Key leakage detection method for adjustable block cipher BipBip

Abstract

The invention relates to a secret key leakage detection method for adjustable block cipher BipBip, which comprises the following steps of: firstly, randomly generating a plaintext to be processed, taking the plaintext as the input of a BipBip algorithm, importing a random 6-bit fault, correspondingly outputting an error ciphertext according to each fault position to calculate an intermediate state, and outputting the intermediate state; the range of candidate keys is narrowed in advance through the impossible relationship of intermediate state values. And selecting a proper discriminator, and obtaining all possible values of the discriminator of the intermediate state values corresponding to the remaining candidate keys. A correct value of a data round key part is solved based on the characteristics of a discriminator, the fault and analysis process is repeatedly imported, a correct data round key is derived, and then the data round key part is determined according to the derivation relation between the data round and the handle-adjusting wheel and the derivation relation between the middle states of all the rounds of the handle-adjusting wheel. A master key is determined by the remaining candidate keys of the exhaustive handler wheel key and a key orchestration scheme. The method provided by the invention is easy to implement, high in speed and high in accuracy, and an important analysis basis is provided for the security research of the BipBip block cipher algorithm.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a key leakage detection method for an adjustable block cipher BipBip. Background Art

[0002] As the complexity of software systems increases, memory safety issues such as buffer overflows and use-after-free become more serious. These problems are often exploited by attackers, resulting in data leaks and system crashes. Therefore, it is particularly important to develop encryption technologies that can effectively protect against these attacks. The BipBip algorithm is a tunable block cipher algorithm designed for low-latency and small-size encryption requirements, proposed by Belkheyar and other scholars in 2023. It can encrypt partial data of 64-bit pointers at extremely low latency, help defend against memory vulnerabilities (such as buffer overflows), and occupy very small resources in hardware implementation, which is particularly suitable for embedded systems and high-performance processor applications. The block length of BipBip is 24 bits, the master key length is 256 bits, the number of algorithm iterations is 11, and it contains a 40-bit handle.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that uses faults (such as hardware failures) deliberately introduced during the execution of a cryptographic algorithm to analyze and attack a cryptographic algorithm. This analysis method does not require the attacker to have internal information about the algorithm, but rather infers the weaknesses of the key or algorithm by observing the behavior of the algorithm when a fault occurs. There are currently no reports evaluating the ability of the BipBip algorithm to resist impossible statistical fault attacks, which leaves a security risk for products that are using the BipBip algorithm package. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a key leakage detection method for an adjustable block cipher BipBip, which can evaluate the ability of the BipBip algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present invention to solve the technical problem is: to provide a key leakage detection method of an adjustable block cipher BipBip, comprising the following steps:

[0006] Step S1, randomly generate a plaintext message to be processed;

[0007] Step S2, encrypting the plaintext message using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault except the all-1 state in the penultimate round of encryption to generate a first fault ciphertext;

[0008] Step S3, recovering the first-round subkey and the second-round subkey by using an impossible statistical fault analysis method according to the fault ciphertext;

[0009] Step S4, constructing a first new ciphertext using the first-round subkey and the second-round subkey, encrypting the first new ciphertext using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault except the all-1 state in the fourth-to-last round of encryption to generate a second fault ciphertext;

[0010] Step S5, recovering the third round sub-key and the fourth round sub-key by using an impossible statistical fault analysis method according to the second fault ciphertext;

[0011] Step S6, using the third round subkey and the fourth round subkey to construct a second new ciphertext, and using the BipBip algorithm and a fixed master key to encrypt the second new ciphertext, and introducing a random 6-bit fault except the all-1 state in the sixth to last round of encryption to generate a third fault ciphertext;

[0012] Step S7, recovering the fifth round subkey and the sixth round subkey by using an impossible statistical fault analysis method according to the third fault ciphertext;

[0013] Step S8, constructing a third new ciphertext using the fifth round subkey and the sixth round subkey, encrypting the third new ciphertext using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault except the all-1 state in the eighth round before encryption to generate a fourth fault ciphertext;

[0014] Step S9, recovering the seventh round subkey and the eighth round subkey by using an impossible statistical fault analysis method according to the fourth fault ciphertext;

[0015] Step S10, constructing a fourth new ciphertext using the seventh round subkey and the eighth round subkey, encrypting the fourth new ciphertext using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault except the all-1 state in the eighth round before encryption to generate a fifth fault ciphertext;

[0016] Step S11, recovering the ninth round subkey and the tenth round subkey by using an impossible statistical fault analysis method according to the fifth fault ciphertext;

[0017] Step S12: according to the key arrangement scheme, the master key is restored according to the keys of each round obtained.

