SPECK integral discriminator search method and system based on modular plus perfect monomial prediction

Abstract

The invention provides an SPECK integral discriminator search method and system based on modular plus perfect monomial prediction, and the method comprises the steps: constructing a first model of monomial prediction of an SPECK algorithm, including: constructing a model according to the constraint of each component of the SPECK algorithm, constructing a model according to the single-round constraint of the SPECK algorithm, and constructing a model according to the constraint of different-round relationships of the SPECK algorithm; forming two optimization strategies based on the constructed model, including dividing long-round search into short-round search, and dividing search according to an intermediate state; and solving the two formed optimization strategies by using a solver, and outputting the number of monomial paths.

Description

Technical Field

[0001] The present invention belongs to the technical field of integral discriminator search, and in particular to a SPECK integral discriminator search method and system based on modular perfect monomial prediction. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Automated search tools play a crucial role in the analysis of many symmetric cryptographic algorithms today. Developing accurate and compact models is a fundamental task in this field. The separation property [Tod15, TM16] and its automated search model have been the main techniques for searching integral discriminators [DKR97, KW02, BBdS+20] for block ciphers, including the ARX cipher.

[0004] However, although dozens of papers have studied the security of the ARX cryptographic algorithm under the separation property [SWW17, HW19, WHG+19, DL22], most of them focus only on the bit-level two-subset separation property (2BDP) [TM16], which is an efficient but lossy version of the separation property. In this context, a lossy model refers to an inexact model that may miss some integral distinguishers.

[0005] For the ARX cipher, the exact version of the separation property, namely monomial prediction () [HSWW20], or the equivalent bit-wise three-subset separation property with no unknown subsets (3BDPwoU) [HLLT20,HLM+20], has received less attention.

[0006] In order to construct the 2BDP or MP model of the target cryptographic algorithm, it is necessary to describe the 2BDP path or MP path of all components of the cryptographic algorithm respectively. For function f: The 2BDP path propagation rule is: if the output A monomial of is an input monomial multiples of , then ( and is defined in the implementation examples).

[0007] On the other hand, for MP, if the input A monomial of In, then Studies have shown that the 2BDP model is a false-positive approximation of the MP model, that is, if an integral feature can be detected by 2BDP, then it can also be detected by MP; the reverse is not necessarily true [HSWW20].

[0008] Therefore, whenever it is possible to apply the MP model to a block cipher, the MP model should be used first. The difficulty in applying the MP model is that the number of feasible MP paths needs to be calculated. However, the modular addition operation in the ARX cipher is inherently complex. Therefore, it is generally believed that it is impossible (or at least very difficult) to calculate the exact number of MP paths for the ARX cipher.

[0009] Therefore, most papers on the separation characteristics of the ARX cryptographic algorithm focus only on 2BDP, such as [SWW17, BBdS+20, DL22], where the most technical part is to model the 2BDP propagation of the modular addition operation. For the modular addition operation, there are two main 2BDP models. The first model was proposed by Sun Ling et al. [SWW17, SWLW18]. The main idea is to decompose the modular addition operation into three basic operations, namely copy (COPY), AND (AND) and exclusive OR (XOR), and model these basic operations with their standard 2BDP propagation rules. This model is complex and heavy because they decompose the modular 2BDP propagation rules into three basic operations, namely copy (COPY), AND (AND) and exclusive OR (XOR). n The addition operation is decomposed into 2n-1 XOR operations, 3n-1 COPY operations, and 2n-1 AND operations, resulting in a search model containing 10n-4 linear constraints and 12n-19 intermediate variables.

[0010] The second method was proposed by Beierle et al. [BBdS+20]. This is a simpler model of modular addition operations that requires only two inequalities per bit. Consider two n-bit words The addition of Through the function , where Maj is the majority function, c i is the carry of the i-th digit, using (y i ,c i-1 )=f(a i ,b i ,c i ) is calculated. The 2BDP table of function f can be modeled with only two inequalities. However, since 2BDP is a lossy model, although the model is lighter, there is still a risk of missing some balanced bits.

[0011] To describe the MP propagation of modular addition operations, a simple transformation can be performed in the following way: in the first method, the 2BDP propagation of COPY, AND, and XOR is replaced by the corresponding MP propagation; in the second method, the 2BDP table is replaced by the MP table. In fact, the simple substitution of the first method has been applied in [HW19]. Propagation is actually the MP version of the first model and is used to search for the integral distinguisher of the Speck-32 algorithm. However, this simple transformation leads to an MP model with modular addition operations that contain redundant paths (i.e., it is not a compact model). This is because the COPY operation in this MP model introduces redundant paths. More importantly, although the propagation of MP paths has been modeled, the exact number of MP paths cannot be calculated due to the existence of a large number of redundant paths. Therefore, as a false positive approximation model of the MP model, the model in [HW19] is still a lossy model. Therefore, a perfect MP model is required for modular addition operations.

[0012] A perfect MP model of modular addition operations should satisfy two conditions. First, it should be efficient, i.e. Appear in If and only if Can be spread to Second, it should be compact, i.e. Appear in When there is only one path connecting and A perfect MP model would minimize the cost of computing the number of monomial paths.

[0013] MP (or 3BDPwoU) is not only an accurate tool for detecting separation properties, but also very useful for computing exact algebraic bounds or lower bounds for symmetric ciphers. In [HSWW20], MP was used to compute the exact algebraic degree of the Trivium algorithm up to 834 rounds. In [HLLT20], 3BDPwoU was used to give lower bounds for block ciphers such as Skinny-64[BJK+16], Present[BKL+07], Simon[BSS+15], etc. However, it is still difficult to compute the exact algebraic degree of the ARX cipher. For example, in [BBdS+20], the authors had to experimentally prove that there are some monomials of degree 32 in the output bits of Alzette.

[0014] Therefore, an important question is raised: Is it possible to design a perfect MP model for modular addition operations?

[0015] There are currently two 2BDP models: the first one decomposes the modular addition operation into three basic operations, which is complex and heavy; the second model is lighter, but there is a risk of missing the balance bit, that is, missing the integral distinguisher; subsequently, a simple transformation of model one was performed to describe the MP propagation of the modular addition operation, but the COPY operation introduced redundant paths and the exact number of MP paths could not be calculated. Summary of the invention

[0016] In order to overcome the above-mentioned deficiencies of the prior art, the present invention provides a SPECK integral discriminator search method based on modular perfect monomial prediction, and implements the SPECK integral discriminator search by using the constructed MP model.

[0017] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0018] In a first aspect, a SPECK integral discriminator search method based on modular perfect monomial prediction is disclosed, comprising:

[0019] Constructing a first model of monomial prediction of the SPECK algorithm, the first model being a MILP model or an SMT model, including: constructing a model according to the constraints of each component of the SPECK algorithm, constructing a model according to the constraints of a single round of the SPECK algorithm, and constructing a model according to the constraints of different rounds of the SPECK algorithm;

[0020] Based on the constructed model, two optimization strategies are formed, including: dividing the long round search into short round search and dividing the search according to the intermediate state;

[0021] The two optimization strategies formed are solved using the solver and the number of monomial paths is output.

