A key leakage detection method for the tunable block cipher BipBip

Abstract

The present invention relates to a key leakage detection method for a tunable block cipher BipBip. First, a plaintext to be processed is randomly generated and used as the input of the BipBip algorithm. A random 6-bit fault is introduced, and an intermediate state is calculated based on the output error ciphertext corresponding to each fault position. The range of candidate keys is narrowed down in advance based on the impossible relationship between the intermediate state values. A suitable discriminator is selected to obtain all possible values ​​of the discriminator for the intermediate state values ​​corresponding to the remaining candidate keys. Based on the characteristics of the discriminator, the correct values ​​of the data wheel subkey are obtained. The fault introduction and analysis process are repeated to derive the correct data wheel subkey. Then, based on the derivation relationship between the data wheel and the handle wheel and the derivation relationship between the intermediate states of each handle wheel round, the master key is determined by exhaustively enumerating the remaining candidate keys and key arrangement schemes of the handle wheel key. The method provided by the present invention is easy to implement, fast and highly accurate, and provides an important analytical basis for the security research of the BipBip block cipher algorithm.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a key leakage detection method for an adjustable block cipher BipBip. Background Art

[0002] As software systems become more complex, memory safety issues such as buffer overflows and use-after-free become increasingly serious. These issues are often exploited by attackers, leading to data leaks and system crashes. Therefore, it is particularly important to develop encryption technologies that can effectively protect against these attacks. The BipBip algorithm is a tunable block cipher algorithm designed for low-latency and small-size encryption requirements. It was proposed by scholars such as Belkheyar in 2023. It can encrypt partial data of a 64-bit pointer at extremely low latency, helping to defend against memory vulnerabilities (such as buffer overflows), and it takes up very little resources in hardware implementation, making it particularly suitable for embedded systems and high-performance processor applications. BipBip has a block length of 24 bits, a master key length of 256 bits, an algorithm iteration number of 11 rounds, and includes a 40-bit tamper handle.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that exploits intentionally introduced faults (such as hardware failures) during the execution of a cryptographic algorithm to analyze and attack it. This analysis method does not require the attacker to possess internal information about the algorithm, but instead infers key or algorithm weaknesses by observing the algorithm's behavior when faults occur. Currently, there are no reports evaluating the BipBip algorithm's ability to resist impossible statistical fault attacks, which poses a security risk to products currently using the BipBip algorithm package. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a key leakage detection method for an adjustable block cipher BipBip, which can evaluate the ability of the BipBip algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present invention to solve the technical problem is to provide a key leakage detection method for an adjustable block cipher BipBip, comprising the following steps:

[0006] Step S1, randomly generate a plaintext message to be processed;

[0007] Step S2: Encrypt the plaintext message using the BipBip algorithm and a fixed master key, and introduce a random 6-bit fault other than the all-1 state in the penultimate round of encryption to generate a first fault ciphertext;

[0008] Step S3, recovering the first-round subkey and the second-round subkey using an impossible statistical fault analysis method according to the fault ciphertext;

[0009] Step S4: construct a first new ciphertext using the first-round subkey and the second-round subkey, encrypt the first new ciphertext using the BipBip algorithm and a fixed master key, and introduce a random 6-bit fault other than the all-1 state in the fourth-to-last round of encryption to generate a second fault ciphertext;

[0010] Step S5: recovering the third-round subkey and the fourth-round subkey according to the second fault ciphertext using an impossible statistical fault analysis method;

[0011] Step S6: Construct a second new ciphertext using the third-round subkey and the fourth-round subkey, encrypt the second new ciphertext using the BipBip algorithm and a fixed master key, and introduce a random 6-bit fault other than the all-ones state in the sixth-to-last encryption round to generate a third fault ciphertext.

[0012] Step S7, recovering the fifth round subkey and the sixth round subkey using an impossible statistical fault analysis method according to the third fault ciphertext;

[0013] Step S8: Construct a third new ciphertext using the fifth-round subkey and the sixth-round subkey, encrypt the third new ciphertext using the BipBip algorithm and a fixed master key, and introduce a random 6-bit fault other than the all-ones state in the eighth-to-last round of encryption to generate a fourth fault ciphertext.

