A key leakage detection method of LEA lightweight cryptographic algorithm

Abstract

The application relates to a key leakage detection method of a LEA lightweight cryptographic algorithm. First, plaintext to be processed is randomly generated, and the plaintext is taken as input of the LEA algorithm, a random 4-bit fault is introduced in the second last round, and a fault ciphertext is output. By enumerating key bit positions corresponding to the last round key, and by impossible relation analysis, false candidate key bit positions are excluded in advance, and an intermediate state is calculated, then by using a statistical method, the hamming weight of the intermediate state is calculated, and the correct value of the corresponding round key is obtained. The fault introduction and analysis process are repeated, and finally the correct last round key can be deduced, and then according to a key arrangement scheme of the algorithm, the correct master key can be deduced. The method provided by the application is easy to implement, fast and high in accuracy, and provides an important analysis basis for the security research of the LEA cryptographic algorithm.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a key leakage detection method of LEA lightweight cryptographic algorithm. BACKGROUND

[0002] With the rapid development of computer and communication technology, smart home, smart medical care and intelligent transportation gradually cover all aspects of people's life, making people's life more convenient and efficient, but it also brings new information security challenges. Because these Internet of Things devices are usually small in size and low in computing power, traditional cryptographic algorithms are difficult to balance security and efficiency, so lightweight cryptographic algorithms with fast encryption speed and low resource consumption have gradually become the focus of people's research and attention. LEA cryptographic algorithm was proposed by Hong et al. in the WISA conference in 2013, and was selected as one of the three lightweight cryptographic standards of the International Organization for Standardization and the International Electrotechnical Commission in 2019, suitable for high-speed operation and resource-constrained environments. LEA cryptographic algorithm adopts ARX structure, with a block length of 128 bits, a key length of 128, 192 and 256 bits, and corresponding encryption round numbers of 24, 28 and 32 rounds, respectively. The encryption and decryption process uses modulo addition, XOR and shift operations.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that uses deliberately introduced faults (such as hardware faults) during the execution of a cryptographic algorithm to analyze and attack the algorithm. This analysis method does not require the attacker to have internal information of the algorithm, but rather observes the behavior of the algorithm when a fault occurs to infer the weaknesses of the key or algorithm. There is currently no related report evaluating the ability of LEA cryptographic algorithm to resist impossible statistical fault attacks, which leaves a security risk for products that are using LEA cryptographic algorithm encapsulation. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a key leakage detection method of LEA lightweight cryptographic algorithm, which can evaluate the ability of LEA cryptographic algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present application to solve its technical problem is: providing a key leakage detection method of LEA lightweight cryptographic algorithm, comprising the following steps:

[0006] Step S1, randomly generating a plaintext message;

[0007] Step S2, using LEA cryptographic algorithm and a fixed master key to encrypt the plaintext message, and introducing a random 4-bit fault except the all-1 state in the second-to-last round of encryption to generate a fault ciphertext;

[0008] Step S3, the intermediate state value of the fault injection position is inversely deduced from the fault ciphertext according to the way of enumerating the bit key positions in each bit data block in the last round of subkeys;

[0009] Step S4, the impossible analysis path with a probability of 0 is constructed based on the 4-bit fault intermediate state impossible value, and the false candidate bit key positions are excluded according to the impossible analysis path;

[0010] Step S5, the Hamming weight of the intermediate state value is calculated by using a statistical method, and the bit key positions in each bit data block in the subkey corresponding to the minimum Hamming weight are found out;

[0011] Step S6, steps S1-S5 are repeated to obtain the subkey of the last round;

[0012] Step S7, the subkey of the first round is obtained by using the last round of subkeys to perform inverse operation one by one according to the key arrangement scheme, and the main key is recovered by using the subkey of the first round.

[0013] Between the step S2 and the step S3, further comprising:

[0014] determining whether the number of fault ciphertexts reaches a preset number;

[0015] If the number of fault ciphertexts does not reach the preset number, returning to step S1;

[0016] If the number of fault ciphertexts reaches the preset number, entering step S3.

[0017] The intermediate state value in the step S3 is calculated by the following way: wherein, is the intermediate state value, are four bit data blocks of the ciphertext respectively, are bit key positions in each bit data block in the last round of subkeys, << is a cyclic left shift, >>> is a cyclic right shift, is a modulo 2 32 subtraction operation, is an exclusive or operation.

[0018] The impossible analysis path is expressed as: wherein, are four bit positions of the intermediate state value respectively; || is a connection operation, is an exclusive or operation.

[0019] The main key is recovered by in the step S7, wherein K is the main key, respectively are the bit key positions in each bit data block in the first round sub-key, and 0 is a constant used in the first round of the LEA algorithm, << is a left circular shift, >> is a right circular shift, and || is a concatenation operation, is a modulo 2 32 subtraction operation.

