A device and method for accurately recovering super polynomials of Atom algorithm

Abstract

The present invention discloses a device and method for accurately recovering super polynomials of the Atom algorithm. The device comprises four modules: a model variable setting module, an Atom algorithm two-subset separability propagation model construction module, a three-subset separability propagation model construction module, and a super polynomial algebraic property detection module. The method of the present invention combines two-subset separability technology and three-subset separability technology, utilizing the propagation model constructed using the two-subset separability technology and the propagation model constructed using the three-subset separability technology, setting model variables for the propagation model, and finally solving the model. Simultaneously, a super polynomial algebraic property detection module is constructed to accurately recover the super polynomial. This method can improve the efficiency of accurately recovering super polynomials of the Atom algorithm, reduce time complexity, and significantly save time costs.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a device and method for accurately recovering an Atom algorithm super polynomial. Background Art

[0002] The cubic attack, a new type of algebraic attack, was first proposed by Dinur, Shamir, and others at the Eurocryptonomy Conference in 2009. It is now widely used in the security analysis of various cryptographic algorithms, including authenticated encryption algorithms such as Ascon, stream ciphers such as Trivium, and hash functions such as Keccak. Its key idea is to use high-order differences and linear tests to recover linear polynomials related to the key. These linear expressions are then used to construct a system of equations, which are then solved to recover partial secret keys. This method allows attackers to recover partial secret key information with significantly lower time complexity than traditional brute-force searches, thereby reducing the overall time complexity of cracking the cryptographic algorithm. When analyzing stream ciphers using a traditional cubic attack, the function expression is treated as a black-box polynomial, and the structure of the superpolynomial is recovered through linear or quadratic tests. However, because the cubic attack relies on experimental analysis of cryptographic algorithms, it faces many implementation challenges. The primary issue is resource constraints. If the cubic variable is large, such as a 50-dimensional cubic variable, then using a cubic attack to analyze the security of a cryptographic algorithm becomes difficult given the available computing resources. Therefore, attackers typically choose cubic variables with dimensions smaller than 40.

[0003] In 2016, Todo et al. proposed a new analysis method - separability analysis [1] . Separability is a general form of integral attack, which mainly utilizes the properties hidden between the active word set and the balanced word set. In order to reduce the complexity required for searching the integral distinguisher for bit-level separability, Xiang et al. first proposed a MILP model in 2016 that can describe the propagation of separability. At the same time, in order to better describe the propagation properties of separability, constructing a more accurate separability propagation model of cryptographic components has also been a research focus in recent years, such as the construction method of the separability propagation model of the S-box and the modeling method of the linear component. At the 2017 American Cryptography Conference, Todo et al. applied separability to the analysis of stream cipher algorithms for the first time and proposed a cubic attack method based on separability. [3]This method, on the one hand, frees us from restrictions on the selection of cubic variables, allowing us to analyze superpolynomials corresponding to cubic variables of larger dimensions. On the other hand, this method allows an attacker to directly determine which key variables are involved in the corresponding superpolynomial and which are not, further reducing the time complexity required to recover the superpolynomial.

[0004] To conduct a key recovery attack, an attacker needs to accurately recover the specific form of the superpolynomial. Wang et al. proposed pruning techniques and a rapid propagation technique for three-subset separability based on three-subset separability. They also designed a method for recovering the superpolynomial based on the MILP model of three-subset separability propagation, but their results were still inaccurate.

[0005] Finally, Hao Yonglin and others completely solved the problem of inaccurate super polynomial recovery in 2020 [5] , which proposes a model with three-subset separability without unknown subsets, which can accurately recover the super polynomial within a reasonable time complexity.

[0006] Current attacks against the Atom algorithm don't utilize a method based on a combination of two-subset separability and three-subset separability to solve the target cryptographic algorithm for the key variables and superpolynomial contained in the superpolynomial. Therefore, utilizing a combination of two-subset separability and three-subset separability to solve the target cryptographic algorithm and accurately recover the superpolynomial remains an unresolved issue.