[0022] As a further technical solution, when the first model is a MILP model, a solver is used to solve the model, and if there is a solution, the number of monomial paths and the solution time are output.

[0023] As a further technical solution, when the first model is an SMT model, a solver is used to solve the model. If there is a solution, the solution result is added as a constraint to the constructed model. If there is no solution, the number of monomial paths is output.

[0024] As a further technical solution, the cyclic shift used in the SPECK algorithm performs parameter selection.

[0025] As a further technical solution, when the first model is an SMT model, an SMT model of modular addition operation, the SMT tool has built-in support for the "+" operation, and given the input and output indices u, v and w, the SMT model can be directly constructed by modeling u+v=w;

[0026] Use STP as the SMT model solver, and its input language is CVC, so the module 2 n The MP constraints for the addition operation are:

[0027]

[0028] In this constraint, and are all n-bit vectors. Since the CVC language allows access to the i-th bit of a vector by index, there is no need to Convert to a bit variable.

[0029] As a further technical solution, when the first model is a MILP model, the MILP model of the modular addition operation: a bit-based MP model is provided for the modular addition operation based on auxiliary variables. The auxiliary variable is used to represent the exponent of the carry bit, and l is unique, so no redundant MP path is introduced and it is still perfect;

[0030] By using a greedy algorithm and efficient propagation, we obtain a set of constraints that represent the perfect MP model for modular addition operations:

[0031] u i +v i +l i+1 -w i -2l i =0,l0=l n =0.

[0032] In a second aspect, a SPECK integral discriminator search system based on modular perfect monomial prediction is disclosed, comprising:

[0033] The model building module is configured to: build a first model for monomial prediction of the SPECK algorithm, including: constructing a model according to the constraints of each component of the SPECK algorithm, constructing a model according to the constraints of a single round of the SPECK algorithm, and constructing a model according to the constraints of different rounds of the SPECK algorithm;

[0034] The optimization strategy module is configured to: form two optimization strategies based on the constructed model, including: dividing the long round search into short round search, and dividing the search according to the intermediate state;

[0035] The solution module is configured to: solve the two formed optimization strategies using a solver and output the number of monomial paths.

[0036] One or more of the above technical solutions have the following beneficial effects:

[0037] The technical solution of the present invention introduces an MP model for modular addition operations, and the proposed modular addition operation model is more accurate and simpler than all previous models. This model does not introduce any redundant modular addition operation MP paths, making it easier to calculate the number of paths. By using this model, the integral distinguisher found in [WHG+20] was rediscovered, and the search time was greatly reduced from hours / days to seconds / minutes. Through a standard that can indicate the complexity of super polynomials, more integral distinguishers suitable for Speck-48, Speck-64, Speck-96 and Speck-128 were discovered. For the first time, the exact algebraic degree of Speck-32 can be calculated. The selection of cyclic shift parameters used in Speck is also re-examined, and a method for selecting the best parameters is provided, thereby enhancing resistance to the integral distinguisher. Using the selected parameters, 6 rounds of Speck-32, -48 and -64 are sufficient to resist integral distinction attacks, one round less than the number of rounds used in the original cryptographic algorithm.

[0038] In [HLLT20, HLLT21], the authors provided the strongest guarantees against integral attacks. Using the model of this example, it is possible to provide similar security guarantees for the ARX cipher and, in addition, explore ways to speed up the number of computation paths in order to discover more integral distinguishers.

[0039] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0041] Figure 1 A schematic diagram showing bit-by-bit iteration of a modular addition operation according to an embodiment of the present invention;

[0042] Figure 2 This is a schematic diagram of the structure of the Speck cipher series according to an embodiment of the present invention;

[0043] Figure 3 This is a schematic diagram of the r-round search divided into four situations in an embodiment of the present invention;

[0044] Figure 4 This is a schematic diagram of a method flow in an embodiment of the present invention;

[0045] Figure 5 The figure is another flow chart of a method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0047] It should be noted that the terms used herein are for describing specific embodiments only and are not intended to be limiting of exemplary embodiments according to the present invention.

[0048] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0049] The modular addition operation is the only nonlinear component in the ARX cryptographic algorithm and the separation characteristic is the most effective tool for detecting the integral distinguisher. Currently, the commonly used separation characteristic models for the modular addition operation are:

[0050] (a) Representing the modular addition operation as a Boolean circuit and applying standard known encodings to the basic operations, namely COPY, XOR and AND; or

[0051] (b) Treat the modular addition operation as a series of smaller functions with a carry bit, and model these smaller functions one by one.

[0052] Currently, both models are proposed only for the bit-level two-subset separation property and are theoretically inexact. In other words, they may miss some balanced bits. Recently, exact versions of the separation property, i.e., the bit-level three-subset separation property or monomial prediction without unknown subsets, have been proposed. However, little attention has been paid to these exact models of modular addition operations.

[0053] In this implementation example, a perfect model for the monomial prediction of modular addition operation is proposed: make Respectively The index of is a valid monomial path propagation if and only if Here "+" is integer addition. Using this new model, we first improve the state-of-the-art integral distinguisher of all algorithms in the Speck family. Second, we prove for the first time the exact algebraic degree of the output bits of 7 rounds of Speck-32. Finally, we re-examine the choice of cyclic shift parameters in the Speck instance, and provide a selection criterion for enhancing the Speck algorithm's resistance to integral attacks.

[0054] A perfect model means that MP Propagation must be unique and without any redundant paths. It is best to model without any auxiliary variables, or to model with auxiliary variables that do not introduce any redundant MP paths. If such a model can be obtained, it is more likely to discover new integral distinguishers that could not be found by the previous lossy model, and calculate the exact algebraic number of the ARX cryptographic algorithm that was previously uncalculated.

[0055] According to the MP propagation rule [HSWW20], for f: If and only if Appear in In the polynomial of Therefore, if we want to design the MP propagation rules for modular addition operations, we need to study their algebraic properties. As early as FSE2005, Braeken and Semaev have studied the algebraic properties of modular addition operations. According to their theory, for If and only if When the MP propagation of its index is Note that the “+” here is addition over the ring of integers. Surprisingly, however, despite the fact that the separation property has been a popular key technology for nearly a decade, researchers in the separation property field have never paid attention to this theory. However, their proof [BS05] is somewhat complicated, so in this paper we provide a new and simpler proof based on the properties of MP. The proof also directly provides a perfect bit-by-bit model for the MP of modular addition operations.

[0056] Based on the MP propagation model, we first developed an SMT model with a built-in “+” operation. In this model, no auxiliary variables are needed at all. Considering that a MILP model is also required in many cases, we introduced a MILP model with auxiliary variables, but proved that these auxiliary variables do not introduce any redundant MP paths.

