A fast search method for collision message pairs based on SAT

Abstract

The present invention discloses a method for quickly searching for collision message pairs based on SAT. According to the idea of ​​the target differential algorithm, by constructing a SAT model of the target differential algorithm and a SAT verification model of collision message pairs that meet the differential characteristics, and combining the two models, the model is solved by a solver to obtain a valid collision message pair, thereby completing a collision attack. This search method optimizes the connector construction stage in the collision attack, and has the advantages of accuracy and efficiency. The method of the present invention effectively optimizes the application of the target differential algorithm in collision attacks through SAT technology, and combines it with the collision message pair verification algorithm, which can search for collision message pairs more quickly, and has the advantages of accuracy and efficiency. The method of the present invention has wide applicability and is suitable for the rapid search of collision message pairs in all sponge structures and hash algorithm collision attacks based on S-box large permutation.

Description

Technical Field

[0001] The present invention relates to a search method, in particular to a SAT-based fast search method for collision message pairs. Background Art

[0002] The principle of a differential-based collision attack is that if a message pair with a non-zero input differential is run through a hash function, the resulting message digest has a zero output differential. This message pair is called a collision pair. The search for a collision pair is closely related to the differential probability Pr and the number of rounds of the collision attack.

[0003] To expand the number of attack rounds, the literature [1-3] all use the idea of ​​the target differential algorithm to construct multi-round connectors. First, the S-box layer of the initial round of the algorithm is linearized, and then the target differential algorithm [4] is used to construct effective connectors. The construction of the connector can usually be transformed into a problem of solving a system of linear equations. Finally, combined with high-probability differential features, a high-round collision attack is obtained.

[0004] Let ΔIN and ΔOUT represent the input and output differences of the differential feature respectively. Use the target differential algorithm to extend the differential feature forward one round. Let the input and output differences of this round be ΔI and ΔT respectively. Then ΔT = ΔIN. The output difference ΔT is called the target difference. Find the input state pair Make in Represents a permutation round, n = r + c (R is a permutation round, n is the number of state bits of the cryptographic algorithm, is an n-bit operation on a binary field, r is the rate part of the state, and c is the capacity part of the state). Then use enough different state pairs To verify whether there is a state pair that meets the differential characteristics. If the first d bits of the state pair output differential ΔOUT are 0, a valid collision message pair is generated, that is, the first r bits of the state pair, such as Figure 1 shown.

[0005] In the collision attack based on sponge structure hash algorithm, the key step is to construct the connector using target differential algorithm, and the algorithm that finds the message pair that meets the given target differential after one round of hash permutation is the target differential algorithm. When executing the target differential algorithm, on the one hand, it is necessary to meet and The last c+p bits of the c , where p is the padding bit, || indicates cascade, 0 c Indicates c 0s; on the other hand, the state needs to satisfy Usually the algebraic degree of the S-box of the hash function on GF(2) is only 2, so we can use the affine subspace to construct a linear equation to solve the problem that satisfies Status pair.

[0006] The target differential algorithm generally consists of two phases. The first phase, called the differential phase, searches for all possible input differentials corresponding to the S-box output differential. The second phase, called the value phase, obtains all possible input values ​​that satisfy the S-box input-output differential, thereby obtaining the actual values ​​of the message pairs that satisfy the target differential. The algorithm then generates a series of candidate message pairs, and finally exhaustively searches for message pairs that satisfy the differential characteristics, resulting in the collision message pairs. Previously, target differential algorithms were implemented by constructing a system of linear equations, which was complex and redundant. These two phases of the algorithm needed to be solved separately, further increasing resource consumption and time costs.

[0007] References:

[0008] 【1】Qiao K, Song L, Liu M, et al. New Collision Attacks on Round-ReducedKeccak[C]. International Conference on the Theory and Applications ofCryptographic Techniques. Paris, France, 2017: 216-243. Doi: 10.1007 / 978-3-319-56617-7_8;

[0009] 【2】Song L, Liao G, Guo J.Non-Full Sbox Linearization:Applications toCollision Attacks on Round-Reduced Keccak[C].International CryptologyConference,Santa Barbara,USA,2017:428-451.Doi:10.1007 / 978-3-319-63715-0_15;

