A key leakage detection method for a SPEEDY authentication encryption algorithm

Abstract

The application relates to a key leakage detection method of a SPEEDY authentication encryption algorithm, which comprises the following steps: firstly, generating a plaintext to be processed at random, taking the plaintext P as the input of the SPEEDY algorithm, introducing a random 6-bit fault in the second last round, and outputting an error ciphertext; secondly, enumerating the subkey of the second last round, excluding error candidate keys in advance through impossible relationship analysis, and calculating an intermediate state; thirdly, calculating the Hamming weight of the intermediate state by using a statistical method, obtaining the 6-bit correct value of the subkey of the second last round, and repeating the fault introduction and analysis process; and finally, deducing the correct subkey of the second last round, and deducing the correct main key according to the key arrangement scheme of the algorithm. The method provided by the application is easy to implement, fast and high in accuracy, and can provide an important analysis basis for the security research of the SPEEDY encryption algorithm.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a key leakage detection method of a SPEEDY authentication encryption algorithm. BACKGROUND

[0002] SPEEDY is a super-lightweight block cipher algorithm proposed by Leander et al. on CHES2021. It is designed for low latency in hardware implementation, containing three variants: SPEEDY-5-192, SPEEDY-6-192 and SPEEDY-7-192, corresponding to 5 rounds, 6 rounds and 7 rounds of encryption process respectively. All variants support 192-bit data block and 192-bit key. Among them, SPEEDY-7-192 can achieve 192-bit security.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that uses deliberately introduced faults (such as hardware faults) during the execution of a cryptographic algorithm to analyze and attack the algorithm. This analysis method does not require the attacker to have internal information of the algorithm, but by observing the behavior of the algorithm when a fault occurs, the key or weakness of the algorithm can be inferred. There is no related report on the ability of SPEEDY authentication encryption algorithm to resist impossible statistical fault attacks, which leaves a security risk for products that are using SPEEDY authentication encryption algorithm encapsulation. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a key leakage detection method of a SPEEDY authentication encryption algorithm, which can evaluate the ability of the SPEEDY cipher algorithm to resist impossible statistical fault attacks.

[0005] The technical solution adopted by the present application to solve the technical problem is: providing a key leakage detection method of a SPEEDY authentication encryption algorithm, comprising the following steps:

[0006] Step S1, randomly generating a plaintext message;

[0007] Step S2, using the SPEEDY cipher algorithm and a fixed master key to encrypt the plaintext message, and introducing a random 6-bit fault except the all-1 state in the second-to-last round of encryption to generate a fault ciphertext;

[0008] Step S3, according to the fault injection position, using the enumeration of the second-to-last round of sub-key bits to inversely deduce the intermediate state value of the fault injection position from the fault ciphertext, to obtain the intermediate state value corresponding to a plurality of candidate sub-key bits;

[0009] Step S4, constructing impossible analysis paths with probability of 0 based on 6-bit fault intermediate state impossible value, and excluding false candidate sub-key bits according to the impossible analysis paths;

[0010] Step S5, for the intermediate state value obtained by the remaining candidate sub-key bits, using statistical method, the Hamming weight of the intermediate state value is calculated, and the sub-key bit corresponding to the minimum Hamming weight is found out;

[0011] Step S6, repeating steps S1-S5 to obtain the sub-key of the penultimate round;

[0012] Step S7, restoring the sub-key of each round according to the key arrangement scheme using the sub-key of the penultimate round, and restoring the master key based on the sub-key of the first round.

[0013] Between the steps S2 and S3, further comprising:

[0014] determining whether the number of faulty ciphertexts reaches a preset number;

[0015] If the number of faulty ciphertexts does not reach the preset number, returning to step S1;

[0016] If the number of faulty ciphertexts reaches the preset number, entering step S3.

[0017] The intermediate state value in step S3 is calculated by the following method: wherein, is the intermediate state value, is the faulty ciphertext, RK6 is the sub-key of the penultimate round, SB -1 is the S-box inverse permutation operation, SC -1 is the column bit shift inverse permutation operation.

[0018] The impossible analysis path in step S4 is represented as: wherein, respectively represent the jth bit, the 32+jth bit, the 64+jth bit, the 96+jth bit, the 128+jth bit, and the 160+jth bit of the intermediate state value, j∈[0, 31].

[0019] In step S7, the sub-key of each round is restored by RK r+1 = PB(RK r ), wherein RK r is the sub-key of the rth round, and PB is the bit permutation operation in the key arrangement scheme.

[0020] In step S2, the introduction of random 6-bit faults is completed by software simulation method, or laser, electromagnetic and voltage interference means.

