of the hash algorithm, the candidate message pairs generated by the target differential algorithm are made to satisfy the corresponding differential features, and a SAT model is constructed to search for valid message pairs that satisfy the differential features;

[0021] (3) Combine the two models of steps (1) and (2) and construct the initial conditions:

[0022] The two models in steps (1) and (2) are combined into a complete large model. The input difference ΔIN of the high probability difference feature of the output difference ΔOUT before d bits being zero is used as the input of the large model, that is, ΔT = ΔIN, and this feature must satisfy:

[0023] The first d bits of the last round of output differential are zero, ΔOUT[i]=0, 0≤i≤d-1, i represents the bit index;

[0024] The first round of input differences are not all zero,

[0025] (4) Use the STP solver to solve the SAT model and obtain the collision message pairs.

[0026] The search method of the present invention is different from the existing solutions in that the SAT model is used instead of the linear equation system, which can effectively avoid the complexity and redundancy of constraints; and the two stages of the target difference algorithm are merged into one, so there is no need to separately calculate the candidate difference and the message pair, and the solution time is greatly improved; at the same time, the process of searching for valid message pairs is also merged into the SAT model, constructing a SAT model that includes all the above processes, which can directly output the final message pairs that meet the collision.

[0027] The beneficial effects of the present invention are:

[0028] The method of the present invention effectively optimizes the application of the target difference algorithm in collision attack through the SAT technology, and combines it with the collision message pair verification algorithm to search for collision message pairs more quickly. In particular, in the search for valid collision pairs in the ASCON3 round, the method is more than 10,000 times faster than the traditional equation solving method.

[0029] The method of the invention has wide applicability and is suitable for fast searching of collision message pairs in all sponge structures and hash algorithm collision attacks based on S-box large permutation. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a schematic diagram of N+1 rounds of collision attack based on target differential algorithm in the prior art;

[0031] Figure 2 This is a schematic diagram of the connector and differential feature docking in the search method of the present invention. DETAILED DESCRIPTION

[0032] The present invention will be further described in detail below in conjunction with the embodiments and drawings, but the present invention is not limited thereto.

[0033] Example

[0034] A method for quickly searching for collision message pairs based on SAT comprises the following steps:

[0035] (1) Construct the SAT model of the connector based on the idea of ​​the target difference algorithm:

[0036] Find all possible message pairs that satisfy the given target difference ΔT after one round of hash permutation. The message pairs need to go through one round of permutation of the nonlinear layer SLayer and the linear layer L.

[0037] For the nonlinear layer, the affine subspace of the S-box is characterized according to the difference distribution table DDT, so that its difference is propagated with probability 1, while the probability of differential propagation of the linear layer itself is 1;

[0038] The difference phase and value phase of the target difference algorithm are merged to construct a SAT model that can directly output a series of candidate message pairs.

[0039] (2) Constructing a SAT model for docking connectors with differential features:

[0040] According to the structure of the hash algorithm, the candidate message pairs generated by the target differential algorithm are made to satisfy the corresponding differential features, and a SAT model is constructed to search for valid message pairs that satisfy the differential features;

[0041] (3) Combine the two models of steps (1) and (2) and construct the initial conditions:

[0042] The two models in steps (1) and (2) are combined into a complete large model. The input difference ΔIN of the high probability differential feature of the output differential ΔOUT before d bits being zero is used as the input of the large model, that is, ΔT = ΔIN, and this feature must satisfy:

[0043] The first d bits of the last round of output differential are zero, ΔOUT[i]=0, 0≤i≤d-1, i represents the bit index;

[0044] The first round of input differences are not all zero,

[0045] (4) Use the STP solver to solve the SAT model and obtain the collision message pairs.

