Side channel attack method and device and medium

Abstract

The invention discloses a side channel attack method and device and a medium, and relates to the technical field of side channel cryptographic analysis. Performing encryption operation on the plurality of sample plaintexts through each hypothesis key in the hypothesis key space to obtain a hypothesis intermediate value matrix; inputting each element of the hypothetical intermediate value matrix into a leakage model, performing Hamming weight and non-uniform weighted bit sum modeling on the hypothetical intermediate value matrix through the leakage model, and generating a hypothetical energy consumption matrix; performing correlation analysis on each element of the assumed energy consumption matrix and the energy traces corresponding to the plurality of sample plaintexts, and determining a joint judgment matrix; updating the hypothesis key space according to the correlation ranking in the joint judgment matrix, and iterating the updated hypothesis key space to obtain the joint judgment matrix; and determining the assumed key with the highest correlation ranking in the joint judgment matrix meeting a preset condition as the key of the encryption equipment. According to the method, a relatively accurate secret key can be obtained through a relatively small sample size.

Description

Technical Field

[0001] The present invention relates to the technical field of side channel cryptographic analysis, and in particular to a side channel attack method, device and medium. Background Art

[0002] In cryptography or cryptanalysis, a chosen plaintext attack refers to an attack mode. The attacker has access to the encryption machine and can construct the ciphertext corresponding to any plaintext. A cryptanalysis method that solves the key or solves the corresponding plaintext from the intercepted ciphertext by selecting a specific plaintext that is beneficial to the attack and its corresponding ciphertext. In a chosen plaintext attack, the cryptanalyst has the ability to select or control the plaintext and can choose any plaintext and its corresponding ciphertext that he thinks is beneficial to the attack. This is a stronger attack method than a known plaintext attack. If a cryptographic system can resist chosen plaintext attacks, then it must be able to resist ciphertext-only attacks and known plaintext attacks. Chosen plaintext attacks are more difficult to implement.

[0003] In the prior art, one attack method is to assume that a cryptanalyst temporarily obtains access to an encryption machine, but the encryption key is securely embedded in the encryption device and the analyst cannot obtain the key. In this case, the key can be inferred by encrypting a large amount of selected plaintext and then using the generated ciphertext.

[0004] However, the attack methods in the prior art require a large number of samples to obtain the key. Summary of the invention

[0005] Based on this, it is necessary to provide a side channel attack method, device and medium to address the above technical problems. This method can obtain a more accurate key with a smaller sample size.

[0006] The present invention adopts the following technical solutions:

[0007] The present invention provides a side channel attack method, comprising:

[0008] Performing encryption operations on multiple sample plaintexts respectively through each hypothetical key in the hypothetical key space to obtain a hypothetical intermediate value matrix; the hypothetical key space includes multiple hypothetical keys of the encryption device;

[0009] Inputting each element of the assumed intermediate value matrix into the leakage model, performing Hamming weight and uneven weighted bit sum modeling on the assumed intermediate value matrix through the leakage model, and generating a assumed energy consumption matrix; each element in the assumed energy consumption matrix represents the correlation between a sample plaintext and a assumed key;

[0010] A correlation analysis is performed between each element of the assumed energy consumption matrix and the energy traces corresponding to the plurality of sample plaintexts to determine a joint decision matrix; the elements in the joint decision matrix represent the correlation ranking between each assumed key and the encryption device;

[0011] According to the correlation ranking in the joint decision matrix, the hypothetical key space is updated, and the joint decision matrix is ​​obtained by iteratively obtaining the updated hypothetical key space;

[0012] The hypothetical key with the highest correlation ranking in the joint decision matrix that meets the preset conditions is determined as the key of the encryption device.

[0013] Preferably, multiple sample plaintexts are encrypted using each hypothetical key in the hypothetical key space to obtain a hypothetical intermediate value matrix, including:

[0014] For each sample plaintext, the first byte of the sample plaintext is subjected to round key addition and byte replacement operations with each hypothetical key to obtain multiple encrypted sample plaintexts;

[0015] According to each encrypted sample plaintext, a hypothesized intermediate value matrix is ​​determined.

[0016] Preferably, the leakage model includes a Hamming weight energy consumption model and an uneven weighted bit sum model; the assumed energy consumption matrix includes a Hamming weight energy consumption matrix and an uneven weighted bit sum energy consumption matrix; the assumed intermediate value matrix is ​​input into the leakage model, and the assumed intermediate value matrix is ​​modeled by the Hamming weight and uneven weighted bit sum through the leakage model to generate the assumed energy consumption matrix, including:

[0017] Substitute the Hamming weight, proportionality coefficient, and irrelevant leakage and noise of each element of the assumed intermediate value matrix into the Hamming weight energy consumption model to obtain the Hamming weight energy consumption matrix;

[0018] Each element value of the assumed intermediate value matrix, the corresponding weight, and the constant component and the noise component in the real leakage are substituted into the unevenly weighted bit and energy consumption matrix to obtain the unevenly weighted bit and energy consumption matrix.

[0019] Preferably, correlation analysis is performed on each element of the assumed energy consumption matrix and energy traces corresponding to a plurality of sample plaintexts to determine a joint decision matrix, including:

[0020] Using the Pearson correlation coefficient as a discriminator, the Hamming weight energy consumption matrix and the energy traces corresponding to multiple sample plaintexts are subjected to correlation analysis to obtain a first correlation matrix;

[0021] Using the Pearson correlation coefficient as a discriminator, correlation analysis is performed on the unevenly weighted bit and energy consumption matrix and the energy traces corresponding to multiple sample plaintexts to obtain a second correlation matrix;

[0022] The first correlation matrix and the second correlation matrix are added together to obtain a joint decision matrix.

[0023] Preferably, the hypothetical key space is updated according to the correlation ranking in the joint decision matrix, including:

[0024] According to the correlation ranking in the joint decision matrix, the hypothesized keys with correlation rankings after a preset number of digits are deleted from the hypothesized key space.

