Differential feature automatic search method for cryptographic algorithm based on replacement design

Abstract

The invention provides a differential feature automatic search method oriented to a permutation design-based cryptographic algorithm, which comprises the following steps of: establishing a model 1 based on a propagation rule of a difference in each cryptographic component; establishing a model 2 based on the operation relationship of the encrypted information pair in the password component and the relationship between the differential value and the encrypted information pair; an SMT solver is used for solving the model 1, high-probability difference characteristics are searched, according to the input difference and the output difference of the high-probability difference characteristics solved in the model 1, the value of the input difference and the value of the output difference in the model 2 are fixed to be consistent with the value of the model 1, and the SMT solver is used for solving the model 2; and if the model 2 has a solution, outputting a high-probability differential feature, otherwise, searching a new high-probability differential feature by using the model 1. According to the modeling method provided by the invention, the situation that the difference feature obtained by a traditional difference search method possibly conflicts with an actual operation value is eliminated, and a more accurate security analysis result is provided for a cryptographic algorithm based on replacement design.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptanalysis, and in particular to an automated differential feature search method for a permutation-based cryptographic algorithm. Background Art

[0002] Differential Cryptanalysis was proposed by Biham in 1990 when he analyzed the DES (Data Encryption Standard) encryption algorithm. It can effectively reduce the complexity of cryptanalysis. Differential analysis finds a high-probability differential characteristic (Differential Characteristic) with fixed input and output, and then statistically calculates the probability that the difference calculated based on the guessed key is equal to the difference between the input and output of the high-probability differential characteristic. If the probabilities of the two are similar, the guessed key is the correct key, otherwise the guessed key is the wrong key. Differential analysis is currently an important cryptographic algorithm analysis method and one of the important indicators for measuring the security of cryptographic algorithms. The key step of differential analysis is to find a high-probability differential characteristic. Using tools such as MILP (Mixed Integer Linear Programming) and SAT (Boolean Satisfiability Problem) can significantly improve the efficiency of finding differential characteristics. SAT is a problem of judging whether there is a given Boolean formula assignment. SAT's propositional logic expression ability is relatively weak, so using Satisfiability Modulo Theories (SMT), which processes first-order logic expressions, can simplify the modeling process of cryptographic algorithms. The method of searching for differential features using SAT / SMT is the same as the principle of searching for differential features using MILP, that is, converting the differential propagation rules in the cryptographic algorithm into the corresponding relationship between Boolean variables, calling the SAT / SMT solver to solve, and searching for high-probability differential features.

[0003] A block cipher is a symmetric cryptographic algorithm that divides plaintext into blocks and performs multiple rounds of iterative encryption on each block in combination with a key. A block cipher mainly consists of three parts: encryption algorithm, decryption algorithm, and key expansion algorithm. The design of block ciphers follows Shannon's obfuscation and diffusion principles, which are reflected in the design as nonlinear obfuscation components and linear diffusion components. The obfuscation principle means that an attacker cannot deduce the relationship between plaintext, ciphertext, and key. The diffusion principle means that each bit of the plaintext and key can affect multiple bits of the ciphertext. Taking the classic block cipher structure SPN (Substitution-Permutation Network) as an example, the reversible nonlinear function S controlled by the round key is its nonlinear obfuscation component, and the reversible linear transformation P is the linear diffusion component of the SPN structure. SPN structure data diffuses faster, but encryption and decryption are usually not consistent. Let X i-1 , X i are the input information and output information of the i-th round of encryption, K i is the round key of the i-th round, then the round function encryption process of the SPN structure is as follows: Figure 1 shown.

[0004] Authenticated encryption algorithms are symmetric cryptographic algorithms that can simultaneously protect data confidentiality and integrity and have authentication capabilities. They can meet the needs of data encryption and authentication integration and improve data transmission efficiency. In January 2013, with the support of the National Institute of Standards and Technology (NIST), Bernstin took the lead in organizing a cryptographic algorithm competition - CAESAR (Competition for Authenticated Encryption: Security, Applicability, and Robustness). The purpose of CAESAR is to promote the development of authenticated encryption algorithm design and analysis and select efficient and secure authenticated encryption algorithms. Candidate algorithms participating in the competition need to meet two conditions: one is to have wide compatibility; the other is to be better than AES-GCM. In March 2014, CAESAR announced the 57 algorithms collected. In March 2019, Ascon was determined to be one of the final winning algorithms of the CAESAR competition. In May 2018, NIST released the lightweight cryptographic solicitation requirements and evaluation criteria (draft), aiming to select lightweight cryptographic algorithms that can be used in highly restricted scenarios such as sensor networks, distributed control systems, the Internet of Things, and cyber-physical systems. On March 29, 2019, the solicitation of candidate algorithms was closed, and a total of 57 algorithms were received. In 2021, Ascon was determined to be one of the final winning algorithms. Ascon is a cryptographic algorithm designed based on the permutation primitive. It is not only one of the authenticated encryption algorithms in the final round of the CAESAR competition, but also one of the authenticated encryption algorithms in the final round of the lightweight cryptographic algorithm standard initiated by NIST. Ascon will be widely used in various encryption scenarios. Therefore, the security analysis of encryption algorithms such as Ascon designed based on the permutation primitive is of great significance.