[0046] Furthermore, in step (1), the SAT model of the connector is constructed according to the idea of ​​the target difference algorithm. The construction method is: given a target difference denoted as ΔT, a round of permutation R = L○SLayer, in order to obtain a SAT model that satisfies after a round of hash permutation R All possible states of For the propagation of state pairs after permutation R, the difference constraints and value constraints are characterized respectively:

[0047] (1.1) Difference constraint:

[0048] Difference constraint 1:

[0049] The last (c+p) bit of the input difference ΔI in one round of the target difference algorithm expansion is equal to 0, and the expression is: ΔI[i]=0, rp-1≤i≤n-1;

[0050] The SAT constraint is characterized as: ASSERT(ΔI[n-1:rp-1]=0);

[0051] Difference constraint 2:

[0052] There is a bit word W with n-bit states that satisfies L(W)+L(W+SLayer(ΔI))=ΔT, where W represents the output state value of the nonlinear layer in one round of permutation;

[0053] In differential constraint 2, it is relatively simple to characterize the linear layer L, which is mostly composed of some simple position transformations.

[0054] For the nonlinear layer SLayer in the target difference algorithm, it is necessary to ensure that the difference is propagated with probability 1, so the affine subspace of the S-box is used to meet this requirement;

[0055] For a large permutation with n bits of state, an m-bit S-box with algebraic degree of 2 is used. Given any non-zero output difference of the m-bit S-box, the set of possible input differences corresponds to m two-dimensional affine subspaces.

[0056] The steps to find the affine subspace of the S-box according to the target difference ΔT are as follows:

[0057] First, the output differences corresponding to all S-boxes are obtained from the target difference ΔT, and then all corresponding possible input differences are obtained from DDT. For each possible input difference of the S-box, the corresponding possible input value is obtained, and these input values ​​constitute the affine subspace of the corresponding input-output difference;

[0058] Due to replacement , then the output difference of the S box Where L -1 represents the inverse operation of the linear layer, represents the output difference of the jth S-box;

[0059] For the jth S-box S j (1≤j≤n / m), analyze its input and output differences in combination with the difference distribution table DDT, and obtain its corresponding affine subspace by the following steps:

[0060] Step 1: Differentiate the n-bit output L -1 (ΔT) is split into n / m parts, each part is m bits, that is, S-box S j The corresponding output difference is And S j and The corresponding data are stored in list T;

[0061] Step 2: Read the list T and for each output difference According to the difference distribution table, all possible input differences corresponding to it are obtained

[0062] Step 3: Differentiate the output All possible input differences corresponding to The input-output differential is obtained The subset of all possible input values ​​of The affine subspace of And the corresponding affine subsets are stored in the corresponding positions in the list T. Each element in the list T is a tuple, represented as in represents an affine subspace;

[0063] Step 4: Read list T to get the corresponding S j All input and output differential The corresponding affine subspace

[0064] Furthermore, it is necessary to characterize the affine subspaces of active S-boxes and inactive S-boxes respectively by SAT constraints;

[0065] For the active S-box, assume that Δα and Δβ represent the input and output differences of the affine subspace, and their specific values ​​are Δξ in and Δξ out , for an S-box of degree 2, X 1 ,X 2 ,X 3 ,X 4 represents the input value that satisfies the two-dimensional affine subspace of the S-box, Y 1 ,Y 2 ,Y 3 ,Y 4 Represents the corresponding output value, and its specific values ​​are {ε 1 ,ε 2 ,ε 3 ,ε 4} and {η 1 ,η 2 ,η 3 ,η 4}, in the CVC statement, the expressions on both sides of AND must be true at the same time, as described by the following statement:

[0066] ASSERT((Δβ=Δξ out )=>(Δα=Δξ in ));

[0067] ASSERT((X 1 =ε 1 )=>(Y 1 =η 1 ));

[0068] ASSERT((X 2 =ε 2 )=>(Y 2 =η 2 ));

[0069] ASSERT((X 3 =ε 3 )=>(Y 3 =η 3 ));

[0070] ASSERT((X 4 =ε 4 )=>(Y 4 =η 4 ));

[0071]

[0072] For an inactive S-box, the input-output differences Δα and Δβ are both zero, which is described by the following statement:

[0073] ASSERT((Δβ=0)=>(Δα=0));

[0074] (1.2) Value constraints:

[0075] Value constraint 1:

[0076] and The last (c+p) bits of p[i] are equal to p[i]||0 c ,rp-1≤i≤r-1;

[0077]

[0078] The corresponding SAT constraint is described as follows:

[0079]

[0080] Value constraint 2:

[0081]

[0082] The characterization of value constraint 2 only requires constraining the value propagation of the state according to the structure of permutation R. For the sponge structure hash algorithm, the internal permutation is mainly composed of XOR operation, copy operation, circular shift, P permutation, and S box;

[0083] P permutation is a simple position transformation, which is characterized by a copy operation model. Therefore, to establish a SAT model for permutation, it is only necessary to characterize the XOR operation, copy operation, circular shift, and S-box operation. The constraints for characterizing the value propagation of these operations in CVC format are as follows;

[0084] Characterization of value propagation of XOR operation:

[0085] The value propagation of the XOR operation is recorded as: Where X 1 ,X 2 and Y represent the input and output values ​​of the XOR operation respectively. BVXOR is the bitwise XOR function in the CVC language, which is described by the following statement:

[0086] ASSERT(Y=BVXOR(X1,X2));

[0087] Characterization of value propagation of copy operations:

[0088] The value propagation of the copy operation is recorded as: Y 1 =X 1 , where X 1 and Y 1 Represent the input and output values ​​of the copy operation, respectively, and are described by the following statements:

[0089] ASSERT(Y 1 =X 1 );

[0090] Characterization of the value propagation of cyclic shift:

[0091] Circular left shift L bits is recorded as: Y 1 =X 1 <<<L, where X 1 and Y 1 Respectively represent the input and output values ​​of the circular shift operation, circularly shifting left by L bits in the n-bit state, and @ represents the cascade in the CVC statement, which is characterized by the following statement:

[0092] ASSERT(Y 1 =X 1 [nL-1:0]@X 1 [n-1:nL]);

[0093] Similarly, a circular right shift of L bits is written as: Y 1 =X 1 >>>L is characterized by the following statement:

[0094] ASSERT(Y 1 =X 1 [L-1:0]@X 1[n-1:L]);

[0095] Characterization of the value propagation of S-box operation:

[0096] The value propagation of the S-box operation is recorded as: 1 =S(X 1 ), where X 1 and Y 1 Represent the input and output values ​​of the S-box operation, ε i (0≤i≤2 m -1) is a 2-bit S-box of size m bits m A specific input value, η i (0≤i≤2 m -1) is the S-box input value ε i The corresponding output value is described by the following SAT statement:

[0097] ASSERT((X 1 =ε i )=>(Y 1 =η i ));

[0098] In this stage, the above value constraints and differential constraints are integrated into a SAT model. Depending on the properties of SAT, differential constraints and value constraints can exist in the same model at the same time.

[0099] Furthermore, in step (2), a SAT model for connecting the connector and the differential feature is constructed, and the input of the connector model is ΔT, and the output is a series of candidate collision pairs. It is necessary to verify whether the propagation of these candidate collision pairs in the permutation satisfies the differential feature that the first d bits of the output differential are 0, such as Figure 2 As shown;

[0100] The characterization of value propagation is the same as that in step (1), and the characterization of differential propagation is as follows:

[0101] (2.1) Characterization of differential propagation of XOR operation:

[0102] The differential propagation of XOR operation is recorded as: where Δα 1 ,Δα 2 and Δβ represent the input and output differences of the XOR operation respectively. In the XOR operation, Where X 1 ,X 2 ,X 3 ,X 4 and Y 1 ,Y 2 They represent the input and output values ​​of the XOR operation, respectively, and are described by the following statements:

[0103] ASSERT(Δα 1 =BVXOR(X 1 ,X 2 )ANDΔα 2 =BVXOR(X 3 ,X 4 ));