[0021] Advantages

[0022] Compared with the prior art, the present application has the following advantages and positive effects: the present application firstly generates a plaintext to be processed randomly, and uses the plaintext X as the input of the SPEEDY algorithm to introduce a random 6-bit fault into the random 6-bit fault by using a 6-bit random fault model, the fault position is the penultimate round, and a faulty ciphertext is obtained. By using the characteristics of the bitwise 'and' operation, the 6-bit intermediate state value at the fault position cannot be 0b111111, thereby generating an impossible analysis path, and part of the wrong candidate keys are excluded in advance. Then, by using the statistical method, the Hamming weight is calculated, the correct value of the sub-key is obtained, the fault introduction and analysis process are repeated, and finally the correct sub-key can be deduced. According to the key arrangement scheme of the algorithm, the correct master key can be deduced. The method provided by the present application is easy to implement, fast and accurate, and provides a good analysis basis for detecting the ability of the SPEEDY cryptographic algorithm to resist impossible statistical fault attacks. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 Flow chart of steps for detecting whether the cryptographic algorithm SPEEDY resists impossible statistical fault attacks

[0024] Figure 2 Fault propagation graph for impossible statistical fault attacks in the encryption process of the SPEEDY algorithm

[0025] Figure 3 Cryptographic algorithm structure diagram of the SPEEDY cryptographic algorithm

[0026] Figure 4 Schematic diagram of the experimental environment of the present application. DETAILED DESCRIPTION

[0027] The present application will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present application and not to limit the scope of the present application. In addition, it should be understood that after reading the content taught by the present application, those skilled in the art can make various modifications or changes to the present application, and these equivalent forms also fall within the scope defined by the appended claims of the present application.

[0028] Basic symbol explanation:

[0029] P: plaintext, P∈{{0,1} 6} 32 ;

[0030] K: master key, K∈{{0,1} 6} 32 ;

[0031] RK r: the rth round key, 0≤r≤6;

[0032] faulty ciphertext,

[0033] SB: S-box permutation operation;

[0034] SB -1 : inverse S-box permutation operation;

[0035] SC -1 : column displacement inverse permutation operation;

[0036] PB: bit permutation operation;

[0037] intermediate state of the rth round, 0≤r≤6;

[0038] exclusive OR operation.

[0039] Figure 1 A flow chart of a method for detecting whether a SPEEDY cryptographic algorithm resists impossible statistical fault attacks according to an embodiment of the present application, which comprises the following steps:

[0040] Step 1: randomly generate a plaintext message P, with a message length of 192 bits;

[0041] Step 2: encrypt the plaintext message P using a SPEEDY cryptographic algorithm (see Figure 3 ) and introduce a random 6-bit fault other than an all-1 state during the encryption process to generate a plurality of faulty ciphertexts Y∈{{0,1} 6} 32 , wherein the SPEEDY has a block length and a key length of 192 bits during the encryption process, a total of 7 rounds of iteration are required during the encryption process, a 6-bit random fault model is used, and the fault position is the penultimate round. In this step, in order to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output, and the specific operation method is as follows: input the plaintext message P, introduce a fault during the running of the SPEEDY algorithm, and then obtain the faulty ciphertext

[0042] In this step, the following can be selected as Figure 4The experimental environment shown, wherein the computer is used to generate the input plaintext message P of SPEEDY, and process and analyze the output result after the input plaintext is processed by the SPEEDY algorithm; the device encapsulating the SPEEDY algorithm is used to process the input message and obtain the corresponding output result; the device introducing faults is used to perform the introducing fault action, and the introducing fault action is performed in the process of running the SPEEDY algorithm, and then the fault ciphertext output is obtained. The device introducing faults can complete the introduction of random 6-bit faults by the method of software simulation, or laser, electromagnetic and voltage interference means.

[0043] Step 3: Determine whether the number of fault ciphertexts reaches the preset number, if not, repeat steps 1 to 2 until the preset number of fault ciphertexts is obtained The preset number of this embodiment is 150, if reached, enter step 4;

[0044] Step 4: Calculate the intermediate state. Assuming that the random fault injection position is as shown in Figure 2 The intermediate state value of the fault injection position is deduced reversely by enumerating 36 bits in the round key RK6, that is:

[0045]

[0046] Thus the intermediate state value of the fault injection position can be obtained

[0047] Step 5: Perform impossible relation analysis, combined with the characteristics of the bitwise AND operation, the 6-bit intermediate state value of the fault injection position cannot be 0b111111, therefore a impossible analysis path is constructed, expressed as:

[0048]

[0049] Wherein, j∈[0,31], respectively represent the jth bit, the 32+jth bit, the 64+jth bit, the 96+jth bit, the 128+jth bit, and the 160+jth bit of the intermediate state value. By using the impossible analysis path with a probability of 0, part of the wrong candidate keys are excluded in advance, thereby effectively reducing the key search space and accelerating the analysis efficiency.

