Method for detecting fault analysis resistance of Elephant authentication encryption algorithm

Abstract

The invention relates to a method for detecting fault analysis resistance of an Elephant authentication encryption algorithm, which comprises the following steps of: firstly, randomly generating a plaintext to be processed, taking the plaintext M as the input of the Elephant algorithm, importing a random half-byte fault, outputting an error ciphertext, and collecting the plaintext and the ciphertext passing signature verification; the secret mask is exhausted, wrong secret mask candidate bits are eliminated in advance through impossible relation analysis, an intermediate state is calculated, the Hamming weight of the intermediate state is calculated by using a statistical method, and a partial correct value of the secret mask is solved. The fault import and analysis process is repeated, all bits of a correct secret mask can be derived finally, and a correct master key can be derived according to a key arrangement scheme of an algorithm. The method provided by the invention is easy to implement, high in speed and high in accuracy, and an important analysis basis is provided for the security research of the Elephant cryptographic algorithm.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for detecting an Elephant authentication encryption algorithm to resist fault analysis. Background Art

[0002] With the rapid development of information technology and computer networks, the Internet of Things technology has been gradually applied to smart homes, smart manufacturing, smart medical care and other fields, bringing great convenience to people. While the Internet of Things brings convenience to people, the vulnerabilities it faces in information security and other aspects are also increasingly concerned. Based on actual scenarios, how to ensure information security has become a hot topic of research and attention. The Elephant algorithm is one of the final round candidate algorithms for the lightweight cryptographic algorithm standard led by the National Institute of Standards and Technology of the United States. The underlying layer uses the more mature Spongent structure and Keccak-f permutation. Its design security goal is to ensure the confidentiality and authenticity of information at the same time.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that uses faults (such as hardware failures) deliberately introduced during the execution of a cryptographic algorithm to analyze and attack a cryptographic algorithm. This analysis method does not require the attacker to have internal information about the algorithm, but rather infers the weaknesses of the key or algorithm by observing the behavior of the algorithm when a fault occurs. There are currently no reports evaluating the ability of the Elephant Authenticated Encryption Algorithm to resist impossible statistical fault attacks, which leaves a security risk for products that are using the Elephant Authenticated Encryption Algorithm package. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a method for detecting the Elephant authentication encryption algorithm against fault analysis, which can evaluate the ability of the Elephant authentication encryption algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present invention to solve the technical problem is: to provide a method for detecting the Elephant authentication encryption algorithm to resist fault analysis, comprising the following steps:

[0006] Step S1, randomly generate a plaintext message to be processed;

[0007] Step S2, encrypt the plaintext message using the Elephant authenticated encryption algorithm and a fixed master key, and introduce a random 4-bit fault except the all-1 state in the penultimate round of the encryption process to generate multiple fault ciphertexts, and collect each pair of plaintext and ciphertext that pass the signature verification;

[0008] Step S3, according to the fault injection position, the bits of the sub-secret mask of the second-to-last round are enumerated, and the intermediate state value of the fault injection position is reversely inferred from the fault ciphertext in combination with the plaintext and ciphertext that have passed the signature verification;

[0009] Step S4, constructing an impossible analysis path with a probability of 0 based on the impossible value of the 4-bit fault intermediate state, and eliminating erroneous candidate secret mask bits according to the impossible analysis path;

[0010] Step S5, for the intermediate state values ​​obtained by the remaining candidate secret mask bits, using a statistical method to calculate the Hamming weight of the intermediate state value, and find the secret mask bit corresponding to the minimum Hamming weight;

[0011] Step S6, repeating steps S1 to S5 to obtain the secret mask of the penultimate round;

[0012] Step S7: Recover the master key using the penultimate round secret mask according to the key arrangement scheme.