[0018] The impossible statistical fault analysis method is specifically as follows:

[0019] According to the fault injection position, the intermediate state value of the fault injection position is reversely inferred from the kth fault ciphertext by enumerating the bits of the i-th round key and the i+1-th round key, wherein i=1,3,5,7,9, and k=1,2,3,4,5;

[0020] Constructing an impossible analysis path with a probability of 0 based on the 6-bit impossible value of the fault intermediate state, and eliminating erroneous candidate subkey bits according to the impossible analysis path;

[0021] For the intermediate state values ​​obtained from the remaining candidate subkey bits, a maximum value or a minimum value is selected based on the characteristics of the distinguisher to obtain the subkey bits corresponding to the maximum value or the minimum value;

[0022] Repeat the fault injection at different locations, and based on the above steps, obtain the i-th round subkey and the i+1-th round subkey.

[0023] The intermediate state value is calculated in the following way: Among them, DM i+1 is the intermediate state value, DRK i is the round i subkey, DRK i+1 is the i+1th round key, π3 is the bit permutation operation 3, S is the S-box replacement operation, is the kth fault ciphertext, It is an XOR operation.

[0024] The impossible analysis path is expressed as: in, are the 6jth bit, 6j+1th bit, 6j+2th bit, 6j+3th bit, 6j+4th bit, and 6j+5th bit of the intermediate state value respectively, || is a cascade, It is an XOR operation.

[0025] The step S12 specifically includes:

[0026] Recover K in the master key using the first round of subkeys 3 , And according to the restored K 3 , Recover bits 4, 4, 5, 8, 3 and 5 of the handle wheel keys TRK1, TRK2, TRK3, TRK4, TRK5 and TRK6 respectively;

[0027] The first 48 bits of the intermediate state value TM1 after the first round of the adjustment handle are restored by using the second round subkey and the third round subkey, and the derivation formula is satisfied The condition narrows down the candidate key range of the handle wheel key TRK1;

[0028] The first 48 bits of the intermediate state value TM2 after the second round of the handle adjustment are restored by using the fourth round subkey and the fifth round subkey, and the derivation formula is satisfied The condition narrows down the candidate key range of the handle wheel key TRK2;

[0029] The 24 bits of the intermediate state value TM4 after the fourth round of the handle adjustment are restored by the fourth round subkey, and the derivation formula is satisfied The conditions narrow down the candidate key range of the handle wheel key TRK3;

[0030] The fifth round subkey and the sixth round subkey are used to restore 24 bits of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel, respectively, and the possible values ​​of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are narrowed down by satisfying the derivation formula χ(π5(θ′(π4(TM5))))=TM6, and then the possible values ​​of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are narrowed down by satisfying the derivation formula The conditions narrow down the candidate key range of the handle wheel key TRK4;

[0031] The 24 bits of the intermediate state value TM7 after the seventh round of the handle adjustment are recovered by the seventh round subkey, and the derivation formula is satisfied The conditions narrow down the candidate key range of the handle wheel key TRK5;

[0032] Use the remaining candidate keys of the handle wheel keys TRK1, TRK2, TRK3, TRK4 and TRK5 to exhaustively enumerate and finally determine the master key

[0033] Wherein, mod represents the modulo operation; T * is the initial value of the adjustment wheel, χ is the nonlinear transformation operation, π5 is the bit permutation operation five, θ t is the linear transformation of the handle wheel 1, π4 is the bit permutation operation 4, θ′ is the linear transformation of the handle wheel 2, The 44th to 52nd bits of the handle wheel key TRK4, TRK1 8-52 The 8th to 52nd bits of the handle wheel key TRK1 are used. From bit 0 to bit 52.