[0025] Preferably, the method for obtaining the sample plaintext includes:

[0026] Encrypting multiple original plaintexts in the plaintext training set through an encryption device to obtain multiple original energy traces generated by the multiple original plaintexts during the encryption process;

[0027] Dividing a plurality of original plaintexts into a plurality of groups according to Hamming weights to obtain a plurality of groups of plaintext data, each group of plaintext data including at least one original plaintext and a corresponding original energy trace;

[0028] Perform a chosen plaintext attack on each group to obtain multiple groups of hypothetical key correlations; each group of hypothetical key correlations is the correlation under each hypothetical key;

[0029] According to the assumed key correlation of each group, a preset number of groups of plaintext data with the greatest correlation are selected from the multiple groups of data;

[0030] From the multiple groups of screened plaintext data, the original plaintext of each group of plaintext data corresponding to the original energy trace that conforms to the normal distribution is determined as the sample plaintext.

[0031] Preferably, the energy trace of the sample plaintext is obtained by:

[0032] For any sample plaintext, outlier detection is performed on multiple original energy traces of the sample plaintext to determine the original energy traces with abnormalities;

[0033] The average of multiple original energy traces is used to replace the original energy trace corresponding to the anomaly, so as to obtain the original energy trace after anomaly detection;

[0034] Performing singular value decomposition denoising on the original energy trace after anomaly detection to obtain the original energy trace after singular value decomposition denoising;

[0035] The original energy trace after singular value decomposition and denoising is subjected to Gaussian mean filtering to obtain the original energy trace after Gaussian mean filtering;

[0036] The original energy trace after Gaussian mean filtering is determined as the energy trace of the corresponding sample plaintext.

[0037] Preferably, performing singular value decomposition denoising processing on the original energy trace after anomaly detection to obtain the original energy trace after singular value decomposition denoising includes:

[0038] Embed all the original energy traces after anomaly detection into the Hankel matrix point by point;

[0039] The Hankel matrix is ​​decomposed into a low-rank signal matrix and a noise sparse matrix by truncated singular value decomposition;

[0040] The low-rank signal matrix is ​​attenuated by damping attenuation to obtain the original energy trace after singular value decomposition and denoising.

[0041] The present invention provides a side channel attack device, comprising:

[0042] An encryption module is used to perform encryption operations on a plurality of sample plaintexts respectively through each of the assumed keys in the assumed key space to obtain an assumed intermediate value matrix; the assumed key space includes a plurality of assumed keys of the encryption device;

[0043] A modeling module is used to perform Hamming weight and uneven weighted bit sum modeling on each element of the assumed intermediate value matrix to generate a assumed energy consumption matrix; each element in the assumed energy consumption matrix represents the correlation between a sample plaintext and a assumed key;

[0044] An analysis module is used to perform correlation analysis on each element of the assumed energy consumption matrix and energy traces corresponding to multiple sample plaintexts to determine a joint decision matrix; the elements in the joint decision matrix represent the correlation ranking of each assumed key and the encryption device;

[0045] An updating module, used for updating the hypothetical key space according to the correlation ranking in the joint decision matrix, and iterating the joint decision matrix through the updated hypothetical key space;

[0046] The determination module is used to determine the hypothetical key with the highest correlation ranking in the joint decision matrix that meets the conditions as the key of the encryption device.

[0047] The present invention provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the side channel attack method is implemented.

[0048] The present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned side channel attack method when executing the program.

[0049] At least one of the above technical solutions adopted by the present invention can achieve the following beneficial effects:

[0050] In the side channel attack method provided by the present invention, a hypothetical energy consumption matrix is ​​generated by modeling the Hamming weight and the unevenly weighted bit sum, and then the modeled hypothetical energy consumption matrix is ​​jointly judged with the energy trace after noise reduction processing to obtain a correlation matrix, and the hypothetical key space is updated using the correlation matrix, so that the hypothetical key in the updated hypothetical key space is used as the basis for subsequent joint judgment. In this way, useful information can be extracted from a small number of samples through the hypothetical energy consumption matrix and the joint judgment, and the hypothetical key space is dynamically updated through the joint judgment matrix, which makes it unnecessary to process all the keys in the subsequent analysis, but can focus on the hypothetical keys that have a greater impact on the judgment result, thereby effectively reducing the sample size requirement. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0052] Figure 1 A schematic diagram of a side channel attack method provided by the present invention;

[0053] Figure 2 A schematic diagram of a flow chart of another side channel attack method provided by the present invention;

[0054] Figure 3 A schematic diagram of a flow chart of another side channel attack method provided by the present invention;

[0055] Figure 4 A schematic diagram of a flow chart of another side channel attack method provided by the present invention;

[0056] Figure 5 A schematic diagram of a flow chart of another side channel attack method provided by the present invention;

[0057] Figure 6 It is a schematic diagram of the effect of selecting a plaintext strategy in a side channel attack method provided by the present invention under a low-noise situation;

[0058] Figure 7 It is a schematic diagram of the effect of selecting a plaintext strategy in a side channel attack method provided by the present invention under a high noise situation;

[0059] Figure 8 It is a schematic diagram of the effect of correlation joint judgment of a side channel attack method provided by the present invention in a low-noise situation;

[0060] Fig. 9 It is a schematic diagram of the effect of correlation joint judgment of a side channel attack method provided by the present invention under high noise conditions;

[0061] Fig.10 It is a schematic diagram of the effect of a key reduction strategy of a side channel attack method provided by the present invention in a low-noise situation;

[0062] Fig.11 It is a schematic diagram of the effect of a key reduction strategy of a side channel attack method provided by the present invention under a high noise situation;

[0063] Fig.12 It is a schematic diagram comparing the success rate of a side channel attack method provided by the present invention with that of a traditional CPA analysis in a low-noise situation;

[0064] Fig.13 This is a schematic diagram comparing the success rate of a side channel attack method provided by the present invention with that of a traditional CPA analysis in a high-noise situation;

[0065] Fig.14 This is a schematic diagram comparing the correlation between a side channel attack method provided by the present invention and a traditional CPA analysis in a low-noise situation;

[0066] Fig.15 This is a schematic diagram comparing the correlation between a side channel attack method provided by the present invention and a traditional CPA analysis in a high noise situation;

[0067] Fig.16 A schematic diagram of a side channel attack device provided by the present invention;

[0068] Fig.17 A schematic diagram of a computer device for implementing a side channel attack method provided by the present invention. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0070] At present, typical chosen plaintext attack methods include collision attack and differential attack, etc. When the implementation code of some Advanced Encryption Standard (AES) algorithms is unknown, it is impossible to establish an accurate leakage model, resulting in the inability to effectively conduct attack experiments.