[0005] Block cipher algorithms generally meet the obfuscation characteristics by XORing the round key before the nonlinear component. During differential analysis, since the round key is unknown, the round key is usually regarded as a random number to simplify the analysis process, that is, the encrypted information added by the round key is also regarded as random. The differential distribution table is a table that traverses all possible pairs of encrypted information and summarizes the relationship between the input differential and the output differential. When the cryptographic algorithm based on permutation design iterates the round function, no round key is involved in the calculation. For this type of fixed permutation, the relationship between the input differential and the output differential is simpler, so directly using the differential distribution table to characterize the propagation of the differential in the nonlinear component will produce incorrect differential characteristics. Summary of the invention

[0006] The existing automated search method for differential features is more suitable for traditional block ciphers, that is, each round has a round key addition operation. Without considering the impossible differential analysis of the key expansion scheme, the round keys of each round are regarded as independent random numbers. Therefore, the encryption pairs added by the round keys are all random numbers, and the differential distribution table can be directly used to characterize the nonlinear component without considering the specific value of the encryption pair before entering the nonlinear component operation. However, the round function of the permutation-based encryption algorithm such as Ascon does not have a round key addition operation, that is, the encryption pair entering the nonlinear component operation is no longer a random number. Therefore, it is inaccurate to use only the differential distribution table to characterize the S-box, and differential features that do not meet the actual operation will be obtained.

[0007] In response to the above problems, the present invention proposes an automatic search method for differential features based on permutation design cryptographic algorithms. This method establishes the relationship between differential values ​​and operation values ​​in the encryption process of the cryptographic algorithm on the basis of traditional bit-based differential analysis, thereby eliminating the situation where the differential features obtained by the traditional differential search method may conflict with the actual operation values, and provides more accurate security analysis results.

[0008] The present invention provides a differential feature automatic search method for a permutation-based cryptographic algorithm, comprising the following steps:

[0009] Step 1: Establish model 1 based on the propagation rules of the difference in each password component;

[0010] Step 2: Establish model 2 based on the relationship between the encrypted information pair in the cryptographic component and the relationship between the differential value and the encrypted information pair;

[0011] Step 3: Use the SMT solver to solve model 1, search for high-probability differential features, fix the input differential and output differential values ​​in model 2 to be consistent with model 1 according to the input differential and output differential of the high-probability differential features obtained in model 1, and use the SMT solver to solve model 2;

[0012] Step 4: If model 2 has a solution, output the high-probability differential feature. Otherwise, return to step 3, restrict the input differential and output differential of model 1 to be not equal to the searched differential, use the SMT solver to solve model 1, and search for new high-probability differential features.

[0013] The steps include:

[0014] Step 1: Establish model 1 based on the propagation rules of the difference in each password component;

[0015] Step 2: Establish model 2 based on the relationship between the encrypted information pair in the cryptographic component and the relationship between the differential value and the encrypted information pair;

[0016] Step 3: Use the SMT solver to solve model 1, search for high-probability differential features, fix the input differential and output differential values ​​in model 2 to be consistent with model 1 according to the input differential and output differential of the high-probability differential features obtained in model 1, and use the SMT solver to solve model 2;

[0017] Step 4: If model 2 has a solution, output the high-probability differential feature. Otherwise, return to step 3, restrict the input differential and output differential of model 1 to be not equal to the searched differential, use the SMT solver to solve model 1, and search for new high-probability differential features.

[0018] Further, the cryptographic component includes a linear component and a non-linear component;

[0019] The linear components include branch operations, XOR operations, linear transformations, shifts, and circular shifts;

[0020] The nonlinear components include AND operation and S-box operation.

[0021] In one embodiment, when the cryptographic component is a branch operation, the modeling method of Model 1 and Model 2 is:

[0022] Assume that the input differential is represented by A, and the output differential is represented by B and C, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ), C=(c0,c1,...,c l ) is an array of variables whose components take values ​​0 and 1, m = n = l; then the relationship among A, B, and C is expressed as:

[0023] (assert(=a0b0))(assert(=a1b1))…(assert(=a m b m ))

[0024] Among them, assert is a keyword in SMT syntax.

[0025] In one embodiment, when the password component is an XOR operation, the modeling method of Model 1 and Model 2 is:

[0026] Assume that the input differential is represented by A, and the output differential is represented by B and C, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ), C=(c0,c1,...,c l ) is an array of variables whose components take values ​​0 and 1, m = n = l; then the relationship among A, B, and C is expressed as:

[0027] (assert(=c0(bvxor a0b0)))

[0028] (assert(=c1(bvxor a1b1)))

[0029] …

[0030] (assert(=c m (bvxor a m b m )))

[0031] Among them, assert and bvxor are both keywords of SMT syntax.

[0032] In one embodiment, when the password component is a linear transformation, the modeling method of Model 1 and Model 2 is:

[0033] Assume that the input difference is represented by array A, and the output difference is represented by array B, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ) is an array of variables whose component values ​​are 0 and 1, m = n; the transformation matrix is ​​P = (p i，j ) (m+1)×(n+1) , then the relationship between A and B is expressed as:

[0034] (assert(=b0(bvxor(bvand a0 p 0,0 )(bvand a1 p 1,0 )…(bvand a m p m,0 ))

[0035] (assert(=b1(bvxor(bvand a0 p 0,1 )(bvand a1 p 1,1 )…(bvand a m p m,1 ))

[0036] …(assert(=b n (bvxor(bvand a0 p 0，n )(bvand a1 p 1，n )…(bvand a m p m,n ))

[0037] Among them, assert, bvxor and bvand are all keywords of SMT syntax.

[0038] In one embodiment, when the password components are shift and cyclic shift, the modeling methods of Model 1 and Model 2 are:

[0039] Assume that the input difference is represented by A, B, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ) is an array of variables whose components take values ​​0 and 1, m = n; then the relationship between A and B is expressed as follows:

[0040] Shift right by k positions:

[0041] (assert(=#b0b0))(assert(=#b0b1))…(assert(=#b0b k-1 ))

[0042] (assert(=a i-k b k ))(assert(=a i-k+1 b k+1 ))…(assert(=a m-k b m ))

[0043] Shift left by k bits:

[0044] (assert(=a k b0))(assert(=a k+1 b1))…(assert(=a m b m-k ))(assert(=#b0b m-k+1 ))(assert(=#b0 b m-k+2 ))…(assert(=#b0 b m ))

[0045] Circular right shift k positions:

[0046] (assert(=a0b k ))(assert(=a1b k+1 ))…(assert(=a m-k b m ))(assert(=a m-k+ 1b0))(assert(=a m-k+1 b1))…(assert(=a m-1 b k-1 ))

[0047] Circular left shift k bits:

[0048] (assert(=a k b0))(assert(=a k+1 b1))…(assert(=a m bm-k ))

[0049] (assert(=a0 b m-k+1 ))(assert(=a2b1))…(assert(=a k-1 b m ))

[0050] Among them, assert is a keyword in SMT syntax.

