Key leakage detection method for LEA lightweight cryptographic algorithm

Abstract

The invention relates to a key leakage detection method for an LEA lightweight cryptographic algorithm, and the method comprises the steps: firstly, randomly generating a plaintext to be processed, taking the plaintext as the input of the LEA algorithm, importing a random 4-bit fault in the last but one round, and outputting a fault ciphertext; the key bit corresponding to the last round of key is exhausted, wrong candidate key bits are eliminated in advance through impossible relation analysis, an intermediate state is calculated, the Hamming weight of the intermediate state is calculated by using a statistical method, and the correct value of the corresponding round of key is solved. The fault import and analysis process is repeated, the correct last round of key can be derived finally, and the correct master key is derived according to the key arrangement scheme of the algorithm. The method provided by the invention is easy to implement, high in speed and high in accuracy, and an important analysis basis is provided for the security research of the LEA cryptographic algorithm.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a key leakage detection method of a LEA lightweight cryptographic algorithm. Background Art

[0002] With the rapid development of computer and communication technology, smart home, smart medical care and smart transportation have gradually covered all aspects of people's lives, making people's lives more convenient and efficient, but this has also brought new information security challenges. Since these IoT devices are usually small in size and low in computing power, traditional cryptographic algorithms are difficult to balance security and efficiency. Therefore, lightweight cryptographic algorithms with fast encryption speed and low resource consumption have gradually become a hot topic of research and attention. The LEA cryptographic algorithm was proposed by Hong et al. at the WISA conference in 2013 and was selected as one of the three lightweight cryptographic standards of the International Organization for Standardization and the International Electrotechnical Commission in 2019. It is suitable for high-speed computing and resource-constrained environments. The LEA cryptographic algorithm adopts an ARX structure with a block length of 128 bits, a key length of 128, 192 and 256 bits, and the corresponding encryption rounds are 24, 28 and 32 rounds respectively. The encryption and decryption process uses modular addition, XOR and shift operations.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that uses faults (such as hardware failures) deliberately introduced during the execution of a cryptographic algorithm to analyze and attack the cryptographic algorithm. This analysis method does not require the attacker to have internal information about the algorithm, but rather infers the weaknesses of the key or algorithm by observing the behavior of the algorithm when a fault occurs. There are currently no reports evaluating the ability of the LEA cryptographic algorithm to resist impossible statistical fault attacks, which leaves a security risk for products that are using the LEA cryptographic algorithm package. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a key leakage detection method for the LEA lightweight cryptographic algorithm, which can evaluate the ability of the LEA cryptographic algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present invention to solve the technical problem is: to provide a key leakage detection method of the LEA lightweight cryptographic algorithm, comprising the following steps:

[0006] Step S1, randomly generate a plaintext message;

[0007] Step S2, encrypt the plaintext message using the LEA cryptographic algorithm and a fixed master key, and introduce a random 4-bit fault except the all-1 state in the penultimate round of encryption to generate a fault ciphertext;

[0008] Step S3, according to the fault injection position, the intermediate state value of the fault injection position is reversely inferred from the fault ciphertext by enumerating the bit key bits in each bit data block in the subkey of the last round;

[0009] Step S4, constructing an impossible analysis path with a probability of 0 based on the impossible value of the 4-bit fault intermediate state, and eliminating erroneous candidate bit key positions according to the impossible analysis path;

[0010] Step S5, for the intermediate state values ​​calculated from the remaining candidate bit key positions, using a statistical method, find the Hamming weight of the intermediate state value, and find the bit key position in each bit data block in the subkey corresponding to the minimum Hamming weight;

[0011] Step S6, repeating steps S1 to S5 to obtain the subkey of the last round;

[0012] Step S7, according to the key arrangement scheme, use the subkeys of the last round to perform successive inverse operations to obtain the subkeys of the first round, and use the subkeys of the first round to restore the master key.

[0013] Between step S2 and step S3, the following steps are also included:

[0014] Determine whether the number of faulty ciphertexts reaches a preset number;

[0015] If the number of the faulty ciphertexts does not reach the preset number, return to step S1;

[0016] If the number of the faulty ciphertexts reaches a preset number, the process proceeds to step S3.

[0017] The intermediate state value in step S3 is calculated in the following way: in, is the intermediate state value, are four bit data blocks of the ciphertext, They are the bit key bits in each bit data block in the last round of subkeys, <<< is a circular left shift, and >>> is a circular right shift. Modulo 2 32 Subtraction operation, It is an XOR operation.

[0018] The impossible analysis path is expressed as: in, The four bits of data of the intermediate state value respectively; || is the connection operation, It is an XOR operation.

[0019] In step S7, Recover the master key, where K is the master key, are the bit key bits in each bit data block in the first round of subkeys, δ 0 is the constant used in the first round of the LEA cipher algorithm, <<< is a circular left shift, >>> is a circular right shift, || is a concatenation operation, Modulo 2 32 Subtraction operation.