[0010] 【3】Guo J, Liao G, Liu G, et al. Practical Collision Attacks against Round-Reduced SHA-3[J]. Journal of Cryptology, 33, 228–270(2020). https: / / doi.org / 10.1007 / s00145-019-09313-3;

[0011] 【4】Dinur I, Dunkelman O, Shamir A. New Attacks on Keccak-224and Keccak-256[C]. International Conference on Fast Software Encryption. Washington, USA, 2012, 12: 442-461. Doi: 10.1007 / 978-3-642-34047-5_25. Summary of the Invention

[0012] To address these issues, this paper proposes a fast SAT-based method for searching for collision message pairs. Based on the concept of the target differential algorithm, this method constructs a SAT model of the target differential algorithm and a SAT verification model for collision message pairs that meet differential characteristics. These two models are then combined and solved using a solver to obtain valid collision message pairs, completing a collision attack. This search method optimizes the connector construction phase of the collision attack, offering both accuracy and efficiency.

[0013] The technical solution for achieving the purpose of the present invention is:

[0014] A method for quickly searching for collision message pairs based on SAT comprises the following steps:

[0015] (1) Construct the SAT model of the connector based on the idea of ​​target difference algorithm:

[0016] Find all possible message pairs that satisfy the given target difference ΔT after one round of hash permutation. The message pairs need to go through one round of permutation of the nonlinear layer SLayer and the linear layer L.

[0017] For the nonlinear layer, the affine subspace of the S-box is characterized according to the differential distribution table DDT, so that its differential propagates with a probability of 1, while the probability of differential propagation of the linear layer itself is 1;

[0018] Merge the difference phase and value phase of the target difference algorithm to construct a SAT model that can directly output a series of candidate message pairs;

[0019] (2) Constructing a SAT model for connecting connectors to differential features:

[0020] According to the structure of the hash algorithm, the candidate message pairs generated by the target differential algorithm are made to meet the corresponding differential characteristics, and a SAT model is constructed to search for valid message pairs that meet the differential characteristics;

[0021] (3) Combine the two models of steps (1) and (2) and construct the initial conditions:

[0022] The two models in steps (1) and (2) are combined into a complete large model. The input difference ΔIN of the high probability differential feature of the output difference ΔOUT with the first d bits being zero is used as the input of the large model, that is, ΔT = ΔIN, and this feature must satisfy:

[0023] The first d bits of the final round of output differential are zero, ΔOUT[i]=0, 0≤i≤d-1, where i represents the bit index;

[0024] The first round of input differences are not all zero,

[0025] (4) Use the STP solver to solve the SAT model and obtain the collision message pair.

[0026] The search method of the present invention differs from existing solutions in that it uses the SAT model instead of a system of linear equations, which can effectively avoid the complexity and redundancy of constraints; and it merges the two stages of the target difference algorithm into one, eliminating the need to separately calculate candidate differences and message pairs, which greatly improves the solution time; at the same time, the process of searching for valid message pairs is also merged into the SAT model, constructing a SAT model that includes all the above processes, which can directly output the final message pairs that meet the collision requirement.

[0027] The beneficial effects of the present invention are:

[0028] The proposed method effectively optimizes the target difference algorithm for collision attacks using SAT technology. Combining this with a collision message pair verification algorithm allows for faster search for collision message pairs. Specifically, in the search for valid collision pairs in three rounds of ASCON, this method was over 10,000 times faster than traditional equation-solving methods.

[0029] The method of the present invention has wide applicability and is suitable for fast searching of collision message pairs in all sponge structures and hash algorithm collision attacks based on S-box large permutation. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 Schematic diagram of N+1 round collision attack based on target differential algorithm in existing technology;

[0031] Figure 2 Schematic diagram of the connector and differential feature docking in the search method of the present invention. DETAILED DESCRIPTION

[0032] The present invention will be further described in detail below with reference to the embodiments and drawings, but the present invention is not limited thereto.

[0033] Example

[0034] A method for quickly searching for collision message pairs based on SAT comprises the following steps:

[0035] (1) Construct the SAT model of the connector based on the idea of ​​target difference algorithm:

[0036] Find all possible message pairs that satisfy the given target difference ΔT after one round of hash permutation. The message pairs need to go through one round of permutation of the nonlinear layer SLayer and the linear layer L.