[0057] Based on a new propagation model for modular addition operations, new integral discriminators are discovered. For the Speck-32, -48, -64, and -96 algorithms, in [WHG+20], Wang et al. used a variant of 3BDP, in which a new propagation rule of "XOR with secret round key" was introduced to bypass the influence of the round key, and new integral discriminators that were previously undetectable by tools were discovered [SWW17, WHG+19, HW19]. By counting the number of paths, the method proposed in the present invention can easily re-identify these previously found integral discriminators. In addition, the time to detect these integral discriminators is reduced from hours or days to seconds or minutes. In addition, the technology of the present invention also found new integral discriminators for Speck-48, -64, -96, and -128, which is not feasible for the method of Wang et al.

[0058] In terms of algebraic power calculation, the method of the present invention proves that for 7 rounds of Speck-32, the exact algebraic power of all output bits is 31. This is the first time that the algebraic power of the ARX cryptographic algorithm can be theoretically calculated.

[0059] Finally, the choice of cyclic shift parameters used in the Speck family of algorithms is revisited. A criterion is proposed to indicate the complexity of the corresponding superpolynomial, and this criterion is used to search for good cyclic shift parameters that make Speck better resistant to integral attacks. The Speck-32, Speck-48, and Speck-64 variants equipped with new cyclic shift parameters can resist integral attacks using only 6 rounds (the original version requires 7 rounds), depending on checking all 2n-1 active modes of the plaintext. The method proposed in this invention has important reference value for the design of future ARX cryptographic algorithms.

[0060] Embodiment 1

[0061] See attached Figure 4 , 5 As shown, this embodiment discloses a SPECK integral discriminator search method based on modular perfect monomial prediction, including:

[0062] Constructing a first model of monomial prediction of the SPECK algorithm, including: constructing a model according to the constraints of each component of the SPECK algorithm, constructing a model according to the constraints of a single round of the SPECK algorithm, and constructing a model according to the constraints of different rounds of the SPECK algorithm;

[0063] Based on the constructed model, two optimization strategies are formed, including: dividing the long round search into short round search and dividing the search according to the intermediate state;

[0064] The two optimization strategies formed are solved using the solver and the number of monomial paths is output.

[0065] The three constraint construction models are: constructing a model based on the constraints of each component of the Speck algorithm refers to modeling each individual component of the Speck algorithm, such as COPY operation, modular addition operation, and XOR operation, because the propagation rules of monomial propagation through each component are different; constructing a model based on the single-round constraints of the Speck algorithm refers to splicing the components in each round, because the input of an operation may be the output of a certain operation; constructing a model based on the relationship constraints of different rounds of the Speck algorithm refers to splicing different rounds, because the output of the previous round is the input of the next round.

[0066] In this technical solution, each component in the wheel is first modeled, then the components are spliced ​​together, and then different wheels are spliced ​​together.

[0067] The innovation points of the technical solution of this embodiment lie in: the SMT model of modular addition operation, the MILP model of modular addition operation, and two optimization strategies for accelerating search; improving the existing integral distinguisher of Speck and providing a criterion for selecting better cyclic shift parameters.

[0068] The entire SMT model is used to determine the number of MP paths. Each solution found needs to be added as a constraint to the model and continue the search until there is no solution. Then the number of all solutions found before is the number of MP paths.

[0069] The above MILP model determines the number of MP paths by enabling the Gurobi option PoolSearchMode.

[0070] To better illustrate the technical solution of this application, the symbols, definitions, and background knowledge used in the technical solution of this embodiment are introduced first.

[0071] Based on the theory proposed nearly 20 years ago, a perfect MP propagation rule for modular addition operation is proposed, and an automated search model is established.

[0072] The models of this embodiment are respectively applied to Speck, and the selection of cyclic shift parameters of the Speck series algorithms is reexamined.

[0073] Symbols and definitions:

[0074] In this embodiment, represents the binary field, represents the space of bit vectors of length n, represents the integer ring. Exclusive OR (XOR), modular addition, and the addition on are represented by the symbols and + respectively, where the length of the operands should be determined according to the context. Bit vectors are represented by black italic lowercase letters. For example, where x i is the i-th index and x n-1 is the least significant bit (LSB). The Hamming weight of For two vectors and defines a partial order relation if and only if for all 0 ≤ i < n, there is x i ≤ y i .

[0075] Given x, is called with respect to To avoid using monomials like Such complex symbols will and Use them interchangeably. Let f: is a Boolean function whose algebraic normal form (ANF) is defined as

[0076]

[0077] in, if appears in the ANF of a Boolean function f, which we denote as Otherwise, record

[0078] Define f: is a vector Boolean function, where for The product of some indices in can be expressed as

[0079]

[0080] Integral attack, separation properties, and algebraic degrees:

[0081] The integral attack was first introduced in the analysis of the Square algorithm [DKR97] and is called the SQUARE attack. Later, Knudsen and Wagner formalized it as an integral attack in [KW02]. Parameterized n-bit block cipher algorithm, note If there is a vector and a plaintext set So that for any All satisfied Then E is said to have an integral property. In fact, for a random permutation, the probability that the sum is 0 is only 2 -n Later, at the EUMI 2015 conference, Fodo generalized the integral property to the separation property [Tod15]. The separation property is currently well understood through its most accurate version, the monomial prediction.

[0082] and Same, will is regarded as another input variable of E, that is, Then the block cipher algorithm can be regarded as a composite vector Boolean function. Assume is a Boolean function of r vectors The composite function composed of , where 0≤i≤r-1, is defined as

[0083]

[0084] use and Respectively represent the vector Boolean function f (i) The input and output of For x (i) The index of .

[0085] if So it is called sequence Yes Connect and About composite functions The r-round monomial path. If arrive There is at least one such monomial path, denoted by Otherwise, record

[0086] Will be from arrive The set of monomial paths of is called a monomial shell and is denoted by The purpose of the monomial forecast is to determine Is it true?

[0087] The following theorem shows how this relates to the number of monomial paths within a monomial shell.

[0088] Theorem 1 ([HSWW20]) The notation is defined as above. If and only if

[0089]

[0090] make and Obviously, if for any have Then for any All have the following integral properties: Therefore, the integral properties can be accurately detected by calculating the size of the monomial shell.

[0091] Algebraic Degree: Boolean Functions The algebraic degree of is defined as

[0092]

[0093] in, is a parameter. So if we prove that there exists a Monomial Then the lower bound of deg(f) is d. If we further prove that there is no such a condition in f Monomial Then deg(f)=d.

[0094] Automated search model for monomial prediction

[0095] According to The definition of a monomial path, is a valid communication if and only if Therefore, when When the scale is not too large, a two-dimensional monomial prediction (MP) table can be constructed, which is defined as follows: for all and

[0096]

[0097] when When is a valid path, otherwise it is an invalid path. Since COPY, AND, and XOR are all small-scale vector Boolean functions, their MP tables are easy to construct.

[0098] To use an automated search tool to trace the propagation of monomial paths, you need to generate an empty model, declare a set of variables, and add constraints to those variables to force them to represent any valid path. The details of this process vary depending on the tool you use.

[0099] See attached Figure 4 , 5 As shown in Figure 1, this example uses MILP or SMT models to search for monomial paths. For MILP, the popular Gurobi solver is used, while for SMT, the STP solver is used. Since any Boolean function can be decomposed into three basic operations: COPY, AND, and XOR, MILP and SMT constraints are introduced for these operations.