[0071] In a data set, due to noise interference and other reasons, the measured values ​​are incorrectly observed and recorded, resulting in observation data that deviates greatly from other data values. This type of observation data is called an outlier, also known as an outlier. In the prior art, a variety of outlier detection methods have been proposed for different application scenarios, including statistical parameter methods, time series prediction methods, and data mining methods. The Z-Score outlier detection in the statistical parameter method models the data by assuming a statistical model, and uses statistical parameters to judge the data for abnormalities, also known as the n-times standard deviation rule of thumb. Among them, Z-Score is a statistic that indicates the degree of deviation between the data and the mean, in units of standard deviation. The standard deviation is an indicator that measures the degree of dispersion of data distribution. The larger the value, the higher the degree of dispersion of the data.

[0072] Since the signal and noise are "weakly separable", the signal and noise can be separated through low-rank matrix approximation based on different features. Low-rank matrix approximation (LRMA) refers to the use of the low rank of the signal matrix and the sparsity of the noise matrix to recover the data matrix. Low-rank matrix recovery is a common tool for solving denoising problems in signal processing and image enhancement. The denoising method based on rank reduction theory mainly constructs a special mathematical matrix for the noisy data, and then uses the low-rank approximation (rank reduction) method to reduce the rank of the noisy data to achieve the purpose of removing random interference.

[0073] In cryptographic chips, digital circuits generally use complementary metal oxide semiconductor (CMOS) technology. CMOS circuits mainly produce two side channel leakages: energy consumption and electromagnetic radiation. Both signals inevitably carry noise signals during the acquisition process. Energy analysis attacks use the fact that the energy consumption of cryptographic devices depends on the operations performed by the device and the data processed. Therefore, the energy trace can be subdivided into operation-dependent components and data-dependent components. For each point in the energy trace, it can be characterized as the sum of the operation-dependent component, the data-dependent component, the electronic noise, and the constant component. If the amplitude distribution of a noise follows a Gaussian distribution and its power spectrum density is uniformly distributed, it is called Gaussian white noise. Gaussian filters are a type of linear smoothing filters that select weights based on the shape of the Gaussian function. Gaussian smoothing filters are very effective in suppressing noise that follows a normal distribution.

[0074] The information leakage model maps the internally processed data to the assumed energy by assuming a mapping relationship between the energy of the device and some internal data (such as S-box output or intermediate values ​​in the encryption process). The information leakage models mainly include the Hamming weight model, the Hamming distance model, the bit model and the zero value model. In the Hamming weight model, the energy is assumed to be proportional to the number of bits set in the intermediate value, which can be understood as a multi-bit model with equal weights. The unevenly weighted bit and leakage model is a generalization of the Hamming weight model. It represents the importance of each bit by assigning different weights, which is closer to the actual situation. In noisy data, different bits are affected by noise to different degrees. By assigning specific weights, the influence of strong interference hypothetical keys can be eliminated to a certain extent.

[0075] A discriminator is a statistical tool whose purpose is to determine the most likely correct key among a set of guessed keys. The optimal discriminator refers to a decision model that maximizes the advantage of distinguishing the correct key. Based on the idea of ​​the DPA method, Brier et al. first proposed Correlation Power Analysis (CPA), which is superior to differential energy analysis in terms of attack efficiency, robustness, and experimental data scale. Correlation energy analysis is a powerful method in energy analysis attacks. It analyzes the energy information of encryption devices when performing encryption operations to infer sensitive data such as keys. The theoretical basis of correlation energy analysis is that there is a correlation between the leakage model of the intermediate value of the cryptographic algorithm operation and the feature points contained in the real power consumption trajectory. The signal at a fixed time is analyzed by analyzing the energy leakage when a large number of different data groups are encrypted, and it is regarded as a function related to the processed data, and the key in the cryptographic integrated circuit is recovered based on the leakage. Correlation energy analysis uses the Pearson correlation coefficient to measure the correlation between the assumed power leakage and the real power leakage. Its advantage is that it can obtain its key information without mastering the implementation details of the encryption algorithm in the target device. In addition, even if there is noise in the leakage signal, correlation energy analysis can also obtain key information.

[0076] Based on this, the present invention provides a non-modeling side channel attack method based on filtering noise reduction and dual model joint judgment. First, the obtained energy trace is subjected to selected plaintext analysis to obtain the corresponding plaintext leakage that is most relevant to the encryption process and the key information, and the energy trace after the selected plaintext is successively subjected to outlier detection, singular value decomposition denoising, and Gaussian mean filtering to improve the signal-to-noise ratio of the signal; the plaintext information after the selected plaintext and the assumed key are operated to generate intermediate values, and then the assumed intermediate values ​​are subjected to Hamming weight and uneven weighted bit and dual model modeling to generate an assumed energy consumption matrix; the assumed energy consumption matrix after modeling is subjected to correlation analysis with the signal after noise reduction processing, and the two obtained correlation matrices are jointly judged to determine the recovery key. During the step test, the size ranking of the correlation matrix is ​​updated, and it will be used as the basis for the assumed key space, thereby reducing the overall calculation amount of the side channel attack. The present invention adopts the above-mentioned non-modeling side channel attack method based on filtering noise reduction and dual model joint judgment, and the signal-to-noise ratio of the signal and the key operation intermediate value is greatly improved, and the number of signal samples required for the success of the side channel attack and the calculation time of the step test are successfully reduced.