[0037] For the nonlinear layer, the affine subspace of the S-box is characterized according to the differential distribution table DDT, so that its differential propagates with a probability of 1, while the probability of differential propagation of the linear layer itself is 1;

[0038] Merge the difference phase and value phase of the target difference algorithm to construct a SAT model that can directly output a series of candidate message pairs;

[0039] (2) Constructing a SAT model for connecting connectors to differential features:

[0040] According to the structure of the hash algorithm, the candidate message pairs generated by the target differential algorithm are made to meet the corresponding differential characteristics, and a SAT model is constructed to search for valid message pairs that meet the differential characteristics;

[0041] (3) Combine the two models of steps (1) and (2) and construct the initial conditions:

[0042] The two models in steps (1) and (2) are combined into a complete large model. The input difference ΔIN of the high-probability differential feature with the first d bits of the output differential ΔOUT being zero is used as the input of the large model, that is, ΔT = ΔIN, and this feature must satisfy:

[0043] The first d bits of the final round of output differential are zero, ΔOUT[i]=0, 0≤i≤d-1, where i represents the bit index;

[0044] The first round of input differences are not all zero,

[0045] (4) Use the STP solver to solve the SAT model and obtain the collision message pair.

[0046] Furthermore, the SAT model of the connector is constructed according to the idea of ​​the target difference algorithm in step (1). The construction method is as follows: given a target difference denoted as ΔT, a round of permutation R = L○SLayer, in order to obtain a SAT model that satisfies the target difference after a round of hash permutation R. All possible state pairs Characterize the difference constraints and value constraints for the propagation of the state through the permutation R:

[0047] (1.1) Difference constraint:

[0048] Difference constraint 1:

[0049] The last (c+p) bits of the input difference ΔI in one round of the target difference algorithm extension are equal to 0, and the expression is: ΔI[i]=0, rp-1≤i≤n-1;

[0050] The SAT constraint is characterized as: ASSERT(ΔI[n-1:rp-1]=0);

[0051] Difference constraint 2:

[0052] There is an n-bit state word W that satisfies L(W) + L(W + SLayer(ΔI)) = ΔT, where W represents the output state value of the nonlinear layer in one round of permutation;

[0053] In differential constraint 2, it is relatively simple to characterize the linear layer L, which is mostly composed of some simple position transformations;

[0054] For the nonlinear layer SLayer in the target difference algorithm, it is necessary to ensure that the difference is propagated with a probability of 1, so the affine subspace of the S-box is used to meet this requirement;

[0055] For a large permutation with n bits of state, an m-bit S-box with algebraic degree of 2 is used. Given any non-zero output difference of the m-bit S-box, the set of possible input differences corresponds to m two-dimensional affine subspaces.

[0056] The steps to find the affine subspace of the S-box according to the target difference ΔT are as follows:

[0057] First, the output differences corresponding to all S-boxes are obtained from the target difference ΔT, and then all corresponding possible input differences are obtained from DDT. For each possible input difference of the S-box, the corresponding possible input value is obtained. These input values ​​constitute the affine subspace of the corresponding input-output differences;

[0058] Due to replacement , then the output difference of the S box Among them L -1 represents the inverse operation of the linear layer, represents the output difference of the jth S-box;

[0059] For the jth S-box S j (1≤j≤n / m), analyze its input and output differences in combination with the difference distribution table DDT, and obtain its corresponding affine subspace by the following steps:

[0060] Step 1: Differentiate the n-bit output L -1 (ΔT) is split into n / m parts, each part is m bits, that is, S box S j The corresponding output difference is And S j and The corresponding data is stored in the list T;

[0061] Step 2: Read the list T and for each output difference According to the differential distribution table, all possible input differences corresponding to it are obtained

[0062] Step 3: Differentiate the output All possible input differences corresponding to The input-output differential is satisfied The subset of all possible input values ​​of The affine subspace of And the corresponding affine subsets are stored in the corresponding positions in the list T. Each element in the list T is a tuple, represented as in represents an affine subspace;

[0063] Step 4: Read the list T to get the corresponding S j All input and output differential The corresponding affine subspace

[0064] Furthermore, it is necessary to characterize the affine subspaces of active S-boxes and inactive S-boxes separately by SAT constraints;