[0051] In one embodiment, when the password component is an AND operation, the modeling method of model 1 is:

[0052] Assume that the input difference is represented by A and B, and the output difference is represented by C, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ), C=(c0,c1,...,c l ) is a variable array whose component values ​​are 0 and 1, m = n = l, then the relationship between the variable arrays A, B, and C is expressed as:

[0053] (assert(=#b0(bvand(bvnot a0)(bvnotb0)c0)))

[0054] (assert(=#b0(bvand(bvnot a1)(bvnotb1)c1)))

[0055] …

[0056] (assert(=#b0(bvand(bvnot a m )(bvnot b m )c m )))

[0057] Among them, assert, bvnot and bvand are all keywords of SMT syntax.

[0058] In one embodiment, when the cryptographic component is an S-box operation, the modeling method of Model 1 is:

[0059] The impossible difference set obtained according to the difference distribution table is S di f f ={sd0, sd1, ..., sd t |sd i =(sd i,0 , s.d. i，1 , ..., sd i,2m+1 )}, let function The input differential is represented by A, and the output differential is represented by B. A=(a0,a1,...,a m ), B=(b0,b1,...,b n ) is a variable array whose component values ​​are 0 and 1, m = n, then the relationship between the variable arrays A and B is expressed as:

[0060] (assert(

[0061] =#b0(bvand(g(sd 0,0 )a0)…(g(sd 0,m ) m )(g(sd 0,m+1 )b0)…(g(sd 0,2m+1 )b m )))))(assert(

[0062] =#b0(bvand(g(sd 1，0 )a0)…(g(sd 1,m ) m )(g(sd 1,m+1 )b0)…(g(sd 1,2m+1 )b m )))))

[0063] …(assert(

[0064] =#b0(bvand(g(sd t,0 )a0)…(g(sd t,m ) m )(g(sd t,m+1 )b0)…(g(sd t,2m+1 )b m )))))

[0065] Among them, assert, bvnot and bvand are all keywords of SMT syntax.

[0066] In one embodiment, when the password component is an AND operation, the modeling method of Model 2 is:

[0067] Assume that the input difference is represented by A and B, and the output difference is represented by C, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ), C=(c0,c1,...,c l ) is an array of variables whose components are 0 and 1, m=n=l; at the same time, a new variable D=(d0, d1, ..., d m ), D′=(d′0, d′1,...,d′ m ), E=(e0,e1,…,em ), E′=(e′0, e′1,…,e′ m ), F=(f0,f1,…,f m ), F′=(f′0, f′1,..., f′ m ), then the relationship between variable arrays A, B, and C is expressed as:

[0068] (assert(=f0(bvand d0 e0)))(assert(=f′0(bvand d′0e′0)))

[0069] (assert(=f1(bvand d1 e1)))(assert(=f′1(bvand d′1 e′1)))

[0070] …

[0071] (assert(=f m (bvand d m e m )))(assert(=f′ m (bvand d′ m e′ m )))

[0072] (assert(=a0(bvxor d0 d′0)))

[0073] (assert(=b0(bvxor e0 e′0)))

[0074] (assert(=c0(bvxor f0f′0)))

[0075] …

[0076] (assert(=a m (bvxor d m d′ m )))

[0077] (assert(=b m (bvxor e m e′ m )))

[0078] (assert(=c m (bvxor f m f′ m )))

[0079] Among them, assert, bvxor and bvand are all keywords of SMT syntax.

[0080] In one embodiment, when the password component is an AND operation, the modeling method of Model 2 is:

[0081] The impossible point set obtained according to the S-box lookup table is S value ={sv0, sv1, ..., sv t |sv i =(sv i，0 , sv i，1 , ..., sv i，2m+1 )}, let function The input differential is represented by A, and the output differential is represented by B. A=(a0,a1,...,a m ), B=(b0,b1,...,b n ) is an array of variables whose components take values ​​0 and 1, m = n; at the same time, a new variable D = (d0, d1, ..., d m ), D′=(d′0, d′1,...,d′ m ), E=(e0,e1,...,e m ), E′=(e′0, e′1,..., e′ m ), then the relationship between variable arrays A and B can be expressed as:

[0082] (assert(

[0083] =#b0(bvand(g(sv 0,0 )d0)...(g(sv 0,m )d m )(g(sv 0，m+1 )e0)...(g(sv 0，2m+1 ) m ))))(assert(

[0084] =#b0(bvand(g(sv 0,0 )d′0)...(g(sv 0,m )d′ m )(g(sv 0，m+1 )e′0)...(g(sv 0,2m+1 )e′ m ))))

[0085] …(assert(

[0086] =#b0(bvand(g(sv t,0 )d0)…(g(sv t,m )d m )(g(sv t,m+1 )e0)…(g(sv t,2m+1 ) m ))))(assert(

[0087] =#b0(bvand(g(sv t,0 )d′0)...(g(sv t,m )d′ m )(g(sv t,m+1 )e′0)...(g(sv t，2m+1 )e′ m ))))

[0088] (assert(=a0(bvxord0 d′0)))

[0089] (assert(=b0(bvxor e0 e′0)))

[0090] (assert(=c0(bvxor f0f′0)))

[0091] …

[0092] (assert(=a m (bvxor d m d′ m )))

[0093] (assert(=b m (bvxor e m e′ m )))

[0094] (assert(=c m (bvxor f m f′ m )))

[0095] Among them, assert, bvxor and bvand are all keywords of SMT syntax.