[0014] Step S9: recovering the seventh round subkey and the eighth round subkey using an impossible statistical fault analysis method according to the fourth fault ciphertext;

[0015] Step S10: constructing a fourth new ciphertext using the seventh-round subkey and the eighth-round subkey, encrypting the fourth new ciphertext using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault other than the all-ones state in the eighth-to-last round of encryption to generate a fifth fault ciphertext;

[0016] Step S11, recovering the ninth round subkey and the tenth round subkey using an impossible statistical fault analysis method according to the fifth fault ciphertext;

[0017] Step S12: According to the key arrangement scheme, the master key is restored based on the obtained round keys.

[0018] The impossible statistical fault analysis method is specifically as follows:

[0019] According to the fault injection location, the intermediate state value of the fault injection location is reversely inferred from the kth fault ciphertext by enumerating the bits of the i-th round key and the i+1-th round key, where i = 1, 3, 5, 7, 9 and k = 1, 2, 3, 4, 5;

[0020] Constructing an impossible analysis path with a probability of 0 based on the 6-bit impossible value of the fault intermediate state, and eliminating erroneous candidate subkey bits according to the impossible analysis path;

[0021] For the intermediate state values ​​obtained for the remaining candidate subkey bits, select the maximum or minimum value based on the characteristics of the distinguisher, and obtain the subkey bits corresponding to the maximum or minimum value;

[0022] Repeat the fault injection at different locations and obtain the i-th round subkey and the i+1-th round subkey based on the above steps.

[0023] The intermediate state value is calculated in the following way: Among them, DM i+1 is the intermediate state value, DRK i is the round i subkey, DRK i+1 is the key of the i+1th round, π3 is the bit permutation operation three, S is the S-box replacement operation, is the k-th fault ciphertext, It is an exclusive OR operation.

[0024] The impossible analysis path is expressed as: in, are the 6jth bit, 6j+1th bit, 6j+2th bit, 6j+3th bit, 6j+4th bit, and 6j+5th bit of the intermediate state value respectively, and || is the cascade. It is an exclusive OR operation.

[0025] The step S12 specifically includes:

[0026] Recover K in the master key using the first round of subkeys 3 , And according to the restored K 3 , Recover bits 4, 4, 5, 8, 3, and 5 of the tuning wheel keys TRK1, TRK2, TRK3, TRK4, TRK5, and TRK6, respectively;

[0027] The first 48 bits of the intermediate state value TM1 after the first round of the handle adjustment are recovered by the second round subkey and the third round subkey, and the derivation formula is satisfied. The condition narrows down the candidate key range of the handle wheel key TRK1;

[0028] The first 48 bits of the intermediate state value TM2 after the second round of the handle adjustment are recovered by the fourth round subkey and the fifth round subkey, and the derivation formula is satisfied. The condition narrows down the candidate key range of the tuning wheel key TRK2;

[0029] The 24 bits of the intermediate state value TM4 after the fourth round of the handle adjustment are recovered by the fourth round subkey, and the derivation formula is satisfied. The condition narrows down the candidate key range of the tuning wheel key TRK3;

[0030] The 24 bits of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are restored by using the fifth round subkey and the sixth round subkey respectively, and the possible values ​​of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are narrowed down by satisfying the derivation formula χ(π5(θ′(π4(TM5))))=TM6, and then the possible values ​​of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are narrowed down by satisfying the derivation formula The condition narrows down the candidate key range of the tuning wheel key TRK4;

[0031] The 24 bits of the intermediate state value TM7 after the seventh round of the handle adjustment are recovered by the seventh round subkey, and the derivation formula is satisfied. The conditions narrow down the candidate key range of the handle wheel key TRK5;

[0032] The remaining candidate keys of the handle wheel keys TRK1, TRK2, TRK3, TRK4 and TRK5 are used to exhaustively search and finally determine the master key.

[0033] Where mod represents the modulo operation; T * is the initial value of the handle wheel, χ is the nonlinear transformation operation, π5 is the bit permutation operation five, θ t is the linear transformation of the handle wheel 1, π4 is the bit permutation operation 4, θ′ is the linear transformation of the handle wheel 2, The 44th to 52nd bits of the handle wheel key TRK4, TRK1 8-52 The 8th to 52nd bits of the handle wheel key TRK1 are From bit 0 to bit 52.

[0034] The first new ciphertext is passed through The second new ciphertext is constructed by To construct, the third new ciphertext is constructed by To construct, the fourth new ciphertext is constructed by Construct, where C0, C1, C2, C3 are the correct ciphertext, the first new ciphertext, the second new ciphertext, and the third new ciphertext respectively; DRK0, DRK1, DRK2, DRK3, DRK4, DRK5, DRK6, DRK7 are the first round subkey, the second round subkey, the third round subkey, the fourth round subkey, the fifth round subkey, the sixth round subkey, the seventh round subkey, and the eighth round subkey respectively; π3 is the bit permutation operation three, S is the S-box replacement operation, π2 is the bit permutation operation two, π1 is the bit permutation operation one, θ d is the data wheel linear transformation, It is an exclusive OR operation.