[0013] Between step S2 and step S3, the following steps are also included:

[0014] Determine whether the number of pairs of plaintext and fault ciphertext collected and passed the signature verification reaches the preset number;

[0015] If the number of pairs of the plaintext and the fault ciphertext does not reach the preset number, return to step S1;

[0016] If the number of pairs of the plaintext and the fault ciphertext reaches a preset number, the process goes to step S3.

[0017] The intermediate state value in step S3 is calculated in the following way: in, is the intermediate state value, C and M are a pair of plaintext and ciphertext obtained through signature verification, MASK 79 For the secret mask of the penultimate round, ICOUNT -1 For the 7-bit LFSR inverse operation, SC -1 Replace the inverse operation for the cell, PB -1 is the inverse operation of matrix permutation, It is an XOR operation.

[0018] The impossible analysis path in step S4 is expressed as: in, They represent the j-th bit, 40+j-th bit, 80+j-th bit and 120+j-th bit of the intermediate state value respectively, j∈[0,39].

[0019] In step S7, Recover the master key, where K is the master key, MASK79 The secret mask for the penultimate round, P -1 represents the inverse operation of the permutation function, is the inverse operation of LFSR with parameter r.

[0020] In step S2, the introduction of random 4-bit faults is completed by software simulation method, or laser, electromagnetic and voltage interference means.

[0021] Beneficial Effects

[0022] Due to the adoption of the above technical solution, the present invention has the following advantages and positive effects compared with the prior art: the present invention first randomly generates the plaintext to be processed, and uses the plaintext as the input of the Elephant algorithm, and introduces a random 4-bit fault, the fault position is the penultimate round, outputs the fault ciphertext, and collects the plaintext and ciphertext that pass the signature verification, and uses the characteristics of the bitwise 'and' operation. The 4-bit intermediate state value injected into the fault position cannot be 0b1111, thereby generating an impossible analysis path, excluding some wrong candidate keys in advance, and then using statistical methods to calculate the Hamming weight, find out the correct value of the secret mask part, repeat the introduction of faults and analysis process, and finally derive the correct secret mask, and then according to the key arrangement scheme of the algorithm, the correct master key can be derived. The method provided by the present invention is easy to implement, fast and accurate, and provides an important analysis basis for the security research of the Elephant authentication encryption algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 Flowchart of the steps for testing whether the authenticated encryption algorithm Elephant algorithm is resistant to impossible statistical fault analysis.

[0024] Figure 2 This is the fault propagation diagram for the Elephant algorithm encryption process where statistical fault analysis is not possible.

[0025] Figure 3 This is the structure diagram of the Spongent-π cryptographic algorithm used at the bottom layer of the Elephant authentication encryption algorithm.

[0026] Figure 4 Schematic diagram of the experimental environment for this scheme. DETAILED DESCRIPTION

[0027] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0028] Basic symbol description:

[0029] M: plaintext, M∈{{0,1} 4} 40 ;

[0030] A: associated data, A∈{{0,1} 4} 40 ;

[0031] N: random number, N∈{{0,1} 4} 40 ;

[0032] MASK: secret mask, K∈{{0,1} 4} 40 ;

[0033] MASK r : The secret mask of the rth round, 0≤r≤40;

[0034] C: correct ciphertext, C∈{{0,1} 4} 40 ;

[0035] C: faulty ciphertext, C∈{{0,1} 4} 40 ;

[0036] SC: Cell Substitution Operation;

[0037] PB: matrix permutation operation;

[0038] ICOUNT: 7-bit LFSR operation;

[0039] LFSR r : LFSR operation, parameter is r;

[0040] SC -1 : The cell replaces the inverse operation;

[0041] PB -1 : Inverse matrix permutation operation;

[0042] ICOUNT -1 : 7-bit LFSR inverse operation;

[0043] LFSR r -1 : LFSR inverse operation, parameter is r;

[0044] GS: S box;

[0045] The intermediate state of the rth round, 0≤r≤40;

[0046] The intermediate state of the rth round after differential calculation, 0≤r≤40;

[0047] T: tag value;

[0048] T i : After grouping by candidate key, the i-th label value of each group, 0≤i≤150;

[0049] E: encryption round transformation step;

[0050] P: n-position permutation function;

[0051] P -1 : n-bit inverse permutation function;

[0052] XOR operation;

[0053] ||: Cascade

[0054] Figure 1 A flowchart of a key leakage detection method based on impossible statistical fault analysis of the authenticated encryption algorithm Elephant provided in an embodiment of the present invention includes the following steps:

[0055] Step 1: Randomly generate a plaintext message to be processed, denoted as M∈{{0,1} 4} 40 .