[0096] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0097] Based on the characteristic of nonlinear components of permutation design cryptographic algorithms without round key addition, the present invention introduces the relationship between operation value and differential value on the basis of traditional differential automatic search method, avoiding the problem that differential characteristics that do not meet actual operation can be obtained by only using differential distribution table to characterize nonlinear components. Compared with traditional differential characteristic search method, the present invention method provides more accurate differential analysis results for cryptographic algorithms based on permutation design. At the same time, the present invention method provides new ideas for security analysis of cryptographic algorithms based on permutation design. BRIEF DESCRIPTION OF THE DRAWINGS

[0098] Figure 1 This is a schematic diagram of the SPN structure.

[0099] Figure 2 The present invention is a flowchart of an automated differential feature search method for a permutation-based cryptographic algorithm in an embodiment of the present invention.

[0100] Figure 3 Schematic diagram of round constant addition operation in an embodiment of the present invention.

[0101] Figure 4 Schematic diagram of nonlinear layer operation in an embodiment of the present invention.

[0102] Figure 5 Schematic diagram of linear layer operation in an embodiment of the present invention. DETAILED DESCRIPTION

[0103] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0104] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0105] like Figure 2 As shown, this embodiment proposes a differential feature automatic search method for a permutation-based cryptographic algorithm, comprising the following steps:

[0106] Step 1: Establish model 1 based on the propagation rules of the difference in each password component;

[0107] Step 2: Establish model 2 based on the relationship between the encrypted information pair in the cryptographic component and the relationship between the differential value and the encrypted information pair;

[0108] Step 3: Use the SMT solver to solve model 1, search for high-probability differential features, fix the input differential and output differential values ​​in model 2 to be consistent with model 1 according to the input differential and output differential of the high-probability differential features obtained in model 1, and use the SMT solver to solve model 2;

[0109] Step 4: If model 2 has a solution, output the high-probability differential feature. Otherwise, return to step 3, restrict the input differential and output differential of model 1 to be not equal to the searched differential, use the SMT solver to solve model 1, and search for new high-probability differential features.

[0110] Furthermore, the cryptographic components in step 1 mainly include linear components and nonlinear components. The linear components mainly include branch operations, XOR operations, linear transformations, shifts, and cyclic shifts, and the nonlinear components mainly include AND operations and S-box operations.

[0111] Let A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ), C=(c0,c1,...,c l ) is an array of variables whose component values ​​are 0 and 1. assert, bvnot, bvxor, and bvand are all keywords in the SMT syntax. The bit-based SMT solver modeling of each cryptographic component is as follows:

[0112] (1) Branch operation: Assume that the input difference is represented by A, and the output difference is represented by B and C. At this time, m = n = l, and the relationship between the variable arrays A, B, and C can be expressed as:

[0113] (assert(=a0b0))(assert(=a1b1))…(assert(=a m b m ))

[0114] (2) XOR operation: Assume that the input difference is represented by A and B, and the output difference is represented by C. At this time, m = n = 1, then the relationship between the variable arrays A, B, and C can be expressed as:

[0115] (assert(=c0(bvxor a0b0)))

[0116] (assert(=c1(bvxor a1b1)))

[0117] …

[0118] (assert(=c m (bvxor a m b m )))

[0119] (3) Linear transformation: Assume that the input difference is represented by array A, the output difference is represented by array B, and the transformation matrix is ​​P = (p i，j ) (m+1)×(n+1) (If the matrix on the linear transformation finite field needs to be converted into a bit matrix first), then the relationship between A and B can be expressed as:

[0120] (assert(=b0(bvxor(bvand a0 p 0,0 )(bvand a1 p 1,0 )…(bvand am p m,0 ))

[0121] (assert(=b1(bvxor(bvand a0 p 0,1 )(bvand a1 p 1,1 )…(bvand a m p m,1 ))

[0122] …

[0123] (assert(=b n (bvxor(bvand a0 p 0，n )(bvand a1 p 1，n )…(bvand a m p m,n ))

[0124] (4) Shift and cyclic shift: Assume that the input difference is represented by A and B, then the relationship between A and B can be expressed as follows:

[0125] Shift right by k positions:

[0126] (assert(=#b0b0))(assert(=#b0b1))…(assert(=#b0b k-1 ))

[0127] (assert(=a i-k b k ))(assert(=a i-k+1 b k+1 ))…(assert(=a m-k b m ))

[0128] Shift left by k bits:

[0129] (assert(=a k b0))(assert(=a k+1 b1))…(assert(=a m b m-k ))(assert(=#b0b m-k+1 ))(assert(=#b0 b m-k+2 ))…(assert(=#b0 b m ))

[0130] Circular right shift k positions:

[0131] (assert(=a0b k ))(assert(=a1bk+1 ))…(assert(=a m-k b m ))(assert(=a m-k+ 1b0))(assert(=a m-k+1 b1))…(assert(=a m-1 b k-1 ))

[0132] Circular left shift k bits:

[0133] (assert(=a k b0))(assert(=a k+1 b1))…(assert(=a m b m-k ))

[0134] (assert(=a0 b m-k+1 ))(assert(=a2b1))…(assert(=a k-1 b m ))

[0135] (5) AND operation: Assume that the input difference is represented by A and B, and the output difference is represented by C. In this case, m = n = 1, and the relationship between the variable arrays A, B, and C can be expressed as:

[0136] (assert(=#b0(bvand(bvnot a0)(bvnotb0)c0)))

[0137] (assert(=#b0(bvand(bvnot a1)(bvnotb1)c1)))

[0138] …

[0139] (assert(=#b0(bvand(bvnot a m )(bvnot b m )c m )))