[0100] COPY: For the COPY operation, the input and output MP variables, i.e., the exponents of the monomials, are u and (v0, v1) respectively. The exponents of the monomials, specifically in the Speck cipher algorithm, refer to the exponents of the input and output monomials of the COPY operation in the Speck cipher algorithm; the COPY operation is a branch-to-two operation, and the valid paths of the COPY operation are (0)→(0,0), (1)→(0,1), (1)→(1,0), and (1)→(1,1). Then, the MILP model (inequality) of the COPY operation is

[0101] u≥v0,u≥v1,u≤v0+v1.

[0102] On the other hand, the SMT model (using CVC language) is

[0103] ASSERT(u=v0|v1);

[0104] AND: For the AND operation, the input and output MP variables, i.e. the exponents of the monomials, are (u0,u1) and (v), respectively. The valid paths of the AND operation are (0,0)→(0) and (1,1)→(1). Then, the MILP model (inequality) of the AND operation is

[0105] u0=v,u1=v.

[0106] Furthermore, the SMT model (using CVC language) is

[0107] ASSERT(u0=v); ASSERT(u1=v);

[0108] XOR: For the XOR operation, the input and output MP variables, i.e. the exponents of the monomials, are (y0,u1) and (v), respectively. The valid paths of the XOR operation are (0,0)→(0), (1,0)→(1), and (0,1)→(1). Then, the MILP model (inequality) of the XOR operation is

[0109] u0+u1=v.

[0110] Furthermore, the SMT model (using CVC language) is

[0111] ASSERT(v=u0|u1); ASSERT(~u0|~u1|~v=0bin1);

[0112] Next, a perfect search model for modular addition operations is introduced, including the SMT model of modular addition operations and the MILP model of modular addition operations. Through this model, monomial prediction is applied to the Speck algorithm to search for integral distinguishers or calculate exact algebraic degrees.

[0113] Monomial prediction for modular addition operations:

[0114] Modular addition is the core operation of the ARX cipher. A well-written model for MP propagation of modular addition is presented. The model is directly based on a theory proposed in [BS05] which is almost 20 years old but has never been used in cryptanalysis of the monomial prediction / separation properties of the ARX cipher. Considering that the original proof is quite complex, a new and simpler proof based on the basic properties of MP is provided. This demonstrates the potential of MP in proving complex mathematical theorems. Its SMT model is constructed without the need for any auxiliary variables. A bit-based MILP model is also proposed which includes auxiliary variables and it is shown that these auxiliary variables do not introduce any redundant MP paths.

[0115] Monomial prediction for modular addition operations:

[0116] In order to construct the MP model of modular addition operations, one needs to understand its algebraic structure. As early as 2003, Braeken and Semaev have proved the following theorem [BS05, Theorem 2], but surprisingly, it has not been noticed by researchers in the field of separation properties until now.

[0117] Theorem 2: For in If and only if

[0118] According to Theorem 2, a monomial Appear in If and only if where "+" represents integer addition. This can be directly used for MP of modular addition operation. However, the original proof in [BS05] is found to be quite complicated because they first prove two recursive complex formulas by mathematical induction (see Lemmas 1 & 2 in [BS05]). Theorem 2 is then proved by these two formulas. Therefore, this application proposes a new and simpler proof method based directly on the MP property to prove Theorem 2. The proof also proposes a compact bit-based MP model of modular addition operation.

[0119] prove: It can be represented as an iterative computation of a series of bitwise operations:

[0120]

[0121] Where 0≤i <n, Indicates carry variable and c n = 0. This can be expressed by the successive application of the function S in the following form:

[0122]

[0123] The bit - by - bit iterative representation of the modular addition operation, as Figure 1 shown.

[0124] ( ): The modular addition operation consists of S. According to Theorem 1, means that there are an odd number of monomial paths connecting and Now, let represent 's exponent. This means that there are an odd number of monomials on S that satisfy Table 1 is the monomial prediction table of the function S. It can be seen that when (u i , v i , l i+1 ) is determined, (w i , l i ) will also be uniquely determined. Since l0 and l n are not the real inputs and outputs of the modular addition operation, so l0 and l n are set to 0. Therefore, when given and , all l i , 1 ≤ i < n will be determined. So, there is only a unique l such that for all i, holds on S. In addition, since w i and l i are uniquely determined by (u i , v i , l i+1 ), their ANF expressions can be written according to Table 1:

[0125]

[0126] Considering l0 = 0 and l n = 0, Equation (2) is just the bit - by - bit representation of .

[0127] Table 1: Monomial prediction table of S: (x i , y i , c i+1 ) → (z i , c i )

[0128]

[0129] ( ): Given and such that Let represent 's carry

[0130] Bit. and is fixed, which means It must be unique. It can be found that l0=l n = 0, it can be rewritten as equation (2). Therefore, there is only one monomial path such that Therefore, there is

[0131] When the first model is an SMT model, it is an SMT model of modular addition operation. The SMT tool has built-in support for the "+" operation, so the SMT model of modular addition operation MP is easy to build. Given the input and output indices u, v and w, the SMT model can be directly constructed by modeling u+v=w. This example uses STP as the SMT model solver, and its input language can be CVC, so modular 2 n The MP constraints for the addition operation are:

[0132]

[0133] In this constraint, and are all n-bit vectors. For other operations in the ARX cipher, such as XOR and COPY, the propagation rules are usually bit-by-bit. Since the CVC language allows access to the i-th bit of a vector by index, such as u[i], there is no need to Convert to a bit variable.

[0134] When the first model is a MILP model, a MILP model of modular addition operation: MILP is another commonly used MP search tool. The famous MILP solver Gurobi supports integer variables. However, as mentioned above, the propagation rules of the remaining operations of the ARX cryptographic algorithm are still bit operations, and Gurobi does not allow flexible access to the i-th bit of an integer, so integer variables are not convenient.

[0135] Therefore, a bit-based MP model is provided for the modular addition operation based on auxiliary variables. The auxiliary variables are just The exponent used to represent the carry bit. According to our proof, l is unique, so it does not introduce redundant MP paths and is still perfect.

[0136] By using the greedy algorithm in the SAGE Computer Algebra System [Joy09], [SHW+15] and the efficient propagation in Table 1, we obtain a set of constraints that represent the perfect MP model of modular addition operations:

[0137] u i +v i +li+1 -w i -2l i =0,l0=l n =0.

[0138] Applied to the Speck family of algorithms:

[0139] In this implementation example, the perfect MP model is applied to the Speck family of algorithms, and a new integral distinguisher that could not be found by any previous tool is found. For Speck-32, it is also proved that all possible terms with algebraic degree of 31 will appear in every bit of the 7-round output.

[0140] The experiments were conducted on an Intel(R) Xeon(R) Gold6338N CPU@2.20GHz Linux platform equipped with 128 processors and 2TB of memory.