[0007] References:

[0008] [1]Todo Y.,Morii M.(2016).Bit-Based Division Property and Application to Simon Family[C].In:Peyrin T.(eds)Fast Software Encryption 2016.LectureNotes in Computer Science,2016,vol 9783,pp.357–377;

[0009] [2]Xiang,Z.,Zhang,W.,Bao,Z.,Lin,D.(2016).Applying MILP Method toSearching Integral Distinguishers Based on Division Property for 6LightweightBlock Ciphers[C].In:Cheon,J.,Takagi,T.(eds)Advances in Cryptology–ASIACRYPT2016.Lecture Notes in Computer Science(),vol 10031.Springer,Berlin,Heidelberg.pp.648-678;

[0010] [3]Todo Y.,Isobe T.,Hao Y.,Meier W.Cube Attacks on Non-BlackboxPolynomials Based on Division Property.In:Katz J.,Shacham H.(eds)Advances inCryptology–CRYPTO 2017.Lecture Notes in Computer Science,2017,vol10403.pp.250-279;

[0011] [4]Wang,S.,Hu,B.,Guan,J.,Zhang,K.,Shi,T.(2019).MILP-aided Method ofSearching Division Property Using Three Subsets and Applications[C].In:Galbraith,S.,Moriai,S.(eds)Advances in Cryptology–ASIACRYPT 2019.LectureNotes in Computer Science,2019,vol 11923.Springer,Cham.pp.398–427;

[0012] [5]Hao, Y., Leander, G., Meier, W., Todo, Y., Wang, Q. Modeling for three-subset division property without unknown subset [C]. In: Canteaut A., Ishai Y. (eds) Advances in Cryptology–EUROCRYPT 2020, Lecture Notes in Computer Science, 2020, vol 12105. Springer, Cham. pp. 466–495. Summary of the Invention

[0013] The present invention aims to provide a device and method for accurately recovering superpolynomials from the Atom algorithm. This method combines two-subset separability techniques with three-subset separability techniques to construct propagation models using the two-subset and three-subset separability techniques, respectively. Model variables are then set and solved. A superpolynomial algebraic property detection module is also constructed to accurately recover the superpolynomial. This method improves the efficiency of accurately recovering superpolynomials from the Atom algorithm, reduces time complexity, and significantly saves time.

[0014] The present invention provides a device for accurately recovering the super polynomial of the Atom algorithm, such as Figure 1 As shown, the device is divided into four modules, including a model variable setting module, an Atom cryptography algorithm two-subset separability propagation model construction module, an Atom cryptography algorithm three-subset separability propagation model construction module, and a super polynomial algebraic property detection module. The functions of each module are as follows:

[0015] (A) a model variable setting module, used to set variables corresponding to the Atom cryptographic algorithm, including key bits and public variable bits;

[0016] (B) The Atom cryptographic algorithm two-subset separability propagation model construction module splits the Atom algorithm operation into the basic operations of Copy, And, and Xor. Based on the propagation properties of the two-subset separability, the separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model M of the Atom algorithm round function. The separability propagation model M is then iterated r times to generate a new separability propagation model M. r ,This module is used to construct a two-subset separable mixed integer linear programming model based on the structure of the Atom algorithm;

[0017] (C) The Atom cryptographic algorithm three-subset separability propagation model construction module splits the Atom algorithm operation into the basic operations of Copy, And, and Xor. Based on the propagation properties of the three-subset separability, the separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model W of the Atom algorithm round function. The separability propagation model W is then iterated r times to generate a new separability propagation model W. r This module is used to construct a three-subset separable mixed integer linear programming model based on the structure of the Atom algorithm;

[0018] (D) a super polynomial algebraic property detection module, which includes a super polynomial-related key detection module, a super polynomial algebraic degree upper bound detection module, and a monomial detection module;

[0019] The key detection module involved in the super polynomial solves the key set involved based on the constructed two-subset separability propagation model; at the same time, when constructing the two-subset separability propagation model, the super polynomial algebraic degree upper bound detection module is added to obtain the highest algebraic degree of the super polynomial to calculate the time complexity and ensure that the key involved in the super polynomial corresponding to the selected cubic variable is meaningful; finally, the three-subset technology is used to construct the monomial detection module, and the algebraic degree upper bound and cubic variable set obtained using the two subsets are brought in to solve the model to accurately recover the super polynomial expression of the Atom cryptographic algorithm.

