Security assessment method and device for SM4-XTS high-order side channel analysis resistance

Abstract

The invention relates to the technical field of chip testing, in particular to a security assessment method and device for SM4-XTS high-order side channel analysis resistance. The method comprises the following steps: inputting a plaintext and a high-order leakage model of an SM4-XTS encrypted circuit according to a hypothetical tweak adjustment value to obtain a difference value sequence of Hamming weights corresponding to tweak adjustment values of adjacent rounds; continuously sending random excitation to the SM4-XTS encryption circuit to obtain a side channel data set; and performing security assessment on the SM4-XTS encrypted circuit according to whether the difference sequence of the Hamming weight and the side channel information difference sequence have the same statistical distribution or not. According to the SM4-XTS encryption circuit, the high-order side channel analysis resistance of the SM4-XTS encryption circuit is tested, and the physical security of the security chip is verified, so that the further development of the protection technology is promoted.

Description

Technical Field

[0001] The present application relates to the field of chip testing technology, and more specifically, to a security assessment method and device for SM4-XTS high-order side channel analysis resistance capability. Background Art

[0002] Side-channel information refers to physical information such as electromagnetic radiation and power consumption generated by the chip during operation. The leakage of side-channel information seriously threatens the information security of cryptographic chips and is one of the main security risks faced by cryptographic chips. Side-channel analysis (SCA) can use the time, power consumption, and electromagnetic and other physical characteristics consumed or generated during the operation of a cryptographic device to recover secret information, which has become a serious threat to information security.

[0003] As an indispensable data storage medium in smart devices, the security of storage devices has received widespread attention. XTS (XEX-based Tweaked Codebook Mode with Ciphertext Stealing) is an encryption mode widely used in storage encryption. Its circuit structure contains two independent encryption modules and two different keys. It can generate an adjustment value tweak based on the storage path, and perform XOR operations with the input plaintext data and the output ciphertext respectively to protect the data actually transmitted in the circuit. These characteristics make the XTS mode not only able to resist cryptanalysis attacks, but also have a high resistance to side channel analysis. At present, some studies have proposed targeted side channel analysis methods based on the structural characteristics of the XTS encryption mode. At the same time, the security-enhanced XTS encryption circuit based on the mask scheme has also received attention.

[0004] Since the XTS encryption circuit structure introduces an adjustment value that iterates with the encryption round, the input plaintext and the key calculation are masked during the encryption process. At the same time, the structure of the adjustment value tweak is not completely consistent with the classic mask structure. Therefore, the side channel analysis based on the mask scheme cannot be applied to the SM4-XTS encryption mode.

[0005] In view of this, this application is filed. Summary of the invention

[0006] The purpose of this application is to provide a security assessment method and device for the resistance of SM4-XTS high-order side channel analysis, to test the ability of SM4-XTS encryption circuit to resist high-order side channel analysis, to verify the physical security of the security chip, and thus to promote the further development of encryption protection technology.

[0007] In order to achieve the above objectives, this application adopts the following technical solutions: In a first aspect, the present application provides a security assessment method for SM4-XTS high-order side channel analysis resistance, including: Build a high-order leakage model for the SM4-XTS encryption circuit; According to the round and iteration relationship of the tweak adjustment value, an assumption is made on the tweak adjustment value; According to the assumed tweak adjustment value, the plaintext input into the SM4-XTS encryption circuit and the high-order leakage model, a difference sequence of Hamming weights corresponding to the tweak adjustment values ​​of adjacent rounds is obtained; Continuously sending random excitations to the SM4-XTS encryption circuit to obtain a side channel data set; the random excitations include two identical plaintexts; the side channel data set includes a correspondence between a side channel information difference sequence, the sent plaintext, and a tweak round; The security of the SM4-XTS encryption circuit is evaluated based on whether the Hamming weight difference sequence and the side channel information difference sequence have the same statistical distribution.