[0140] (6) S-box operation: The impossible difference set obtained according to the difference distribution table is S di f f ={sd0, sd1, ..., sd t |sd i =(sd i,0 , s.d. i，1 ,…,sd i,2m+1 )}, let function The input difference is represented by A, and the output difference is represented by B. Then the relationship between the variable arrays A and B can be expressed as:

[0141] (assert(

[0142] =#b0(bvand(g(sd 0,0 )a0)…(g(sd 0,m ) m )(g(sd 0,m+1 )b0)…(g(sd 0,2m+1 )b m )))))(assert(

[0143] =#b0(bvand(g(sd 1，0 )a0)…(g(sd 1,m ) m )(g(sd 1,m+1 )b0)…(g(sd 1,2m+1 )b m )))))

[0144] …(assert(

[0145] =#b0(bvand(g(sd t,0 )a0)…(g(sd t,m ) m )(g(sd t,m+1 )b0)…(g(sd t,2m+1 )b m )))))

[0146] Furthermore, the modeling method of model 2 in step 2 needs to introduce a set of new input operation value variables D = (d0, d1, ..., d m ), D′=(d′0, d′1,...,d′ m ), E=(e0,e1,...,e m ), E′=(e′0, e′1,..., e′ m ), output operation value variable F = (f0, f1, ..., f m ), F′=(f′0, f′1,..., f′ m ). For any cryptographic component τ, the differential propagation rule

[0147] Then it is as follows:

[0148]

[0149] When τ is a linear component, the modeling method of the operation value through the password component is the same as the differential modeling method in step 1. The modeling method of the nonlinear component is as follows:

[0150] (1) AND operation: Let A and B represent the input difference and C represent the output difference. Then m = n = 1. At the same time, a new variable D = (d0, d1, ..., d m ), D′=(d′0, d′1,...,d′ m ), E=(e0,e1,…,e m ), E′=(e′0, e′1,…,e′ m ), F=(f0,f1,…,f m ), F′=(f′0, f′1,..., f′ m ), then the relationship between variable arrays A, B, and C can be expressed as:

[0151] (assert(=f0(bvand d0 e0)))(assert(=f′0(bvand d′0e′0)))

[0152] (assert(=f1(bvand d1 e1)))(assert(=f′1(bvand d′1 e′1)))

[0153] …

[0154] (assert(=f m (bvand d m e m )))(assert(=f′ m (bvand d′ m e′ m )))

[0155] (assert(=a0(bvxor d0 d′0)))

[0156] (assert(=b0(bvxor e0 e′0)))

[0157] (assert(=c0(bvxor f0f′0)))

[0158] …

[0159] (assert(=a m (bvxor d m d′ m )))

[0160] (assert(=b m (bvxor e m e′ m )))

[0161] (assert(=c m(bvxor f m f′ m )))

[0162] (2) S-box operation: The impossible point set obtained by the S-box lookup table is S value ={sv0, sv1, ..., sv t |sv i =(sv i,0 , sv i,1 , ..., sv i,2m+1 )}, let function The input difference is represented by A, and the output difference is represented by B. At this time, m=n; at the same time, a new variable D=(d0, d1, ..., d m ), D′=(d′0, d′1,...,d′ m ), E=(e0,e1,...,e m ), E′=(e′0, e′1,..., e′ m ), then the relationship between variable arrays A and B can be expressed as:

[0163] (assert(

[0164] =#b0(bvand(g(sv 0,0 )d0)…(g(sv 0,m )d m )(g(sv 0,m+1 )e0)…(g(sv 0,2m+1 ) m ))))(assert(

[0165] =#b0(bvand(g(sv 0,0 )d′0)…(g(sv 0,m )d′ m )(g(sv 0,m+1 )e′0)…(g(sv 0,2m+1 )e′ m ))))

[0166] …(assert(

[0167] =#b0(bvand(g(sv t,0 )d0)…(g(sv t,m )d m )(g(sv t，m+1 )e0)...(g(sv t,2m+1 ) m ))))(assert(

[0168] =#b0(bvand(g(sv t,0)d′0)...(g(sv t,m )d′ m )(g(sv t,m+1 )e′0)...(g(sv t,2m+1 )e′ m ))))

[0169] (assert(=a0(bvxord0 d′0)))

[0170] (assert(=b0(bvxor e0 e′0)))

[0171] (assert(=c0(bvxorf0f′0)))

[0172] …

[0173] (assert(=a m (bvxor d m d′ m )))

[0174] (assert(=b m (bvxor e m e′ m )))

[0175] (assert(=c m (bvxor f m f′ m )))

[0176] In the above method, the main improvement is that based on the relationship between the encrypted information and the operation in the cryptographic component, a new modeling method of Model 2 is proposed. The modeling method of Model 2 of the Ascon algorithm cryptographic component is given below in conjunction with the accompanying drawings.

[0177] Ascon replacement includes p a and p b Two 320-bit permutations, p a and p b Both are based on the SPN structure and have the same iterative transformation. The only difference between the two is the number of iterations. a is an iteration a round, and p a is iterated b rounds, a and b are adjustable security parameters. The transformation p of each round of Ascon permutation is the round constant plus p C , nonlinear replacement layer p s and the linear diffusion layer p L Three parts:

[0178]

[0179] The permuted 320-bit state S is divided into five 64-bit words x0, x1, x2, x3, x4, that is, S = x0||x1||x2||x3||x4.

[0180] Round constant addition operation p C It means that in each round of iteration, the word x2 is XORed with a round constant c. r , the round constant c of the i-th round r As shown in Table 1. When the substitution is p a When r=i, when replaced by p b When r = i + ab, the round constant addition operation is as follows Figure 3 shown.