[0020] The present invention provides a method for accurately recovering an Atom algorithm super polynomial, which combines a two-subset separability technique with a three-subset separability technique and uses an Atom algorithm super polynomial device to obtain an expression of the super polynomial. The method comprises the following steps:

[0021] (1) Through the model variable setting module, define an empty MILP model M in the register, and then set the key variable Key of the Atom algorithm to {key0, key1, ..., key 127} and initial variables IV={iv0,iv1,…,iv 127}Declare the corresponding MILP model variables, k={k0,k1,…,k 127} and v={v0,v1,…,v 127}, add the MILP model variables to the model M;

[0022] (2) Based on the two-subset separability propagation model of the Atom cryptographic algorithm, a mixed integer linear programming model M of the two-subset separability propagation of the Atom algorithm in round r is constructed. According to the propagation property of separability, the Atom algorithm operation is split into the basic operations of Copy, And and Xor, and the two-subset separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model M of the Atom algorithm round function. Then, the separability propagation model M is iterated r times to generate a new separability propagation model M. r ;

[0023] (3) Through the three-subset separability propagation model of the Atom cryptographic algorithm, a mixed integer linear programming model W for the three-subset separability propagation of the Atom cryptographic algorithm in round r is constructed. r According to the three-subset separability propagation property, the Atom algorithm operation is split into the basic operations of Copy, And and Xor, and the three-subset separability propagation models of these basic operations are constructed respectively. The three-subset separability propagation model W of the Atom algorithm round function is obtained. Then, the separability propagation model W is iterated for r rounds to generate a new separability propagation model W. r ;

[0024] (4) The algebraic properties of the super polynomial are accurately detected by the super polynomial algebraic property detection module. The super polynomial involves a key detection module, a super polynomial algebraic degree upper bound detection module, and a monomial detection module. The detection steps include:

[0025] (4.1) The key detection module tests the key variables contained in the super polynomial. It randomly selects the subscript set of cubic variables and represents it with I. If the subscript i exists in the selected cubic variable set I, in the separability propagation model M r Add constraint v i = 1, when i does not exist in the selected cubic variable set I, in the separability propagation model M r Add constraint v i = 0 and add constraints to the model

[0026] Set the set J to be an empty set, define an output variable called res1, and add the output constraint res1→1. r Put it into the automated search tool Gurobi to solve the key involved in the super polynomial;

[0027] If the model M is detected r There is a feasible solution, and k i =1, then add the subscript i to the set J and add the restriction k i =0 to model M rRepeat this process until the model has no solution, and get the key variables involved in the super polynomial. The key variable subscript set involved in the super polynomial is J = {j0, j1, ..., j n-1}, n is an integer less than 128;

[0028] (4.2) Super polynomial algebraic degree upper bound detection module, solves the super polynomial algebraic degree upper bound, and obtains the new two-subset separability model M of the Atom algorithm based on the method in step (2). *r , select the same cubic variable set I as in step (4.1), when the subscript i exists in the selected cubic variable set I, in the separability propagation model M *r Add constraint v i = 1, when i does not exist in the selected cubic variable set I, in the separability propagation model M *r Add constraint v i =0, and set the objective function

[0029] Define another output variable called res2 and add the output constraint res2→1. Solve the model to obtain the upper bound d of the algebraic degree of the super polynomial.

[0030] (4.3) Monomial detection module, select the same cubic variables as in step (4.1), set restrictions on the model variables corresponding to the initial IV variables, if the subscript is in the cube set I, then the corresponding subscript variable is set to 1, and in the model W r Add relevant constraints v i =1(i∈I), the values ​​of the other variables corresponding to the model variables are set to 0, and in the model W r Add relevant constraints

[0031] Define another output variable as res3 and add the output constraint res3→1. Then define the super polynomial p=0 and convert the output obtained in steps (3) and (4) into the model W. r The constraints in W r To solve, the specific operations are as follows:

[0032] Adding Constraints To Model W r , for model W r Solve and get the subscript set corresponding to the variable with component 1 in k, called J', and check the trajectory The number of items, where the symbol Represents a 128-bit vector, and only the position whose subscript is included in the set I has a value of 1, and the other positions not included in the set I have a value of 0. If the number of entries is odd, it means that J'={J'0,J'1,…,J'|J'|-1 The monomials about the key with} as subscripts are contained in the super polynomials corresponding to the set of cube variables I, where |J'| is the number of elements in the set J';

[0033] Then add it to Otherwise, J'={J'0,J'1,…,J' |J'|-1} is a subscripted monomial about the key, which is not included in the super polynomial corresponding to the cube variable set I;

[0034] Then, set J' is set to the empty set and W r Adding constraints Used to exclude the current solution and continue to solve the model W according to the above process r Solve until the model W r There is no solution, and we get the expression p of the final super polynomial.

