Key leakage detection method for SPEEDY authentication encryption algorithm

Abstract

The invention relates to a key leakage detection method for an SPEEDY authentication encryption algorithm, which comprises the following steps: firstly, randomly generating a plaintext to be processed, taking the plaintext P as the input of the SPEEDY algorithm, importing a random 6-bit fault in the last but one round, and outputting a wrong ciphertext; the method comprises the following steps of: firstly, extracting a subkey of the last but one round, exhausting the subkey of the last but one round, eliminating wrong candidate keys in advance through impossible relation analysis, calculating an intermediate state, calculating the Hamming weight of the intermediate state by utilizing a statistical method, solving a 6-bit correct value of the subkey of the last but one round, and repeating the fault importing and analysis process. And finally, deriving a correct subkey of the last but one round, and deriving a correct master key according to a key arrangement scheme of the algorithm. The method provided by the invention is easy to implement, high in speed and high in accuracy, and an important analysis basis is provided for the security research of the SPEEDY cryptographic algorithm.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a key leakage detection method for a SPEEDY authentication encryption algorithm. Background Art

[0002] SPEEDY is an ultra-lightweight block cipher algorithm proposed by Leander et al. at CHES2021. It is designed for low latency in hardware implementation and contains three variants: SPEEDY-5-192, SPEEDY-6-192, and SPEEDY-7-192, corresponding to 5, 6, and 7 rounds of encryption, respectively. All variants support 192-bit data blocks and 192-bit keys. Among them, SPEEDY-7-192 can fully achieve 192-bit security.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that uses faults (such as hardware failures) deliberately introduced during the execution of a cryptographic algorithm to analyze and attack the algorithm. This analysis method does not require the attacker to have internal information about the algorithm, but rather infers the weaknesses of the key or algorithm by observing the behavior of the algorithm when a fault occurs. There are currently no reports evaluating the ability of the SPEEDY certified encryption algorithm to resist impossible statistical fault attacks, which poses a security risk to products that are using the SPEEDY certified encryption algorithm package. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a key leakage detection method for a SPEEDY authentication encryption algorithm, which can evaluate the ability of the SPEEDY cryptographic algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present invention to solve the technical problem is: to provide a key leakage detection method of a SPEEDY authentication encryption algorithm, comprising the following steps:

[0006] Step S1, randomly generate a plaintext message;

[0007] Step S2, encrypt the plaintext message using the SPEEDY cryptographic algorithm and a fixed master key, and introduce a random 6-bit fault except the all-1 state in the penultimate round of encryption to generate a fault ciphertext;

[0008] Step S3, according to the fault injection position, the intermediate state value of the fault injection position is reversely inferred from the fault ciphertext by enumerating the subkey bits of the second-to-last round, so as to obtain the intermediate state values ​​corresponding to the plurality of candidate subkey bits;

[0009] Step S4, constructing an impossible analysis path with a probability of 0 based on the 6-bit impossible value of the fault intermediate state, and eliminating erroneous candidate subkey bits according to the impossible analysis path;

[0010] Step S5, for the intermediate state values ​​obtained from the remaining candidate subkey bits, using a statistical method, calculate the Hamming weight of the intermediate state value, and find the subkey bit corresponding to the minimum Hamming weight;

[0011] Step S6, repeating steps S1 to S5 to obtain the subkey of the second-to-last round;

[0012] Step S7: according to the key arrangement scheme, the subkeys of the penultimate round are used to recover the subkeys of each round, and the master key is recovered based on the subkeys of the first round.

[0013] Between step S2 and step S3, the following steps are also included:

[0014] Determine whether the number of faulty ciphertexts reaches a preset number;

[0015] If the number of the faulty ciphertexts does not reach the preset number, return to step S1;

[0016] If the number of the faulty ciphertexts reaches a preset number, the process proceeds to step S3.

[0017] The intermediate state value in step S3 is calculated in the following way: in, is the intermediate state value, is the fault ciphertext, RK6 is the subkey of the second-to-last round, SB -1 is the S-box inverse permutation operation, SC -1 It is the column shift inverse permutation operation.

[0018] The impossible analysis path in step S4 is expressed as: in, They respectively represent the j-th bit, 32+j-th bit, 64+j-th bit, 96+j-th bit, 128+j-th bit, and 160+j-th bit of the intermediate state value, j∈[0,31].

[0019] In step S7, RK is used r+1 =PB(RK r )Recover the subkey of each round, where RK r is the subkey of the rth round, and PB is the bit permutation operation in the key scheduling scheme.