[0141] Detailed description of Speck's algorithm and existing results:

[0142] Speck[BSS+15] is a lightweight block cipher family released by the National Security Agency (NSA) of the United States. It uses the ARX structure, in which the modular addition operation is used as a nonlinear operation. Depending on the block size, the Speck cipher family can be represented as Speck-2n, where n∈{16,24,32,48,64}. The round function structure of Speck is as follows: Figure 2 As shown, and are the input and output of the i-th round function, respectively. is the round key of round i, S -α Indicates a circular right shift of α bits, S β represents a circular left shift of β bits. The parameters α and β are 8 and 3 respectively, but in Speck-32, they are 7 and 2 respectively.

[0143] In [SWLW18], Sun Ling et al. applied their two-subset separation property model to all block ciphers in the Speck family and obtained a 6-round integral distinguisher for each block cipher. For Speck-32, the data complexity is 2 31 , the data complexity of Speck-48 is 2 45 , the data complexity of Speck-64 is 2 61 , the data complexity of Speck-96 is 2 93 , the data complexity of Speck-128 is 2 125 In [HW19], Hu et al. used a variant of the three-subset separation property to detect a new 6-round integral discriminator for Speck-32 with a data complexity of 231 In [WHG+20], Wang et al. introduced a new separation feature model based on a special treatment of key-xor operations and found more integral discriminators for Speck-32, -48, -64, and -96 than [HW19, SWW17]. In this work, we show that our model can detect more integral discriminators than all previous tools.

[0144] Search for new integral differentiators for the Speck family:

[0145] Since the model of the present application is an accurate MP model of modular addition operation, the entire MP model is directly established for Speck-2n, and all MP paths are attempted to be calculated. Since the modular addition operation of the ARX cipher is relatively complex, it seems quite difficult to enumerate all MP paths. However, thanks to the compactness of the model of the present application, all paths under specific input and output conditions can be enumerated through some optimized search strategies.

[0146] MILP model: Enable Gurobi option PoolSearchMode; SMT model writes the current solution into the model as a constraint after searching for a solution until there is no solution. The number of solutions before the number is the number of MP paths at this time.

[0147] Establish the MP propagation model, i.e., the MILP model of modular addition operation: In order to model the propagation of exponentials, some n-bit auxiliary variables are introduced for the intermediate states of Speck-2n, such as Figure 2 A, B, C, D, E, F, G, H, I in R, and connect all these variables in a standard way using the introduced propagation rules. R It can be described as follows:

[0148]

[0149] For r rounds of Speck-2n, it is assumed that the r n-bit round keys are independent of each other, that is, the influence of the key generation algorithm is not considered. This is a common simplification method to make the search process simpler. For example, [WHG+20, HLLT20] also adopts the same assumption.

[0150] The three constraint construction models are: constructing a model based on the constraints of each component of the Speck algorithm refers to modeling each individual component of the Speck algorithm, such as COPY operation, modular addition operation, and XOR operation, because the propagation rules of monomial propagation through each component are different; constructing a model based on the single-round constraints of the Speck algorithm refers to splicing the components in each round, because the input of an operation may be the output of a certain operation; constructing a model based on the relationship constraints of different rounds of the Speck algorithm refers to splicing different rounds, because the output of the previous round is the input of the next round.

[0151] Table 2: Integral discriminators of the Speck cipher family. The results of [SWW17], [HW19], and [WHG+20] are respectively Marked by a diamond The results are detected by the method in this example. Time1 is the time reported in [WHG+20], and Time2 is the time it takes for the method in this example to find these distinguishers.

[0152] Table 2: Integral Differentiators for the Speck Cipher Family

[0153]

[0154] The super polynomials of p0, p1, p2 and p3 are as follows:

[0155]

[0156]

[0157]

[0158]

[0159] In [WHG+20], the authors applied their model to 6 rounds of Speck-32, -48, -64 and -96, discovering more integral discriminators than previous tools. Each newly discovered integral discriminator for each Speck instance is associated with a 1-bit key. The authors of [WHG+20] managed to find these discriminators by introducing a new propagation rule for the key bits. From the MP point of view, the superpolynomial associated with this key bit is likely to be very simple. This application first uses the same input-output exponentiation as [WHG+20] and adds an objective function to M6, where is the input and output index that causes [WHG+20] to detect the integral differentiator (these and The objective function is set to maximize The maximum value of can represent how many bits of key the super polynomial involves. For convenience, the optimization problem is stated as follows:

[0160]

[0161] Optimizing the Model * 1. Standard: Let Model * 1 means Model 1 with the Gurobi option PoolSearchMode enabled. However, using Model * 1 It may take a lot of time to calculate the number of monomial paths. In order to speed up the search, two optimization strategies based on the divide-and-conquer idea are adopted in the search.

[0162] The first strategy considers the MP property of modular addition operations. It is the exponent of a modular addition operation with two inputs and one output.

[0163] According to Theorem 2, if So It must be {(0,0,...,0,0),(0,0,...,0,1)} or {(0,0,...,0,1),(0,0,...,0,0)}; if It must be {(0,0,...,0,0),(0,0,...,0,0)}. Therefore, Figure 3 As shown, the search of Speck-2n in rounds r can be divided into four cases, including one (r-1) round search and three (r-2) round search. The number of monomial paths in Speck-2n in round r is the sum of the number of all paths in these four cases.

[0164] The second optimization strategy is to partition the search according to intermediate states, which is similar to the approach used in [HLM+20].

[0165] First, extract all possible solutions of the intermediate state after the second round, expressed as:

[0166]

[0167] in, and They represent plaintext, ciphertext and the intermediate state after the second round respectively.

[0168] Then, for each value of S2, calculate and The number of solutions. The number of all solutions can be obtained by calculation.

[0169]

[0170] Through these two optimization strategies, the search speed is significantly improved.

[0171] Retesting the integral discriminator in [WHG+20]: For Speck-32, -48, -64, -96 with R=6 and the corresponding input and output indices, the results of Model 1 show that The maximum value of is only 1. This means that the super polynomial contains only one key variable. Then Model1 (hereinafter referred to as Model * 1) Enable PoolSearchMode in Gurobi options to count the number of monomial paths. The number of paths is shown in Table 2. For each key monomial that appears in the path, the corresponding number of paths is an even number.

[0172] Therefore, according to Theorem 1, the same integral discriminator as in [WHG+20] can be easily re-detected by counting the number of paths.

[0173] Search for new integral discriminators for all Speck instances. Inspired by the above observation, given a pair of input and output exponents and Down, The maximum value (i.e. at a fixed and Lower R wheel Speck-2n ) does reflect the complexity of the corresponding superpolynomial. When is relatively small, the superpolynomial is usually simple, so it is possible to recover it by enumerating all monomial paths. If the number of monomial paths is even for all key monomials, then an integral distinguisher can be obtained. For large values ​​of , the number of expected monomial paths may be too large for the solver to count in a reasonable time.