[0104] ASSERT(Δβ=BVXOR(Y 1 ,Y 2 ));

[0105] (2.2) Characterization of differential propagation of replication operation:

[0106] The differential propagation of the replication operation is recorded as: Where Δα and Δβ represent the input and output differences of the replication operation, respectively. Y 1 =X 1 ,Y 2 =X 2 ,

[0107] Where X 1 ,X 2 and Y 1 ,Y 2 Represent the input and output values ​​of the copy operation, respectively, and are described by the following statements:

[0108] ASSERT(Δα=BVXOR(X 1 ,X 2 )ANDΔβ=BVXOR(Y 1 ,Y 2 ));

[0109] (2.3) Characterization of differential propagation of cyclic shift:

[0110] The differential propagation of circular left shift is recorded as: Where Δα and Δβ represent the input and output differences of the circular left shift, respectively. Y 1 =X 1 <<<L,

[0111] Y 2 =X 2 <<<L, where X 1 ,X 2 and Y 1 ,Y 2 Respectively represent the input and output values ​​of the circular shift operation, which are described by the following statements:

[0112] ASSERT(Δα=BVXOR(X 1 ,X 2 )ANDΔβ=BVXOR(Y 1 ,Y 2 ));

[0113] The differential propagation of circular right shift is recorded as: Similarly, it is described by the following statement:

[0114] ASSERT(Δα=BVXOR(X 1 ,X 2 )ANDΔβ=BVXOR(Y 1 ,Y 2 ));

[0115] (2.4) Differential propagation characterization of S-box operation:

[0116] The differential propagation of S-box operation is recorded as: where ΔS in and ΔS out Represent the input and output differences of the S-box operation respectively. In the S-box operation Y 1 =S(X 1 ),Y 2 =S(X 2 ), where X 1 ,X 2 and Y 1 ,Y 2 They represent the input and output values ​​of the S-box operation, respectively, and are described by the following statements:

[0117] ASSERT(ΔS in =BVXOR(X 1 ,X 2 )ANDΔS out =BVXOR(Y 1 ,Y 2 ));

[0118] The above modeling method is used to constrain the encryption algorithm and establish a complete constraint model through the characterization of value propagation and differential propagation.

[0119] Furthermore, the combined model in step (3) uses the high probability differential feature of the output differential being 0 before d bits to construct the initial condition, and the specific steps are as follows:

[0120] The constraints described in step (1) and the constraints described in step (2) are combined into a complete model. The initial conditions are set to use the output of step (1) as the input of step (2). Then the constraints of steps (1) and (2) must be satisfied at the same time, that is, while generating candidate collision pairs, valid collision pairs that satisfy the differential characteristics are verified. Therefore, the complete model will directly output valid collision message pairs.

[0121] Assume that the input difference of a high-probability differential feature with the first d bits of the output difference being 0 is ΔIN, and the output difference of the i-th round is The input of the target differential algorithm phase in step (1) is ΔT, and the differential propagation in the i-th round in step (2) is The initial conditions are then described by the following statement:

[0122]

[0123] The complete SAT model is obtained through the above steps.

[0124] Furthermore, in step (4), the SAT model is solved using the solver STP. When searching for collision pairs, the search strategy is to ask whether there is a valid solution under the current constraints. The query condition corresponding to the strategy is:

[0125] QUERY(FALSE);

[0126] COUNTEREXAMPLE;

[0127] The above query condition is called an error query. When STP returns Invalid and a collision message pair, it means that there is at least one message pair under the current target constraint. If STP returns Valid, it means that no matter what the value is, there is no valid message pair under the current constraint.

[0128] The present invention is based on the SAT-based fast search method for collision message pairs, performs effective constraint characterization on processes such as differential distribution table, affine subspace, value propagation, differential propagation, etc., combines the target differential algorithm and the high-probability differential feature verification process into a unified model solution, and can complete the fast search for effective collision message pairs in one step.