[0020] In step S2, the introduction of random 6-bit faults is completed by software simulation method, or laser, electromagnetic and voltage interference means.

[0021] Beneficial Effects

[0022] Due to the adoption of the above technical scheme, the present invention has the following advantages and positive effects compared with the prior art: the present invention first randomly generates a plaintext to be processed, and uses the plaintext X as the input of the SPEEDY algorithm to introduce a random 6-bit fault using a 6-bit random fault model, the fault position is the penultimate round, and the fault ciphertext is obtained. By using the characteristics of the bitwise 'and' operation, the 6-bit intermediate state value injected into the fault position cannot be 0b111111, thereby generating an impossible analysis path, excluding some erroneous candidate keys in advance, and then using statistical methods to calculate the Hamming weight, find out the correct value of the subkey part, repeat the introduction of faults and analysis process, and finally derive the correct subkey, and then derive the correct master key according to the key arrangement scheme of the algorithm. The method provided by the present invention is easy to implement, fast and highly accurate, and provides a good analytical basis for detecting the ability of the SPEEDY cryptographic algorithm to resist impossible statistical fault attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 Flowchart of steps to test whether the cryptographic algorithm SPEEDY is resistant to impossible statistical failure attacks

[0024] Figure 2 It is a fault propagation diagram for the SPEEDY algorithm encryption process where statistical fault attacks are impossible;

[0025] Figure 3 It is the cryptographic algorithm structure diagram of the SPEEDY cryptographic algorithm;

[0026] Figure 4 Schematic diagram of the experimental environment for this scheme. DETAILED DESCRIPTION

[0027] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0028] Basic symbol description:

[0029] P: plain text, P∈{{0,1} 6} 32 ;

[0030] K: master key, K∈{{0,1} 6} 32 ;

[0031] R r: rth round subkey, 0≤r≤6;

[0032] Fault ciphertext,

[0033] SB: S-box permutation operation;

[0034] SB -1 : S-box inverse permutation operation;

[0035] SC -1 : Column shift inverse permutation operation;

[0036] PB: bit permutation operation;

[0037] The intermediate state of the rth round, 0≤r≤6;

[0038] XOR operation.

[0039] Figure 1 A flow chart of a method for detecting the SPEEDY cryptographic algorithm against impossible statistical failure attacks provided by an embodiment of the present invention, comprising the following steps:

[0040] Step 1: Randomly generate a plaintext message P with a length of 192 bits;

[0041] Step 2: Use the SPEEDY cryptographic algorithm (see Figure 3 ) encrypts the plaintext message P and introduces a random 6-bit fault except the all-1 state during the encryption process to generate multiple faulty ciphertexts Y∈{{0,1} 6} 32 , where the block length and key length of SPEEDY in the encryption process are both 192 bits. During the encryption process, a total of 7 rounds of iterations are required, and a 6-bit random fault model is used. The fault location is the second to last round. In this step, in order to ensure the accuracy of the experimental results, it is necessary to strictly control the experimental environment to obtain the corresponding output. The specific operation method is as follows: input the plaintext message P, introduce the fault during the operation of the SPEEDY algorithm, and then obtain the fault ciphertext

[0042] In this step, you can choose Figure 4The experimental environment shown in the figure uses a computer to generate the input plaintext message P of SPEEDY, and processes and analyzes the output result of the input plaintext after the SPEEDY algorithm; the device encapsulating the SPEEDY algorithm is used to process the input message and obtain the corresponding output result; the device for introducing faults is used to perform the action of introducing faults, and will perform the action of introducing faults during the operation of the SPEEDY algorithm to obtain the output of the fault ciphertext. The device for introducing faults can complete the introduction of random 6-bit faults through software simulation methods, or laser, electromagnetic and voltage interference methods.

[0043] Step 3: Determine whether the number of faulty ciphertexts reaches the preset number. If not, repeat steps 1 to 2 until the preset number of faulty ciphertexts is obtained. The preset number in this embodiment is 150. If it is reached, proceed to step 4;

[0044] Step 4: Calculate the intermediate state. Assume that the random fault injection position is Figure 2 As shown, the intermediate state value of the imported fault position is reversely derived by enumerating 36 bits in the round key RK6, that is:

[0045]

[0046] This allows you to obtain the intermediate status value of the import fault location

[0047] Step 5: Perform impossible relationship analysis. Combined with the characteristics of the bitwise "AND" operation, the 6-bit intermediate state value injected into the fault position cannot be 0b111111. Therefore, an impossible analysis path is constructed, which is expressed as:

[0048]

[0049] where j∈[0,31], They represent the jth bit, 32+jth bit, 64+jth bit, 96+jth bit, 128+jth bit, and 160+jth bit of the intermediate state value respectively. By using the impossible analysis path with a probability of 0, some incorrect candidate keys can be eliminated in advance, thereby effectively reducing the key search space and improving the analysis efficiency.

