A method for detecting that elephant authentication encryption algorithm resists fault analysis

Abstract

The application relates to a method for detecting that an Elephant authentication encryption algorithm resists fault analysis. First, a plaintext to be processed is randomly generated, the plaintext M is taken as an input of the Elephant algorithm, a random half-byte fault is introduced, error ciphertext is output, and the plaintext and the ciphertext passing signature verification are collected. Secret masks are exhausted, error secret mask candidate bits are excluded in advance through impossible relation analysis, an intermediate state is calculated, the Hamming weight of the intermediate state is calculated through a statistical method, and part of correct values of the secret mask are obtained. The fault introduction and the analysis process are repeated, finally, all bits of the correct secret mask can be deduced, and the correct master key can be deduced according to a key arrangement scheme of the algorithm. The method provided by the application is easy to implement, fast and high in accuracy, and provides an important analysis basis for the security research of the Elephant password algorithm.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a method for detecting resistance of an Elephant authentication encryption algorithm to fault analysis. BACKGROUND

[0002] With the rapid development of information technology and computer networks, Internet of Things technology is gradually applied to smart home, intelligent manufacturing and smart medical care, etc., which brings great convenience to people. While the Internet of Things brings convenience to people, the vulnerabilities in information security and other aspects are increasingly concerned. Based on the actual scene, how to protect information security has become a hot spot of research and concern. Elephant algorithm is one of the final round candidate algorithms of the lightweight cryptographic algorithm standard led by the National Institute of Standards and Technology of the United States, which uses a relatively mature Spongent structure and Keccak-f permutation at the bottom. Its design security goal is to ensure the confidentiality and authenticity of information at the same time.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that uses deliberately introduced faults (such as hardware faults) during the execution of a cryptographic algorithm to analyze and attack the algorithm. This analysis method does not require the attacker to have internal information of the algorithm, but infers the weakness of the key or algorithm by observing the behavior of the algorithm when a fault occurs. There is no related report on the evaluation of the ability of Elephant authentication encryption algorithm to resist impossible statistical fault attacks, which leaves a security risk for products that are using Elephant authentication encryption algorithm encapsulation. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a method for detecting resistance of an Elephant authentication encryption algorithm to fault analysis, which can evaluate the ability of the Elephant authentication encryption algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present application to solve the technical problem is: a method for detecting resistance of an Elephant authentication encryption algorithm to fault analysis is provided, comprising the following steps:

[0006] Step S1, randomly generating a plaintext message to be processed;

[0007] Step S2, using the Elephant authentication encryption algorithm and a fixed master key to encrypt the plaintext message, and introducing a random 4-bit fault except the all-1 state in the second-to-last round of the encryption process, to generate a plurality of fault ciphertexts, and collecting each pair of plaintext and ciphertext that passes the signature verification;

[0008] Step S3, according to the fault injection position, the bits of the last round of the sub-secret mask are enumerated, and the intermediate state value of the fault injection position is inversely deduced from the plaintext and the ciphertext verified by the fault ciphertext;

[0009] Step S4, based on the 4-bit fault intermediate state impossible value, a impossible analysis path with a probability of 0 is constructed, and the wrong candidate secret mask bits are excluded according to the impossible analysis path;

[0010] Step S5, for the intermediate state value obtained by the remaining candidate secret mask bits, the Hamming weight of the intermediate state value is calculated by using statistical method, and the secret mask bits corresponding to the minimum Hamming weight are found out;

[0011] Step S6, steps S1-S5 are repeated to obtain the last round of the secret mask;

[0012] Step S7, according to the key arrangement scheme, the main key is recovered by using the last round of the secret mask.

[0013] Between the step S2 and the step S3, further comprising:

[0014] Determine whether the number of the collected plaintext and fault ciphertext pairs verified by the signature reaches a preset number;

[0015] If the number of the plaintext and fault ciphertext pairs does not reach the preset number, return to step S1;

[0016] If the number of the plaintext and fault ciphertext pairs reaches the preset number, enter step S3.

[0017] The intermediate state value in the step S3 is calculated by the following way: Wherein, is the intermediate state value, C and M are a pair of plaintext and ciphertext obtained by verification, MASK 79 is the last round of the secret mask, ICOUNT -1 is the 7-bit LFSR inverse operation, SC -1 is the cell replacement inverse operation, PB -1 is the matrix permutation inverse operation, is the exclusive or operation.

[0018] The impossible analysis path in the step S4 is represented as: Wherein, respectively represent the jth bit, the 40+jth bit, the 80+jth bit and the 120+jth bit of the intermediate state value, j∈[0, 39].

[0019] In the step S7, the last round of the secret mask is used to recover the main key, wherein K is the main key, and MASK79 P is the penultimate round secret mask, -1 denotes the inverse operation of the permutation function, is the LFSR inverse operation with parameter r.

[0020] The step S2 is completed by a method of software simulation, or laser, electromagnetic and voltage interference means.