[0020] In step S2, the introduction of random 4-bit faults is completed by software simulation method, or laser, electromagnetic and voltage interference means.

[0021] Beneficial Effects

[0022] Due to the adoption of the above technical solution, the present invention has the following advantages and positive effects compared with the prior art: the present invention first randomly generates a plaintext to be processed, denoted as P∈{{0,1} 32} 4 , and use the plaintext P as the input of the LEA algorithm, introduce a random 4-bit fault, the fault position is the second to last round, and output the fault ciphertext By using the characteristics of bitwise 'AND' operation, the 4-bit intermediate state value injected into the fault position cannot be 0b1111, thereby generating an impossible analysis path, eliminating some wrong candidate keys in advance, and then using statistical methods to calculate the Hamming weight, find out the correct value of the round key part, repeat the fault introduction and analysis process, and finally derive the correct round key, and then derive the correct master key according to the key arrangement scheme of the algorithm. The method provided by the present invention is easy to implement, fast and accurate, and provides a good analysis basis for detecting the ability of the LEA cryptographic algorithm to resist impossible statistical fault attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A flowchart of the steps for testing whether the cryptographic algorithm LEA is resistant to impossible statistical fault attacks;

[0024] Figure 2 It is the fault propagation graph of the LEA algorithm encryption process where statistical fault attacks are impossible;

[0025] Figure 3 This is the detailed structure diagram of the LEA cryptographic algorithm;

[0026] Figure 4 Schematic diagram of the experimental environment for this scheme. DETAILED DESCRIPTION

[0027] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0028] Basic symbol description

[0029] P: Plain text, consisting of four 32-bit data blocks, denoted as: P = P 0 ||P 1 ||P 2 ||P 3 , the total length is 128 bits, that is, P∈{{0,1} 32} 4 ;

[0030] The fault ciphertext consists of four 32-bit data blocks, denoted as: The total length is 128 bits, that is

[0031] K: master key, composed of four 32-bit data blocks, denoted as: K = K 0 ||K 1 ||K 2 ||K 3 , the total length is 128 bits, that is, K∈{{0,1} 32} 4 ;

[0032] R r : The r+1th round subkey consists of 6 32-bit data blocks, denoted as: The total length is 192 bits, namely RK r ∈{{0,1} 32} 6 , where 0≤r≤23;

[0033] X r : The intermediate state value of the r+1th round consists of four 32-bit data blocks, denoted as: Where 0≤r≤23;

[0034] XOR operation;

[0035] Module 2 32 Addition operation;

[0036] Module 2 32 Subtraction operation;

[0037] ||: connection operation;

[0038] >>>: Circular right shift operation;

[0039] <<<: Circular left shift operation

[0040] Figure 1 A flowchart of a method for detecting a LEA cryptographic algorithm against an impossible statistical failure attack provided by an embodiment of the present invention, comprising the following steps:

[0041] Step 1: Randomly generate a plaintext message P.

[0042] Step 2: Use the LEA cryptographic algorithm (see Figure 3 ) Encrypt the plaintext message P with a fixed master key K, and introduce a random 4-bit fault other than the all-1 state in the penultimate round of encryption to generate the fault ciphertext In this step, in order to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output. The specific operation method is as follows: input the plaintext message P, introduce the fault during the operation of the LEA algorithm, and then obtain the fault ciphertext

[0043] In this step, you can choose Figure 4 The experimental environment shown in the figure uses a computer to generate the input plaintext message P of LEA, and processes and analyzes the output result of the input plaintext after the LEA algorithm; the device encapsulating the LEA algorithm is used to process the input message and obtain the corresponding output result; the device for importing faults is used to perform the import fault action, which will be performed during the operation of the LEA algorithm to obtain the output of the fault ciphertext. The device for importing faults can complete the introduction of random 4-bit faults through software simulation methods, or laser, electromagnetic and voltage interference methods.

[0044] Step 3: Determine whether the number of faulty ciphertexts reaches the preset number. If not, repeat steps 1 to 2 until the preset number of faulty ciphertexts is obtained. The preset number in this embodiment is 200. If the number is reached, proceed to step 4.

[0045] Step 4: Calculate the intermediate state value. The fault injection position is the second to last round before the operation starts. The fault propagation path diagram needs to be derived according to different fault injection positions. Assume that the fault injection position is X 22 The first half byte of the fault propagation path is as follows Figure 2 Combined with the structural design of LEA cipher, the intermediate state value The reverse formula is as follows:

[0046]

[0047] Therefore, you can enumerate The corresponding 4-bit key bit is used to calculate The status value of .