[0050] Step 6: For the intermediate state value of the remaining candidate keys, the Hamming weight of the intermediate state value is calculated by using statistical methods. Wherein, the Hamming weight represents the number of '1' contained in the binary form of the intermediate state. For example, when the binary representation of 38 is 100110, then The Hamming weight of is 3. Different keys are distinguished by calculating the number of '1's in the binary string, wherein the minimum value corresponds to the correct key. Each group of 6 bits in The intermediate state value with the minimum Hamming weight value is selected, and the corresponding round key candidate value is the 6-bit correct round key;

[0051] Step 8: Repeat steps 1 to 7, and the introduction position of each fault is different from the previous one, so that all bits of RK6 can be obtained;

[0052] Step 9: Master key recovery. According to the obtained round key RK6, the round keys RK i , wherein i ∈ [0, 6], and the formula is as follows:

[0053] RK r+1 = PB(RK r ).

[0054] The first round sub-key RK0 can be gradually obtained through the above formula, and finally the master key K can be recovered by K = RK0.

[0055] Using the above analysis method, the IDEA development tool is used to simulate the introduction of faults and the SPEEDY password algorithm processing process on an Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz 1.99GHz 8GB memory computer, and the experiment is repeated 2000 times. The experimental results show that the above detection method is accurate. The method provided by the present application is easy to implement, fast and accurate, and has important significance for the security research of the SPEEDY password algorithm.​

Claims

1. A method for detecting key leakage of the SPEEDY authentication encryption algorithm, characterized in that, Includes the following steps: Step S1: Randomly generate plaintext messages; Step S2: Encrypt the plaintext message using the SPEEDY cryptographic algorithm and a fixed master key, and introduce a random 6-bit fault (excluding the all-1 state) in the penultimate round of encryption to generate fault ciphertext. Step S3: Based on the fault injection position, the intermediate state value of the fault injection position is deduced from the fault ciphertext by enumerating the subkey bits of the penultimate round, thereby obtaining the intermediate state value corresponding to multiple candidate subkey bits. Step S4: Construct an impossible analysis path with a probability of 0 based on the 6-bit fault intermediate state impossible value, and exclude erroneous candidate subkey bits according to the impossible analysis path; Step S5: For the intermediate state values ​​obtained from the remaining candidate subkey bits, use statistical methods to calculate the Hamming weight of the intermediate state values ​​and find the subkey bit corresponding to the minimum Hamming weight. Step S6: Repeat steps S1-S5 to obtain the subkey for the penultimate round; Step S7: Recover the subkey of each round using the penultimate round subkey according to the key arrangement scheme, and recover the master key based on the first round subkey.

2. The key leakage detection method for the SPEEDY authentication encryption algorithm according to claim 1, characterized in that, Between steps S2 and S3, the following is also included: Determine if the number of faulty ciphertexts has reached the preset number; If the number of faulty ciphertexts does not reach the preset number, return to step S1; If the number of faulty encrypted messages reaches a preset number, proceed to step S3.

3. The key leakage detection method for the SPEEDY authentication encryption algorithm according to claim 1, characterized in that, The intermediate state value in step S3 is calculated in the following way: in, This is an intermediate state value. This is the faulty ciphertext, RK6 is the penultimate round's subkey, and SB... -1 For the inverse permutation operation of the S-box, SC -1 This is the inverse permutation operation for column displacement.

4. The key leakage detection method for the SPEEDY authentication encryption algorithm according to claim 1, characterized in that, The impossible analysis path in step S4 is represented as follows: in, These represent the j-th bit, 32+j-th bit, 64+j-th bit, 96+j-th bit, 128+j-th bit, and 160+j-th bit of the intermediate state value, respectively, where j∈[0,31].

5. The key leakage detection method for the SPEEDY authentication encryption algorithm according to claim 1, characterized in that, In step S7, RK is used. r+1 =PB(RK) r Recover the subkey for each round, where RK r Let be the subkey for the r-th round, and PB be the bit permutation operation in the key arrangement scheme.

6. The key leakage detection method for the SPEEDY authentication encryption algorithm according to claim 1, characterized in that, In step S2, a random 6-bit fault is introduced by means of software simulation or by means of laser, electromagnetic and voltage interference.

Images