[0034] The first new ciphertext is obtained by Construct; the second new ciphertext is constructed by To construct, the third new ciphertext is constructed by To construct, the fourth new ciphertext is constructed by , where C0, C1, C2, C3 are the correct ciphertext, the first new ciphertext, the second new ciphertext and the third new ciphertext respectively; DRK0, DRK1, DRK2, DRK3, DRK4, DRK5, DRK6, DRK7 are the first round subkey, the second round subkey, the third round subkey, the fourth round key, the fifth round key, the sixth round key, the seventh round key and the eighth round key respectively; π3 is the bit permutation operation three, S is the S-box replacement operation, π2 is the bit permutation operation two, π1 is the bit permutation operation one, θ d is the data wheel linear transformation, It is an XOR operation.

[0035] When introducing the random 6-bit fault except the all-1 state, the introduction of the random 6-bit fault is completed by using a software simulation method, or laser, electromagnetic and voltage interference means.

[0036] Beneficial Effects

[0037] Due to the adoption of the above technical scheme, the present invention has the following advantages and positive effects compared with the prior art: the present invention first randomly generates a plaintext to be processed, and uses the plaintext as the input of the BipBip algorithm, introduces a random 6-bit fault, and outputs an erroneous ciphertext corresponding to each fault position, and calculates the intermediate state, and narrows the range of candidate keys in advance through the impossible relationship of the intermediate state value. Select a suitable discriminator to obtain all possible values ​​of the discriminator of the intermediate state value corresponding to the remaining candidate keys. Select the maximum or minimum value based on the characteristics of the discriminator, find the correct value of the data wheel key part, repeat the introduction of faults and analysis process, and finally derive the correct data wheel key, and then according to the derivation relationship between the data wheel and the handle wheel, and the derivation relationship between the intermediate states of each round of the handle wheel, narrow the candidate key range of the handle wheel key, and finally determine the master key by exhaustively enumerating the remaining candidate keys and key arrangement schemes of the handle wheel key. The method provided by the present invention is easy to implement, fast and accurate, and provides an important analytical basis for the security research of the BipBip block cipher algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Flowchart of the steps for testing whether the BipBip block cipher algorithm is resistant to impossible statistical fault analysis.

[0039] Figure 2 This is the fault propagation diagram for the BipBip algorithm encryption process where statistical fault analysis is not possible.

[0040] Figure 3 This is the structure diagram of the BipBip block cipher algorithm.

[0041] Figure 4 Schematic diagram of the experimental environment for this scheme. DETAILED DESCRIPTION

[0042] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0043] Basic symbol description:

[0044] P: plain text, P∈{{0,1} 6} 4 .

[0045] T: Adjustment wheel input value, T∈{0,1} 40 .

[0046] T * : Initial value of the adjustment handle, T * =T||1||0 12 .

[0047] K: master key, K∈{0,1} 256 .

[0048] DRK i : Data round i subkey, DRK i ∈{0,1} 24 , 0≤i≤11.

[0049] TRK i : Key of the i-th wheel of the adjustment handle, TRK i ∈{0,1} 53 , 1≤i≤6.

[0050] C: correct ciphertext, C∈{{0,1} 6} 4 .

[0051] C: Error ciphertext, C∈{{0,1} 6} 4 .

[0052] π1: Bit permutation operation one.

[0053] π2: Bit permutation operation 2.

[0054] π3: Bit permutation operation three.

[0055] π4: Bit permutation operation four.

[0056] π5: Bit permutation operation five.

[0057] θd : Data wheel linear transformation.

[0058] θ t : Linear transformation of the adjustment handle wheel 1.

[0059] θ′: Linear transformation of the adjustment handle wheel 2.

[0060] χ: nonlinear transformation.

[0061] S: S box replacement.

[0062] E0: Get the values ​​at bits 0, 2, .., 46 of the 53-bit data.

[0063] E1: Get the values ​​of the 1st, 3rd, .., 47th bits of 53-bit data.

[0064] E: Execute the operations of E0 and E1 respectively.

[0065] DM i : The intermediate state value after the i-th round from the last.

[0066] TM i : The intermediate state value after the i-th turn of the adjustment handle.

[0067] XOR operation.

[0068] ||: Cascade

[0069] Figure 1 A flowchart of a key leakage detection method based on impossible statistical fault analysis for the BipBip block cipher algorithm provided in an embodiment of the present invention includes the following steps:

[0070] Step 1: Randomly generate a plaintext message to be processed, denoted as P∈{{0,1} 6} 4 .