[0035] When introducing a random 6-bit fault other than the all-1 state, a software simulation method, or laser, electromagnetic and voltage interference means is used to complete the introduction of the random 6-bit fault.

[0036] Beneficial effects

[0037] Due to the adoption of the above-mentioned technical solution, the present invention has the following advantages and positive effects compared to the prior art: The present invention first randomly generates the plaintext to be processed and uses the plaintext as the input of the BipBip algorithm. A random 6-bit fault is introduced, and each fault location corresponds to an erroneous ciphertext output. The intermediate state is calculated, and the range of candidate keys is narrowed in advance by using the improbability relationship between the intermediate state values. A suitable discriminator is selected, and all possible values ​​of the discriminator for the intermediate state values ​​corresponding to the remaining candidate keys are obtained. Based on the characteristics of the discriminator, the maximum or minimum value is selected to determine the correct partial value of the data wheel subkey. The fault introduction and analysis process is repeated, and finally, the correct data wheel subkey can be derived. The range of candidate keys for the handle wheel key is then narrowed based on the derivation relationship between the data wheel and the handle wheel, and the derivation relationship between the intermediate states of each handle wheel round. Finally, the master key is determined by exhaustively enumerating the remaining candidate keys and key arrangement schemes for the handle wheel key. The method provided by the present invention is easy to implement, fast, and highly accurate, providing an important analytical basis for security research on the BipBip block cipher algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Flowchart of the steps for testing whether the BipBip block cipher algorithm is resistant to impossible statistical fault analysis.

[0039] Figure 2 This is a fault propagation diagram for the BipBip algorithm encryption process where statistical fault analysis is impossible.

[0040] Figure 3 This is the structure diagram of the BipBip block cipher algorithm.

[0041] Figure 4 Schematic diagram of the experimental environment for this scheme. DETAILED DESCRIPTION

[0042] Below in conjunction with specific embodiment, further set forth the present invention.Should be understood that these embodiments are only used to illustrate the present invention and are not used in limiting the scope of the present invention.In addition, should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall equally within the scope limited by the appended claims of the application.

[0043] Basic symbol description:

[0044] P: plaintext, P∈{{0,1} 6} 4 .

[0045] T: handle wheel input value, T∈{0,1} 40 .

[0046] T * : Initial value of the adjustment handle, T * =T||1||0 12 .

[0047] K: master key, K∈{0,1} 256 .

[0048] DRK i : Data round i subkey, DRK i ∈{0,1} 24 , 0≤i≤11.

[0049] TRK i : Key of the i-th wheel of the adjustment handle, TRK i ∈{0,1} 53 , 1≤i≤6.

[0050] C: correct ciphertext, C∈{{0,1} 6} 4 .

[0051] C: Error ciphertext, C∈{{0,1} 6} 4 .

[0052] π1: Bit permutation operation one.

[0053] π2: Bit permutation operation 2.

[0054] π3: Bit permutation operation three.

[0055] π4: Bit permutation operation four.

[0056] π5: Bit permutation operation five.

[0057] θd : Data wheel linear transformation.

[0058] θ t : Linear transformation of the adjustment handle wheel 1.

[0059] θ′: Linear transformation of the adjustment handle wheel 2.

[0060] χ: nonlinear transformation.

[0061] S: S box replacement.

[0062] E0: Gets the values ​​of bits 0, 2, .., 46 of the 53-bit data.

[0063] E1: Gets the values ​​of bits 1, 3, .., 47 of the 53-bit data.

[0064] E: Execute the operations of E0 and E1 respectively.

[0065] DM i : The intermediate state value after the i-th round of the data round.

[0066] TM i : The intermediate state value after the i-th rotation of the adjustment handle.

[0067] XOR operation.

[0068] ||: cascade

[0069] Figure 1 A flowchart of a key leakage detection method for the BipBip block cipher algorithm based on impossible statistical fault analysis provided in an embodiment of the present invention includes the following steps:

[0070] Step 1: Randomly generate a plaintext message to be processed, denoted as P∈{{0,1} 6} 4 .