Claims

1. A fast search method for collision message pairs based on SAT, characterized in that: The steps include: (1) Construct the SAT model of the connector based on the idea of ​​the target difference algorithm: Find all possible message pairs that satisfy the given target difference ΔT after one round of hash permutation. The message pairs need to go through one round of permutation of the nonlinear layer SLayer and the linear layer L. For the nonlinear layer, the affine subspace of the S-box is characterized according to the difference distribution table DDT, so that its difference is propagated with probability 1, while the probability of differential propagation of the linear layer itself is 1; The difference phase and value phase of the target difference algorithm are merged to construct a SAT model that can directly output a series of candidate message pairs. (2) Constructing a SAT model for docking connectors with differential features: According to the structure of the hash algorithm, the candidate message pairs generated by the target differential algorithm are made to satisfy the corresponding differential features, and a SAT model is constructed to search for valid message pairs that satisfy the differential features; (3) Combine the two models of steps (1) and (2) and construct the initial conditions: The two models in steps (1) and (2) are combined into a complete large model. The input difference ΔIN of the high probability difference feature of the output difference ΔOUT before d bits being zero is used as the input of the large model, that is, ΔT = ΔIN, and this feature must satisfy: The first d bits of the last round of output differential are zero, ΔOUT[i]=0, 0≤i≤d-1, i represents the bit index; the first round of input differential is not all zero, (4) Use the STP solver to solve the SAT model and obtain the collision message pairs.