[0021] Advantages

[0022] Compared with the prior art, the present application has the following advantages and positive effects: the present application firstly generates a plaintext to be processed at random, takes the plaintext as an input of the Elephant algorithm, introduces a random 4-bit fault, the fault position is the penultimate round, outputs a fault ciphertext, collects the plaintext and ciphertext passed by signature verification, uses the feature of bitwise 'and' operation, the 4-bit intermediate state value at the fault position cannot be 0b1111, thereby generating an impossible analysis path, and part of the wrong candidate keys are excluded in advance, then the statistical method is used to calculate the Hamming weight, the secret mask part of the correct value is calculated, the fault introduction and analysis process are repeated, and finally the correct secret mask can be deduced, and according to the key arrangement scheme of the algorithm, the correct master key can be deduced. The method provided by the present application is easy to implement, fast and accurate, and provides an important analysis basis for the security research of the Elephant authentication encryption algorithm. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 A step flow chart for detecting whether the authentication encryption algorithm Elephant algorithm resists impossible statistical fault analysis.

[0024] Figure 2 A fault propagation diagram for impossible statistical fault analysis in the Elephant algorithm encryption process.

[0025] Figure 3 A structure diagram of the Spongent-pi cipher algorithm used by the Elephant authentication encryption algorithm.

[0026] Figure 4 A schematic diagram of the experimental environment of the present scheme. DETAILED DESCRIPTION

[0027] The present application will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present application and not used to limit the scope of the present application. In addition, it should be understood that after reading the content taught by the present application, those skilled in the art can make various modifications or changes to the present application, and these equivalent forms also fall within the scope defined by the appended claims of the present application.

[0028] Basic Notation:

[0029] M: plaintext, M e {{0,1} 4} 40 ;

[0030] A: associated data, A e {{0,1} 4} 40 ;

[0031] N: random number, N e {{0,1} 4} 40 ;

[0032] MASK: secret mask, K e {{0,1} 4} 40 ;

[0033] MASK r : r-th round secret mask, 0≤r≤40;

[0034] C: correct ciphertext, C e {{0,1} 4} 40 ;

[0035] C: faulty ciphertext, C e {{0,1} 4} 40 ;

[0036] SC: cell substitution operation;

[0037] PB: matrix permutation operation;

[0038] ICOUNT: 7-bit LFSR operation;

[0039] LFSR r : LFSR operation, parameter r;

[0040] SC -1 : cell substitution inverse operation;

[0041] PB -1 : matrix permutation inverse operation;

[0042] ICOUNT -1 : 7-bit LFSR inverse operation;

[0043] LFSR r -1 : LFSR inverse operation, parameter r;

[0044] GS: S-box;

[0045] r-th round intermediate state, 0≤r≤40;

[0046] The intermediate state of the rth round after differential calculation, 0≤r≤40;

[0047] T: tag value;

[0048] T i : the ith tag value of each group after grouping by candidate key, 0≤i≤150;

[0049] E: encryption round transformation step;

[0050] P: n-position exchange function;

[0051] P -1 : n-bit inverse permutation function;

[0052] XOR operation;

[0053] ||: concatenation

[0054] Figure 1 The authentication encryption algorithm Elephant provided by the embodiment of the application is based on the step flowchart of the key leakage detection method of impossible statistical fault analysis, which includes the following steps:

[0055] Step 1: randomly generate a plaintext message to be processed, denoted as M∈{{0,1} 4} 40 .

[0056] Step 2: encrypt the plaintext message M using the Elephant authentication encryption algorithm and a fixed master key K, and introduce a random 4-bit fault except the all-1 state in the second-to-last round of the encryption process (see Figure 3 ) to generate a plurality of fault ciphertexts and collect each pair of plaintext M and ciphertext C verified by signature. In this step, in order to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output. The specific operation method is as follows: input a random number N, associated data A and plaintext message M, introduce a fault in the Elephant algorithm running process, and then obtain the error ciphertext and the tag T. Since the Elephant authentication encryption algorithm has an authentication mechanism, two steps of encryption and authentication are required when simulating in software. Only when the tag verification is successful, the error ciphertext and the tag T will be output, so the collected tags T are all tag values affected by invalid faults, and each tag includes a pair of plaintext M and ciphertext C.

[0057] This step can be selected as Figure 4The experimental environment shown, wherein the computer is used to generate the input plaintext M of Elephant, and process and analyze the output results after the input plaintext is processed by Elephant algorithm; the device encapsulating Elephant algorithm is used to process the input message and obtain the corresponding output results; the device introducing faults is used to perform the introduction of faults, and the introduction of faults is performed in the process of running Elephant algorithm, and then the error ciphertext C and the output of the label value are obtained. The device introducing faults can complete the introduction of random 4-bit faults by software simulation method, or laser, electromagnetic and voltage interference means.

[0058] Step 3: Determine whether the number of pairs of plaintexts and fault ciphertexts collected by signature verification reaches the preset number, if not, repeat steps 1 to 2 until enough plaintexts M and ciphertexts C are obtained, and the preset number of the embodiment is 150; if yes, go to step 4.