[0071] Step 2: Use the BipBip algorithm and the fixed master key to encrypt the plaintext message and Figure 3 ) in the penultimate round, a random 6-bit fault other than the all-1 state is introduced to obtain multiple fault ciphertexts In this step, in order to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output. The specific operation method is as follows: input the plaintext P, introduce the fault during the operation of the BipBip algorithm, and then obtain the fault ciphertext

[0072] In this step, you can choose Figure 4In the experimental environment shown, a computer is used to generate the BipBip input plaintext P and process and analyze the output of the BipBip algorithm. A device encapsulating the BipBip algorithm processes the input message and generates the corresponding output. A fault-introduction device performs fault-introduction actions during the BipBip algorithm, resulting in erroneous ciphertext output. The fault-introduction device can introduce random 6-bit faults through software simulation or laser, electromagnetic, and voltage interference.

[0073] Step 3: Fault propagation path is as follows Figure 2 As shown in the figure, the intermediate state value after the second-to-last round of transformation is deduced using the obtained fault ciphertext:

[0074]

[0075] By enumerating the 6 bits of DRK0 and the 6 bits of DRK1, the 6 bits of the intermediate state after the fault injection are derived, that is,

[0076]

[0077] If faults are introduced multiple times at any position in the second to last round, the intermediate state value where the fault is injected can be deduced using the error ciphertext, that is,

[0078]

[0079] where j∈[0,3].

[0080] Perform impossible relationship analysis. Since the fault is injected using a bitwise AND operation, combined with the characteristics of this operation, the 6-bit intermediate state value at the injected fault location cannot be 0b111111. Therefore, an impossible analysis path is constructed, which is expressed as:

[0081]

[0082] When the intermediate state value satisfies the equation By excluding these candidate keys that cannot be the correct keys, the range of candidate keys that need to be screened using the distinguisher is narrowed down.

[0083] Step 5: Select a suitable discriminator and obtain all possible values ​​of the discriminator for the intermediate state values ​​corresponding to the remaining candidate keys. Select the maximum or minimum value based on the characteristics of the discriminator to calculate the correct 6-bit DRK0 and 6-bit DRK1.

[0084] Step 6: Repeat steps 1 to 5, and make the position of the introduced fault different each time, until all 24 bits of DRK0 and all 24 bits of DRK1 are restored.

[0085] Step 7: Calculation As the new ciphertext,

[0086]

[0087] Step 8: In the same way as recovering DRK0 and DRK1 above, introduce a random 6-bit fault in the fourth to last round of the encryption process and use the new derivation It is not possible to perform statistical failure analysis to recover DRK2 and DRK3.

[0088] Step 9: Calculation As the new ciphertext,

[0089]

[0090] Step 10: In the same way as recovering DRK0 and DRK1 above, introduce a random 6-bit fault in the sixth round of the encryption process, using the new derivation It is not possible to perform statistical failure analysis to recover DRK4 and DRK5.

[0091] Step 11: Calculation As the new ciphertext,

[0092]

[0093] Step 12: In the same way as recovering DRK0 and DRK1 above, introduce a random 6-bit fault in the 8th round of the encryption process, using the new derivation It is not possible to perform statistical failure analysis to recover DRK6 and DRK7.

[0094] Step 13: Calculation As the new ciphertext,

[0095]

[0096] Step 14: In the same way as recovering DRK0 and DRK1 above, introduce a random 6-bit fault in the 10th round of the encryption process and use the new derivation It is not possible to perform statistical failure analysis to recover DRK8 and DRK9.

[0097] Step 15: According to the key arrangement scheme, the master key K can be recovered through DRK0. 3 , There are 24 bits in total, and based on these 24 bits, 4, 4, 5, 8, 3 and 5 bits of the handle wheel keys TRK1, TRK2, TRK3, TRK4, TRK5 and TRK6 can be recovered respectively.

[0098] Step 16: The intermediate state value after the first round of the handle adjustment is derived by the formula E(TM1) = DRK1, DRK2. The first 48 bits of TM1 can be restored by DRK1 and DRK2. The conditions narrow down the candidate key range of TRK1.

[0099] Step 17: The intermediate state value after the second round of the handle adjustment wheel has the derivation formula E(TM2)=DRK3,DRK4. The value of the first 48 bits of TM2 can be restored through DRK3 and DRK4. The conditions narrow down the candidate key range of TRK2.

[0100] Step 18: The intermediate state value after the fourth turn of the handle wheel has the derivation formula E0(TM4)=DRK5, and the value of 24 bits of TM4 can be restored through DRK5. The conditions narrow down the candidate key range of TRK3.