[0035] Furthermore, the key variable key is a 128-bit vector, the initial variable IV is a 128-bit vector, the cube set is a positive integer set, the number of rounds is a positive integer, and the size of the cube set cannot exceed the size of the Atom algorithm key vector.

[0036] Furthermore, the mixed integer linear programming model of the Atom algorithm is solved to obtain the relevant key bits and super polynomials involved in solving the super polynomial corresponding to the Atom algorithm, including placing the mixed integer linear programming model into an open source mixed integer linear programming solver, and running the mixed linear integer programming model based on the mixed integer linear programming solver to solve the relevant key bits and super polynomials that satisfy the Atom cryptographic algorithm.

[0037] The beneficial effects of the present invention are:

[0038] (1) The method of the present invention can solve the key involved in the super polynomial in the Atom algorithm and accurately recover the super polynomial of the Atom algorithm.

[0039] (2) The method of the present invention combines the two-subset technique with the three-subset technique, applying the information obtained from solving the two-subset separability propagation model as a constraint to the three-subset separability propagation model. This effectively improves the efficiency of solving the Atom superpolynomial and reduces the search space required for three-subset separability.

[0040] (3) The method of the present invention applies separability and MILP (mixed integer linear programming model) to the Atom analysis algorithm, which has a certain effect on the security of Atom analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1Schematic diagram of the device for accurately recovering the super polynomial of the Atom algorithm according to the present invention;

[0042] Figure 2 Flowchart of the separability propagation model of the Atom algorithm of the present invention (same for two subsets and three subsets);

[0043] Figure 3 A flow chart of the method for accurately solving super polynomials and designing keys in the method of the present invention;

[0044] Figure 4 This is a flow chart of a method for solving the upper bound of the algebraic degree of a super polynomial in the method of the present invention;

[0045] Figure 5 This is a flow chart of a method for outputting a super polynomial through a monomial detection module in the method of the present invention. DETAILED DESCRIPTION

[0046] The present invention will be further described below with reference to the accompanying drawings and embodiments, but the present invention is not limited thereto.

[0047] In the embodiment, under the hardware environment of Windows 11 operating system, Intel i9-12900 processor, 40GB DDR54800MHz memory, and LNVNB161216 motherboard, the software environment of Python 3.11 and Gurobi 11.0.0 academic version is used to construct a model variable setting module, an Atom cryptographic algorithm two-subset separability propagation model construction module, an Atom cryptographic algorithm three-subset separability propagation model construction module, and a super polynomial algebraic property detection module, which are set in sequence, such as Figure 1 shown.

[0048] Example

[0049] Reference Figure 2-5 A method for accurately recovering the super polynomial of the Atom algorithm is implemented using the constructed modules. The method includes the following steps:

[0050] (1) Through the model variable setting module, refer to Figure 2 , define an empty MILP model M in the register, for the internal structure of the Atom algorithm, it has 128 key bits Key = {key0, key1, ..., key 127} and 128 initial variable bits IV={iv0,iv1,…,iv 127}, declare the corresponding model variables for key and IV, respectively, denoted as k={k0,k1,…k 127} and v={v0,v1,…v 127}, and then add it to the model M as a model variable.

[0051] (2) Through the Atom algorithm two-subset separability propagation model, a mixed integer linear programming model M of the Atom algorithm r-round two-subset separability propagation is constructed, referring to Figure 2 According to the propagation property of separability, the Atom algorithm operation is split into basic operations such as Copy, And, and Xor. Two subsets of separability propagation models of these basic operations are constructed and added to the model M. The specific method is as follows:

[0052]

[0053]

[0054] Based on the structure of the Atom algorithm, the separability propagation model M of the Atom algorithm round function is obtained, and then the separability propagation model M is iterated r times to generate a new separability propagation model M r .