[0056] Step 2: Encrypt the plaintext message M using the Elephant authenticated encryption algorithm and a fixed master key K, and Figure 3 ) introduces a random 4-bit fault except the all-1 state in the penultimate round, generating multiple faulty ciphertexts And collect each pair of plaintext M and ciphertext C that pass the signature verification. In this step, in order to ensure the accuracy of the experimental results, it is necessary to strictly control the experimental environment to obtain the corresponding output. The specific operation method is as follows: input the random number N, the associated data A and the plaintext message M, introduce a fault during the operation of the Elephant algorithm, and then obtain the wrong ciphertext and label T. Since the Elephant authenticated encryption algorithm has an authentication mechanism, encryption and authentication are required in software simulation. The wrong ciphertext will be output only after the label verification is successful. And label T, so the collected labels T are all label values ​​affected by invalid faults, and each label includes a pair of plaintext M and ciphertext C.

[0057] In this step, you can choose Figure 4The experimental environment shown in the figure uses a computer to generate the input plaintext M of Elephant, and processes and analyzes the output of the input plaintext after the Elephant algorithm. The device that encapsulates the Elephant algorithm is used to process the input message and obtain the corresponding output result. The device that imports the fault is used to perform the import fault action, which will be performed during the operation of the Elephant algorithm to obtain the output of the error ciphertext C and the label value. The device that imports the fault can complete the introduction of random 4-bit faults through software simulation methods, or laser, electromagnetic and voltage interference methods.

[0058] Step 3: Determine whether the number of collected plaintexts and faulty ciphertexts that have passed signature verification has reached a preset number. If not, repeat steps 1 to 2 until enough plaintexts M and ciphertexts C are obtained. The preset number in this embodiment is 150. If reached, proceed to step 4.

[0059] Step 4: Calculate the intermediate state. Assume that the random fault injection position is Figure 2 As shown, by exhaustively enumerating the sub-secret mask MASK of the penultimate round 79 The 4 bits of the intermediate state value are obtained by the following formula:

[0060]

[0061] This allows you to obtain the intermediate status value of the import fault location

[0062] Step 5: Perform impossible relationship analysis. Combined with the characteristics of the bitwise "AND" operation, the 4-bit intermediate state value injected into the fault position cannot be 0b1111. Therefore, an impossible analysis path is constructed, which is expressed as:

[0063]

[0064] in, They represent the jth bit, 40+jth bit, 80+jth bit and 120+jth bit of the intermediate state value respectively. By using the impossible analysis path with a probability of 0, some incorrect candidate keys can be eliminated in advance, thereby effectively reducing the key search space and improving the analysis efficiency.

[0065] Step 6: For the intermediate state values ​​obtained from the remaining candidate sub-secret mask bits, use statistical methods to calculate the intermediate state values The Hamming weight represents the number of '1's contained in the binary form of the intermediate state. For example, when The binary representation of 38 is 100110, then The Hamming weight of is 3. Different sub-secret mask bits are distinguished by counting the number of '1's in the binary string, where the minimum value corresponds to the correct sub-secret mask bit. 4 bits in A group of intermediate state values ​​with the smallest Hamming weight value is selected, and the bit candidate values ​​of the sub-secret mask corresponding to the group of intermediate state values ​​are 4 bits of the correct sub-secret mask.