[0101] Step 19: The intermediate state values ​​after the fifth and sixth rotations of the handle wheel are derived using the equations E0(TM5)=DRK6 and E0(TM6)=DRK7, respectively. DRK6 and DRK7 can be used to recover 24 bits of TM5 and TM6, respectively. The possible values ​​of TM5 and TM6 are narrowed down by satisfying the equation χ(π5(θ′(π4(TM5))))=TM6.

[0102] Step 20: Use the Satisfaction Derivation The conditions narrow down the candidate key range of TRK4.

[0103] Step 21: The intermediate state value after the seventh turn of the handle wheel has the derivation formula E0(TM7)=DRK8, and the value of 24 bits of TM7 can be restored through DRK8. The conditions narrow down the candidate key range of TRK5.

[0104] Step 22: Use the remaining candidate keys of TRK1, TRK2, TRK3, TRK4 and TRK5 to exhaustively search and finally determine the master key

[0105] Using this analysis method, we simulated import failures and the BipBip block cipher algorithm processing process 2000 times on a computer with an Intel(R) Core(TM) i5-1135G7 CPU @ 2.40GHz and 16GB of memory, using the CLion development tool and the C++ programming language. The results demonstrate the accuracy of this detection method. The method provided by this invention is easy to implement, fast, and highly accurate, and is of great significance for the security research of the BipBip block cipher algorithm.

Claims

1. A key leakage detection method for a tunable block cipher BipBip, characterized in that: The following steps are involved: Step S1, randomly generate a plaintext message to be processed; Step S2: Encrypt the plaintext message using the BipBip algorithm and a fixed master key, and introduce a random 6-bit fault other than the all-1 state in the penultimate round of encryption to generate a first fault ciphertext; Step S3, recovering the first round subkey and the second round subkey using an impossible statistical fault analysis method according to the first fault ciphertext; Step S4: Construct a first new ciphertext using the first round subkey and the second round subkey, encrypt the first new ciphertext using the BipBip algorithm and a fixed master key, and introduce a random 6-bit fault other than the all-ones state in the fourth-to-last round of encryption to generate a second fault ciphertext; Step S5: recovering the third-round subkey and the fourth-round subkey according to the second fault ciphertext using an impossible statistical fault analysis method; Step S6: Construct a second new ciphertext using the third-round subkey and the fourth-round subkey, encrypt the second new ciphertext using the BipBip algorithm and a fixed master key, and introduce a random 6-bit fault other than the all-ones state in the sixth-to-last encryption round to generate a third fault ciphertext. Step S7, recovering the fifth round subkey and the sixth round subkey using an impossible statistical fault analysis method according to the third fault ciphertext; Step S8: Construct a third new ciphertext using the fifth-round subkey and the sixth-round subkey, encrypt the third new ciphertext using the BipBip algorithm and a fixed master key, and introduce a random 6-bit fault other than the all-ones state in the eighth-to-last round of encryption to generate a fourth fault ciphertext. Step S9: recovering the seventh round subkey and the eighth round subkey using an impossible statistical fault analysis method according to the fourth fault ciphertext; Step S10: constructing a fourth new ciphertext using the seventh-round subkey and the eighth-round subkey, encrypting the fourth new ciphertext using the BipBip algorithm and a fixed master key, and introducing a random 6-bit fault other than the all-ones state in the eighth-to-last round of encryption to generate a fifth fault ciphertext; Step S11, recovering the ninth round subkey and the tenth round subkey using an impossible statistical fault analysis method according to the fifth fault ciphertext; Step S12, according to the key arrangement scheme, uses the obtained round keys to restore the master key, specifically including: Recover K in the master key using the first round of subkeys 3 , And according to the restored K 3 , Recover 4 bits of the wheel key TRK1, 4 bits of TRK2, 5 bits of TRK3, 8 bits of TRK4, 3 bits of TRK5, and 5 bits of TRK6 respectively; The first 48 bits of the intermediate state value TM1 after the first round of the handle adjustment are recovered by the second round subkey and the third round subkey, and the derivation formula is satisfied. The condition narrows down the candidate key range of the handle wheel key TRK1; The first 48 bits of the intermediate state value TM2 after the second round of the handle adjustment are recovered by the fourth round subkey and the fifth round subkey, and the derivation formula is satisfied. The condition narrows down the candidate key range of the tuning wheel key TRK2; The 24 bits of the intermediate state value TM4 after the fourth round of the handle adjustment are recovered by the fourth round subkey, and the derivation formula is satisfied. The condition narrows down the candidate key range of the tuning wheel key TRK3; The 24 bits of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are respectively recovered by the fifth round subkey and the sixth round subkey, and the possible values ​​of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are narrowed down by satisfying the derivation formula χ(π5(θ′(π4(TM5))))=TM6, and then the possible values ​​of the intermediate state value TM5 after the fifth round of the handle adjustment wheel and the intermediate state value TM6 after the sixth round of the handle adjustment wheel are narrowed down by satisfying the derivation formula The condition narrows down the candidate key range of the tuning wheel key TRK4; The 24 bits of the intermediate state value TM7 after the seventh round of the handle adjustment are recovered by the seventh round subkey, and the derivation formula is satisfied. The conditions narrow down the candidate key range of the handle wheel key TRK5; The remaining candidate keys of the handle wheel keys TRK1, TRK2, TRK3, TRK4 and TRK5 are used to exhaustively search and finally determine the master key. Wherein, mod represents the modulo operation; T * is the initial value of the handle wheel, χ is the nonlinear transformation operation, π5 is the bit permutation operation five, θ t is the linear transformation of the handle wheel 1, π4 is the bit permutation operation 4, θ′ is the linear transformation of the handle wheel 2, The 44th to 52nd bits of the handle wheel key TRK4 are The 8th to 52nd bits of the handle wheel key TRK1 are From bit 0 to bit 52.