[0077] The technical solutions provided by various embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0078] Figure 1 The following is a flow chart of a side channel attack method in the present invention, which specifically includes the following steps:

[0079] S101, encrypting multiple sample plaintexts respectively through each hypothetical key in the hypothetical key space to obtain a hypothetical intermediate value matrix; the hypothetical key space includes multiple hypothetical keys of the encryption device.

[0080] First, before conducting a side channel attack, a sample plaintext used in the side channel attack may be determined. The sample plaintext is the corresponding plaintext most relevant to the key information executed by the encryption device during the encryption process.

[0081] In an exemplary embodiment, a method for obtaining sample plaintext includes: encrypting multiple original plaintexts in a plaintext training set through an encryption device to obtain multiple original energy traces generated by the multiple original plaintexts during the encryption process; dividing the multiple original plaintexts into multiple groups according to Hamming weight to obtain multiple groups of plaintext data, each group of plaintext data includes at least one original plaintext and a corresponding original energy trace; performing a chosen plaintext attack on each group to obtain multiple groups of assumed key correlations; each group of assumed key correlations is a correlation under each assumed key; based on the assumed key correlations of each group, a preset number of groups of plaintext data with the largest correlation are screened from the multiple groups of data; finally, from the screened multiple groups of plaintext data, the original plaintext of each group of plaintext data corresponding to the original energy trace that conforms to the normal distribution is determined as the sample plaintext.

[0082] The encryption device is a device whose key needs to be cracked. The encryption device includes a key. When the encryption device encrypts plain text, the plain text is encrypted by the key therein. The assumed key is the key of the assumed encryption device.

[0083] The plaintext training set includes multiple plaintexts. This plaintext is used as the original plaintext. The multiple original plaintexts are encrypted by the encryption device to obtain multiple original energy traces generated by the multiple original plaintexts during the encryption process. The original energy traces include two side channel leakages: energy consumption and electromagnetic radiation. It should be noted that the same original plaintext can be encrypted multiple times to obtain multiple original energy traces corresponding to one original plaintext. Then, the obtained original energy traces are subjected to selected plaintext analysis to obtain the corresponding plaintext leakage that is most relevant to the encryption process and key information.

[0084] Specifically, the number of bits with "1" in each original plaintext is counted, and the original plaintexts with the same number of "1" are taken as a group to obtain multiple groups of plaintext data; then, a chosen plaintext attack (CPA) is performed on each original plaintext and the corresponding original energy trace in each group to obtain multiple groups of assumed key correlations, where the assumed key correlation of each group is the correlation under each assumed key. For example, if there are 256 assumed keys, each group has 256 correlations.

[0085] Then, based on the assumed key correlation of each group, a preset number of groups of plaintext data with the greatest correlation are screened from multiple groups of data, and finally the original plaintext in the plaintext data is determined as the sample plaintext; specifically, based on the assumed key correlation of each group, the original plaintext trace and the original energy trace corresponding to the Hamming weight with the most obvious leakage are screened out; optionally, the screening method can be to obtain the peak value of the assumed key correlation of each group, sort the peak values ​​in order from large to small, and screen out the groups corresponding to the preset number of peak values; finally, in the multiple groups of plaintext data preliminarily screened out, the overall statistical distribution of the original energy trace of each group of plaintext data is analyzed respectively, for example, whether the original energy trace of each group of plaintext data conforms to the normal distribution, and the "P" value is used as the main reference information, and it is considered that the energy trace group greater than the "P" value is closer to the normal distribution, and the original energy trace closer to the normal distribution and the corresponding original plaintext are used as the output of the plaintext selection stage; the original plaintext output at the end is determined as the sample plaintext.

[0086] In an exemplary embodiment, multiple sample plaintexts are encrypted with each hypothetical key in the hypothetical key space to obtain a hypothetical intermediate value matrix, including: for each sample plaintext, the first byte of the sample plaintext is subjected to round key addition and byte replacement operations with each hypothetical key to obtain multiple encrypted sample plaintexts, and then the hypothetical intermediate value matrix is ​​determined based on each encrypted sample plaintext.

[0087] The round key addition operation and the byte replacement operation are both operations in the AES encryption algorithm, and the specific implementation methods are not repeated here in this embodiment; wherein, as shown in formula (1), S is the encrypted sample plaintext.

[0088] S=S box [plaintext^keyspace] (1)

[0089] Among them, S box [.] is the function corresponding to the target operation (byte replacement) of the cryptographic algorithm (AES algorithm), plaintext is the plaintext involved in the operation, and keyspace is the hypothetical key space. The hypothetical key space includes multiple hypothetical keys.

[0090] In essence, this embodiment performs round key addition operations and byte replacement operations on each sample plaintext through each hypothetical key in the hypothetical key space, so as to obtain a hypothetical intermediate value matrix.

[0091] It should be noted that the encryption operation in this embodiment is to encrypt the first byte of the sample plaintext, so the final predicted key is the first byte of the key. The remaining bytes of the key can be divided and conquered by referring to this method to obtain the bytes of the key; for example, if the encryption operation is performed on the second byte of the sample plaintext at this time, the final predicted key is the second byte of the key.

[0092] S102, inputting the assumed intermediate value matrix into the leakage model, performing Hamming weight and uneven weighted bit sum modeling on the assumed intermediate value matrix through the leakage model, and generating a assumed energy consumption matrix.

[0093] Among them, each element in the assumed energy consumption matrix represents the correlation between a sample plaintext and a hypothetical key.

[0094] Specifically, the leakage model includes a Hamming weight energy consumption model and an unevenly weighted bit and energy consumption model; the energy consumption matrix includes a Hamming weight energy consumption matrix and an unevenly weighted bit and energy consumption matrix; the assumed intermediate value matrix is ​​input into the leakage model, and the assumed intermediate value matrix is ​​subjected to Hamming weight and unevenly weighted bit and energy consumption modeling through the leakage model to generate the assumed energy consumption matrix, including: substituting the Hamming weight, proportionality coefficient, and uncorrelated leakage and noise of each element of the assumed intermediate value matrix into the Hamming weight energy consumption model to obtain the Hamming weight energy consumption matrix; substituting each element value of the assumed intermediate value matrix, the corresponding weight, and the constant component and noise component in the actual leakage into the unevenly weighted bit and energy consumption matrix.