[0008] In a second aspect, the present application provides an electronic device, including: at least one processor, and a memory communicatively coupled to at least one of the processors; The memory stores instructions that can be executed by at least one of the processors, and the instructions are executed by at least one of the processors so that at least one of the processors can execute any of the security assessment methods for the SM4-XTS high-order side channel analysis resistance capabilities.

[0009] Compared with the prior art, the beneficial effects of this application are: The present application proposes a security assessment method for the resistance to high-order side channel analysis of SM4-XTS. Aiming at the tweak structure characteristics in the SM4-XTS encryption circuit, the security analysis method of the inverse T test is used to assess and analyze the resistance to high-order side channel analysis of the SM4-XTS encryption circuit, which can effectively verify the security attributes of the encryption circuit. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0011] Figure 1It is a schematic diagram of the structure of the SM4-XTS encryption circuit provided in an embodiment of the present application; Figure 2 is a flow chart of a security assessment method for SM4-XTS high-order side channel analysis resistance capability provided in this embodiment; Figure 3 It is a schematic diagram of an encryption process and analysis area of ​​an SM4-XTS encryption circuit provided in an embodiment of the present application; Figure 4 It is a schematic diagram of the encryption process and analysis area of ​​another SM4-XTS encryption circuit provided in an embodiment of the present application; Figure 5 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0013] In order to facilitate the introduction of the solution provided by this embodiment, the SM4-XTS encryption circuit is first introduced. Figure 1 First, the 128-bit sector address index (SN) is encrypted with the key Key2 and input into SM4-enc to generate the initial, first-round tweak value: . With the i-th round After modular multiplication, we get the i-th round . 128-bit input plaintext 129-bit Plaintext and After XOR, it is input into SM4-enc together with key Key2 for encryption operation. The output result is again The purpose of this application is to make assumptions about the tweak values ​​of each round to evaluate the security of the encryption circuit.

[0014] Figure 2 This is a flowchart of a security assessment method for SM4-XTS high-order side channel analysis resistance provided by this embodiment. This embodiment is applicable to the scenario of assessing the security of the tweak adjustment value of the SM4-XTS encryption circuit through side channel information. The method can be executed by an electronic device, and specifically includes the following operations: S110. Build a high-order leakage model for the SM4-XTS encryption circuit.

[0015] The "high-order" in the high-order leakage model of this embodiment is: a byte is simulated / expressed through a mathematical expression after at least two "1" and "0" flipping processes. In order to facilitate the introduction of the high-order leakage model, firstly according to Figure 3 Introduces the encryption process and analysis areas of the SM4-XTS encryption circuit.

[0016] In the generation back, Perform an XOR operation with plaintext A to obtain 128 bits of data, respectively. These four data blocks are used to represent the first intermediate value. Each data block has 32 bits, which can be called the first intermediate value. The last 96 bits, namely Perform a second XOR operation to obtain a second intermediate value. The second intermediate value and the round key After XOR, it is replaced by the substitution box Sbox for nonlinear substitution. Then, after the shift operation and XOR operation, the third intermediate value is generated. XOR .

[0017] See also Figure 4 , After iteration, the adjustment value for the next round is obtained , if the same plaintext A is input to the circuit again, then the plaintext A and After an XOR operation, 128 bits of data are obtained. These four data blocks are used to represent the subsequent operation process. Figure 3 The same description as .

[0018] The iterative formula for the tweak adjustment value of two adjacent rounds is as follows: ;Formula (1) in, for The kth byte of .

[0019] It can be seen from the above formula that there is a shift and XOR relationship between the tweak values ​​of two adjacent rounds. For two adjacent tweak values ​​with the same plaintext input, there is also a corresponding linear and nonlinear correlation between the tweak value and the plaintext in the operation of the SM4 encryption module. The leakage model can be constructed by establishing the correlation between the intermediate values. The high-order leakage model represents the correlation between the intermediate values ​​in the encryption process under the influence of the tweak values ​​of two adjacent rounds.

