Method for detecting impossible statistical fault analysis resistance of Ascon algorithm

Abstract

The invention relates to a method for detecting impossible statistical fault analysis resistance of an Ascon algorithm, which comprises the following steps of: firstly, randomly generating a plaintext to be processed, processing a plaintext message by using an Ascon authentication encryption algorithm, interfering a processing process in the stage, inducing the plaintext message to generate a fault, and obtaining error output to obtain an error label; calculating an intermediate state value through a decryption algorithm and a statistical method, counting the occurrence probability of each value, eliminating key candidate values which cause the occurrence of the intermediate state value which is theoretically impossible to obtain, and selecting key candidate values which enable the occurrence probability of the intermediate state value to most conform to an ideal condition; and the fault introduction and analysis process is repeated for multiple times, so that a complete key is recovered. The method is easy to implement, high in speed and high in accuracy, and a good analysis basis is provided for security research of an Ascon authentication encryption algorithm for resisting impossible statistical fault attacks.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for detecting an Ascon algorithm against impossible statistical fault analysis. Background Art

[0002] In recent years, the fields of Internet of Things, mobile communications, etc. have developed rapidly, gradually covering all aspects of people's lives, and people's dependence on information has continued to increase. Information security issues have become increasingly prominent, and people are paying more and more attention to the privacy protection function of devices. As the core technology to ensure information security, encryption algorithms have always attracted much attention. The Ascon certified encryption algorithm is an encryption algorithm for lightweight applications. It was designed by a team from Graz University of Technology in Austria. It was originally proposed in the international cryptography competition CAESAR and was selected as one of the lightweight cryptographic standards by the National Institute of Standards and Technology (NIST) of the United States in 2020. Its applicable scenarios include resource-constrained IoT devices. The Ascon certified encryption algorithm has high security and can resist various currently known attacks, such as linear attacks, differential attacks, etc. As a new type of lightweight encryption technology, it has broad application prospects.

[0003] Statistical Fault Analysis (SFA) is a cryptographic analysis technique that uses faults (such as hardware failures) deliberately introduced during the execution of a cryptographic algorithm to analyze and attack a cryptographic algorithm. This analysis method does not require the attacker to have internal information about the algorithm, but rather infers the weaknesses of the key or algorithm by observing the behavior of the algorithm when a fault occurs. There are currently no public research results evaluating the ability of the Ascon certified encryption algorithm to resist impossible statistical fault attacks. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a method for detecting the Ascon algorithm's resistance to impossible statistical fault analysis, which can evaluate the ability of the Ascon authentication encryption algorithm to resist impossible statistical fault analysis.

[0005] The technical solution adopted by the present invention to solve the technical problem is: to provide a method for detecting Ascon algorithm to resist impossible statistical fault analysis, comprising the following steps:

[0006] Step S1, randomly generate a plaintext message;

[0007] Step S2, encrypt the plaintext message using the Ascon-128 encryption algorithm and a fixed master key, and at the end of the encryption process, introduce a 2-bit random fault other than the 0b11 state to obtain an error label set;

[0008] Step S3, performing a Cartesian product of the 2-bit key candidate value set corresponding to the imported fault position and the error label set, grouping the elements in the Cartesian product according to the key candidate value, and generating 4 sets, each set containing multiple 2-tuples;

[0009] Step S4, calculating the intermediate state of the imported fault location according to each tuple;

[0010] Step S5, constructing an impossible analysis path with a probability of 0, and excluding the binary groups corresponding to the wrong key candidate values ​​according to the impossible analysis path;

[0011] Step S6, for the intermediate state values ​​calculated from the binary groups corresponding to the remaining key candidate values, the probability of the intermediate state values ​​appearing is calculated using a statistical method, and the key corresponding to the binary group that best meets the theoretical probability value is selected as the 2-bit key imported into the fault position;

[0012] Step S7, repeating steps S1 to S6 until the 2-bit keys of all positions are obtained.