[0174] Since all integral distinguishers found in [WHG+20] have 2n-2 (for Speck-32) or 2n-3 (for other Speck instances) active bits in the plaintext and a balanced ciphertext bit at the rightmost end of the left branch, we use Model 1 to iterate over all possible Hamming weights of 2n-2 (for Speck-32) or 2n-3 (for other Speck instances). Test with en-1 For Speck-32, -48, and -64, try all For Speck-96 and -128, try all In these cases, the corresponding superpolynomials are expected to be simple, so the monomial paths can be counted. The experimental results are consistent with our expectations. * 1 is applied to all the above cases, many cases can get integral discriminators. Based on the model proposed in this application, new integral discriminators are found, see Table 2 for details. Although some are not integral discriminators, their super polynomials are indeed very simple, so their super polynomials are listed below the table.

[0175] Compute a lower bound on the Speck-32 algebraic degree:

[0176] In [HLLT20], Hebborn et al. proposed a method for determining lower bounds on the algebraic power of the output bits of a block cipher and applied it to the S-box based block ciphers Gift-64, Skinny-64, AES, and Present. Their method has not been used for the ARX cipher until now. Using our perfect model of modular addition operations, the method is applied to Speck-32 and exact lower bounds are determined for all output bits. Furthermore, it is shown that all 31-degree terms of the plaintext do appear in all output bits.

[0177] The idea in [HLLT20] is to assume that all round keys are independent and find a suitable monomial, record Satisfy

[0178]

[0179] The method proposed in [HLLT20] for finding the key monomial is a heuristic method. Represents the intermediate state The index (where and represent plaintext and ciphertext respectively). First, they look for a pair of suitable and Make their Hamming weight as high as possible and satisfy

[0180]

[0181] Then, they iteratively search for a pair and Make their Hamming weight as high as possible and satisfy

[0182]

[0183] Then, they repeat this process until R mid , thus obtaining and Finally, calculate (t(0) ,…,t (mid-1) ) to satisfy equation (3).

[0184] Since there is already an integral distinguisher for 6-round Speck-32, the same idea is applied to 7-round Speck-32. For each output bit and each monomial of degree 31 in the plaintext, find a monomial of the round key such that the number of monomial paths connecting the plaintext and ciphertext monomials is odd. Therefore, for each ciphertext bit, all terms of degree 31 do appear in its polynomial.

[0185] Remark: In [HLLT20], it is further proved that for all linear combinations of ciphertext bits, there is no linear combination of (2n-1) (the block size of Speck-2n is 2n) plaintext bits. To achieve this goal, it is necessary to calculate the number of paths between all plaintext and ciphertext monomials corresponding to each key monomial and construct a full-rank matrix accordingly. After completing the above work, the authors provide a strong and tight security bound for block cipher algorithms in [HLLT21] based on certain whitening key assumptions. In this experiment, although the key monomial for each 31-order plaintext monomial and ciphertext bit is found, it is not possible to prove that the corresponding matrix has the full-rank property. This is because for some plaintext and ciphertext monomials, the number of solutions is too large to complete the search. The method is also applied to Speck-48. Unfortunately, for the search model, even the first step, that is, proving that all 47-order plaintext monomials appear in the ciphertext bits, cannot be completed due to the large solution space. This is not surprising, since the complexity of the modular addition operation is much higher than that of the S-box.

[0186] About the Speck series circular shift parameters:

[0187] The Speck family (and Simon family) of cryptographic algorithms were designed by the NSA and have been criticized for not providing design rationale [BSS+15]. In response to these criticisms and to support the ISO / IEC standardization attempts for Speck (and Simon), the designers provided design rationale for Speck (and Simon) [BSS+17]. However, the confusion over the various parameter choices in the Speck algorithm left a deep impression on the academic community and sparked a great deal of controversy [AL21].

[0188] Although differential and linear attacks are generally considered to be the two main threats to the Speck algorithm, and integral attacks are not, it is still very important to have a deep understanding of how parameters (especially the cyclic shift constant) affect the security of Speck against integral differentiators. In fact, integral attacks help to check whether a cryptographic algorithm has certain algebraic vulnerabilities.

[0189] In this implementation example, a heuristic method is presented to test the strength of Speck instances with cyclic shift constant pairs (α, β) against integral distinguishing attacks. Many (α, β) pairs are successfully found that make Speck instances resistant to integral distinguishers for 6 rounds or more (depending on checking all 2n-1 active bits of the plaintext).

[0190] For convenience, the Speck instance with a group size of 2n and a cyclic shift constant pair (α, β) is denoted as Speck α,β -2n. It can be used as a criterion for predicting the complexity of the corresponding superpolynomial. When is larger, the superpolynomial is more likely to be non-zero. This indicates that finding an integral discriminator is unlikely, or at least, computing all paths is extremely challenging, making it infeasible to identify the integral discriminator within limited resources.,Both cases show that the corresponding output bits of the test consist of complex superpolynomials,,indicating its strong algebraic properties.

[0191] Therefore, the method to check different (α, β) pairs is simple. First, traverse the space of (α, β) combinations and try all possible cases where the number of active bits in the plaintext is 2n-1. Finally, calculate the (n-1)th ciphertext bit. Because this bit is the weakest. Considering that Speck is designed as a lightweight cipher, α≤8 and β≤8 will make it more efficient on low-end 8-bit processors, so restrictions are set on α and β, that is, 1≤α≤8 and 1≤β≤8, and α≠β. In Table 6, 10 pairs of (α, β) parameters of Speck-32, -48, -64, -96 and -128 are listed and their The smallest (i.e., for each with 2n-1 active bits Calculate the of The values ​​in Table 6 are all of minimum value of ).

[0192] To prove that the (α,β) parameters do enhance Speck’s ability to resist the integral distinguisher, we find that all 31 monomials are15,14 -32 appears in all output bits. Note that for the original Speck-32, i.e., Speack 7,2 -32, and it takes 7 rounds to reach this property. It is also found that all 47th and 63rd monomials appear in 6 rounds of Speck 23,22 -48 and Speck 31,30 -64 in each output bit. That is, with these constraints, it is easier to prove that Speack is more resistant to the integral distinguisher with fewer rounds.

[0193] Table 6: The smallest first 10 pairs (α, β)

[0194]

[0195] Related literature:

[0196] AL21. Tomer Ashur and Atul Luykx. An account of the ISO / IEC standardization of the simon and speck block cipher families. In Gildas Avoine and Julio Hernandez-Castro, editors, Security of Ubiquitous Computing Systems, pages 63–78. Springer International Publishing, 2021.

[0197] BBdS+19.Christof Beierle,Alex Biryukov,Luan Cardoso dos Santos,Johann Léo Perrin, Aleksei Udovenko, Vesselin Velichkov, Qingju Wang, and Alex Biryukov. Schwaemm and esch: lightweight authenticated encryption and hashing using the sparkle permutation family. NIST round, 2, 2019.