[0020] Specifically, the analysis area is determined according to the structure of the SM4-XTS encryption circuit. The analysis area includes the analysis area surrounded by the first XOR operation and the second XOR operation, see Figure 3 As shown by the dotted line. It can be seen that the operations in the analysis area include: a XOR operation of the tweak value and the input plaintext to obtain the first intermediate value; and a second XOR operation of the 96 bits after the first intermediate value to obtain the second intermediate value. A high-order leakage model M is constructed based on the operations in the analysis area.

[0021] ;Formula (2) in, is the input plaintext. The plaintext input in the i-th round is the same as the plaintext input in the i+1-th round. is the tweak adjustment value of the i-th round, It is the tweak adjustment value of the i+1th round. It is the result of an XOR operation between the tweak value of the i-th round and the plaintext. The first intermediate value of an XOR operation between the tweak value of the (i+1)th round and the plaintext. is the i-th round The data between the mth and nth bits in the . It is the second intermediate value obtained by performing an XOR operation on the last 96 bits of the first intermediate value of the i-th round. The i+1th round The data between the mth and nth bits in the . It is the second intermediate value obtained by performing an XOR operation on the last 96 bits of the first intermediate value of the (i+1)th round. represents the Hamming weight, Indicates the pth bit of the tweak adjustment value of the i-th round, It is an XOR operation, where m, n, and p are all integers.

[0022] Since the plaintext input in adjacent rounds is the same and the tweak values ​​are adjacent, when the same plaintext is input twice in a row, the change in the Hamming weight of the second intermediate value is only the change in the first and last two bits of the tweak value. Assuming HW(A1+B1)=HW(A1+c1)-HW(B1+c1), A1, B1, and c1 all represent bytes, the difference between the second intermediate value Y can eliminate the influence of the last 96 bits of the first intermediate value on the Hamming weight difference, which is helpful to save the amount of calculation.

[0023] S120: Make assumptions about the tweak value according to the round and iteration relationship of the tweak value.

[0024] Traverse the first round of tweak adjustment values ​​within the set range: ; According to the iterative relationship between the tweak adjustment values, the tweak adjustment value of the current round is obtained based on the tweak adjustment value of the previous round, so that the tweak adjustment value of each iterative round can be obtained.

[0025] The setting range is the possible range of the tweak value, and the range of each byte is (0~F).

[0026] Since this embodiment can eliminate the influence of the last 96 bits of the first intermediate value on the final ciphertext through the high-order leakage model, it can be assumed that only the first 32 bits of the tweak value are used, and the last 96 bits can be fixed values.

[0027] Subsequent operations are performed on each set of assumed tweak values ​​in order to verify which set of assumed tweak values ​​is the key of the current encryption circuit, wherein each set of assumed tweak values ​​is the tweak value of each round.

[0028] S130, obtaining a difference sequence of Hamming weights corresponding to the tweak values ​​of adjacent rounds according to the assumed tweak value, the plaintext input into the SM4-XTS encryption circuit, and the high-order leakage model.

[0029] The same plaintext is encrypted using a high-order leakage model in succession, and the Hamming weights during the encryption operation are counted. The Hamming weights counted in succession are subtracted to obtain a difference sequence of Hamming weights corresponding to the tweak values ​​of adjacent rounds.

[0030] Specifically, a hypothetical tweak value is substituted into formula (2) , put the plaintext A into formula (2) , bringing the adjacent hypothetical tweak adjustment value into the formula (2) , put the plaintext A into formula (2) , and finally we get the difference of the Hamming weight of the encryption process under the influence of a pair of adjacent assumed tweak values.

[0031] Similarly, the hypothetical tweak adjustment value of the next iteration is obtained and encrypted in the high-order leakage model to obtain a new difference in Hamming weight. As the hypothetical tweak adjustment values ​​of multiple rounds are encrypted in the high-order leakage model, a sequence of Hamming weight differences is obtained.