[0013] Between step S2 and step S3, the following steps are also included:

[0014] Determine whether the number of error labels in the error label set reaches a preset number;

[0015] If the number of error labels in the error label set does not reach the preset number, return to step S1;

[0016] If the number of error labels in the error label set reaches a preset number, the process proceeds to step S3.

[0017] The intermediate state in step S4 is calculated in the following way: Among them, S is the intermediate state, T i is the wrong label value in the binary, K j is a 2-bit key candidate value, PL -1 is the inverse operation of linear diffusion, It is an XOR operation.

[0018] The impossible analysis path of step S5 is expressed as:

[0019] The theoretical probability value in step S6 is expressed as: Where n is the number of bits injected with faults, β is all possible values ​​of the intermediate state, and hw(β) represents the Hamming weight of all possible values ​​β of the intermediate state.

[0020] In step S2, the introduction of 2-bit random faults except the 0b11 state is completed through a software simulation method, or laser, electromagnetic and voltage interference means.

[0021] Beneficial Effects

[0022] Due to the adoption of the above technical solution, the present invention has the following advantages and positive effects compared with the prior art: the present invention first processes the plaintext message through the Ascon authentication encryption algorithm, interferes with the algorithm in the process of processing the plaintext message, induces it to fail, and obtains an erroneous output label set. Through the decryption algorithm and statistical methods, the probability of each result of the intermediate state is calculated, the partial correct value of the key is obtained, and the fault introduction and analysis process are repeated to derive the correct master key. The method provided by the present invention is easy to implement, fast and highly accurate, and provides an important analytical basis for detecting the ability of the Ascon authentication encryption algorithm to resist impossible statistical failure attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 Flowchart of steps to certify encryption algorithms for Ascon against impossible statistical failure analysis;

[0024] Figure 2 It is a propagation path diagram of the fault in the encryption process of the Ascon authentication encryption algorithm after the fault is imported;

[0025] Figure 3 Encryption flow chart for Ascon authentication encryption algorithm;

[0026] Figure 4 Schematic diagram of the experimental environment for implementing this verification scheme for the Ascon authentication encryption algorithm. DETAILED DESCRIPTION

[0027] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0028] Basic symbol description:

[0029] K: master key, K∈{0,1} k ,k≤160 bits;

[0030] N: random number, N∈{0,1} 128 ;

[0031] T: label value, T∈{0,1} 128 ;

[0032] T: error label value, T∈{0,1} 128 ;

[0033] T * : A set of valid error labels output after importing failures;

[0034] P: plaintext, arbitrary length, P∈{0,1} * ;

[0035] C: ciphertext, same length as plaintext, C∈{0,1} * ;

[0036] C: incorrect ciphertext, the same length as the plaintext, C∈{0,1} * ;

[0037] IV: initial vector;

[0038] A: associated data, arbitrary length;

[0039] S: intermediate state, S∈{0,1} 320 ;

[0040] S r : The first r bits of the intermediate state S;

[0041] S c : The last c bits of the intermediate state S;

[0042] p a : round a is a full permutation process consisting of three processes: PC, PS, and PL. Ascon-128 stipulates that a is 12, which means that 12 rounds are required;

[0043] p b : Round b is a full permutation process consisting of three processes: PC, PS, and PL. Ascon-128 stipulates that b is 6, which means that 6 rounds are required;

[0044] PC: round constant plus process;

[0045] PS: S-box replacement process;

[0046] PL: linear diffusion process;

[0047] X0,…,X4: 5 groups of data divided into 320-bit state S, each group is 64 bits;

[0048] 0 k : A k-bit bit stream whose values ​​are all 0 (if k is *, the length is variable);

[0049] |x|: the length of the bit string x, in bits;

[0050] The bit string x is truncated to the first k bits;

[0051] The bit string x is truncated to the last k bits;

[0052] ⊥: error message, authentication and encryption failed;

[0053] mod: remainder operation;

[0054] >>>: circularly shift right;

[0055] XOR operation;

[0056] ||: Cascade.