[0181] Table 1, wheel constant c r In p a and p b The value of the i-th round:

[0182] <![CDATA[p 12 ]]> <![CDATA[p 8 ]]> <![CDATA[p 6 ]]> <![CDATA[Wheel constant c r > <![CDATA[p 12 ]]> <![CDATA[p 8 ]]> <![CDATA[p 6 ]]> <![CDATA[Wheel constant c r > 0 000000000000000000f0 6 2 0 00000000000000000096 1 000000000000000000e1 7 3 1 00000000000000000087 2 000000000000000000d2 8 4 3 00000000000000000078 3 000000000000000000c3 9 5 4 00000000000000000069 4 0 000000000000000000b4 10 6 5 0000000000000000005a 5 1 000000000000000000a5 11 7 6 0000000000000000004b

[0183] Non-linear replacement layer p s The state S is updated through 64 identical 5-bit S-boxes. The S-box is directly constructed using the bit-slice technology. Table 2 lists the 5-bit S-box table lookup implementation method. The nonlinear substitution layer operation is as follows: Figure 4 shown.

[0184] Table 2, Ascon 5-bit S-box lookup table:

[0185]

[0186]

[0187] Linear diffusion layer p L By 5 linear functions ∑ i (x i ) to update the state S, the linear diffusion layer operation is as follows Figure 5 As shown. Linear function ∑ i (x i ) has the following structure:

[0188] x i ←∑ i (x i ), 0≤i≤4

[0189]

[0190]

[0191]

[0192]

[0193]

[0194] Assume that the input differential variable of each password component is A=(a0, a1, ..., a 320 ), the output difference variable is B = (b0, b1, ..., b 320 ), the input operation value is D = (d0, d1, ..., d 320 ), D′=(d′0, d′1,...,d′ 320 ), the output operation value is E = (e0, e1, ..., e 320 ), E′=(e′0, e′1,..., e′ 320 ).

[0195] Round constant addition operation p c Modeling: c r The bit form is c r =(0, 0, ..., 0, c r，0 , c r，1 , …, c r，7 )

[0196] (assert(=d0 e0))…(assert(=d 63 e 63 ))

[0197] (assert(=d 64 e 64 ))…(assert(=d 127 e 127 ))

[0198] (assert(=d 128 e 128 ))…(assert(=e 184 (bvxor d 184 c r，0 )))

[0199] (assert(=e 185 (bvxord 185 c r，1 )))…(assert(=e 191 (bvxord 191 c r，7 )))

[0200] (assert(=d 192 e 192 ))…(assert(=d 255 e 255 ))

[0201] (assert(=d 256 e 256 ))…(assert(=d 319 e 319 ))

[0202] (assert(=d′0e′0)),...(assert(=d′ 63 e′ 63 ))

[0203] (assert(=d′ 64 e′ 64 ))…(assert(=d′ 127 e′ 127 ))

[0204] (assert(=d′ 128 e′ 128 ))...(assert(=e′ 184 (bvxor d′ 184 c r，0 )))

[0205] (assert(=e′ 185 (bvxor d′ 185 c r，1 ))…(assert(=e′ 191 (bvxord′ 191 c′ r，7 )))

[0206] (assert(=d′ 192 e′ 192 ))…(assert(=d′ 255 e′ 255 ))

[0207] (assert(=d′ 256 e′ 256 ))…(assert(=d′ 319 e′ 319 ))

[0208] (assert(=a0(bvxor d0d′0)))…(assert(=a 319 (bvxor d 319 d′ 319 )))

[0209] (assert(=b0(bvxor e0e′0)))…(assert(=b 319(bvxor e 319 e′ 319 )))

[0210] linear diffusion layer p L modeling:

[0211] (assert(=e0(bvxor d0 d 19 the 28 )))…(assert(=e 63 (bvxor d 63 the 18 the 27 )))

[0212] (assert(=e 64 (bvxor d 64 the 125 the 103 )))…(assert(=e 127 (bvxor d 127 the 124 the 102 )))

[0213] (assert(=e 128 (bvxor d 128 the 129 the 134 )))…(assert(=e 191 (bvxor d 191 the 128 the 133 )))

[0214] (assert(=e 192 (bvxor d 192 the 202 the 209 )))…(assert(=e 255 (bvxor d 255 the 201 the 208 )))

[0215] (assert(=e 256 (bvxor d 256 the 263 the 297 )))…(assert(=e 319 (bvxor d 319 the 262 the 296 )))

[0216] (assert(=e′0(bvxor d′0d′ 19 the 28 )))…(assert(=e′ 63 (by the way) 63 the 18 the 27 )))

[0217] (assert(=e′ 64 (by the way) 64 the 125 the 103 )))…(assert(=e′ 127 (by the way) 127 the 124 the 102 )))

[0218] (assert(=e′ 128 (by the way) 128 the 129 the 134 )))…(assert(=e′ 191 (by the way) 191 the 128 the 133 )))

[0219] (assert(=e′ 192 (by the way) 192 the 202 the 209 )))...(assert(=e′ 255 (by the way) 255 the 201 the 208 )))

[0220] (assert(=e′ 256 (by the way) 256 the 263 the 297 )))...(assert(=e′ 319 (by the way) 319 the 262 the 296 )))

[0221] (assert(=a0(bvxor d0d′0)))...(assert(=a 319 (bvxor d 319 the 319)))

[0222] (assert(=b0(bvxor e0e′0)))…(assert(=b 319 (bvxor e 319 e′ 319 )))

[0223] Nonlinear replacement layer p s Modeling: The set of impossible points corresponding to the lookup table of the 5-bit S-box is {(0000000001), (0000000010), .... {1111111111}}

[0224] / / The first impossible point characterization (assert(

[0225] =#b0(bvand(bvnot d0)(bvnot d 64 )…(bvnot d 256 )(bvnot e0)…(bvnote 256 ))))(assert(

[0226] =#b0(bvand(bvnot d1)(bvnot d 65 )…(bvnot d 257 )(bvnot e1)…(bvnote 257 ))))