[0095] Substitute each element value in the assumed intermediate value matrix into the Hamming weight and the unevenly weighted bit sum model respectively to generate the corresponding assumed energy consumption matrix as the output of the leakage model modeling phase, as shown in formula (2) and formula (3).

[0096] h1=aHW(v)+b (2)

[0097]

[0098] Where h1 is the element value of the Hamming weight energy consumption matrix, v is each element of the assumed intermediate value matrix, usually the function value of the assumed key and encryption operation data, HW is the Hamming weight of v (the number of 1), a is the proportional coefficient of the signal, b is the uncorrelated leakage and noise; h2 is the element value of the unevenly weighted bit and energy consumption matrix, z i For each element value of the assumed intermediate value matrix, usually the i-th bit of the assumed intermediate matrix of the cryptographic algorithm target byte, a i For the corresponding assignment weights, c and n q are the constant component and noise component in the real leakage, and n is the number of bits of the assumed intermediate value matrix.

[0099] S103, performing correlation analysis on each element of the assumed energy consumption matrix and energy traces corresponding to a plurality of sample plaintexts to determine a joint decision matrix; the elements in the joint decision matrix represent the correlation ranking between each assumed key and the encryption device.

[0100] In an exemplary embodiment, the original energy trace corresponding to the sample plaintext can be subjected to outlier detection, singular value decomposition denoising and Gaussian mean filtering in sequence to obtain the original energy trace after denoising, and the original energy trace after denoising is determined as the energy trace corresponding to the sample plaintext.

[0101] Specifically, the method for obtaining the energy trace of the sample plaintext includes: for any sample plaintext, performing outlier detection on multiple original energy traces of the sample plaintext to determine the original energy trace with abnormalities; replacing the original energy trace corresponding to the abnormality with the mean of the multiple original energy traces to obtain the original energy trace after the abnormality detection; performing singular value decomposition denoising processing on the original energy trace after the abnormality detection to obtain the original energy trace after the singular value decomposition denoising; performing Gaussian mean filtering on the original energy trace after the singular value decomposition denoising to obtain the original energy trace after the Gaussian mean filtering; and determining the original energy trace after the Gaussian mean filtering as the energy trace of the corresponding sample plaintext.

[0102] Outlier detection includes taking the original energy trace with a Z-Score absolute value greater than 3 as an outlier (abnormal original energy trace), and then using the mean of the original energy trace under the same plaintext as filling, that is, replacing the abnormal original energy trace with the mean of the original energy trace under the same plaintext.

[0103] Optionally, singular value decomposition denoising is performed on the original energy trace after anomaly detection to obtain the original energy trace after singular value decomposition denoising, including: embedding all the original energy traces after anomaly detection into a Hankel matrix point by point, and then decomposing the Hankel matrix into a low-rank signal matrix and a noise sparse matrix by truncated singular value decomposition; finally, the low-rank signal matrix is ​​attenuated by damping attenuation to obtain the original energy trace after singular value decomposition denoising.

[0104] Specifically, the original energy trace after anomaly detection is embedded into the Hankel matrix point by point, and then the low-rank property of the signal matrix is ​​utilized to decompose the Hankel matrix into a low-rank signal matrix and a noise sparse matrix through truncated singular value decomposition, and the low-rank signal matrix is ​​attenuated by the damping term.

[0105] First, the threshold of the truncated singular value decomposition and the singular value sequence to be retained (arranged from large to small, the large ones are retained) are determined by the hard threshold method, and then the retained singular values ​​are damped and attenuated to obtain the singular diagonal matrix after the truncated singular value damping attenuation, that is, the singular diagonal matrix processed by the damped singular value decomposition method (also including the left singular matrix and the right singular matrix). Finally, the matrix after damped singular value decomposition denoising is obtained by matrix multiplication of the left singular matrix, the singular diagonal matrix and the right singular matrix, and then the matrix after damped singular value decomposition denoising is converted into the original energy trace after singular value decomposition denoising.

[0106] The original energy trace after singular value decomposition denoising is subjected to Gaussian mean filtering of the original energy trace under the same plaintext to obtain the data after Gaussian mean filtering (the original energy trace after denoising) as the final output of the filtering and denoising stage (the energy trace corresponding to the sample plaintext).

[0107] Therefore, a correlation analysis is performed on each element of the assumed energy consumption matrix and the energy traces corresponding to multiple sample plaintexts to determine a joint decision matrix, including: using the Pearson correlation coefficient as a discriminator, performing a correlation analysis on the Hamming weight energy consumption matrix and the energy traces corresponding to multiple sample plaintexts to obtain a first correlation matrix; using the Pearson correlation coefficient as a discriminator, performing a correlation analysis on the unevenly weighted bit and energy consumption matrix and the energy traces corresponding to multiple sample plaintexts to obtain a second correlation matrix; adding the first correlation matrix and the second correlation matrix to obtain a joint decision matrix.

[0108] That is, the two assumed energy consumption matrices are respectively subjected to correlation analysis with the leakage data after noise reduction filtering, and the distinguisher selects the Pearson correlation coefficient. The two correlation matrices are added together as the basis for decision to obtain the recovery key, as shown in formula (4).

[0109] Correlation key =Pearson(AssumPower1, trace)+Pearson(AssumPower2,trace) (4)

[0110] Among them, Correlation M key is the joint decision matrix, Pearson(.) is the function of correlation analysis using the Pearson correlation coefficient as the discriminator, AssumPower1 is the Hamming weight energy consumption matrix, AssumPower2 is the unevenly weighted bit and energy consumption matrix, and trace is the energy trace corresponding to multiple sample plaintexts (the leakage data after denoising filtering).

[0111] S104, updating the hypothetical key space according to the correlation ranking in the joint decision matrix, and iterating through the updated hypothetical key space to obtain the joint decision matrix.

[0112] The element values ​​in the joint decision matrix represent the correlation between the hypothesized keys.