[0065] For the active S-box, assume that Δα and Δβ represent the input and output differences of the affine subspace, respectively, and their specific values ​​are Δξ in and Δξ out For an S-box with an algebraic degree of 2, X1, X2, X3, and X4 represent the input values ​​that satisfy the two-dimensional affine subspace of the S-box, and Y1, Y2, Y3, and Y4 represent the corresponding output values, whose specific values ​​are {ε1, ε2, ε3, ε4} and {η1, η2, η3, η4} respectively. In the CVC statement, the expressions on both sides of the AND must hold at the same time, which is described by the following statement:

[0066] ASSERT((Δβ=Δξ out )=>(Δα=Δξ in ));

[0067] ASSERT((X1=ε1)=>(Y1=η1));

[0068] ASSERT((X2=ε2)=>(Y2=η2));

[0069] ASSERT((X3=ε3)=>(Y3=η3));

[0070] ASSERT((X4=ε4)=>(Y4=η4));

[0071]

[0072] For an inactive S-box, the input-output differences Δα and Δβ are both zero, which is described by the following statement:

[0073] ASSERT((Δβ=0)=>(Δα=0));

[0074] (1.2) Value constraints:

[0075] Value constraint 1:

[0076] and The last (c+p) bits of p[i]||0 c ,rp-1≤i≤r-1;

[0077]

[0078] The corresponding SAT constraint characterization is:

[0079]

[0080] Value constraint 2:

[0081]

[0082] The characterization of value constraint 2 only requires constraining the value propagation of the state according to the structure of permutation R. For the sponge structure hash algorithm, the internal permutation mainly consists of XOR operation, copy operation, circular shift, P permutation, and S box;

[0083] P permutation is a simple position transformation, which is characterized by a copy operation model. Therefore, to establish a SAT model for permutation, it is only necessary to characterize the XOR operation, copy operation, circular shift, and S-box operation. The constraints for characterizing the value propagation of these operations in the CVC format are as follows;

[0084] Characterization of the value propagation of XOR operation:

[0085] The value propagation of the XOR operation is recorded as: Where X1, X2, and Y represent the input and output values ​​of the XOR operation respectively. BVXOR is the bitwise XOR function in the CVC language, which is described by the following statement:

[0086] ASSERT(Y=BVXOR(X1,X2));

[0087] Characterization of value propagation of copy operation:

[0088] The value propagation of the copy operation is recorded as: Y1 = X1, where X1 and Y1 represent the input and output values ​​of the copy operation respectively, and is characterized by the following statement:

[0089] ASSERT(Y1=X1);

[0090] Characterization of the value propagation of cyclic shift:

[0091] A circular left shift of L bits is expressed as: Y1 = X1 < < < L, where X1 and Y1 represent the input and output values ​​of the circular shift operation, respectively. A circular left shift of L bits is performed in the n-bit state. @ represents the cascade in the CVC statement, which is characterized by the following statement:

[0092] ASSERT(Y1=X1[nL-1:0]@X1[n-1:nL]);

[0093] Similarly, a circular right shift of L bits is written as: Y1 = X1 >> > L, which is described by the following statement:

[0094] ASSERT(Y1=X1[L-1:0]@X1[n-1:L]);

[0095] Characterization of the value propagation of S-box operation:

[0096] The value propagation of the S-box operation is recorded as: Y1 = S(X1), where X1 and Y1 represent the input and output values ​​of the S-box operation respectively, ε i (0≤i≤2 m -1) is a 2-bit S-box of size m bits m A specific input value, η i (0≤i≤2 m -1) is the S-box input value ε i The corresponding output value is characterized by the following SAT statement:

[0097] ASSERT((X1=ε i )=>(Y1=η i ));

[0098] In this stage, the above value constraints and differential constraints are integrated into a SAT model. Depending on the properties of SAT, differential constraints and value constraints can exist in the same model at the same time.