[0032] This embodiment eliminates the influence of the plaintext on the Hamming weight of the encryption process by inputting the same plaintext, subtracting the Hamming weights of the second intermediate values, and XORing adjacent tweak values, and only retains the influence of the first two XOR processes on the Hamming weight.

[0033] S140. Continue to send random excitations to the SM4-XTS encryption circuit to obtain a side channel data set.

[0034] The random excitation includes two identical plaintexts, which are randomly generated.

[0035] Different from performing encryption operations in a high-order leakage model, this step performs encryption operations in the actual SM4-XTS encryption circuit.

[0036] First, the same plaintext is input into the SM4-XTS encryption circuit successively to collect the side channel power consumption curve.

[0037] When the plaintext is input successively, the circuit will use the tweak adjustment value of the adjacent round to participate in the encryption operation. The plaintexts input successively are a pair of identical plaintexts (assuming plaintext A); when the next input is made, the same pair of plaintexts can be input successively (assuming plaintext A) or the same pair of plaintexts can be input successively (assuming plaintext B).

[0038] The power consumption during circuit operation (or electromagnetic and other side channel data that can reflect the circuit operation status) is collected through dedicated equipment. The horizontal axis represents time and the vertical axis represents power consumption value, and the side channel power consumption curve corresponding to each plaintext input is drawn.

[0039] Then, the side channel power consumption curves collected successively are subtracted to obtain the side channel information difference sequence of adjacent rounds, which can offset the impact of plaintext on power consumption.

[0040] Preferably, since the side channel power consumption curve is Figure 1 The power consumption curve of the complete encryption process of the circuit shown, in order to correspond to the analysis area represented by the high-order leakage model, determines the first side channel power consumption of a single XOR operation and the second side channel power consumption of a secondary XOR operation based on the circuit execution time on the side channel power consumption curve collected for a single plaintext input; subtracts the first side channel power consumption from the second side channel power consumption to obtain a new side channel power consumption curve to eliminate the influence of the last 96 bits of the first intermediate value on the side channel information difference; and subtracts the new side channel power consumption curves collected successively to obtain a side channel information difference sequence of adjacent rounds.

[0041] Specifically, according to the circuit crystal frequency and the execution time of the electronic components, the time period for the circuit to perform a first XOR operation and the time period for the circuit to perform a second XOR operation can be estimated. Subtracting the power consumption of the two time periods eliminates the influence of the 96 bits of the side channel information difference after the first intermediate value.

[0042] In summary, by continuously sending random excitations to the SM4-XTS encryption circuit, a side channel data set is obtained, including the correspondence between the side channel information difference sequence, the sent plaintext, and the tweak rounds.

[0043] S150. Perform security assessment on the SM4-XTS encryption circuit based on whether the Hamming weight difference sequence and the side channel information difference sequence have the same statistical distribution.

[0044] This embodiment performs an inverse T test on the Hamming weight difference sequence and the side channel information difference sequence to evaluate the security of the SM4-XTS encryption circuit. The inverse T test is implemented based on the inverse transformation of the T test. In a conventional T test, sample data is used to test whether the hypothesis is true based on the assumption of the population parameter (such as the mean). This embodiment adopts the inverse T test method: based on the known statistical characteristics (mean or variance, etc.) of the Hamming weight difference sequence and the side channel information difference sequence, the probability of whether they come from the same sample population is judged by the distribution properties, thereby judging whether the key value in the XTS encryption circuit is the current tweak adjustment value.