[0050] Step 6: For the intermediate state values ​​of the remaining candidate keys, use statistical methods to find the intermediate state values The Hamming weight represents the number of '1's contained in the binary form of the intermediate state. For example, when The binary representation of 38 is 100110, then The Hamming weight of is 3. Different keys are distinguished by counting the number of '1's in the binary string, where the minimum value corresponds to the correct key. 6 bits in Select a group of intermediate state values ​​with the smallest Hamming weight value, and the corresponding round key candidate value is the 6 bits of the correct round key;

[0051] Step 8: Repeat steps 1 to 7, with each fault import position being different from the previous one, so that all bits of RK6 can be obtained;

[0052] Step 9: Master key recovery. Based on the obtained round key RK6, RK i , where i∈[0,6], the formula is as follows:

[0053] R r+1 =PB(RK r ).

[0054] The first round of sub-keys RK0 can be gradually obtained through the above formula, and finally the master key K can be restored by K=RK0.

[0055] The above analysis method is used to simulate the import failure and SPEEDY cryptographic algorithm processing process on a computer with Intel(R)Core(TM)i7-8565U CPU@1.80GHz 1.99GHz 8GB memory using the IDEA development tool, and the process is repeated 2000 times. The experimental results show that the above detection method is accurate. The method provided by the present invention is easy to implement, fast and accurate, and has important significance for the security research of the SPEEDY cryptographic algorithm.

Claims

1. A key leakage detection method for a SPEEDY authentication encryption algorithm, characterized in that: The following steps are involved: Step S1, randomly generate a plaintext message; Step S2, encrypt the plaintext message using the SPEEDY cryptographic algorithm and a fixed master key, and introduce a random 6-bit fault except the all-1 state in the penultimate round of encryption to generate a fault ciphertext; Step S3, according to the fault injection position, the intermediate state value of the fault injection position is reversely inferred from the fault ciphertext by enumerating the subkey bits of the second-to-last round, so as to obtain the intermediate state values ​​corresponding to the plurality of candidate subkey bits; Step S4, constructing an impossible analysis path with a probability of 0 based on the 6-bit impossible value of the fault intermediate state, and eliminating erroneous candidate subkey bits according to the impossible analysis path; Step S5, for the intermediate state values ​​obtained from the remaining candidate subkey bits, using a statistical method, calculate the Hamming weight of the intermediate state value, and find the subkey bit corresponding to the minimum Hamming weight; Step S6, repeating steps S1 to S5 to obtain the subkey of the second-to-last round; Step S7: according to the key arrangement scheme, the subkeys of the penultimate round are used to recover the subkeys of each round, and the master key is recovered based on the subkeys of the first round.

2. The key leakage detection method of the SPEEDY authentication encryption algorithm according to claim 1 is characterized in that: Between step S2 and step S3, the following steps are also included: Determine whether the number of faulty ciphertexts reaches a preset number; If the number of the faulty ciphertexts does not reach the preset number, return to step S1; If the number of the faulty ciphertexts reaches a preset number, the process proceeds to step S3.

3. The key leakage detection method of the SPEEDY authentication encryption algorithm according to claim 1 is characterized in that: The intermediate state value in step S3 is calculated in the following way: in, is the intermediate state value, is the fault ciphertext, RK6 is the subkey of the second-to-last round, SB -1 is the S-box inverse permutation operation, SC -1 It is the column shift inverse permutation operation.

4. The key leakage detection method of the SPEEDY authentication encryption algorithm according to claim 1 is characterized in that: The impossible analysis path in step S4 is expressed as: in, They respectively represent the j-th bit, 32+j-th bit, 64+j-th bit, 96+j-th bit, 128+j-th bit, and 160+j-th bit of the intermediate state value, j∈[0,31].

5. The key leakage detection method of the SPEEDY authentication encryption algorithm according to claim 1 is characterized in that: In step S7, RK is used r+1 =PB(RK r )Recover the subkey of each round, where RK r is the subkey of the rth round, and PB is the bit permutation operation in the key scheduling scheme.

6. The key leakage detection method of the SPEEDY authentication encryption algorithm according to claim 1, characterized in that: In step S2, the introduction of random 6-bit faults is completed by software simulation method, or laser, electromagnetic and voltage interference means.

Images