[0071] Step 2: Encrypt the plaintext message using the BipBip algorithm and a fixed master key, and Figure 3 ) introduces a random 6-bit fault except the all-1 state in the penultimate round, and obtains multiple fault ciphertexts In this step, in order to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output. The specific operation method is as follows: input the plaintext P, introduce the fault during the operation of the BipBip algorithm, and then obtain the fault ciphertext

[0072] In this step, you can choose Figure 4The experimental environment shown in the figure uses a computer to generate the input plaintext P of BipBip, and processes and analyzes the output result of the input plaintext after the BipBip algorithm; the device encapsulating the BipBip algorithm is used to process the input message and obtain the corresponding output result; the device for importing faults is used to perform the import fault action, which will be performed during the operation of the BipBip algorithm to obtain the output of the erroneous ciphertext. The device for importing faults can complete the introduction of random 6-bit faults through software simulation methods, or laser, electromagnetic and voltage interference methods.

[0073] Step 3: Fault propagation path Figure 2 As shown, the intermediate state value after the second-to-last round of transformation is deduced using the obtained fault ciphertext:

[0074]

[0075] By enumerating the 6 bits of DRK0 and the 6 bits of DRK1, the 6 bits of the intermediate state after the fault injection are derived, that is,

[0076]

[0077] If faults are introduced multiple times at any position in the second to last round, the intermediate state value where the fault is injected can be derived using the error ciphertext, that is,

[0078]

[0079] where j∈[0,3].

[0080] Perform impossible relationship analysis. Since the fault is injected in a bitwise "AND" manner, combined with the characteristics of this operation, the 6-bit intermediate state value injected into the fault position cannot be 0b111111, so an impossible analysis path is constructed, which is expressed as:

[0081]

[0082] When the intermediate state value satisfies the equation The corresponding candidate key cannot be the correct key. By excluding these candidate keys that cannot be the correct key, the range of candidate keys that need to be screened using the distinguisher is narrowed down.

[0083] Step 5: Select a suitable distinguisher to obtain all possible values ​​of the distinguisher for the intermediate state values ​​corresponding to the remaining candidate keys. Select the maximum or minimum value based on the characteristics of the distinguisher to calculate and obtain the correct 6-bit DRK0 and 6-bit DRK1.

[0084] Step 6: Repeat steps 1 to 5, and make the position of the introduced fault different each time, until all 24 bits of DRK0 and all 24 bits of DRK1 are restored.

[0085] Step 7: Calculation As the new ciphertext,

[0086]

[0087] Step 8: In the same way as above to recover DRK0 and DRK1, introduce a random 6-bit fault in the fourth to last round of the encryption process and use the new derivation It is not possible to perform statistical failure analysis to recover DRK2 and DRK3.

[0088] Step 9: Calculation As the new ciphertext,

[0089]

[0090] Step 10: In the same way as above to recover DRK0 and DRK1, introduce a random 6-bit fault in the sixth-to-last round of the encryption process, using the new derivation It is not possible to perform statistical failure analysis to recover DRK4 and DRK5.

[0091] Step 11: Calculation As the new ciphertext,

[0092]

[0093] Step 12: In the same way as above to recover DRK0 and DRK1, introduce a random 6-bit fault in the 8th round from the end of the encryption process, using the new derivation It is not possible to perform statistical failure analysis to recover DRK6 and DRK7.

[0094] Step 13: Calculation As the new ciphertext,

[0095]

[0096] Step 14: In the same way as recovering DRK0 and DRK1 above, introduce a random 6-bit fault in the 10th round of the encryption process, using the new derivation It is not possible to perform statistical failure analysis to recover DRK8 and DRK9.

[0097] Step 15: According to the key arrangement scheme, the master key K can be recovered through DRK0. 3 , There are 24 bits in total, and based on these 24 bits, 4, 4, 5, 8, 3 and 5 bits of the handle wheel keys TRK1, TRK2, TRK3, TRK4, TRK5 and TRK6 can be recovered respectively.

[0098] Step 16: The intermediate state value after the first turn of the handle adjustment wheel has the derivation formula E(TM1) = DRK1, DRK2. The first 48 bits of TM1 can be restored through DRK1 and DRK2. The conditions narrow down the candidate key range of TRK1.

[0099] Step 17: The intermediate state value after the second turn of the handle adjustment wheel has the derivation formula E(TM2)=DRK3,DRK4. The value of the first 48 bits of TM2 can be restored through DRK3 and DRK4. The conditions narrow down the candidate key range of TRK2.