[0045] The specific technical route of using the inverse T test is: first, statistically analyze the side channel information difference sequence to obtain the security threshold T. For example, two groups of data input operations are performed on the existing circuit, one of which is a random plaintext input and the other is a fixed plaintext input (as a control), and each group includes 2 identical plaintexts. Based on the side channel information difference of the two groups of inputs, a T test is performed to calculate the T value (T represents the difference between the two groups of inputs); then, based on the evaluation criteria for whether the side channel is safe or not, the maximum value of the T value is determined as the security threshold, and then the security threshold is used as an evaluation index parameter for security analysis to construct a dedicated security parameter for subsequent analysis. In a specific implementation, 1) multiple side channel information difference sequences under different stimuli are obtained. "Different stimuli" include a group of random plaintext stimuli and a group of fixed plaintext stimuli; the two plaintexts included in each group of stimuli are the same. This embodiment can directly adopt the stimulus method provided by S140, and select side channel information difference sequences of different plaintexts from the final side channel data set without applying the stimulus again. 2) From multiple side channel information difference sequences, extract multiple side channel information difference points in the same circuit execution stage. 3) Performing a T test based on the multiple information differences to obtain a T value at each circuit execution stage. 4) Selecting a maximum T value from multiple T values ​​at multiple circuit execution stages as a safety threshold T.

[0046] The circuit execution phase is Figure 3 or Figure 4The steps such as XOR and shift performed by the electronic components can be obtained according to the circuit crystal frequency and the execution time of the electronic components. Exemplarily, when the plaintexts of different groups are different, it is equivalent to applying random excitation and fixed excitation to the circuit. In this way, multiple groups of side channel information difference sequences under different excitations are obtained. For example, there are 2000 side channel information difference sequences under random excitations, of which 1 is copied into 2000 copies to obtain the side channel information difference sequence under fixed excitation. The sequence under each group of excitations includes 100 time points. According to the order of the time points, the information difference points at the same time point in the same circuit execution phase can be obtained. For example, the information difference between the first time point under the first group of excitations and the first time point under the Nth group of excitations is leaked in the same circuit execution phase. In this way, 2000 side channel information differences are obtained at each time point. The 2000 side channel information differences at each time point are subjected to T tests respectively, that is, 100 T tests are performed to obtain 100 T values. The maximum value of the 100 T values ​​is selected as the security threshold.

[0047] This embodiment takes into account that the T value of T transformation has an empirical value, but the empirical value of t inverse transformation is generally missing. The security threshold is calculated by the actual side channel leakage data of the circuit.

[0048] After obtaining the security threshold T, the inverse transformation of T between the difference sequence of the Hamming weight obtained in S130 and the side channel information difference sequence obtained in S140 is calculated to determine whether there is a solution within the security threshold T; if there is a solution, it means that the currently assumed tweak adjustment value is the key of the SM4-XTS encryption circuit, and the SM4-XTS encryption circuit is not secure. If there is no solution, it means that the key of the SM4-XTS encryption circuit cannot be obtained, and the SM4-XTS encryption circuit is secure.

[0049] Specifically, we first assume that the difference sequence of the Hamming weight and the side channel information difference sequence have the same distribution characteristics, and then calculate the T value to obtain the probability of rejecting this hypothesis, thereby evaluating the difference between the two groups of sequences. For the calculated Hamming weight difference sequence Q0 and the side channel information difference sequence Q1, the T statistic and degrees of freedom of the T test It can be expressed as: ;Formula (3) ;Formula (4) in, and are the means of Q0 and Q1 respectively, and are the variances of Q0 and Q1 respectively, and Represent the basis of Q0 and Q1 respectively.

[0050] The Student's T distribution density function is calculated by the following formula: ;Formula (5) Where Г(·) is the gamma function. Based on the two-sided Welch's T test, the expected probability can be obtained by the following formula: ;Formula (6) The p value calculated above is the probability of rejecting the hypothesis, that is, the probability of rejecting "the difference sequence of Hamming weights and the difference sequence of side channel information have the same distribution characteristics". If, under the confidence level p, there is a solution T that falls within the security threshold T, it can be inferred that the difference sequence of Hamming weights and the difference sequence of side channel information have the same distribution, then the tweak adjustment value assumed in the high-order leakage model is considered to be the correct assumption, and the SM4-XTS encryption circuit is not secure. If no solution within the security threshold T can be found under each set of traversed tweak adjustment values, so that the two sequences have the same distribution characteristics, then the SM4-XTS encryption circuit is secure.