[0055] (3) Through the Atom algorithm three-subset separability propagation model, a mixed integer linear programming model W for the Atom cryptographic algorithm r round three-subset separability propagation is constructed. r , refer to Figure 2 , according to the propagation property of the three-subset separability, the Atom algorithm operation is split into basic operations such as Copy, And, and Xor. The separability propagation models of these basic operations are constructed respectively and added to W. The specific method is as follows:

[0056]

[0057] Based on the structure of the Atom algorithm, the separability propagation model W of the Atom algorithm round function is obtained, and then the separability propagation model W is iterated r times to generate a new separability propagation model W r .

[0058] (4) The algebraic properties of the super polynomial are accurately detected through the polynomial algebraic property detection module. The super polynomial involves a key detection module, a super polynomial algebraic degree upper bound detection module, and a monomial detection module. The detection steps are as follows:

[0059] (4.1) The key detection module involved in the super polynomial tests the key variables contained in the super polynomial, referring to Figure 3 , randomly select the subscript set of cubic variables and represent it with I, when the subscript i exists in the selected cubic variable set I, in the separability propagation model M r Add constraint v i= 1, when i does not exist in the selected cubic variable set I, when i does not exist in the selected cubic variable set I, add constraint v in the separability propagation model i = 0, and use Gurboi to add constraints M in the model r .addConstr(quicksum(k))==1;

[0060] Set the initial set J to be empty, define an output variable called res1, and add the output constraint res1→1, and propagate the separability model M r Put it into the automated search tool Gurobi and use the M r .optimize() function to solve the key involved in the super polynomial;

[0061] If the model M is detected r There is a feasible solution, and k i =1, use Gurobi's k[idx].Xn==1 to judge, add the subscript i to the set J, and then add the restriction k i =0 to model M r Repeat this process until the model has no solution, and get the key variables involved in the super polynomial. The key variable subscript set involved in the super polynomial is J = {j0, j1, ..., j n-1}, n is an integer less than 128;

[0062] (4.2) Super polynomial algebraic degree upper bound detection module, solve the super polynomial algebraic degree upper bound, refer to Figure 4 Based on the method in step (2), we get the new two-subset separability model M* of the Atom algorithm r , select the same cubic variable set I as in step (4.1), when the subscript i exists in the selected cubic variable set I, in the separability propagation model M *r Add constraint v i = 1, when i does not exist in the selected cubic variable set I, add constraint v in the separability propagation model i = 0, and use Gurobi to set M in the model *r Objective function:

[0063] M *r .setObjective(quicksum(k),GRB.MAXIMIZE);

[0064] Define another output variable called res2 and add the output constraint res2→1, and use Gurobi's M * r.optimize() function and M *r The .ObjVal() function solves the model and obtains the upper bound d of the algebraic degree of the super polynomial;

[0065] (4.3) Monomial detection module, refer to Figure 5 , select the same cubic variables as in step (4.1), set restrictions on the model variables corresponding to the initial IV variables, if the subscript is in the cube set I, then the corresponding subscript variable is set to 1, and in the model W r Add relevant constraints v i =1(i∈I), the values ​​of the other variables corresponding to the model variables are set to 0, and in the model W r Add relevant constraints

[0066] Define another output variable as res3 and add the output constraint res3→1. Then define the super polynomial p=0 and convert the output obtained in steps (3) and (4) into the model W. r The constraints in W r To solve, the specific operations are as follows:

[0067] Adding Constraints To Model W r , for model W r Solve and get the subscript set corresponding to the variable with component 1 in k, which is called J'. Use Gurobi's W r .SolCount() function checks the trajectory The number of items, where the symbol Represents a 128-bit vector, where only the positions whose subscripts are included in set I have a value of 1, and the rest of the positions not included in set I have a value of 0;

[0068] Define the variable Tempnum to store the number of tracks, and use Tempnum%2==1 to determine whether it is an odd number. If the number is odd, it means that J'={J'0, J'1, ..., J' |J'|-1 The monomials about the key with} as subscripts are contained in the super polynomials corresponding to the set of cube variables I, where |J'| is the number of elements in the set J';

[0069] Then add it to Otherwise, J'={J'0,J'1,…,J' |J'|-1} is a subscripted monomial about the key, which is not included in the super polynomial corresponding to the cube variable set I;

[0070] Then, set J' is set to the empty set and W r Adding constraints Used to exclude the current solution and use W in Gurobi r .optimize() function continues to optimize the model W r Solve until the model W r There is no solution, and we get the expression p of the final super polynomial.