[0099] Furthermore, in step (2), a SAT model for docking the connector with the differential feature is constructed, where the input of the connector model is ΔT and the output is a series of candidate collision pairs. It is necessary to verify whether the propagation of these candidate collision pairs in the permutation satisfies the differential feature that the first d bits of the output differential are 0, such as Figure 2 As shown;

[0100] The characterization of value propagation is the same as that in step (1), and the characterization of differential propagation is as follows:

[0101] (2.1) Characterization of differential propagation of XOR operation:

[0102] The differential propagation of the XOR operation is recorded as: Where Δα1, Δα2 and Δβ represent the input and output differences of the XOR operation respectively. Where X1, X2, X3, X4 and Y1, Y2 represent the input and output values ​​of the XOR operation respectively, which are described by the following statement:

[0103] ASSERT(Δα1=BVXOR(X1,X2)ANDΔα2=BVXOR(X3,X4));

[0104] ASSERT(Δβ=BVXOR(Y1,Y2));

[0105] (2.2) Characterization of differential propagation of replication operation:

[0106] The differential propagation of the replication operation is recorded as: Where Δα and Δβ represent the input and output differences of the replication operation, respectively. Y1=X1,Y2=X2,

[0107] Where X1, X2 and Y1, Y2 represent the input and output values ​​of the copy operation respectively, which are described by the following statements:

[0108] ASSERT(Δα=BVXOR(X1,X2)ANDΔβ=BVXOR(Y1,Y2));

[0109] (2.3) Characterization of differential propagation of cyclic shift:

[0110] The differential propagation of circular left shift is recorded as: Where Δα and Δβ represent the input and output differences of the circular left shift respectively. Y1=X1<<<L,

[0111] Y2=X2<<<L, where X1, X2 and Y1, Y2 represent the input and output values ​​of the circular shift operation respectively, which is described by the following statement:

[0112] ASSERT(Δα=BVXOR(X1,X2)ANDΔβ=BVXOR(Y1,Y2));

[0113] The differential propagation of circular right shift is recorded as: Similarly, it is described by the following statement:

[0114] ASSERT(Δα=BVXOR(X1,X2)ANDΔβ=BVXOR(Y1,Y2));

[0115] (2.4) Differential propagation characterization of S-box operation:

[0116] The differential propagation of S-box operation is recorded as: where ΔS in and ΔS out Represent the input and output differences of the S-box operation respectively, then in the S-box operation Y1=S(X1),Y2=S(X2), where X1, X2 and Y1, Y2 represent the input and output values ​​of the S-box operation respectively, which are described by the following statement:

[0117] ASSERT(ΔS in =BVXOR(X1,X2)ANDΔS out =BVXOR(Y1,Y2);

[0118] The above modeling method is used to constrain the encryption algorithm and establish a complete constraint model through the characterization of value propagation and differential propagation.

[0119] Furthermore, the combined model in step (3) uses the high-probability differential feature where the first d bits of the output differential are 0 to construct the initial condition. The specific steps are as follows:

[0120] The constraints described in step (1) and the constraints described in step (2) are combined into a complete model. The initial conditions are set to use the output of step (1) as the input of step (2). Then the constraints of steps (1) and (2) must be established at the same time, that is, while generating candidate collision pairs, valid collision pairs that meet the differential characteristics are verified. Therefore, the complete model will directly output valid collision message pairs.

[0121] Assume that the input difference of a high-probability differential feature with the first d bits of the output difference being 0 is ΔIN, and the output difference of the i-th round is The input of the target differential algorithm phase in step (1) is ΔT, and the differential propagation in the i-th round in step (2) is The initial conditions are then described by the following statement:

[0122]

[0123] The complete SAT model is obtained through the above steps.

[0124] Furthermore, in step (4), the SAT model is solved using the solver STP. When searching for collision pairs, the search strategy is to ask whether there is a valid solution under the current constraints. The query condition corresponding to the strategy is:

[0125] QUERY(FALSE);

[0126] COUNTEREXAMPLE;

[0127] The above query condition is called an error query. When STP returns Invalid and a collision message pair, it means that there is at least one message pair under the current target constraints. If STP returns Valid, it means that no matter what the value is, there is no valid message pair under the current constraints.

[0128] The present invention is based on a SAT-based fast search method for collision message pairs, which effectively constrains the processes of differential distribution table, affine subspace, value propagation, differential propagation, etc., and combines the target differential algorithm and the high-probability differential feature verification process into a unified model solution, which can complete the fast search for effective collision message pairs in one step.