2. The SAT-based fast search method for collision message pairs according to claim 1, characterized in that: Step (1) constructs the SAT model of the connector based on the idea of ​​the target difference algorithm. Given a target difference denoted as ΔT, a round of permutation In order to obtain the result after a round of hash permutation R All possible states of For the propagation of state pairs after permutation R, the difference constraints and value constraints are characterized respectively: (1.1) Difference constraint: Differential constraint 1: The last (c+p) bit of the input differential ΔI in one round of the target differential algorithm expansion is equal to 0, expressed as: ΔI[i]=0,rp-1≤i≤n-1 The SAT constraints are characterized as: ASSERT(ΔI[n-1:rp-1]=0) Differential constraint 2: There exists a bit word W with n-bit states satisfying L(W)+L(W+SLayer(ΔI))=ΔT, where W represents the output state value of the nonlinear layer in a permutation round; In differential constraint 2, it is relatively simple to characterize the linear layer L, which is mostly composed of some simple position transformations. For the nonlinear layer SLayer in the target difference algorithm, it is necessary to ensure that the difference is propagated with probability 1, so the affine subspace of the S-box is used to meet this requirement; For a large permutation with n bits of state, an S-box with m bits and algebraic degree of 2 is used. Given any non-zero output difference of the S-box with m bits, the set of possible input differences corresponds to m two-dimensional affine subspaces. The steps to find the affine subspace of the S-box according to the target difference ΔT are as follows: First, the output differences corresponding to all S-boxes are obtained from the target difference ΔT, and then all corresponding possible input differences are obtained from DDT. For each possible input difference of the S-box, the corresponding possible input value is obtained, and these input values ​​constitute the affine subspace of the corresponding input-output difference; Due to replacement Then the output difference of the S box Where L -1 represents the inverse operation of the linear layer, represents the output difference of the jth S-box; For the jth S-box S j , 1≤j≤n / m, combined with the difference distribution table DDT to analyze its input and output differences, the corresponding affine subspace is obtained by the following steps: Step 1: Differentiate the n-bit output L -1 (ΔT) is split into n / m parts, each part is m bits, that is, S-box S j The corresponding output difference is And S j and The corresponding data are stored in list T; Step 2: Read the list T and for each output difference According to the difference distribution table, all possible input differences corresponding to it are obtained Step 3: Differentiate the output All possible input differences corresponding to The input-output differential is obtained The subset of all possible input values ​​of The affine subspace of And the corresponding affine subsets are stored in the corresponding positions in the list T. Each element in the list T is a tuple, represented as in represents an affine subspace; Step 4: Read list T to get the corresponding S j All input and output differential The corresponding affine subspace Furthermore, it is necessary to characterize the affine subspace of the active S-box and the inactive S-box respectively by SAT constraints; for the active S-box, assume that Δα and Δβ represent the input and output differences of the affine subspace respectively, and their specific values ​​are Δξ in and Δξ out For an S-box with algebraic degree of 2, X1, X2, X3, and X4 represent input values ​​that satisfy the two-dimensional affine subspace of the S-box, and Y1, Y2, Y3, and Y4 represent corresponding output values, whose specific values ​​are {ε1, ε2, ε3, ε4} and {η1, η2, η3, η4}, respectively. In the CVC statement, the expressions on both sides of AND must hold at the same time, which is described by the following statement: ASSERT((Δβ=Δξ out )=>(D=Dx in )); ASSERT((X1=ε1)=>(Y1=η1)); ASSERT((X2=ε2)=>(Y2=η2)); ASSERT((X3=ε3)=>(Y3=ε3)); ASSERT((X4=ε4)=>(Y4=η4)); For an inactive S-box, the input-output differences Δα and Δβ are both zero, which is described by the following statement: ASSERT((Δβ == 0) => (Δα == 0)); (1.2) Value constraint: Value constraint 1: and The last (c+p) bits of p[i] are equal to p[i]||0 c ,rp-1≤i≤r-1; Its corresponding SAT constraint characterization is as follows: Value constraint 2: For the characterization of value constraint 2, only the value propagation of the state needs to be constrained according to the structure of the permutation R. For the sponge structure hashing algorithm, the internal permutation is mainly composed of exclusive-or operation, copy operation, circular shift, P permutation, and S box; The P permutation is a simple position transformation and is characterized by the copy operation model. Therefore, to establish the SAT model of the permutation, only the exclusive-or operation, copy operation, circular shift, and S box operation in it need to be characterized. The constraints for characterizing the value propagation of these operations in CVC format are as follows; Characterization of the value propagation of the exclusive-or operation: The value propagation of the XOR operation is recorded as: Where X1, X2 and Y represent the input and output values ​​of the XOR operation respectively. BVXOR is the bitwise XOR function in the CVC language, which is described by the following statement: ASSERT(Y == BVXOR(X1, X2)); Characterization of the value propagation of the copy operation: The value propagation of the copy operation is denoted as: Y1 = X1, where X1 and Y1 represent the input and output values of the copy operation respectively, and is characterized by the following statement: ASSERT(Y1 == X1); Characterization of the value propagation of the circular shift: A circular left shift of L bits is denoted as: Y1 = X1 <<< L, where X1 and Y1 represent the input and output values of the circular shift operation respectively. In an n-bit state, a circular left shift of L bits, @ represents concatenation in the CVC statement, and is characterized by the following statement: ASSERT(Y1 == X1[n - L - 1:0] @ X1[n - 1:n - L]); Similarly, a circular right shift of L bits is denoted as: Y1 = X1 >>> L, and is characterized by the following statement: ASSERT(Y1 == X1[L - 1:0] @ X1[n - 1:L]); Characterization of the value propagation of the S box operation: The value propagation of the S-box operation is recorded as: Y1 = S(X1), where X1 and Y1 represent the input and output values ​​of the S-box operation respectively, ε i is a 2-bit S-box of size m bits m Specific input value, 0≤i≤2 m -1,η i is the S-box input value ε i The corresponding output value, 0≤i≤2 m -1, which is described by the following SAT statement: ASSERT((X1=e i )=>(Y1=η i )); In this stage, the above value constraints and differential constraints are integrated into a SAT model. Depending on the properties of SAT, the differential constraints and value constraints can coexist in one model.