[0051] It should be noted that if only the first 32 bits of the tweak value are assumed, and the last 96 bits are fixed values, then the first 32 bits of the key can be obtained through the above steps, and with the successive iterations of the tweak value, the same method can be used to obtain the subsequent bits of the tweak value, thereby restoring the complete tweak value.

[0052] The present application also provides an electronic device, see Figure 5 , comprising at least one processor 301, and a memory 302 communicatively connected to at least one of the processors 301; The memory 302 stores instructions that can be executed by at least one of the processors 301. The instructions are executed by at least one of the processors 301 so that at least one of the processors 301 can execute the above-mentioned security assessment method for the resistance capability of SM4-XTS high-order side channel analysis, thereby having at least the same advantages as the above-mentioned method.

[0053] Optionally, the electronic device also includes interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on a memory to display graphical information of a GUI (Graphical User Interface) on an external input / output device (such as a display device coupled to an interface). In other embodiments, if necessary, multiple processors can be used together with multiple memories, and / or multiple buses can be used together with multiple memories. Similarly, multiple electronic devices can be connected (for example, as a server array, a group of blade servers, or a multi-processor system), and each device provides some necessary operations.

[0054] The memory 302, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the security assessment method for the resistance to high-order side channel analysis of SM4-XTS in the embodiment of the present application. The processor 301 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 301, that is, implements the above-mentioned security assessment method for the resistance to high-order side channel analysis of SM4-XTS.

[0055] The memory 301 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 302 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 302 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0056] The electronic device may further include: an input device 303 and an output device 304. The processor 301, the memory 301, the input device 303 and the output device 304 may be connected via a bus or other means.

[0057] The input device 303 can receive input digital or character information, and the output device 304 can include a display device, an auxiliary lighting device (e.g., LED), and a tactile feedback device (e.g., a vibration motor), etc. The display device can include, but is not limited to, a liquid crystal display (LCD), a light emitting diode (LED) display, and a plasma display. In some embodiments, the display device can be a touch screen.

[0058] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0059] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A security assessment method for SM4-XTS high-order side channel analysis resistance, characterized in that: include: Build a high-order leakage model for the SM4-XTS encryption circuit; According to the round and iteration relationship of the tweak adjustment value, an assumption is made on the tweak adjustment value; According to the assumed tweak adjustment value, the plaintext input into the SM4-XTS encryption circuit and the high-order leakage model, a difference sequence of Hamming weights corresponding to the tweak adjustment values ​​of adjacent rounds is obtained; Continuously sending random excitations to the SM4-XTS encryption circuit to obtain a side channel data set; the random excitations include two identical plaintexts; the side channel data set includes a correspondence between a side channel information difference sequence, the sent plaintext, and a tweak round; The security of the SM4-XTS encryption circuit is evaluated based on whether the Hamming weight difference sequence and the side channel information difference sequence have the same statistical distribution.

2. The method according to claim 1, characterized in that: Build a high-level leakage model of the SM4-XTS encryption circuit, including: According to the structure of the SM4-XTS encryption circuit, an analysis area is determined, and the operations in the analysis area include: a first XOR operation of the tweak adjustment value and the input plaintext to obtain a first intermediate value, and a second XOR operation of the last 96 bits of the first intermediate value to obtain a second intermediate value; A high-order leakage model M is constructed based on the calculations within the analysis area: ； in, is the plain text input, is the tweak adjustment value of the i-th round, is the tweak value of the i+1th round, It is the result of an XOR operation between the tweak value of the i-th round and the plaintext. The first intermediate value of an XOR operation between the tweak value of the i+1th round and the plaintext, is the i-th round The data between the mth and nth bits in the is the second intermediate value obtained by XORing the last 96 bits of the first intermediate value of the i-th round, The i+1th round The data between the mth and nth bits in the is the second intermediate value obtained by performing an XOR operation on the last 96 bits of the first intermediate value of the i+1th round, represents the Hamming weight, Indicates the pth bit of the tweak adjustment value of the i-th round, is an XOR operation, m, n, p are all integers; The high-order leakage model represents the correlation between the intermediate values ​​of the encryption process under the influence of two adjacent rounds of tweak adjustment values.