[0100] Step 18: The intermediate state value after the fourth turn of the handle wheel has the derivation formula E0(TM4)=DRK5, and the value of 24 bits of TM4 can be restored through DRK5. The conditions narrow down the candidate key range of TRK3.

[0101] Step 19: The intermediate state values ​​after the fifth and sixth turns of the handle wheel are derived by the formulas E0(TM5)=DRK6 and E0(TM6)=DRK7, respectively. 24 bits of TM5 and TM6 can be restored by DRK6 and DRK7, respectively. The possible values ​​of TM5 and TM6 are narrowed down by satisfying the condition of the derived formula χ(π5(θ′(π4(TM5))))=TM6.

[0102] Step 20: Use the Satisfaction Derivation The conditions narrow down the candidate keys of TRK4.

[0103] Step 21: The intermediate state value after the seventh turn of the handle wheel has the derivation formula E0(TM7)=DRK8, and the value of 24 bits of TM7 can be restored through DRK8. The conditions narrow down the candidate key range of TRK5.

[0104] Step 22: Use the remaining candidate keys of TRK1, TRK2, TRK3, TRK4 and TRK5 to exhaustively determine the master key

[0105] Using the above analysis method, the present invention simulates the import failure and the BipBip block cipher algorithm processing process on a computer with Intel(R)Core(TM)i5-1135G7 CPU@2.40GHz 16GB memory using CLion development tool and C++ programming language, and repeats the execution 2000 times. The experimental results show that the above detection method is accurate. The method provided by the present invention is easy to implement, fast and accurate, and has important significance for the security research of the BipBip block cipher algorithm.

Claims

1. A key leakage detection method for an adjustable block cipher BipBip, characterized in that: The following steps are involved: Step S1, randomly generate a plaintext message to be processed; Step S2, encrypting the plaintext message using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault except the all-1 state in the penultimate round of encryption to generate a first fault ciphertext; Step S3, recovering the first-round subkey and the second-round subkey by using an impossible statistical fault analysis method according to the fault ciphertext; Step S4, constructing a first new ciphertext using the first-round subkey and the second-round subkey, encrypting the first new ciphertext using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault except the all-1 state in the fourth-to-last round of encryption to generate a second fault ciphertext; Step S5, recovering the third round sub-key and the fourth round sub-key by using an impossible statistical fault analysis method according to the second fault ciphertext; Step S6, using the third round subkey and the fourth round subkey to construct a second new ciphertext, and using the BipBip algorithm and a fixed master key to encrypt the second new ciphertext, and introducing a random 6-bit fault except the all-1 state in the sixth to last round of encryption to generate a third fault ciphertext; Step S7, recovering the fifth round subkey and the sixth round subkey by using an impossible statistical fault analysis method according to the third fault ciphertext; Step S8, constructing a third new ciphertext using the fifth round subkey and the sixth round subkey, encrypting the third new ciphertext using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault except the all-1 state in the eighth round before encryption to generate a fourth fault ciphertext; Step S9, recovering the seventh round subkey and the eighth round subkey by using an impossible statistical fault analysis method according to the fourth fault ciphertext; Step S10, constructing a fourth new ciphertext using the seventh round subkey and the eighth round subkey, encrypting the fourth new ciphertext using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault except the all-1 state in the eighth round before encryption to generate a fifth fault ciphertext; Step S11, recovering the ninth round subkey and the tenth round subkey by using an impossible statistical fault analysis method according to the fifth fault ciphertext; Step S12: according to the key arrangement scheme, the master key is restored according to the keys of each round obtained.

2. The key leakage detection method of the adjustable block cipher BipBip according to claim 1 is characterized in that: The impossible statistical fault analysis method is specifically as follows: According to the fault injection position, the intermediate state value of the fault injection position is reversely inferred from the kth fault ciphertext by enumerating the bits of the i-th round key and the i+1-th round key, wherein i=1,3,5,7,9, and k=1,2,3,4,5; Constructing an impossible analysis path with a probability of 0 based on the 6-bit impossible value of the fault intermediate state, and eliminating erroneous candidate subkey bits according to the impossible analysis path; For the intermediate state values ​​obtained for the remaining candidate subkey bits, the maximum or minimum value is selected based on the characteristics of the distinguisher. Get the subkey bit corresponding to the maximum value or minimum value; Repeat the fault injection at different locations, and based on the above steps, obtain the i-th round subkey and the i+1-th round subkey.