[0057] Figure 1 A flowchart of the steps for detecting the Ascon authentication encryption algorithm against impossible statistical fault analysis provided by the embodiment of the present invention, the detection method described includes the following steps:

[0058] Step 1: Randomly generate a plaintext message, denoted as P∈{0,1} 128 , the message length is 128 bits;

[0059] Step 2: Encrypt the plaintext message using the Ascon-128 encryption algorithm and a fixed master key, and Figure 3 ) In the last round of the Ascon-128 encryption algorithm, a 2-bit random fault other than the 0b11 state is introduced to obtain an error label set. In this step, in order to ensure the accuracy of the experimental results, the experimental environment needs to be strictly controlled to obtain the corresponding output. The specific operation method is as follows: input a random number N, associated data A, a plaintext message P and a master key K, all of which are 128 bits long. During the operation of the Ascon-128 encryption algorithm, a 2-bit random fault other than the 0b11 state is introduced. The fault position is the last round of the last full permutation process. The error label set calculated after the influence of the introduced fault is obtained, which is recorded as T * .

[0060] In this step, you can choose Figure 4 The experimental environment shown in the figure uses a computer to generate an input plaintext message P, and processes and analyzes the output result of the input plaintext Ascon-128 encryption algorithm; the device that encapsulates the Ascon-128 encryption algorithm is used to process the input message and obtain the corresponding output result; the device that imports the fault is used to perform the import fault action, which will be performed during the operation of the Ascon-128 encryption algorithm to obtain the error label set. The device that imports the fault can complete the introduction of random 2-bit faults through software simulation methods, or laser, electromagnetic and voltage interference methods.

[0061] Step 3: Determine whether the number of error labels in the error label set reaches a preset number. If not, repeat steps 1 and 2 until enough error labels are obtained; if it reaches the preset number, proceed to step 4.

[0062] Ascon is an international encryption standard for lightweight applications. It was designed by a team from the Graz University of Technology in Austria. It supports both AE encryption algorithm mode and hash mode, and has stood out in CAESAR and NIST competitions. Taking the Ascon-128 authentication encryption algorithm as an example, the master key K and random number N in the encryption process of Ascon-128 are both 128 bits long. r To obtain the first 64 bits of state S, that is, r = 64. After completing the encryption of the plaintext to obtain the complete ciphertext, the algorithm will perform 12 rounds of full permutation operations on state S. Each round of permutation is divided into three steps, namely, round constant plus PC, S box replacement PS and linear diffusion PL. The result is recorded as Then take The last 128 bits of the key are XORed with the master key K to obtain the output label T. The calculation formulas of X3 and X4 in linear diffusion are:

[0063]

[0064] Taking the case where the fault is introduced before the PL step of the 12th round of full permutation linear diffusion and the first bit of X3 and X4 as an example, the fault propagation path is as follows: Figure 2 Follow the steps below to confirm the values ​​of all bits of the correct key.

[0065] Step 4: Import the 2-bit key candidate value set K corresponding to the fault location and the error label set T * Doing the Cartesian product, we have K×T * , the Cartesian product K×T * The elements in are grouped according to the key candidate values ​​to generate 4 sets, each of which contains multiple tuples, as shown below:

[0066]

[0067] Step 5: Calculate the intermediate state of the imported fault based on each tuple. In this step, substitute each tuple into the following formula:

[0068]

[0069] S is the intermediate state, T i is the wrong label value in the binary, K j is a 2-bit key candidate value, PL -1 is the inverse operation of linear diffusion, It is an XOR operation.

[0070] Step 6: When injecting a fault, this implementation introduces a 2-bit random fault other than the 0b11 state, so the intermediate state value cannot be 0b11, and thus an impossible analysis path is constructed, which is expressed as: The candidate key corresponding to the intermediate state value cannot be the correct key, so the candidate key can be excluded, which can effectively narrow the search space.