[0227] …(assert(

[0228] =#b0(bvand(bvnot d 63 )(bvnot d 127 )…(bvnot d 319 )(bvnot e 63 )…(bvnote 319 ))))(assert(

[0229] =#b0(bvand(bvnot d′0)(bvnot d′ 64 )…(bvnot d′ 256 )(bvnot e′0)…(bvnote′ 256 ))))(assert(

[0230] =#b0(bvand(bvnot d′1)(bvnot d′ 65 )…(bvnot d′ 257 )(bvnot e′1)…(bvnote′ 257 ))))

[0231] …(assert(

[0232] =#b0(bvand(bvnot d′ 63 )(bvnot d′ 127 )…(bvnot d′ 319 )(bvnot e′ 63 )…(bvnote′ 319 ))))

[0233] …

[0234] / / The last impossible point is depicted

[0235] (assert(=#b0(bvand d0 d 64 …d 256 e0…e 256 )))

[0236] (assert(=#b0(bvand d1 d 65 …d 257 e1…e 257 )))

[0237] …

[0238] (assert(=#b0(bvand d 63 d 127 …d 319 e 63 ...e 319 )))

[0239] (assert(=#b0(bvand d′0d′ 64 …d′ 256 e′0…e′ 256 )))

[0240] (assert(=#b0(bvand d′1 d′ 65 …d′ 257 e′1…e′ 257 )))

[0241] …

[0242] (assert(=#b0(bvand d′ 63 d′ 127 …d′ 319 e′ 63 …e′ 319 )))

[0243] / / Link the difference value and the calculated value

[0244] (assert(=a0(bvxor d0d′0)))…(assert(=a 319 (bvxor d 319 d′ 319 )))

[0245] (assert(=b0(bvxor e0e′0)))…(assert(=b 319 (bvxor e 319 e′ 319 )))

[0246] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A differential feature automatic search method for a permutation-based cryptographic algorithm, characterized in that: The steps include: Step 1: Establish model 1 based on the propagation rules of the difference in each password component; Step 2: Establish model 2 based on the relationship between the encrypted information pair in the cryptographic component and the relationship between the differential value and the encrypted information pair; Step 3: Use the SMT solver to solve model 1, search for high-probability differential features, fix the input differential and output differential values ​​in model 2 to be consistent with model 1 according to the input differential and output differential of the high-probability differential features obtained in model 1, and use the SMT solver to solve model 2; Step 4: If model 2 has a solution, output the high-probability differential feature. Otherwise, return to step 3, restrict the input differential and output differential of model 1 to be not equal to the searched differential, use the SMT solver to solve model 1, and search for new high-probability differential features.

2. The differential feature automated search method for a permutation-based cryptographic algorithm according to claim 1, characterized in that: The cryptographic component includes a linear component and a non-linear component; The linear components include branch operations, XOR operations, linear transformations, shifts, and circular shifts; The nonlinear components include AND operation and S-box operation.

3. The differential feature automated search method for a permutation-based cryptographic algorithm according to claim 2, characterized in that: When the cryptographic component is a branch operation, the modeling methods of Model 1 and Model 2 are: Assume that the input differential is represented by A, and the output differential is represented by B and C. A=(a0,a1,…,a m ), B=(b0,b1,…,b n ), C=(c0,c1,…,c l ) is an array of variables whose components take values ​​0 and 1, m = n = l; then the relationship among A, B, and C is expressed as: (assert(=a0b0))(assert(=a1b1))…(assert(=a m b m )) Among them, assert is a keyword in SMT syntax.

4. The differential feature automated search method for a permutation-based cryptographic algorithm according to claim 1, characterized in that: When the password component is an XOR operation, the modeling methods of Model 1 and Model 2 are: Assume that the input differential is represented by A, and the output differential is represented by B and C, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ), C=(c0,c1,...,c l ) is an array of variables whose components take values ​​0 and 1, m = n = l; then the relationship among A, B, and C is expressed as: (assert(=c0(bvxor a0b0))) (assert(=c1(bvxor a1b1))) … (assert(=c m (bvxor a m b m ))) Among them, assert and bvxor are both keywords of SMT syntax.

5. The differential feature automated search method for a permutation-based cryptographic algorithm according to claim 1, characterized in that: When the password component is a linear transformation, the modeling methods of Model 1 and Model 2 are: Assume that the input difference is represented by array A, and the output difference is represented by array B, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ) is an array of variables whose components are 0 and 1, m = n; the transformation matrix is ​​P = (p i，j ) (m+1)×(n+1) , then the relationship between A and B is expressed as: (assert(=b0(bvxor(bvand a0 p 0,0 )(bvand a1 p 1,0 )…(bvand a m p m,0 )) (assert(=b1(bvxor(bvand a0 p 0,1 )(bvand a1 p 1,1 )…(bvand a m p m,1 )) … (assert(=b n (bvxor(bvand a0 p 0，n )(bvand a1 p 1，n )…(bvand a m p m,n )) Among them, assert, bvxor and bvand are all keywords of SMT syntax.

6. The differential feature automated search method for a permutation-based cryptographic algorithm according to claim 1, characterized in that: When the password components are shift and cyclic shift, the modeling methods of Model 1 and Model 2 are: Assume that the input difference is represented by A, B, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ) is an array of variables whose components take values ​​0 and 1, m = n; then the relationship between A and B is expressed as follows: Shift right by k positions: (assert(=#b0 b0))(assert(=#b0 b1))…(assert(=#b0 b k-1 )) (assert(=a i-k b k ))(assert(=a i-k+1 b k+1 ))…(assert(=a m-k b m )) Shift left by k bits: (assert(=a k b0))(assert(=a k+1 b1))…(assert(=a m b m-k )) (assert(=#b0 b m-k+1 ))(assert(=#b0 b m-k+2 ))…(assert(=#b0 b m )) Circular right shift k positions: (assert(=a0 b k ))(assert(=a1 b k+1 ))…(assert(=a m-k b m )) (assert(=a m-k+1 b0))(assert(=a m-k+1 b1))…(assert(=a m-1 b k-1 )) Circular left shift k bits: (assert(=a k b0))(assert(=a k+1 b1))…(assert(=a m b m-k )) (assert(=a0 b m-k+1 ))(assert(=a2 b1))…(assert(=a k-1 b m )) Among them, assert is a keyword in SMT syntax.