3. The key leakage detection method of the adjustable block cipher BipBip according to claim 2 is characterized in that: The intermediate state value is calculated in the following way: Among them, DM i+1 is the intermediate state value, DRK i is the round i subkey, DRK i+1 is the i+1th round key, π3 is the bit permutation operation 3, S is the S-box replacement operation, is the kth fault ciphertext, It is an XOR operation.

4. The key leakage detection method of the adjustable block cipher BipBip according to claim 2 is characterized in that: The impossible analysis path is expressed as: in, are the 6jth bit, 6j+1th bit, 6j+2th bit, 6j+3th bit, 6j+4th bit, and 6j+5th bit of the intermediate state value respectively, || is a cascade, It is an XOR operation.

5. The key leakage detection method of the adjustable block cipher BipBip according to claim 1 is characterized in that: The step S12 specifically includes: Recover K in the master key using the first round of subkeys 3 , And according to the restored K 3 , Recover bits 4, 4, 5, 8, 3 and 5 of the handle wheel keys TRK1, TRK2, TRK3, TRK4, TRK5 and TRK6 respectively; The first 48 bits of the intermediate state value TM1 after the first round of the adjustment handle are restored by using the second round subkey and the third round subkey, and the derivation formula is satisfied The condition narrows down the candidate key range of the handle wheel key TRK1; The first 48 bits of the intermediate state value TM2 after the second round of the handle adjustment are restored by using the fourth round subkey and the fifth round subkey, and the derivation formula is satisfied The condition narrows down the candidate key range of the handle wheel key TRK2; The 24 bits of the intermediate state value TM4 after the fourth round of the handle adjustment are restored by the fourth round subkey, and the derivation formula is satisfied The conditions narrow down the candidate key range of the handle wheel key TRK3; The fifth round subkey and the sixth round subkey are used to restore 24 bits of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel, respectively, and the possible values ​​of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are narrowed down by satisfying the derivation formula χ(π5(θ′(π4(TM5))))=TM6, and then the possible values ​​of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are narrowed down by satisfying the derivation formula The conditions narrow down the candidate key range of the handle wheel key TRK4; The 24 bits of the intermediate state value TM7 after the seventh round of the handle adjustment are recovered by the seventh round subkey, and the derivation formula is satisfied The conditions narrow down the candidate key range of the handle wheel key TRK5; Use the remaining candidate keys of the handle wheel keys TRK1, TRK2, TRK3, TRK4 and TRK5 to exhaustively enumerate and finally determine the master key Wherein, mod represents the modulo operation; T * is the initial value of the adjustment wheel, χ is the nonlinear transformation operation, π5 is the bit permutation operation five, θ t is the linear transformation of the handle wheel 1, π4 is the bit permutation operation 4, θ′ is the linear transformation of the handle wheel 2, The 44th to 52nd bits of the handle wheel key TRK4 are used. The 8th to 52nd bits of the handle wheel key TRK1 are used. From bit 0 to bit 52.

6. The key leakage detection method of the adjustable block cipher BipBip according to claim 1 is characterized in that: The first new ciphertext is obtained by To construct; the second new ciphertext is passed To construct, the third new ciphertext is constructed by To construct, the fourth new ciphertext is constructed by , where C0, C1, C2, C3 are the correct ciphertext, the first new ciphertext, the second new ciphertext and the third new ciphertext respectively; DRK0, DRK1, DRK2, DRK3, DRK4, DRK5, DRK6, DRK7 are the first round subkey, the second round subkey, the third round subkey, the fourth round key, the fifth round key, the sixth round key, the seventh round key and the eighth round key respectively; π3 is the bit permutation operation three, S is the S-box replacement operation, π2 is the bit permutation operation two, π1 is the bit permutation operation one, θ d is the data wheel linear transformation, It is an XOR operation.

7. The key leakage detection method of the adjustable block cipher BipBip according to claim 1 is characterized in that: When introducing the random 6-bit fault except the all-1 state, the introduction of the random 6-bit fault is completed by using a software simulation method, or laser, electromagnetic and voltage interference means.

Images