[0113] Optionally, according to the correlation ranking in the joint decision matrix, the hypothetical keys with correlation rankings after a preset number of digits are deleted from the hypothetical key space to update the hypothetical key space, and the joint decision matrix is ​​obtained by iteratively obtaining the updated hypothetical key space.

[0114] Specifically, when performing a step test, the joint decision matrix obtained by the previous correlation analysis will exclude the hypothetical keys with the later ranking according to the size, and the updated hypothetical key space will be used as the hypothetical key input of the previous round of key addition link of this correlation analysis.

[0115] S105, determining the hypothetical key with the highest correlation ranking in the joint decision matrix that meets the preset conditions as the key of the encryption device.

[0116] The preset condition may be that the number of times the joint decision matrix is ​​updated reaches a preset number, and after the joint decision matrix is ​​updated the preset number of times, the hypothetical key with the highest correlation ranking in the joint decision matrix is ​​determined as the key of the encryption device.

[0117] In an exemplary embodiment, the present invention also provides a side channel attack method. Taking the AES encryption algorithm as an example, energy information is collected for the first round of byte replacement part of the algorithm encryption process. The first byte of the key is restored by adopting this method. The remaining bytes of the key can be divided and conquered by referring to the analysis process. Figure 2 As shown, this embodiment includes the following steps:

[0118] S201, obtaining source data, the source data including original plaintext and corresponding energy trace, obtaining sample plaintext and corresponding energy trace from the original plaintext by selecting plaintext.

[0119] Specifically, the original plaintext is grouped according to the Hamming weight, and side channel attacks are carried out on different groups of data to select the plaintext with the most obvious Hamming weight leakage; then, on this basis, the corresponding energy trace of the selected plaintext is selected according to its overall statistical distribution, and some plaintexts that are closer to the normal distribution are selected; among them, the P value of the overall statistical distribution is used as the main reference, and the larger the P value, the closer the corresponding data is to the normal distribution.

[0120] S202, preprocessing the energy trace corresponding to the sample plaintext to obtain a preprocessed energy trace; the preprocessing includes: outlier detection, damped singular value decomposition denoising and Gaussian mean filtering.

[0121] Specifically, Figure 3 As shown in the figure, firstly, the energy trace of the sample plaintext is subjected to outlier detection based on the Z-Score method. When the absolute value of the Z-Score of the observed data is greater than 3, it is considered to be an outlier, and the mean of the leaked data with the same plaintext is used as padding; then, the energy trace is subjected to damped singular value decomposition denoising, and the leaked data used for the attack is embedded into a Hankel matrix point by point. By utilizing the low-rank characteristic of the signal matrix, the original Hankel matrix is ​​decomposed into a low-rank signal matrix and a noise sparse matrix through damped singular value decomposition, and attenuated by the damping term; finally, the energy trace denoised by damped singular value decomposition is subjected to Gaussian mean filtering under the same plaintext to obtain the data after Gaussian mean filtering (the energy trace after preprocessing) as the final output of the filtering and denoising stage.

[0122] S203, perform round key addition operation and byte replacement operation on the sample plaintext and the assumed key in sequence to obtain the corresponding assumed intermediate value matrix; then perform Hamming weight (HW model) and uneven weighted bit sum (UWSB leakage model) dual modeling on the assumed intermediate value matrix to generate a assumed energy consumption matrix.

[0123] Specifically, Figure 4 As shown, the first byte of the sample plaintext and the first byte of the assumed key are subjected to round key addition and byte replacement operations to obtain a hypothetical intermediate value matrix, and then the hypothetical intermediate value matrix is ​​input into the HW model and the UWSB leakage model respectively to obtain two hypothetical energy consumption matrices.

[0124] First, the generated hypothetical intermediate value matrix is ​​modeled based on the Hamming weight model to generate a hypothetical energy consumption matrix 1. In the Hamming weight model, the energy is assumed to be proportional to the number of bits set in the intermediate value, and its definition can be expressed as: h = aHW(v) + b; where v is the hypothetical intermediate value of the cryptographic algorithm, usually the function value of the hypothetical key and encryption operation data, HW is the Hamming weight of v, a is the proportional coefficient of the signal, and b is uncorrelated leakage and noise.

[0125] According to the results of correlation analysis after single-bit model modeling and the mutual information between different bits of the intermediate value, the uneven and weighted bit sum model is weighted, and then the generated hypothetical intermediate value matrix is ​​modeled based on the uneven weighted bit sum model to generate the hypothetical energy consumption matrix 2. The uneven weighted bit sum leakage model is a generalization of the Hamming weight and Hamming distance model, and its definition can be: Among them, z i is the ith bit of the assumed intermediate value of the target byte of the cryptographic algorithm, a i is the corresponding assignment weight, c and n q are the constant component and the noise component in the real leakage.

[0126] S204, input the preprocessed energy trace outputted from S202 and the two assumed energy consumption matrices outputted from S203 into two discriminators with Pearson correlation coefficients, and optimize the data outputted from the two discriminators by weights to output a correlation matrix.

[0127] Specifically, Figure 5 As shown, the preprocessed energy trace and the assumed energy consumption matrix of the HW model are input into the differentiator 1, and the preprocessed energy trace and the assumed energy consumption matrix of the UWSB leakage model are input into the differentiator 2, and the data output by the two differentiators are weighted and optimized to obtain the correlation matrix.

[0128] A correlation analysis is performed on the modeled hypothetical energy consumption matrix and the signal after noise reduction processing, and the two correlation matrices are jointly judged to determine the recovery key. The main feature is that the characteristics of the intermediate value modeling by the two models are combined, and a correlation analysis is performed with the real leakage signal to obtain a more accurate correlation analysis result as the decision basis for recovering the key.

[0129] S205, updating the hypothetical key space according to the size ranking of the correlation matrix, and determining the key of the encryption device according to the size ranking of the correlation matrix.

[0130] S206, during the step test, the size ranking of the correlation matrix is ​​updated and used as the basis for assuming the key space.