2. The key leakage detection method of the adjustable block cipher BipBip according to claim 1 is characterized in that: The impossible statistical fault analysis method is specifically as follows: According to the fault injection location, the intermediate state value of the fault injection location is reversed from the kth fault ciphertext by enumerating the bits of the i-th round key and the i+1-th round key, where i = 1, 3, 5, 7, 9 and k = 1, 2, 3, 4, 5; Constructing an impossible analysis path with a probability of 0 based on the 6-bit impossible value of the fault intermediate state, and eliminating erroneous candidate subkey bits according to the impossible analysis path; For the intermediate state values ​​obtained for the remaining candidate subkey bits, the maximum or minimum value is selected based on the characteristics of the distinguisher. Get the subkey bit corresponding to the maximum or minimum value; By injecting faults into multiple operations at different locations, the keys of round i and round i+1 are gradually recovered.

3. The key leakage detection method of the adjustable block cipher BipBip according to claim 2 is characterized in that: The intermediate state value obtained for the remaining candidate subkey bits is calculated in the following manner: Among them, DM i+1 DRK is the intermediate state value after the i+1th round of the data round, i is the round i subkey, DRK i+1 is the key of the i+1th round, π3 is the bit permutation operation three, S is the S-box replacement operation, is the k-th fault ciphertext, It is an exclusive OR operation.

4. The key leakage detection method of the adjustable block cipher BipBip according to claim 2 is characterized in that: The impossible analysis path is expressed as: in, are the 6j-th bit, 6j+1-th bit, 6j+2-th bit, 6j+3-th bit, 6j+4-th bit, and 6j+5-th bit of the intermediate state value after the i+1-th round from the end of the data round, respectively. || is a cascade. For the exclusive OR operation, 0b111111 is an impossible value for the 6-bit fault intermediate state.

5. The key leakage detection method of the adjustable block cipher BipBip according to claim 1 is characterized in that: The first new ciphertext is passed through The second new ciphertext is constructed by To construct, the third new ciphertext is constructed by To construct, the fourth new ciphertext is constructed by Construct, where C0, C1, C2, C3 are the correct ciphertext, the first new ciphertext, the second new ciphertext, and the third new ciphertext respectively; DRK0, DRK1, DRK2, DRK3, DRK4, DRK5, DRK6, DRK7 are the first round subkey, the second round subkey, the third round subkey, the fourth round subkey, the fifth round subkey, the sixth round subkey, the seventh round subkey, and the eighth round subkey respectively; π3 is the bit permutation operation three, S is the S-box replacement operation, π2 is the bit permutation operation two, π1 is the bit permutation operation one, θ d is the data wheel linear transformation, It is an exclusive OR operation.

6. The key leakage detection method of the adjustable block cipher BipBip according to claim 1 is characterized in that: When introducing a random 6-bit fault other than the all-1 state, a software simulation method, or laser, electromagnetic and voltage interference means is used to complete the introduction of the random 6-bit fault.

Images