[0071] The method of the present invention solves the mixed integer linear programming model of the Atom algorithm to obtain relevant key bits and super polynomials involved in solving the super polynomial corresponding to the Atom algorithm, including placing the mixed integer linear programming model into an open source mixed integer linear programming solver, and running the mixed linear integer programming model based on the mixed integer linear programming solver to solve the relevant key bits and super polynomials that satisfy the Atom cryptographic algorithm. The obtained results have a certain effect on security analysis of the Atom algorithm.

Claims

1. A device for accurately recovering super polynomials of the Atom algorithm, characterized in that: The device includes a model variable setting module, an Atom cryptographic algorithm two-subset separability propagation model construction module, an Atom cryptographic algorithm three-subset separability propagation model construction module, and a super polynomial algebraic property detection module, which are sequentially arranged. The functions of each module are: (A) a model variable setting module, used to set variables corresponding to the Atom cryptographic algorithm, including key bits and public variable bits; (B) The Atom cryptographic algorithm two-subset separability propagation model construction module splits the Atom algorithm operation into the basic operations of Copy, And, and Xor. Based on the propagation properties of the two-subset separability, the separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model M of the Atom algorithm round function. The separability propagation model M is then iterated r times to generate a new separability propagation model M. r ,This module is used to construct a two-subset separable mixed integer linear programming model based on the structure of the Atom algorithm; (C) The Atom cryptographic algorithm three-subset separability propagation model construction module splits the Atom algorithm operation into the basic operations of Copy, And, and Xor. Based on the propagation properties of the three-subset separability, the separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model W of the Atom algorithm round function. The separability propagation model W is then iterated r times to generate a new separability propagation model W. r This module is used to construct a three-subset separable mixed integer linear programming model based on the structure of the Atom algorithm; (D) a super polynomial algebraic property detection module, which includes a super polynomial-related key detection module, a super polynomial algebraic degree upper bound detection module, and a monomial detection module; The key detection module involved in the super polynomial solves the key set involved based on the constructed two-subset separability propagation model; at the same time, when constructing the two-subset separability propagation model, the super polynomial algebraic degree upper bound detection module is added to obtain the highest algebraic degree of the super polynomial to calculate the time complexity and ensure that the key involved in the super polynomial corresponding to the selected cubic variable is meaningful; finally, the three-subset technology is used to construct the monomial detection module, and the algebraic degree upper bound and cubic variable set obtained using the two subsets are brought in to solve the model to accurately recover the super polynomial expression of the Atom cryptographic algorithm.