[0048] Step 5: Perform impossible relationship analysis. Since the fault is injected in a bitwise "AND" manner, combined with the characteristics of the operation, the 4-bit intermediate state value of the injected fault position cannot be 0b1111, so an impossible analysis path is constructed (based on Figure 2 For example):

[0049]

[0050] in, Four bits of data representing the intermediate state values ​​respectively.

[0051] By using impossible analysis paths with a probability of 0, some incorrect candidate keys can be eliminated in advance, thereby effectively reducing the key search space and speeding up analysis efficiency.

[0052] Step 6: For the intermediate state values ​​of the remaining candidate keys, use statistical methods to find the intermediate state values The Hamming weight represents the number of '1's contained in the binary form of the intermediate state. For example, when The binary representation of 8 is 1000, so The Hamming weight of is 1.

[0053] Step 7: Find the bit key position in each bit data block in the subkey corresponding to the minimum Hamming weight. Since the fault is injected by bitwise "AND", the distribution of the intermediate state value will be uneven, showing that "1" is less than "0". Therefore, the bit key position corresponding to the minimum Hamming weight is the correct bit key position.

[0054] Step 8: Repeat steps 1 to 7. The import location of each fault is different from the previous one. All bits of .

[0055] Step 9: Master key recovery. According to the key scheduling scheme, the last round of subkeys RK can be used 23 Perform inverse operations one by one to obtain the first-round sub-key RK0, and use the first-round sub-key RK0 to restore the master key of the algorithm:

[0056]

[0057] Among them, δ 0 are known constants used in the first round of the algorithm.

[0058] Using the above analysis method, on a computer with Intel(R) Core(TM) i5-10400F 2.90GHz 16GB memory, the VS Code development tool was used to simulate the import failure and LEA cryptographic algorithm processing process, and the execution was repeated 2000 times. The experimental results show that the above detection method is accurate. The method provided by the present invention is easy to implement, fast and accurate, and has important significance for the security research of the LEA cryptographic algorithm.

Claims

1. A key leakage detection method for LEA lightweight cryptographic algorithm, characterized in that: The following steps are involved: 。 Step S1, randomly generate a plaintext message; Step S2, encrypt the plaintext message using the LEA cryptographic algorithm and a fixed master key, and introduce a random 4-bit fault except the all-1 state in the penultimate round of encryption to generate a fault ciphertext; Step S3, according to the fault injection position, the intermediate state value of the fault injection position is reversely inferred from the fault ciphertext by enumerating the bit key bits in each bit data block in the subkey of the last round; Step S4, constructing an impossible analysis path with a probability of 0 based on the impossible value of the 4-bit fault intermediate state, and eliminating erroneous candidate bit key positions according to the impossible analysis path; Step S5, for the intermediate state values ​​calculated from the remaining candidate bit key positions, using a statistical method, find the Hamming weight of the intermediate state value, and find the bit key position in each bit data block in the subkey corresponding to the minimum Hamming weight; Step S6, repeating steps S1 to S5 to obtain the subkey of the last round; Step S7, according to the key arrangement scheme, use the subkeys of the last round to perform successive inverse operations to obtain the subkeys of the first round, and use the subkeys of the first round to restore the master key.

2. The key leakage detection method of the LEA lightweight cryptographic algorithm according to claim 1 is characterized in that: Between step S2 and step S3, the following steps are also included: Determine whether the number of faulty ciphertexts reaches a preset number; If the number of the faulty ciphertexts does not reach the preset number, return to step S1; If the number of the faulty ciphertexts reaches a preset number, the process proceeds to step S3.

3. The key leakage detection method of the LEA lightweight cryptographic algorithm according to claim 1 is characterized in that: The intermediate state value in step S3 is calculated in the following way: in, is the intermediate state value, are four bit data blocks of the ciphertext, They are the bit key bits in each bit data block in the last round of subkeys, <<< is a circular left shift, and >>> is a circular right shift. Modulo 2 32 Subtraction operation, It is an XOR operation.

4. The key leakage detection method of the LEA lightweight cryptographic algorithm according to claim 1 is characterized in that: The impossible analysis path is expressed as: in, The four bits of data of the intermediate state value respectively; || is the connection operation, It is an XOR operation.

5. The key leakage detection method of the LEA lightweight cryptographic algorithm according to claim 1 is characterized in that: In step S7, Recover the master key, where K is the master key, are the bit key bits in each bit data block in the first round of subkeys, δ 0 is the constant used in the first round of the LEA cipher algorithm, <<< is a circular left shift, >>> is a circular right shift, || is a concatenation operation, Modulo 2 32 Subtraction operation.

6. The key leakage detection method of the LEA lightweight cryptographic algorithm according to claim 1 is characterized in that: In step S2, the introduction of random 4-bit faults is completed by software simulation method, or laser, electromagnetic and voltage interference means.

Images