[0066] Step 7: Repeat steps 1 to 6, and the import position of each fault is different from the previous one, so that the sub-secret mask MASK can be obtained 79 All bits of .

[0067] Step 8: Master key recovery. The Elephant algorithm is based on the Spongent-π key arrangement scheme with a block length of 160 bits. The master key K is deduced by the formula:

[0068]

[0069] Among them, P -1 Represents the inverse operation of the permutation function.

[0070] Using the above analysis method, the present invention simulates the import failure and the Elephant authentication encryption algorithm processing process on a computer with Intel (R) Core (TM) i7-8565U CPU @ 1.80GHz 1.99GHz 8GB memory using the IDEA development tool, and repeats the execution 2000 times. The experimental results show that the above detection method is accurate. The method provided by the present invention is easy to implement, fast and accurate, and has important significance for the security research of the Elephant authentication encryption algorithm.

Claims

1. A method for detecting the Elephant authentication encryption algorithm against fault analysis, characterized in that: The following steps are involved: Step S1, randomly generate a plaintext message to be processed; Step S2, encrypt the plaintext message using the Elephant authenticated encryption algorithm and a fixed master key, and introduce a random 4-bit fault except the all-1 state in the penultimate round of the encryption process to generate multiple fault ciphertexts, and collect each pair of plaintext and ciphertext that pass the signature verification; Step S3, according to the fault injection position, the bits of the sub-secret mask of the second-to-last round are enumerated, and the intermediate state value of the fault injection position is reversely inferred from the fault ciphertext in combination with the plaintext and ciphertext that have passed the signature verification; Step S4, constructing an impossible analysis path with a probability of 0 based on the impossible value of the 4-bit fault intermediate state, and eliminating erroneous candidate sub-secret mask bits according to the impossible analysis path; Step S5, for the intermediate state values ​​obtained by the remaining candidate sub-secret mask bits, using a statistical method, calculate the Hamming weight of the intermediate state value, and find the sub-secret mask bit corresponding to the minimum Hamming weight; Step S6, repeating steps S1 to S5 to obtain the penultimate round of sub-secret masks; Step S7, recovering the master key using the penultimate round of sub-secret mask according to the key arrangement scheme.

2. The method for detecting the Elephant authentication encryption algorithm against fault analysis according to claim 1, characterized in that: Between step S2 and step S3, the following steps are also included: Determine whether the number of pairs of plaintext and fault ciphertext collected and passed the signature verification reaches the preset number; If the number of pairs of the plaintext and the fault ciphertext does not reach the preset number, return to step S1; If the number of pairs of the plaintext and the fault ciphertext reaches a preset number, the process goes to step S3.

3. The method for detecting the Elephant authentication encryption algorithm against fault analysis according to claim 1, characterized in that: The intermediate state value in step S3 is calculated in the following way: in, is the intermediate state value, C and M are a pair of plaintext and ciphertext obtained through signature verification, MASK 79 For the penultimate round of sub-secret masks, ICOUNT -1 For the 7-bit LFSR inverse operation, SC -1 PB is used to replace the inverse operation for the cell. -1 is the inverse operation of matrix permutation, It is an XOR operation.

4. The method for detecting the Elephant authentication encryption algorithm against fault analysis according to claim 1, characterized in that: The impossible analysis path in step S4 is expressed as: in, They represent the j-th bit, 40+j-th bit, 80+j-th bit and 120+j-th bit of the intermediate state value respectively, j∈[0,39].

5. The method for detecting the Elephant authentication encryption algorithm against fault analysis according to claim 1, characterized in that: In step S7, Recover the master key, where K is the master key, MASK 79 is the sub-secret mask of the penultimate round, P -1 represents the inverse operation of the permutation function, is the inverse operation of LFSR with parameter r.

6. The method for detecting the Elephant authentication encryption algorithm against fault analysis according to claim 1, characterized in that: In step S2, the introduction of random 4-bit faults is completed by software simulation method, or laser, electromagnetic and voltage interference means.

Images