7. The differential feature automated search method for a permutation-based cryptographic algorithm according to claim 1, characterized in that: When the password component is AND operation, the modeling method of model 1 is: Assume that the input difference is represented by A and B, and the output difference is represented by C, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ), C=(c0,c1,...,c l ) is a variable array whose component values ​​are 0 and 1, m = n = l, then the relationship between the variable arrays A, B, and C is expressed as: (assert(=#b0(bvand(bvnot a0)(bvnot b0)c0))) (assert(=#b0(bvand(bvnot a1)(bvnot b1)c1))) … (assert(=#b0(bvand(bvnot a m )(bvnot b m )c m ))) Among them, assert, bvnot and bvand are all keywords of SMT syntax.

8. The differential feature automated search method for a permutation-based cryptographic algorithm according to claim 1, characterized in that: When the cryptographic component is an S-box operation, the modeling method of Model 1 is: The impossible difference set obtained according to the difference distribution table is S diff ={sd0, sd1, ..., sd t |sd i =(sd i,0 , s.d. i,1 ,…,sd i,2m+1 )}, let function The input differential is represented by A, and the output differential is represented by B. A=(a0,a1,...,a m ), B=(b0,b1,...,b n ) is a variable array whose component values ​​are 0 and 1, m = n, then the relationship between the variable arrays A and B is expressed as: (assert( =#b0(bvand(g(sd 0,0 )a0)...(g(sd 0,m )a m )(g(sd 0,m+1 )b0)...(g(sd 0,2m+1 )b m ))))) (assert( =#b0(bvand(g(sd 1,0 )a0)...(g(sd 1,m )a m )(g(sd 1,m+1 )b0)...(g(sd 1,2m+1 )b m ))))) … (assert( =#b0(bvand(g(sd t,0 )a0)...(g(sd t,m )a m )(g(sd t,m+1 )b0)...(g(sd t,2m+1 )b m ))))) Among them, assert, bvnot and bvand are all keywords of SMT syntax.

9. The differential feature automated search method for a permutation-based cryptographic algorithm according to claim 1, characterized in that: When the password component is AND operation, the modeling method of model 2 is: Assume that the input difference is represented by A and B, and the output difference is represented by C, A = (a0, a1, ..., a m ), B=(b0,b1,...,b n ), C=(c0,c1,...,c l ) is an array of variables whose components are 0 and 1, m=n=l; at the same time, a new variable D=(d0, d1, ..., d m ), D′=(d′0, d′1,...,d′ m ), E=(e0,e1,…,e m ), E′=(e′0, e′1,…,e′ m ), F=(f0,f1,…,f m ), F′=(f′0, f′1,..., f′ m ), then the relationship between variable arrays A, B, and C is expressed as: (assert(=f0(bvand d0 e0))) (assert(=f′0(bvand d′0e′0))) (assert(=f1(bvand d1 e1))) (assert(=f′1(bvand d′1 e′1))) … (assert(=f m (bvand d m e m ))) (assert(=f′ m (bvand d′ m e′ m ))) (assert(=a0(bvxor d0 d′0))) (assert(=b0(bvxor e0 e′0))) (assert(=c0(bvxor f0f′0))) … (assert(=a m (bvxor d m d′ m ))) (assert(=b m (bvxor e m e′ m ))) (assert(=c m (bvxor f m f′ m ))) Among them, assert, bvxor and bvand are all keywords of SMT syntax.

10. The differential feature automated search method for a permutation-based cryptographic algorithm according to claim 1, characterized in that: When the password component is AND operation, the modeling method of model 2 is: The impossible point set obtained according to the S-box lookup table is S value ={sv0, sv1, ..., sv t |sv i =(sv i，0 , sv i，1 , ..., sv i，2m+1 )}, let function The input differential is represented by A, and the output differential is represented by B. A=(a0,a1,...,a m ), B=(b0,b1,...,b n ) is an array of variables whose components take values ​​0 and 1, m = n; at the same time, a new variable D = (d0, d1, ..., d m ), D′=(d′0, d′1,...,d′ m ), E=(e0,e1,...,e m ), E′=(e′0, e′1,..., e′ m ), then the relationship between variable arrays A and B can be expressed as: (assert( n#b0(water(g(sv 0,0 )d0)...(g(sv 0,m )d m )(g(sv 0，m+1 )e0)...(g(sv 0,2m+1 )e m )))) (assert( n#b0(water(g(sv 0,0 )d′0)...(g(sv 0,m )d′ m )(g(sv 0，m+1 )e′0)...(g(sv 0，2m+1 )e′ m )))) … (assert( n#b0(water(g(sv t,0 )d0)...(g(sv t,m )d m )(g(sv t,m+1 )e0)...(g(sv t,2m+1 )e m )))) (assert( n#b0(water(g(sv t,0 )d′0)...(g(sv t,m )d′ m )(g(sv t，m+1 )e′0)...(g(sv t,2m+1 )e′ m )))) (assert(=a0(bvxord0 d′0))) (assert(=b0(bvxor e0 e′0))) (assert(=c0(bvxor f0f′0))) (assert(=a m (bvxor d m d′ m ))) (assert(=b m (bvxor e m e′ m ))) (assert(=c m (bvxor f m f′ m ))) Among them, assert, bvxor and bvand are all keywords of SMT syntax.

Images