3. The method according to claim 2, characterized in that According to the round and iteration relationship of the tweak adjustment value, assumptions are made on the tweak adjustment value, including: Traverse the first round of tweak adjustment values ​​within the set range: ; According to the iterative relationship between the tweak adjustment values, the tweak adjustment values ​​of the current round are obtained based on the tweak adjustment values ​​of the previous round.

4. The method according to claim 3, characterized in that: According to the assumed tweak adjustment value, the plaintext input into the SM4-XTS encryption circuit and the high-order leakage model, a difference sequence of Hamming weights corresponding to the tweak adjustment values ​​of adjacent rounds is obtained, including: The same plaintext is encrypted using the high-order leakage model successively, and the Hamming weight in the encryption operation process is counted; Subtract the Hamming weights obtained by statistics in succession to obtain the difference sequence of Hamming weights corresponding to the tweak adjustment values ​​of adjacent rounds.

5. The method according to claim 4, characterized in that Continuously send random stimuli to the SM4-XTS encryption circuit to obtain a side channel data set, including: Input the same plaintext into the SM4-XTS encryption circuit successively to collect the side channel power consumption curve; The side channel power consumption curves collected successively are subtracted to obtain the side channel information difference sequence of adjacent rounds.

6. The method according to claim 5, characterized in that Subtract the power consumption curves of the measured signals collected successively to obtain the side channel information difference sequence of adjacent rounds, including: On a side channel power consumption curve collected by a single plain text input, determining a first side channel power consumption of the single XOR operation and a second side channel power consumption of the second XOR operation according to a circuit execution time; Subtracting the first side channel power consumption from the second side channel power consumption to obtain a new side channel power consumption curve, so as to eliminate the influence of the last 96 bits of the first intermediate value on the side channel information difference; The new side channel power consumption curves collected successively are subtracted to obtain the side channel information difference sequence of adjacent rounds.

7. The method according to claim 6, characterized in that According to whether the difference sequence of the Hamming weights and the side channel information difference sequence have the same statistical distribution, a security assessment is performed on the SM4-XTS encryption circuit, including: An inverse T test is performed on the Hamming weight difference sequence and the side channel information difference sequence to perform a security assessment on the SM4-XTS encryption circuit.

8. The method according to claim 7, characterized in that Performing an inverse T test on the difference sequence of the Hamming weights and the side channel information difference sequence to perform a security assessment on the SM4-XTS encryption circuit includes: Performing statistical analysis on the side channel information difference sequence to obtain a security threshold T; Calculate the T inverse transform between the difference sequence of the Hamming weight and the side channel information difference sequence to determine whether there is a solution within the security threshold T; If there is a solution, it means that the currently assumed tweak value is the key of the SM4-XTS encryption circuit, and the SM4-XTS encryption circuit is not secure.

9. The method according to claim 8, characterized in that Statistical analysis is performed on the side channel information difference sequence to obtain a security threshold T, including: Obtain multiple side channel information difference sequences under different excitations; Extracting a plurality of side channel information difference points of the same circuit execution stage from the plurality of side channel information difference sequences; Obtaining a T value of each circuit execution stage according to the plurality of side channel information difference bits; A maximum T value is selected from multiple T values ​​in multiple circuit execution stages as a safety threshold T.

10. An electronic device, characterized in that: include: at least one processor, and a memory communicatively coupled to at least one of the processors; Wherein, the memory stores instructions that can be executed by at least one of the processors, and the instructions are executed by at least one of the processors so that at least one of the processors can execute the security assessment method for the SM4-XTS high-order side channel analysis resistance capability described in any one of claims 1-9.

Images