Claims

1. A fast search method for collision message pairs based on SAT, characterized in that: The steps include: (1) Construct the SAT model of the connector based on the idea of ​​target differential algorithm: Find the difference that satisfies the given target after one round of hash permutation All possible message pairs, the message pairs need to go through a round of permutation of nonlinear layer SLayer and linear layer L; For the nonlinear layer, the affine subspace of the S-box is characterized according to the differential distribution table DDT, so that its differential propagates with a probability of 1, while the probability of differential propagation of the linear layer itself is 1; Merge the difference phase and value phase of the target difference algorithm to construct a SAT model that can directly output a series of candidate message pairs; Given a target difference denoted as , a round of replacement , in order to obtain after a round of hash permutation Post-satisfaction All possible state pairs , characterize the difference constraints and value constraints for the propagation of state pairs through permutation R respectively; Integrate value constraints and differential constraints into a SAT model. Depending on the properties of SAT, differential constraints and value constraints can exist in the same model at the same time. (2) Constructing a SAT model for connecting connectors and differential features: According to the structure of the hash algorithm, the candidate message pairs generated by the target differential algorithm are made to meet the corresponding differential characteristics, and a SAT model is constructed to search for valid message pairs that meet the differential characteristics; Use modeling methods to constrain the encryption algorithm and establish a SAT model for connecting connectors and differential features through the characterization of value propagation and differential propagation. (3) Combine the two models in steps (1) and (2) and construct the initial conditions: The two models of steps (1) and (2) are combined into a complete SAT model, which outputs the difference Input differential of high probability differential features with the first d bits being zero As the input of the complete SAT model, , and this feature must meet the following requirements: The first d bits of the final round of output differential are zero. , i represents the bit index; The first round of input differences are not all zero, ; The constraints described in step (1) and the constraints described in step (2) are combined into a complete SAT model. The initial conditions are set to use the output of step (1) as the input of step (2). Then the constraints of steps (1) and (2) must be established at the same time, that is, while generating candidate collision pairs, valid collision pairs that meet the differential characteristics are verified. Therefore, the complete SAT model will directly output valid collision message pairs. An input difference with a high probability difference feature of 0 before the output difference is , the output difference of round i is , , the input of the target difference algorithm stage in step (1) is , the differential propagation of the i-th round in step (2) is , , then the initial conditions are described by the following statement: ； (4) Use the STP solver to solve the complete SAT model and obtain the collision message pairs.