[0131] Specifically, the ranking of the correlation matrix size during the step test is updated and used as the basis for the hypothetical key space. The hypothetical keys with low ranking in the correlation matrix are used as non-major interference items, which increases the computational complexity of the overall side channel analysis process. By updating the ranking and screening out the hypothetical keys with low ranking, the overall analysis time of the step test is shortened. Its definition can be: S = S box [plaintext^keyspace], where S box [·] is the function corresponding to the target operation (byte replacement) of the cryptographic algorithm, plaintext is the plaintext involved in the operation, keyspace is the hypothetical key space, and the hypothetical key space will be updated according to the correlation ranking in the step test to exclude hypothetical keys with weak correlation.

[0132] In order to further verify the effectiveness of the side channel attack method provided by the present invention, Figure 6 and Fig.11 As shown, a schematic diagram of the effect of selecting a plaintext strategy in the implementation of the side channel attack method of the present invention in a low-noise situation, a schematic diagram of the effect of selecting a plaintext strategy in the implementation of a high-noise situation, a schematic diagram of the effect of joint judgment based on correlation in the implementation of a low-noise situation, a schematic diagram of the effect of joint judgment based on correlation in the implementation of a high-noise situation, a schematic diagram of the effect of key reduction strategy in the implementation of a low-noise situation, and a schematic diagram of the effect of key reduction strategy in the implementation of a high-noise situation are given.

[0133] Furthermore, the side channel attack method of the present invention can be compared with the traditional CPA method, such as Figure 12-Figure 15 As shown, Fig.12 : is a schematic diagram comparing the success rate of the side channel attack method provided by the present invention with that of the traditional CPA analysis in a low-noise situation. Fig.13 : is a schematic diagram comparing the success rate of the side channel attack method provided by the present invention with that of the traditional CPA analysis in a high noise situation. Fig.14It is a schematic diagram comparing the correlation between the side channel attack method provided by the present invention and the traditional CPA analysis in a low-noise situation. Fig.15 It is a schematic diagram comparing the correlation between the side channel attack method provided by the present invention and the traditional CPA analysis in a high-noise situation.

[0134] It has been experimentally verified that the side channel attack method provided by the present invention can significantly improve the correlation of the correct subkey and greatly reduce the number of samples required to guess the correct subkey. Table 1 is a comparison result between the side channel attack method provided by the present invention and the traditional CPA. From Table 1, it can be concluded that the non-modeling side channel attack method based on filtering noise reduction and dual-model joint judgment helps to reduce the number of samples required to guess the correct subkey and improve the efficiency of the side channel attack.

[0135] Table 1

[0136]

[0137] In summary, the side channel attack method provided by the present invention can better retain the useful information in the side channel signal, improve the correlation of the correct key bytes, and greatly reduce the number of required signal samples.

[0138] Therefore, the present invention adopts the above-mentioned non-modeling side channel attack method based on filtering noise reduction and dual-model joint judgment. The method is used to preprocess the signal data set, and the signal-to-noise ratio of the intermediate value of the signal and the key operation is greatly improved. The efficiency of the side channel attack is greatly improved, and the number of signal samples required for a successful side channel attack is successfully reduced.

[0139] In summary, the side channel attack method of the present invention can efficiently analyze the energy trace of the cryptographic algorithm in the case of low signal-to-noise ratio and strong interference, and obtain a significant improvement in the correlation of the correct key in the noisy energy trace analysis. By modeling the Hamming weight and unevenly weighted bits and dual models, the correlation is jointly judged to make up for the leakage characteristics that are not noticed by a single leakage model, and exclude some of the hypothetical keys that show strong interference after modeling in a single model, thereby improving the accuracy of the correlation analysis and achieving a better recovery effect.

[0140] When applying the side channel attack method provided by the present invention, it is not necessary to Figure 1 The steps are executed in the order shown. The specific execution order of the steps can be determined according to needs, and the present invention does not limit this.

[0141] The above is a side channel attack method provided by one or more embodiments of the present invention. Based on the same idea, the present invention also provides a corresponding side channel attack device, such as Fig.16 shown.

[0142] Fig.16A schematic diagram of a side channel attack device provided by the present invention, the device 1600 includes:

[0143] The encryption module 1601 is used to perform encryption operations on multiple sample plaintexts respectively through each hypothetical key in the hypothetical key space to obtain a hypothetical intermediate value matrix; the hypothetical key space includes multiple hypothetical keys of the encryption device;

[0144] The modeling module 1602 is used to perform Hamming weight and uneven weighted bit sum modeling on each element of the assumed intermediate value matrix to generate an assumed energy consumption matrix; each element in the assumed energy consumption matrix represents the correlation between a sample plaintext and a assumed key;

[0145] The analysis module 1603 is used to perform correlation analysis on each element of the assumed energy consumption matrix and the energy traces corresponding to the plurality of sample plaintexts to determine a joint decision matrix; the elements in the joint decision matrix represent the correlation ranking of each assumed key and the encryption device;

[0146] An updating module 1604 is used to update the assumed key space according to the correlation ranking in the joint decision matrix, and iterate the updated assumed key space to obtain the joint decision matrix;

[0147] The determination module 1605 is used to determine the hypothetical key with the highest correlation ranking in the joint decision matrix that meets the conditions as the key of the encryption device.

[0148] For the specific definition of the side channel attack device, please refer to the definition of the side channel attack method above, which will not be repeated here. Each module in the above-mentioned side channel attack device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0149] The present invention also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 Provided side channel attack method.

[0150] The present invention also provides Fig.17 The structural diagram of the computer device shown in FIG. Fig.17 As shown in the figure, at the hardware level, the computer device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 Provided side channel attack method.

[0151] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0152] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of the present invention.