[0198] BBdS+20.Christoph Beierle,Alex Biryukov,Luan Cardoso dos Santos,Johann Leo Perrin,Alexei Udovenko,Vesselin Velichkov,and QingjuWang.Alzette:A 64-Bit Arx-Box-(feat.CRAX and TRAX).In Daniele Micciancio andThomas Ristenpart, editors,Advances in Cryptology-CRYPTO 2020-40th AnnualInternational Cryptology Conference,CRYPTO 2020,Santa Barbara,CA,USA,August17-21,2020,Proceedings,Part III,volume 12172of Lecture Notes in ComputerScience,pages 419–448.Springer,2

[0199] BJK+16.Christoph Beierle,Jeremy Jean,Stephen Gregor Leander, Amir Moradi, Thomas Peyrin, Yu Sasaki, Pascal Sasdrich, and Siang Meng Sim.The SKINNYFamily of Block Ciphers and Its Low-Latency Variant MANTIS ofLNCS,pages123–153.Springer,2016.

[0200] BKL+07.Andrey Bogdanov,Lars R.Knudsen,Gregor Leander,Christof Paar,AxelPoschmann,Matthew J.B.Robshaw,Yannick Seurin,and C.Vikkelsoe.PRESENT:anultra-lightweight block cipher.In Pascal Paillier and Ingrid Verbauwhede,editors,Cryptographic Hardware and Embedded Systems-CHES 2007,9thInternational Workshop,Vienna,Austria,September 10-13,2007,Proceedings,volume4727 of Lecture Notes inComputer Science,pages 450–466.Springer,2007.

[0201] BS05.An Braeken and Igor A.Semaev.The ANF of the composition ofaddition andmultiplication mod 2n with a boolean function.In Henri Gilbertand Helena Handschuh,editors,Fast Software Encryption:12th InternationalWorkshop,FSE 2005,Paris,France,February 21-23,2005,Revised Selected Papers,volume 3557 of Lecture Notes in ComputerScience,pages 112–125.Springer,2005.

[0202] BSS+15.Ray Beaulieu,Douglas Shors,Jason Smith,Stefan Treatman-Clark,BryanWeeks,and Louis Wingers.The SIMON and SPECK lightweight blockciphers.InProceedings ofthe 52nd Annual Design Automation Conference,

[0203] San Francisco,CA,USA,June 7-11,2015,pages 175:1–175:6.ACM,2015.

[0204] BSS+17.Ray Beaulieu,Douglas Shors,Jason Smith,Stefan Treatman-Clark,BryanWeeks,and Louis Wingers.Notes on the design and analysis of SIMON andSPECK.IACRCryptol.ePrint Arch.,page 560,2017.

[0205] DKR97.Joan Daemen,Lars R.Knudsen,and Vincent Rijmen.The Block CipherSquare.In Eli Biham,editor,Fast Software Encryption-FSE’97,volume 1267 ofLNCS,pages149–165.Springer,1997.

[0206] DL22.Patrick Derbez and Baptiste Lambin.Fast MILP models for divisionproperty.IACR Trans.Symmetric Cryptol.,2022(2):289–321,2022.

[0207] HLK+13.Deukjo Hong,Jung-Keun Lee,Dong-Chan Kim,Daesung Kwon,KwonHoRyu,and Donggeon Lee.LEA:A 128-bit block cipher for fast encryption oncommonprocessors.In Yongdae Kim,Heejo Lee,and Adrian Perrig,editors,Information SecurityApplications-14th International Workshop,WISA 2013,JejuIsland,Korea,August 19-21,2013,Revised Selected Papers,volume 8267 of LectureNotes in Computer Science,pages3–27.Springer,2013.

[0208] HLLT20.Phil Hebborn,Baptiste Lambin,Gregor Leander,and YosukeTodo.LowerBounds on the Degree of Block Ciphers.In Shiho Moriai and HuaxiongWang,editors,Advances in Cryptology-ASIACRYPT 2020,volume 12491of LNCS,pages537–566.Springer,2020.

[0209] HLLT21.Phil Hebborn,Baptiste Lambin,Gregor Leander,and YosukeTodo.Strongand tight security guarantees against integral distinguishers.InMehdi Tibouchi and HuaxiongWang,editors,Advances in Cryptology-ASIACRYPT2021-27th International Conferenceon the Theory and Application ofCryptologyand Information Security,Singapore,December6-10,2021,Proceedings,Part I,volume 13090 of Lecture Notes in ComputerScience,pages362–391.Springer,2021.

[0210] HLM+20.Yonglin Hao,Gregor Leander,Willi Meier,Yosuke Todo,and QingjuWang.Modeling for three-subset division property without unknown subset-improved cube attacksagainst trivium and grain-128aead.In Anne Canteaut andYuval Ishai,editors,Advances inCryptology–EUROCRYPT 2020-39th AnnualInternational Conference on the Theory andApplications ofCryptographicTechniques,Zagreb,Croatia,May 10-14,2020,

[0211] Proceedings,Part I,volume 12105 of Lecture Notes in Computer Science,pages466–495.Springer,2020.

[0212] HSH+06.Deukjo Hong,Jaechul Sung,Seokhie Hong,Jongin Lim,Sangjin Lee,Bonseok Koo,Changhoon Lee,Donghoon Chang,Jesang Lee,Kitae Jeong,Hyun Kim,Jongsung Kim,and Seongtaek Chee.HIGHT:A new block

[0213] cipher suitable for low-resource device.In Louis Goubin and MitsuruMatsui,editors,Cryptographic Hardware and Embedded Systems-CHES 2006,8thInternational Workshop,Yokohama,Japan,October 10-13,2006,Proceedings,volume4249 of Lecture Notes inComputer Science,pages 46–59.Springer,2006.

[0214] HSWW20.Kai Hu,Siwei Sun,Meiqin Wang,and Qingju Wang.AnAlgebraicFormulation of the Division Property:Revisiting Degree Evaluations,Cube attacks,andkey-independent sums.In Shiho Moriai and Huaxiong Wang,editors,Advances in Cryptology-ASIACRYPT 2020,volume 12491 ofLNCS,pages 446–476.Springer,2020.

[0215] HW19.Kai Hu and Meiqin Wang.Automatic search for a variant ofdivision propertyusing three subsets.In Mitsuru Matsui,editor,Topics inCryptology-CT-RSA 2019-TheCryptographers’Track at the RSA Conference 2019,SanFrancisco,CA,USA,March 4-8,2019,Proceedings,volume 11405 of Lecture Notes inComputer Science,pages 412–432.Springer,2019.

[0216] Joy09.David Joyner.AMS special session on SAGE and mathematicalresearch usingopen source software.ACM Commun.Comput.Algebra,43(1 / 2):49–54,2009.

[0217] KP20.James Kestyn and Eric Polizzi.From fundamental first-principlecalculations toNanoEngineering applications:Review ofthe NESSIEproject.February 2020.

[0218] KW02.Lars R.Knudsen and David A.Wagner.Integral Cryptanalysis.In JoanDaemenand Vincent Rijmen,editors,Fast Software Encryption–FSE 2002,volume2365 of LNCS,pages 112–127.Springer,2002.

[0219] SHW+15.Siwei Sun,Lei Hu,Meiqin Wang,Pengpian Wang,Kexin Qiao,XiaoshuangMa,Danping Shi,Ling Song,and Kai Fu.Towards finding the bestcharacteristics of somebit-oriented block ciphers and automatic enumerationof(related-key)differential and linearcharacteristics with predefinedproperties.2015.