3. The SAT-based fast search method for collision message pairs according to claim 2, characterized in that: Step (2) constructs a SAT model for docking the connector with the differential feature. The input of the connector model is ΔT, and the output is a series of candidate collision pairs. It is necessary to verify whether the propagation of these candidate collision pairs in the permutation satisfies the differential feature that the first d bits of the output differential are 0; The characterization of value propagation is the same as that in step (1), and the characterization of differential propagation is as follows: (2.1) Characterization of the differential propagation of the exclusive-or operation: The differential propagation of XOR operation is recorded as: Where Δα1, Δα2 and Δβ represent the input and output differences of the XOR operation respectively. Where X1, X2, X3, X4 and Y1, Y2 represent the input and output values ​​of the XOR operation respectively, which are characterized by the following statement: ASSERT(Δα1=BVXOR(X1, X2)ANDΔα2=BVXOR(X3, X4)); ASSERT(Δβ == BVXOR(Y1, Y2)); (2.2) Characterization of the differential propagation of the copy operation: The differential propagation of the replication operation is recorded as: Where Δα and Δβ represent the input and output differences of the replication operation, respectively. Y1=X1,Y2=X2, Where X1, X2 and Y1, Y2 represent the input and output values of the copy operation respectively, and are characterized by the following statement: ASSERT(Δα == BVXOR(X1, X2) AND Δβ == BVXOR(Y1, Y2)); (2.3) Characterization of the differential propagation of the circular shift: The differential propagation of circular left shift is recorded as: Where Δα and Δβ represent the input and output differences of the circular left shift, respectively. Y1=X1<<<L,Y2=X2<<<L, where X1,X2 and Y1,Y2 represent the input and output values ​​of the circular shift operation respectively, which are described by the following statement: ASSERT(Δα=BVXOR(X1,X2)ANDΔβ=BVXOR(Y1,Y2)); The differential propagation of the circular right shift is recorded as: Similarly, it is characterized by the following statement: ASSERT(Δα=BVXOR(X1,X2)ANDΔβ=BVXOR(Y1,Y2)); (2.4) Characterization of the differential propagation of the S box operation: The differential propagation of S-box operation is recorded as: Among them, αS in and αS out Represent the input and output differences of the S-box operation respectively. In the S-box operation Y1=S(X1),Y2=S(X2), where X1,X2 and Y1,Y2 represent the input and output values ​​of the S-box operation respectively, which are described by the following statement: ASSERT(ΔS in =BVXOR(X1,X2)ANDΔS out =BVXOR(Y1,Y2)); Use the above modeling method to constrain and characterize the encryption algorithm, and establish a complete constraint model through the characterization of value propagation and differential propagation.

4. The SAT-based fast search method for collision message pairs according to claim 3, characterized in that: Combine the model in step (3) and use the high-probability differential characteristic that the first d bits of the output difference are 0 to construct the initial condition. The specific steps are as follows: The constraints described in step (1) and the constraints described in step (2) are combined into a complete model. The initial conditions are set to use the output of step (1) as the input of step (2). Then the constraints of steps (1) and (2) must be satisfied at the same time, that is, while generating candidate collision pairs, valid collision pairs that satisfy the differential characteristics are verified. Therefore, the complete model will directly output valid collision message pairs. Assume that the input difference of a high-probability differential feature with the first d bits of the output difference being 0 is ΔIN, and the output difference of the i-th round is 0≤i≤N-1, the input of the target differential algorithm phase in step (1) is ΔT, and the differential propagation in the i-th round in step (2) is 0≤i≤N-1, then the initial condition is described by the following statement: The complete SAT model is obtained through the above steps.

5. The SAT-based fast search method for collision message pairs according to claim 4, characterized in that: In step (4), the SAT model is solved using the solver STP. When searching for collision pairs, the search strategy is to ask whether there is a valid solution under the current constraints. The query condition corresponding to the strategy is: QUERY(FALSE); COUNTEREXAMPLE; The above query condition is called an error query. When STP returns Invalid and a collision message pair, it means that there is at least one message pair under the current target constraint. If STP returns Valid, it means that no matter what the value is, there is no valid message pair under the current constraint.

Images