[0020] The step S2 is completed by a method of software simulation, or laser, electromagnetic and voltage interference means.

[0021] Advantages

[0022] Compared with the prior art, the present application has the following advantages and positive effects: the present application first randomly generates a plaintext to be processed, denoted as P e {{0,1} 32} 4 , and uses a random 4-bit fault injection with a fault position in the second last round, and outputs a faulty ciphertext Using the characteristics of the bitwise AND operation, the 4-bit intermediate state value at the fault position cannot be 0b1111, thereby generating an impossible analysis path, and part of the incorrect candidate keys are excluded in advance, and then using a statistical method, the Hamming weight is calculated, the correct value of the round key is obtained, the fault injection and analysis process are repeated, and finally the correct round key can be deduced, and according to the key arrangement scheme of the algorithm, the correct master key can be deduced. The method provided by the present application is easy to implement, fast and accurate, and provides a good analysis basis for detecting the ability of the LEA cryptographic algorithm to resist impossible statistical fault attacks. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 is a step flow chart for detecting whether the cryptographic algorithm LEA resists impossible statistical fault attacks;

[0024] Figure 2 is a fault propagation diagram for impossible statistical fault attacks in the encryption process of the LEA algorithm;

[0025] Figure 3 is a detailed structure diagram of the LEA cryptographic algorithm;

[0026] Figure 4 is a schematic diagram of the experimental environment of the present scheme. DETAILED DESCRIPTION

[0027] The application will be further described in connection with specific embodiments. It should be understood that these embodiments are only used to illustrate the application and not used to limit the scope of the application. Furthermore, it should be understood that after reading the content of the application, those skilled in the art can make various modifications or changes to the application, and these equivalent forms also fall within the scope of the appended claims.

[0028] Basic symbol description

[0029] P: plaintext, consisting of 4 32-bit data blocks, denoted as: 0 ||P 1 ||P 2 ||P 3 , with a total length of 128 bits, i.e. P∈{{0,1} 32} 4 ;

[0030] Fault ciphertext, consisting of 4 32-bit data blocks, denoted as: with a total length of 128 bits, i.e.

[0031] K: master key, consisting of 4 32-bit data blocks, denoted as: 0 ||K 1 ||K 2 ||K 3 , with a total length of 128 bits, i.e. K∈{{0,1} 32} 4 ;

[0032] RK r : the r+1th round subkey, consisting of 6 32-bit data blocks, denoted as: with a total length of 192 bits, i.e. RK r ∈{{0,1} 32} 6 , where 0≤r≤23;

[0033] X r : the r+1th round intermediate state value, consisting of 4 32-bit data blocks, denoted as: , where 0≤r≤23;

[0034] XOR operation;

[0035] modulo 2 32 addition operation;

[0036] modulo 2 32 subtraction operation;

[0037] ||: concatenation operation;

[0038] >>> : cyclic right shift operation

[0039] <<< : cyclic left shift operation

[0040] Figure 1 A flow chart of the method for detecting whether the LEA cryptographic algorithm can resist impossible differential fault attack according to an embodiment of the present application is provided, which comprises the following steps:

[0041] Step 1: randomly generating a plaintext message P.

[0042] Step 2: encrypting the plaintext message P with a fixed master key K using the LEA cryptographic algorithm (see Figure 3 ) and introducing a random 4-bit fault except the all-1 state in the second-to-last round of the encryption to generate a fault ciphertext In this step, in order to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output. The specific operation method is as follows: input the plaintext message P, introduce the fault in the LEA algorithm running process, and then obtain the fault ciphertext

[0043] This step can select the experimental environment as shown in Figure 4 , wherein the computer is used to generate the input plaintext message P of the LEA, and process and analyze the output results of the input plaintext after the LEA algorithm; the device encapsulating the LEA algorithm is used to process the input message and obtain the corresponding output results; the device for introducing the fault is used to perform the fault introduction action, which will be performed in the LEA algorithm running process, and then the output of the fault ciphertext is obtained. The device for introducing the fault can complete the introduction of the random 4-bit fault through the method of software simulation, or laser, electromagnetic and voltage interference means.

[0044] Step 3: judging whether the number of fault ciphertexts reaches a preset number, if not, repeating steps 1 to 2 until the preset number of fault ciphertexts The preset number of this embodiment is 200. If yes, go to step 4.

[0045] Step 4: calculating the intermediate state value. The fault injection position is before the second-to-last round starts to operate, and the fault propagation path diagram needs to be derived according to different fault injection positions. Assuming that the fault injection position is the first nibble of X 22 , the fault propagation path diagram is shown in Figure 2 . Combined with the structural design of the LEA cipher, the backstepping formula of the intermediate state value is as follows:

[0046]

[0047] Therefore, the intermediate state value can be enumerated corresponding 4-bit key bits to calculate the state value of .