[0059] Step 4: Calculate the intermediate state. Assuming that the random fault injection position is as shown in Figure 2 , the intermediate state value is obtained by enumerating the last but one round of 4-bit sub-secret mask MASK 79 , and the formula is as follows:

[0060]

[0061] Thus the intermediate state value of the fault injection position can be obtained

[0062] Step 5: Perform impossible relation analysis, and according to the characteristics of bitwise "and" operation, the 4-bit intermediate state value of the fault injection position cannot be 0b1111, so an impossible analysis path is constructed, which is represented as:

[0063]

[0064] Wherein, respectively represent the jth bit, 40+jth bit, 80+jth bit and 120+jth bit of the intermediate state value. By using the impossible analysis path with a probability of 0, part of the wrong candidate keys are excluded in advance, thereby effectively reducing the key search space and accelerating the analysis efficiency.

[0065] Step 6: For the intermediate state value obtained by the remaining candidate sub-secret mask bits, the Hamming weight of the intermediate state value is calculated by using statistical method. The Hamming weight represents the number of '1' contained in the binary form of the intermediate state. For example, when the binary representation of 38 is 100110, then The hamming weight of is 3. Different sub-secret mask bits are distinguished by calculating the number of '1' in the binary string, wherein the minimum value corresponds to the correct sub-secret mask bit. Each group of 4 bits in The intermediate state value with the minimum hamming weight value is selected, and the candidate value of the corresponding sub-secret mask bit is the correct 4-bit sub-secret mask.

[0066] Step 7: Steps 1 to 6 are repeated, and the introduction position of each fault is different from the previous one, so that all bits of the sub-secret mask MASK 79 can be obtained.

[0067] Step 8: Master key recovery. The Elephant algorithm is based on the Spongent-pi key arrangement scheme with a group length of 160 bits, and the master key K is inversely deduced, and the formula is

[0068]

[0069] Wherein, P -1 represents the inverse operation of the permutation function.

[0070] By using the above analysis method, the present application uses the IDEA development tool to simulate the introduction of faults and the Elephant authentication encryption algorithm processing process on an Intel(R) Core(TM) i7-8565U CPU@1.80GHz 1.99GHz 8GB memory computer, and the experiment is repeated 2000 times. The experimental results show that the above detection method is accurate. The method provided by the present application is easy to implement, fast and accurate, and has important significance for the security research of the Elephant authentication encryption algorithm.​

Claims

1. A method for fault analysis of the Elephant authentication encryption algorithm, characterized in that, Includes the following steps: Step S1: Randomly generate plaintext messages to be processed; Step S2: Encrypt the plaintext message using the Elephant authentication encryption algorithm and a fixed master key. In the penultimate round of the encryption process, a random 4-bit fault (excluding the all-1 state) is introduced to generate multiple fault ciphertexts. Each pair of plaintext and fault ciphertext that passes the signature verification is collected. Step S3: Based on the fault injection position, the intermediate state value of the fault injection position is deduced by enumerating the bits of the penultimate round of the sub-secret mask and combining the plaintext verified by the signature with the fault ciphertext. Step S4: The 4-bit intermediate state value injected at the fault location cannot be 0b1111. Construct an impossible analysis path and exclude erroneous candidate sub-secret mask bits based on the impossible analysis path. Step S5: For the intermediate state values ​​obtained from the remaining candidate sub-secret mask bits, use statistical methods to calculate the Hamming weight of the intermediate state values ​​and find the sub-secret mask bit corresponding to the minimum Hamming weight. Step S6: Repeat steps S1-S5 to obtain the penultimate round of sub-secret mask; Step S7: Recover the master key using the penultimate round of sub-secret mask according to the key arrangement scheme.

2. The method for detecting and analyzing the Elephant authentication encryption algorithm's resistance to faults according to claim 1, characterized in that, Between steps S2 and S3, the following is also included: Determine whether the number of logarithmic plaintexts and faulty ciphertexts collected that have passed verification has reached the preset quantity; If the logarithm of the plaintext and the faulty ciphertext does not reach the preset number, return to step S1; If the logarithm of the plaintext and the faulty ciphertext reaches a preset number, proceed to step S3.

3. The method for detecting fault resistance analysis of the Elephant authentication encryption algorithm according to claim 1, characterized in that, The intermediate state value in step S3 is calculated in the following way: in, The MASK is an intermediate state value, where C and M are a pair of plaintext and fault ciphertext obtained through signature verification. 79 For the penultimate round's sub-secret mask, ICOUNT -1 For the inverse operation of a 7-bit LFSR, SC -1 PB replaces the inverse operation for the information cell. -1 This is the inverse operation of matrix permutation. This is an XOR operation.

4. The method for detecting fault resistance analysis of the Elephant authentication encryption algorithm according to claim 3, characterized in that, The impossible analysis path in step S4 is represented as follows: in, These represent the j-th, 40+j-th, 80+j-th, and 120+j-th bits of the intermediate state value, respectively, where j∈[0,39].

5. The method for detecting fault resistance analysis of the Elephant authentication encryption algorithm according to claim 1, characterized in that, The method used in step S7 Recover the master key, where K is the master key and MASK is the master key. 79 For the penultimate round's sub-secret mask, P -1 This represents the inverse operation of the permutation function. This is the inverse operation of LFSR with parameter r.

Images