Claims

1. A side channel attack method, characterized in that: The method comprises: Performing encryption operations on multiple sample plaintexts respectively through each hypothetical key in the hypothetical key space to obtain a hypothetical intermediate value matrix; the hypothetical key space includes multiple hypothetical keys of the encryption device; Inputting the assumed intermediate value matrix into the leakage model, performing Hamming weight and uneven weighted bit sum modeling on the assumed intermediate value matrix through the leakage model, and generating a assumed energy consumption matrix; each element in the assumed energy consumption matrix represents the correlation between a sample plaintext and a assumed key; Performing correlation analysis on each element of the assumed energy consumption matrix and the energy traces corresponding to the plurality of sample plaintexts to determine a joint decision matrix; the elements in the joint decision matrix represent the correlation ranking of each assumed key and the encryption device; According to the correlation ranking in the joint decision matrix, the hypothetical key space is updated, and the joint decision matrix is ​​obtained by iteratively obtaining the updated hypothetical key space; The hypothetical key with the highest correlation ranking in the joint decision matrix that meets the preset conditions is determined as the key of the encryption device.

2. The method according to claim 1, characterized in that The method of encrypting the plurality of sample plaintexts by using each of the assumed keys in the assumed key space to obtain the assumed intermediate value matrix comprises: For each sample plaintext, perform round key addition operation and byte replacement operation on the first byte of the sample plaintext and each hypothetical key respectively, to obtain multiple encrypted sample plaintexts; The assumed intermediate value matrix is ​​determined according to each encrypted sample plaintext.

3. The method according to claim 1, characterized in that The leakage model includes a Hamming weight energy consumption model and an uneven weighted bit sum model; the assumed energy consumption matrix includes a Hamming weight energy consumption matrix and an uneven weighted bit sum energy consumption matrix; the assumed intermediate value matrix is ​​input into the leakage model, and the assumed intermediate value matrix is ​​modeled by the Hamming weight and uneven weighted bit sum through the leakage model to generate the assumed energy consumption matrix, including: Substituting the Hamming weight, proportionality coefficient, and irrelevant leakage and noise of each element of the assumed intermediate value matrix into the Hamming weight energy consumption model to obtain the Hamming weight energy consumption matrix; Each element value of the assumed intermediate value matrix, the corresponding weight, and the constant component and the noise component in the real leakage are respectively substituted into the unevenly weighted bit sum model to obtain the unevenly weighted bit sum energy consumption matrix.

4. The method according to claim 3, characterized in that The step of performing correlation analysis on each element of the assumed energy consumption matrix and the energy traces corresponding to the plurality of sample plaintexts to determine a joint decision matrix includes: Using the Pearson correlation coefficient as a discriminator, a correlation analysis is performed on the Hamming weight energy consumption matrix and the energy traces corresponding to the plurality of sample plaintexts to obtain a first correlation matrix; Using the Pearson correlation coefficient as a discriminator, a correlation analysis is performed on the unevenly weighted bit and energy consumption matrix and the energy traces corresponding to the plurality of sample plaintexts to obtain a second correlation matrix; The first correlation matrix and the second correlation matrix are added together to obtain the joint decision matrix.

5. The method according to claim 1, characterized in that The updating of the hypothetical key space according to the correlation ranking in the joint decision matrix includes: According to the correlation ranking in the joint decision matrix, the hypothetical keys with correlation rankings after a preset number of bits are deleted from the hypothetical key space.

6. The method according to claim 1, characterized in that The method for obtaining the sample plaintext includes: Encrypting multiple original plaintexts in the plaintext training set through the encryption device to obtain multiple original energy traces generated by the multiple original plaintexts during the encryption process; Dividing the plurality of original plaintexts into a plurality of groups according to the Hamming weight to obtain a plurality of groups of plaintext data, each group of plaintext data including at least one original plaintext and a corresponding original energy trace; Perform a chosen plaintext attack on each group to obtain multiple groups of hypothetical key correlations; each group of hypothetical key correlations is the correlation under each hypothetical key; According to the assumed key correlation of each group, a preset number of groups of plaintext data with the greatest correlation are selected from the multiple groups of data; From the multiple groups of screened plaintext data, the original plaintext of each group of plaintext data corresponding to the original energy trace that conforms to the normal distribution is determined as the sample plaintext.

7. The method according to claim 6, characterized in that The method for obtaining the energy trace of the sample plaintext includes: For any sample plaintext, perform outlier detection on multiple original energy traces of the sample plaintext to determine the existence of abnormal original energy traces; Replacing the original energy trace corresponding to the anomaly with the mean value of the multiple original energy traces to obtain the original energy trace after anomaly detection; Performing singular value decomposition denoising processing on the original energy trace after the anomaly detection to obtain the original energy trace after singular value decomposition denoising; Performing Gaussian mean filtering on the original energy trace after singular value decomposition and denoising to obtain the original energy trace after Gaussian mean filtering; The original energy trace after the Gaussian mean filtering is determined as the energy trace of the corresponding sample plaintext.

8. The method according to claim 7, characterized in that The performing singular value decomposition denoising processing on the original energy trace after the anomaly detection to obtain the original energy trace after singular value decomposition denoising includes: embedding all original energy traces after the anomaly detection into a Hankel matrix point by point; The Hankel matrix is ​​decomposed into a low-rank signal matrix and a noise sparse matrix by truncated singular value decomposition; The low-rank signal matrix is ​​attenuated by damping attenuation to obtain the original energy trace after singular value decomposition and denoising.

9. A side channel attack device, characterized in that: include: An encryption module is used to perform encryption operations on a plurality of sample plaintexts respectively through each hypothetical key in the hypothetical key space to obtain a hypothetical intermediate value matrix; The hypothetical key space includes a plurality of hypothetical keys of an encryption device; A modeling module, used for performing Hamming weight and uneven weighted bit sum modeling on each element of the assumed intermediate value matrix to generate a assumed energy consumption matrix; Each element in the assumed energy consumption matrix represents the correlation between a sample plaintext and a hypothetical key; An analysis module, configured to perform correlation analysis on each element of the assumed energy consumption matrix and the energy traces corresponding to the plurality of sample plaintexts to determine a joint decision matrix; the elements in the joint decision matrix represent the correlation ranking of each assumed key and the encryption device; An updating module, used for updating the hypothetical key space according to the correlation ranking in the joint decision matrix, and iterating to obtain the joint decision matrix through the updated hypothetical key space; The determination module is used to determine the hypothetical key with the highest correlation ranking in the joint decision matrix that meets the conditions as the key of the encryption device.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images