2. A method for accurately recovering the super polynomial of the Atom algorithm, characterized in that: Using the apparatus of claim 1, the method comprises the steps of: (1) Through the model variable setting module, define an empty MILP model M in the register, and then set the key variable Key of the Atom algorithm to {key0, key1, ..., key 127 } and initial variables IV={iv0,iv1,…,iv 127 }Declare the corresponding MILP model variables, k={k0,k1,…,k 127 } and v={v0,v1,…,v 127 }, add the MILP model variables to the model M; (2) Based on the two-subset separability propagation model of the Atom cryptographic algorithm, a mixed integer linear programming model M of the two-subset separability propagation of the Atom algorithm in round r is constructed. According to the propagation property of separability, the Atom algorithm operation is split into the basic operations of Copy, And and Xor, and the two-subset separability propagation models of these basic operations are constructed respectively to obtain the separability propagation model M of the Atom algorithm round function. Then, the separability propagation model M is iterated r times to generate a new separability propagation model M. r ; (3) Through the three-subset separability propagation model of the Atom cryptographic algorithm, a mixed integer linear programming model W for the three-subset separability propagation of the Atom cryptographic algorithm in round r is constructed. r According to the three-subset separability propagation property, the Atom algorithm operation is split into the basic operations of Copy, And and Xor, and the three-subset separability propagation models of these basic operations are constructed respectively. The three-subset separability propagation model W of the Atom algorithm round function is obtained. Then, the separability propagation model W is iterated for r rounds to generate a new separability propagation model W. r ; (4) The algebraic properties of the super polynomial are accurately detected by the super polynomial algebraic property detection module. The super polynomial involves a key detection module, a super polynomial algebraic degree upper bound detection module, and a monomial detection module. The detection steps include: (4.1) The key detection module tests the key variables contained in the super polynomial. It randomly selects the subscript set of cubic variables and represents it with I. If the subscript i exists in the selected cubic variable set I, in the separability propagation model M r Add constraint v i = 1, when i does not exist in the selected cubic variable set I, in the separability propagation model M r Add constraint v i = 0 and add constraints to the model Set the set J to be an empty set, define an output variable called res1, and add the output constraint res1→1. r Put it into the automated search tool Gurobi to solve the key involved in the super polynomial; If the model M is detected r There is a feasible solution, and k i =1, then add the subscript i to the set J and add the restriction k i =0 to model M r Repeat this process until the model has no solution, and get the key variables involved in the super polynomial. The key variable subscript set involved in the super polynomial is J = {j0, j1, ..., j n-1 }, n is an integer less than 128; (4.2) Super polynomial algebraic degree upper bound detection module, solves the super polynomial algebraic degree upper bound, and obtains the new two-subset separability model M of the Atom algorithm based on the method in step (2). *r , select the same cubic variable set I as in step (4.1), when the subscript i exists in the selected cubic variable set I, in the separability propagation model M *r Add constraint v i = 1, when i does not exist in the selected cubic variable set I, in the separability propagation model M *r Add constraint v i =0, and set the objective function Define another output variable called res2 and add the output constraint res2→1. Solve the model to obtain the upper bound d of the algebraic degree of the super polynomial. (4.3) Monomial detection module, select the same cubic variables as in step (4.1), set restrictions on the model variables corresponding to the initial IV variables, if the subscript is in the cube set I, then the corresponding subscript variable is set to 1, and in the model W r Add relevant constraints v i =1(i∈I), the values ​​of the other variables corresponding to the model variables are set to 0, and in the model W r Add relevant constraints Define another output variable as res3 and add the output constraint res3→1. Then define the super polynomial p=0 and convert the output obtained in steps (3) and (4) into the model W. r The constraints in W r To solve, the specific operations are as follows: Adding Constraints To Model W r , for model W r Solve and get the subscript set corresponding to the variable with component 1 in k, called J', and check the trajectory The number of items, where the symbol Represents a 128-bit vector, and only the position whose subscript is included in the set I has a value of 1, and the other positions not included in the set I have a value of 0. If the number of entries is odd, it means that J'={J'0,J'1,…,J' |J'|-1 The monomials about the key with} as subscripts are contained in the super polynomials corresponding to the set of cube variables I, where |J'| is the number of elements in the set J'; Then add it to Otherwise, J'={J'0,J'1,…,J' |J'|-1 } is a subscripted monomial about the key, which is not included in the super polynomial corresponding to the cube variable set I; Then, set J' is set to the empty set and W r Adding constraints Used to exclude the current solution and continue to solve the model W according to the above process r Solve until the model W r There is no solution, and we get the expression p of the final super polynomial.

3. The method for accurately recovering the Atom algorithm super polynomial according to claim 2, wherein: The key variable key is a 128-bit vector, the initial variable IV is a 128-bit vector, the cube set is a positive integer set, the number of rounds is a positive integer, and the size of the cube set cannot exceed the size of the Atom algorithm key vector.

4. The method for accurately recovering the Atom algorithm super polynomial according to claim 2, wherein: The mixed integer linear programming model of the Atom algorithm is solved to obtain relevant key bits and super polynomials involved in solving the super polynomial corresponding to the Atom algorithm, including placing the mixed integer linear programming model into an open source mixed integer linear programming solver, and running the mixed linear integer programming model based on the mixed integer linear programming solver to solve the relevant key bits and super polynomials that satisfy the Atom cryptographic algorithm.

Images