[0071] Step 7: For the intermediate state values ​​calculated for the binary pairs corresponding to the remaining key candidate values, use statistical methods to calculate the probability of the intermediate state values ​​appearing, and select the key corresponding to the binary pair that best meets the theoretical probability value as the 2-bit key for importing the fault location. The theoretical probability value is expressed as: Where n is the number of bits injected with faults, in this implementation, n=2, β is all possible values ​​of the intermediate state, 0≤β≤3 ， hw(β) represents the Hamming weight of all possible values ​​β of the intermediate state, 0≤hw(β)≤2.

[0072] Step 8, repeat the above steps 64 times, each time shifting the fault import position right by 1 bit, you can get the 2-bit key of all positions, and splice the 2-bit keys of all positions to restore the complete 128-bit master key.

[0073] Using the above analysis method, Core TM On a computer with i5-9400CPU@2.90GHz 2.90GHz 8GB memory, Visual studio2019 development tools and C++ language programming were used to simulate the import failure and Ascon authentication encryption algorithm processing process, and repeated 2000 times. The experimental results show that the above detection method is accurate. The method provided by the present invention is easy to implement, fast and accurate, and provides a sufficient theoretical basis for the security research of Ascon authentication encryption algorithm.

Claims

1. A method for detecting the Ascon algorithm against impossible statistical fault analysis, characterized in that: The following steps are involved: Step S1, randomly generate a plaintext message; Step S2, encrypt the plaintext message using the Ascon-128 encryption algorithm and a fixed master key, and introduce a 2-bit random fault except the 0b11 state at the end of the encryption process to obtain an error label set; Step S3, performing a Cartesian product of the 2-bit key candidate value set corresponding to the imported fault position and the error label set, grouping the elements in the Cartesian product according to the key candidate value to generate 4 sets, each set containing multiple 2-tuples; Step S4, calculating the intermediate state of the imported fault location according to each tuple; Step S5, constructing an impossible analysis path with a probability of 0, and excluding the binary groups corresponding to the wrong key candidate values ​​according to the impossible analysis path; Step S6, for the intermediate state values ​​calculated from the binary groups corresponding to the remaining key candidate values, the probability of the intermediate state values ​​appearing is calculated using a statistical method, and the key corresponding to the binary group that best meets the theoretical probability value is selected as the 2-bit key imported into the fault position; Step S7, repeating steps S1 to S6 until the 2-bit keys of all positions are obtained.

2. The method for detecting Ascon algorithm against impossible statistical fault analysis according to claim 1, characterized in that: Between step S2 and step S3, the following steps are also included: Determine whether the number of error labels in the error label set reaches a preset number; If the number of error labels in the error label set does not reach the preset number, return to step S1; If the number of error labels in the error label set reaches a preset number, the process proceeds to step S3.

3. The method for detecting Ascon algorithm against impossible statistical fault analysis according to claim 1, characterized in that: The intermediate state in step S4 is calculated in the following way: Among them, S is the intermediate state, T i is the wrong label value in the binary, K j is a 2-bit key candidate value, PL -1 is the inverse operation of linear diffusion, It is an XOR operation.

4. The method for detecting Ascon algorithm against impossible statistical fault analysis according to claim 3, characterized in that: The impossible analysis path of step S5 is expressed as:

5. The method for detecting Ascon algorithm against impossible statistical fault analysis according to claim 1, characterized in that: The theoretical probability value in step S6 is expressed as: Where n is the number of bits injected with faults, β is all possible values ​​of the intermediate state, and hw(β) represents the Hamming weight of all possible values ​​β of the intermediate state.

6. The method for detecting Ascon algorithm against impossible statistical fault analysis according to claim 1, characterized in that: In step S2, the introduction of 2-bit random faults except the 0b11 state is completed through a software simulation method, or laser, electromagnetic and voltage interference means.

Images