2. The SAT-based fast search method for collision message pairs according to claim 1, characterized in that: The SAT model of the connector is constructed according to the idea of ​​the target difference algorithm in step (1), including: (1.1) Difference constraint: Differential Constraint 1: Input differential in one round of target differential algorithm expansion The End bit is equal to 0, where C Indicates the number of bits of the capacity part, p Indicates the number of padding bits, expressed as: Where, r Indicates the number of bits in the rate part, n Indicates the total number of input differential bits; The SAT constraint is characterized as: Differential Constraint 2: There exists a bit word with n states satisfy , where W represents the output state value of the nonlinear layer in a round of permutation, L is a linear layer, SLayer is a nonlinear layer; For the nonlinear layer SLayer in the target difference algorithm, the affine subspace of the S-box is used to ensure that the difference is propagated with probability 1; For a large permutation with n bits of state, an m-bit S-box with algebraic degree of 2 is used. Given any non-zero output difference of the m-bit S-box, the set of possible input differences corresponds to m two-dimensional affine subspaces. According to the target difference The steps to find the affine subspace of the S-box are as follows: First, the target difference Get the output differences corresponding to all S-boxes, and then use DDT to get all the corresponding possible input differences. For each possible input difference of the S-box, get the corresponding possible input value. These input values ​​constitute the affine subspace of the corresponding input-output differences. Due to replacement , then the output difference of the S box ,in represents the inverse operation of the linear layer, represents the output difference of the jth S-box; For the jth S-box , , combined with the difference distribution table DDT to analyze its input and output differences, the corresponding affine subspace is obtained by the following steps: Step 1: Differentiate the n-bit output Split into Each copy is m bits, which is an S box The corresponding output difference is , and and The corresponding data is stored in the list T; Step 2: Read the list T and for each output difference , according to the differential distribution table, all possible input differentials corresponding to it are obtained ; Step 3: Differentiate the output All possible input differences corresponding to , to satisfy the input-output differential The subset of all possible input values ​​of The affine subspace of And the corresponding affine subsets are stored in the corresponding positions in the list T. Each element in the list T is a tuple, represented as ,in represents an affine subspace; Step 4: Read the list T to get the corresponding All input and output differential The corresponding affine subspace ; Furthermore, it is necessary to characterize the affine subspaces of active S-boxes and inactive S-boxes separately by SAT constraints; For active S-box, and Represent the input and output differences of the affine subspace, and their specific values ​​are and , for an S-box of degree 2, Represents the input value that satisfies the S-box two-dimensional affine subspace, Indicates the corresponding output value, and its specific values ​​are and In a CVC statement, the expressions on both sides of AND must hold true at the same time, as described by the following statement: ； ； ； ； ； ； ； For an inactive S-box, the input and output differential and are all zero, as described by the following statement: ； (1.2) Value constraints: Value constraint 1: and The End Bit is equal to ; The corresponding SAT constraint characterization is: ； ； Value constraint 2: The characterization of value constraint 2 only requires constraining the value propagation of the state according to the structure of permutation R. For the sponge structure hash algorithm, the internal permutation includes XOR operation, copy operation, circular shift, P permutation, and S box; P permutation is a simple position transformation, which is characterized by a copy operation model. Therefore, to establish a SAT model for permutation, it is only necessary to characterize the XOR operation, copy operation, circular shift, and S-box operation. The constraints for characterizing the value propagation of these operations in the CVC format are as follows; Characterization of the value propagation of XOR operation: The value propagation of the XOR operation is recorded as: ,in and Represent the input and output values ​​of the XOR operation respectively. BVXOR is the bitwise XOR function in the CVC language, which is described by the following statement: ； Characterization of value propagation of copy operation: The value propagation of the copy operation is recorded as: ,in and Represent the input and output values ​​of the copy operation, respectively, and are described by the following statements: ； Characterization of the value propagation of cyclic shift: Circular left shift L bits is recorded as: ,in and Represent the input and output values ​​of the circular shift operation, respectively, and circularly shift left by L bits in the n-bit state. @ represents the cascade in the CVC statement, which is characterized by the following statement: ； Circular right shift L bits is recorded as: , described by the following statement: ； Characterization of the value propagation of S-box operation: The value propagation of the S-box operation is recorded as: ,in and Represent the input and output values ​​of the S-box operation respectively, is an S-box of size m bits A specific input value, , is the S-box input value The corresponding output value, , which is characterized by the following SAT statement: 。 3. The SAT-based fast search method for collision message pairs according to claim 2, characterized in that: Step (2) constructs a SAT model for connecting the connector to the differential feature. The input of the SAT model of the connector is , the output is a series of candidate collision pairs , it is necessary to verify whether the propagation of these candidate collision pairs in the permutation satisfies the differential feature that the first d bits of the output differential are 0; The characterization of value propagation is the same as that in step (1), and the characterization of differential propagation is as follows: (2.1) Characterization of differential propagation of XOR operation: The differential propagation of the XOR operation is recorded as: ,in and Represent the input and output differences of the XOR operation respectively, then in the XOR operation , , , , ,in and Represent the input and output values ​​of the XOR operation, respectively, and are described by the following statements: ； ； (2.2) Characterization of differential propagation of replication operation: The differential propagation of the replication operation is recorded as: ,in and Represent the input and output differences of the copy operation respectively, then in the copy operation , , , , in and Represent the input and output values ​​of the copy operation, respectively, and are described by the following statements: ； (2.3) Characterization of differential propagation of cyclic shift: The differential propagation of circular left shift is recorded as: ,in and Represent the input and output differences of the circular left shift respectively, then in the circular left shift , , , ,in and Represent the input and output values ​​of the circular shift operation, respectively, and are described by the following statements: ； The differential propagation of circular right shift is recorded as: , which is described by the following statement: ； (2.4) Differential propagation characterization of S-box operation: The differential propagation of S-box operation is recorded as: ,in and Represent the input and output differences of the S-box operation respectively, then in the S-box operation , , , ,in and Represent the input and output values ​​of the S-box operation, respectively, and are described by the following statements: 。 4. The SAT-based fast search method for collision message pairs according to claim 3, characterized in that: In step (4), the STP solver is used to solve the complete SAT model. When searching for collision pairs, the search strategy is to ask whether there is a valid solution under the current constraints. The query condition corresponding to the strategy is: QUERY (FALSE); COUNTEREXAMPLE; The above query condition is called an error query. When STP returns Invalid and a collision message pair, it means that there is at least one message pair under the current target constraints. If STP returns Valid, it means that no matter what the value is, there is no valid message pair under the current constraints.

Images