[0048] Step 5: Perform impossible relation analysis. Since the fault is injected in the form of bitwise AND, combined with the characteristics of the operation, the 4-bit intermediate state value at the fault injection position cannot be 0b1111. Therefore, an impossible analysis path (taking Figure 2 as an example) is constructed:

[0049]

[0050] wherein, the four bits of the intermediate state value are respectively .

[0051] By using the impossible analysis path with a probability of 0, some incorrect candidate keys are excluded in advance, thereby effectively reducing the key search space and accelerating the analysis efficiency.

[0052] Step 6: For the intermediate state values of the remaining candidate keys, the Hamming weight of the intermediate state value is calculated by using statistical methods. The Hamming weight represents the number of ‘1’s contained in the binary form of the intermediate state. For example, when the binary representation of 8 is 1000, the Hamming weight of is 1.

[0053] Step 7: Find the bit key bits in each bit data block corresponding to the minimum Hamming weight. Since the fault is injected in the form of bitwise AND, the distribution of the intermediate state values will be uneven, with ‘1’s less than ‘0’s. Therefore, the bit key bits corresponding to the minimum Hamming weight are the correct bit key bits.

[0054] Step 8: Repeat steps 1 to 7, and the fault injection position is different from the previous one each time. In this way, all the bit positions of can be obtained.

[0055] Step 9: Master key recovery. According to the key arrangement scheme, the last round of sub-key RK 23 can be used to perform inverse operation to obtain the first round of sub-key RK0, and the first round of sub-key RK0 is used to recover the master key of the algorithm:

[0056]

[0057] wherein, δ 0 is a known constant used in the first round of the algorithm.

[0058] ​By using the above analysis method, on the computer of Intel(R) Core(TM) i5-10400F 2.90GHz 16GB memory, using VS Code development tool to simulate the import fault and LEA password algorithm processing process, repeatedly executing 2000 times, the experimental results show that the above detection method is accurate. The method provided by the application is easy to implement, fast and accurate, and has important significance for the security research of the LEA password algorithm.

Claims

1. A method for detecting key leakage using the LEA lightweight cryptographic algorithm, characterized in that, Includes the following steps: Step S1: Randomly generate plaintext messages; Step S2: Encrypt the plaintext message using the LEA cryptographic algorithm and a fixed master key, and introduce a random 4-bit fault (excluding the all-1 state) in the penultimate round of encryption to generate fault ciphertext. Step S3: Based on the fault injection location, the intermediate state value of the fault injection location is deduced from the fault ciphertext by enumerating the bit key bits in each bit data block of the subkey in the last round. Step S4: Construct an impossible analysis path with a probability of 0 based on the 4-bit fault intermediate state impossible value, and exclude erroneous candidate key bits according to the impossible analysis path; Step S5: For the intermediate state value obtained by calculating the remaining candidate bit key bits, use statistical methods to calculate the Hamming weight of the intermediate state value, and find the bit key bits in each bit data block of the subkey corresponding to the minimum Hamming weight. Step S6: Repeat steps S1-S5 to obtain the subkey for the last round; Step S7: According to the key arrangement scheme, the subkey of the last round is used to perform successive inverse operations to obtain the subkey of the first round, and the master key is recovered using the subkey of the first round.

2. The key leakage detection method for the LEA lightweight cryptographic algorithm according to claim 1, characterized in that, Between steps S2 and S3, the following is also included: Determine if the number of faulty ciphertexts has reached the preset number; If the number of faulty ciphertexts does not reach the preset number, return to step S1; If the number of faulty encrypted messages reaches a preset number, proceed to step S3.

3. The key leakage detection method for the LEA lightweight cryptographic algorithm according to claim 1, characterized in that, The intermediate state value in step S3 is calculated in the following way: in, This is an intermediate state value. Each of the four bits of ciphertext is represented by a separate block. These represent the key bits in each data block of the subkey in the last round, with <<< indicating a circular left shift and >>> indicating a circular right shift. For modulo 2 32 Subtraction operation, This is an XOR operation.

4. The key leakage detection method for the LEA lightweight cryptographic algorithm according to claim 1, characterized in that, The impossible analysis path is represented as: in, The four bits of the intermediate state value are respectively represented; || is the concatenation operation. This is an XOR operation.

5. The key leakage detection method for the LEA lightweight cryptographic algorithm according to claim 1, characterized in that, In step S7, through Recover the master key, where K is the master key. These are the key bits in each data block of the first round's subkey, δ. 0 These are the constants used in the first round of the LEA cryptographic algorithm, where <<< represents a circular left shift, >>> represents a circular right shift, and || represents a concatenation operation. For modulo 2 32 Subtraction operation.

6. The key leakage detection method for the LEA lightweight cryptographic algorithm according to claim 1, characterized in that, In step S2, a random 4-bit fault is introduced by means of software simulation or by means of laser, electromagnetic and voltage interference.

Images