[0220] SWLW18.Ling Sun,Wei Wang,Ru Liu,and Meiqin Wang.Milp-aided bit-baseddivision property for ARX ciphers.Sci.China Inf.Sci.,61(11):118102:1–118102:3,2018.

[0221] SWW17.Ling Sun,Wei Wang,and Meiqin Wang.Automatic search of bit-baseddivision property for ARX ciphers and word-based division property.InTsuyoshi Takagi andThomas Peyrin,editors,Advances in Cryptology-ASIACRYPT2017-23rd InternationalConference on the Theory and Applications ofCryptology and Information Security,HongKong,China,December 3-7,2017,Proceedings,Part I,volume 10624 of Lecture Notes inComputer Science,pages128–157.Springer,2017.

[0222] TM16.Yosuke Todo and Masakatu Morii.Bit-based division property andapplication tosimon family.In Thomas Peyrin,editor,Fast Software Encryption-23rd InternationalConference,FSE 2016,Bochum,Germany,March 20-23,2016,RevisedSelected Papers,volume 9783 ofLecture Notes in Computer Science,pages 357–377.Springer,2016.

[0223] Tod15.Yosuke Todo.Structural evaluation by generalized integralproperty.In ElisabethOswald and Marc Fischlin,editors,Advances in Cryptology-EUROCRYPT 2015-34thAnnual International Conference on the Theory andApplications of CryptographicTechniques,Sofia,Bulgaria,April 26-30,2015,Proceedings,Part I,volume 9056 of LectureNotes in Computer Science,pages 287–314.Springer,2015.

[0224] WHG+19.Senpeng Wang,Bin Hu,Jie Guan,Kai Zhang,and Tairong Shi.Milp-aidedmethod of searching division property using three subsets and applications.In Steven D.Galbraith and Shiho Moriai,editors,Advances in Cryptology-ASIACRYPT 2019-25thInternational Conference on the Theory andApplication of Cryptology and Information Security,Kobe,Japan,December 8-12,2019,Proceedings,Part III,volume 11923ofLecture Notes in Computer Science,pages 398–427.Springer,2019.

[0225] WHG+20.Senpeng Wang,Bin Hu,Jie Guan,Kai Zhang,and TairongShi.Exploring secret keys in searching integral distinguishers based ondivision property.IACR Trans.Symmetric Cryptol.,2020(3):288–304,2020.

[0226] Embodiment 2

[0227] The purpose of this embodiment is to provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the program.

[0228] Embodiment 3

[0229] The purpose of this embodiment is to provide a computer-readable storage medium.

[0230] A computer-readable storage medium stores a computer program, which executes the steps of the above method when executed by a processor.

[0231] Embodiment 4

[0232] The purpose of this embodiment is to provide a SPECK integral discriminator search system based on modular perfect monomial prediction, including:

[0233] The model building module is configured to: build a first model for monomial prediction of the SPECK algorithm, including: constructing a model according to the constraints of each component of the SPECK algorithm, constructing a model according to the constraints of a single round of the SPECK algorithm, and constructing a model according to the constraints of different rounds of the SPECK algorithm;

[0234] The optimization strategy module is configured to: form two optimization strategies based on the constructed model, including: dividing the long round search into short round search, and dividing the search according to the intermediate state;

[0235] The solution module is configured to: solve the two formed optimization strategies using a solver and output the number of monomial paths.

[0236] The above optimization strategy is used to speed up the search process of this model and will not affect the results of the model output.

[0237] Embodiment 5

[0238] The purpose of this embodiment is to provide a computer program product containing instructions, which, when running on a computer, enables the computer to execute the methods and functions involved in any of the above embodiments.

[0239] The steps involved in the apparatus of the above embodiment correspond to the method embodiment 1, and the specific implementation method can refer to the relevant description part of embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood to include any medium that can store, encode or carry an instruction set for execution by a processor and enable the processor to execute any method in the present invention.

[0240] Those skilled in the art should understand that the modules or steps of the present invention described above can be implemented by a general-purpose computer device, or alternatively, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0241] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A SPECK integral discriminator search method based on modular perfect monomial prediction, characterized by: include: Constructing a first model of monomial prediction of the SPECK algorithm, including: constructing a model according to the constraints of each component of the SPECK algorithm, constructing a model according to the constraints of a single round of the SPECK algorithm, and constructing a model according to the constraints of different rounds of the SPECK algorithm; Based on the constructed model, two optimization strategies are formed, including: dividing the long round search into short round search and dividing the search according to the intermediate state; The two optimization strategies formed are solved using the solver and the number of monomial paths is output.

2. The SPECK integral discriminator search method based on modular perfect monomial prediction as claimed in claim 1 is characterized in that: When the first model is a MILP model, a solver is used to solve the model, and if a solution is found, the number of monomial paths and the solution time are output.

3. The SPECK integral discriminator search method based on modular perfect monomial prediction as claimed in claim 1, characterized in that: When the first model is an SMT model, a solver is used to solve the model. If there is a solution, the solution result is added as a constraint to the constructed model. If there is no solution, the number of monomial paths is output.

4. The SPECK integral discriminator search method based on modular perfect monomial prediction as claimed in claim 1, characterized in that: When the first model is an SMT model, the SMT tool has built-in support for the "+" operation. Given the input and output indices u, v and w, the SMT model can be directly constructed by modeling u+v=w.

5. The SPECK integral discriminator search method based on modular perfect monomial prediction as claimed in claim 4 is characterized in that: Use STP as the SMT model solver, and its input language is CVC, so the module 2 n The MP constraint for the addition operation is: ASSERT(w=BVPLUS,u,v)); In this constraint, u, v, and w are all n-bit vectors. Since the CVC language allows access to the i-th bit of a vector by index, there is no need to convert u, v, w into bit variables.

6. The SPECK integral discriminator search method based on modular perfect monomial prediction as claimed in claim 1, characterized in that: When the first model is a MILP model, a bit-based MP model is provided for the modular addition operation based on auxiliary variables. The auxiliary variables are used to represent the exponent of the carry bit. l is unique, so no redundant MP paths are introduced and it is still perfect; By using a greedy algorithm and efficient propagation, we obtain a set of constraints that represent the perfect MP model for modular addition operations: u i +v i +l i+1 -w i -2l i 0.l0.l n =0.

7. A SPECK integral discriminator search system based on modular perfect monomial prediction, characterized by: include: The model building module is configured to: build a first model for monomial prediction of the SPECK algorithm, including: constructing a model according to the constraints of each component of the SPECK algorithm, constructing a model according to the constraints of a single round of the SPECK algorithm, and constructing a model according to the constraints of different rounds of the SPECK algorithm; The optimization strategy module is configured to: form two optimization strategies based on the constructed model, including: dividing the long round search into short round search, and dividing the search according to the intermediate state; The solution module is configured to: solve the two formed optimization strategies using a solver and output the number of monomial paths.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are performed.

Images